Semantic-Agnostic Multimodal Image Jailbreak

Description

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are reconstructed despite refusal expectations, and score both model refusal and output-moderation behavior; no operational payload is included here.

Examples

See the primary source for the paper's evaluation and defensive reproduction context: https://arxiv.org/abs/2601.15698 (opens in a new tab)

Impact

Successful exploitation may cause an image-generating MLLM to produce policy-prohibited visual content despite direct text or image requests being refused. This undermines safety controls and output integrity. The success rates are paper-reported measurements, not independently verified facts: the abstract reports 98.21% against GPT-5, while Section 4.3/Table 1 reportedly gives 98.18% for GPT-5 and 95.45% for Gemini 1.5 Flash.

Affected Systems

• GPT-5 (12 January 2026 evaluation snapshot reported by the paper)
• Gemini 1.5 Flash (15 January 2026 evaluation snapshot reported by the paper)
• Multimodal models that accept image-text pairs and generate images
• Safety pipelines that inspect text and images independently or rely on holistic input semantics
• Output filters that do not evaluate reconstructed cross-modal intent

Mitigation Steps

• Evaluate safety controls against fragmented, shuffled, and semantically incoherent image-text combinations using harmless proxy content.
• Apply moderation at multiple stages: individual visual regions, reconstructed/global image semantics, text instructions, and generated outputs.
• Detect reconstruction-oriented instructions and suspicious selective attention to image regions before image generation.
• Use cross-modal safety classifiers that reason over the combined image-text intent rather than evaluating each modality independently.
• Run output moderation on every generated image and block or escalate uncertain high-risk generations.
• Continuously red-team with held-out multimodal recomposition variants and regression-test model or policy updates.

Evidence

• https://arxiv.org/abs/2601.15698 (opens in a new tab) (Abstract): defines BVS as an image-text pair jailbreak using a reconstruction-then-generation strategy with neutralized visual splicing and inductive recomposition, and reports a 98.21% jailbreak success rate against GPT-5.
• https://arxiv.org/html/2601.15698 (opens in a new tab) (Section 4.2, Experimental Setup): the paper constructs a 110-sample high-severity benchmark covering categories such as bloody violence, drug consumption, pornography, self-harm, arson, and gun violence; this supports that the work is a concrete evaluation rather than a purely conceptual claim.
• https://arxiv.org/html/2601.15698 (opens in a new tab) (Section 4.3 and Table 1, Jailbreaking Results): the paper evaluates GPT-5 and Gemini 1.5 Flash and reports BVS jailbreak success rates of 98.18% and 95.45%, respectively; these figures are author-reported and were not independently verified here.
• https://arxiv.org/html/2601.15698 (opens in a new tab) (Methodology, BVS framework): the paper describes a reproducible three-stage structure—visual guidance generation, neutralized visual splicing, and jailbreak execution—showing a specific security-relevant test procedure, although operational attack details are intentionally omitted from this entry.