Source-linked AI summary
Jailbreaking Attack against Multimodal Large Language Model
Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, Rong Jin
TL;DR
MLLMs introduce a jailbreaking problem in which harmful responses can be elicited through images, while evidence about transferable and universal attacks remains limited. The paper proposes maximum-likelihood imgJP optimization and a construction-based conversion to LLM jailbreaks, reporting transfer across models and greater efficiency than prior methods.
Problem
MLLMs can be jailbroken through images, creating safety concerns because their visual modules may make them more susceptible than pure LLMs.
Method
The paper maximizes target-output likelihood to learn data-universal imgJPs, then reverses their jailbreaking embeddings into txtJPs for LLM attacks.
Results
93% ASR was achieved on LLaMA2 using 20 reversed txtJPs, while imgJPs transferred across multiple MLLMs, including mPLUG-Owl2 and MiniGPT-v2.
Takeaways & Limitations
The results connect MLLM and LLM jailbreaks and support black-box, cross-model attacks using universal or transferred prompts.
Takeaways & Limitations
The research contains material that could allow people to jailbreak some public MLLMs, creating associated risks despite the authors’ justification for disclosure.
Abstract
from arXiv · showhide
This paper focuses on jailbreaking attacks against multi-modal large language models (MLLMs), seeking to elicit MLLMs to generate objectionable responses to harmful user queries. A maximum likelihood-based algorithm is proposed to find an \emph{image Jailbreaking Prompt} (imgJP), enabling jailbreaks against MLLMs across multiple unseen prompts and images (i.e., data-universal property). Our approach exhibits strong model-transferability, as the generated imgJP can be transferred to jailbreak various models, including MiniGPT-v2, LLaVA, InstructBLIP, and mPLUG-Owl2, in a black-box manner. Moreover, we reveal a connection between MLLM-jailbreaks and LLM-jailbreaks. As a result, we introduce a construction-based method to harness our approach for LLM-jailbreaks, demonstrating greater efficiency than current state-of-the-art methods. The code is available here. \textbf{Warning: some content generated by language models may be offensive to some readers.}
1. Introduction
The paper introduces image-based jailbreaks for MLLMs, targeting harmful responses through generated image prompts. It further develops a transferable, data-universal attack and connects MLLM jailbreaks to an efficient construction-based attack on LLMs.
- MLLMs may pose greater safety risks than pure LLMs because they contain vulnerable visual modules.
- The proposed imgJP replaces a text suffix with an image that can elicit harmful responses to harmful queries.With ordinary images, the model refuses; with the generated imgJP, it responds to the harmful request.
- The maximum likelihood attack modifies adversarial-attack objectives to maximize likelihood of target harmful outputs in a generative task.The resulting optimization can be solved with adversarial strategies such as PGD.
- The attack is data-universal across unseen prompts and images through a shared perturbation.Prompt-universality covers unseen harmful requests, while image-universality applies one perturbation to unseen input images.
- The paper reports that MLLM jailbreak optimization is more efficient because it is continuous rather than discrete.It attributes this efficiency partly to optimizing across thousands of pixels rather than limited discrete tokens.
- The construction-based attack converts MLLM jailbreaks into LLM jailbreaks by reversing jailbreaking embeddings into text prompts.From MiniGPT-4(LLaMA2) to LLaMA2, 93% ASR was achieved with 20 reversed txtJPs, outperforming the efficiency of GCG.
- 59% transferred ASR was achieved on mPLUG-Owl2 and MiniGPT-v2, with transfer also demonstrated on InstructBLIP and other MLLMs.The evaluation uses imgJPs generated on MiniGPT-4 with Vicuna and LLaMA2, then transfers them to other models.
2. Related Work
Related work distinguishes conventional adversarial attacks from jailbreaking attacks. Conventional attacks target model-task failures, whereas jailbreaking targets aligned language models and objectionable generation.
- LLM jailbreaking commonly searches for a text suffix that elicits objectionable responses when appended to a harmful request.
- Earlier adversarial attacks crafted inputs to mislead DNN predictions in tasks such as sentiment classification and image classification.
- Multimodal adversarial attacks make models fail at tasks such as VQA or image captioning by producing irrelevant outputs.
- The paper positions MLLM jailbreaking as an extension of LLM jailbreaking rather than conventional task-failure attacks.
- Jailbreaking attacks target LLM alignment safeguards that otherwise prevent certain inappropriate responses to direct queries.
3. Our Approach
The approach optimizes image-based jailbreak prompts for harmful requests, extending them to constrained perturbations, transferable black-box attacks, and construction-based text jailbreaks. It also reports prompt generalization and improved sampling efficiency from converting image embeddings into text prompts.
- 3.1. imgJP-based Jailbreak: The imgJP attack maximizes the likelihood of target answers, typically positive affirmations, for harmful requests.The optimization is performed over harmful query–answer pairs and can use adversarial attack methods such as PGD.
- 3.1. imgJP-based Jailbreak: 25 training prompts suffice to generalize an imgJP to 300 unseen prompts.The paper describes this as prompt-universal behavior across disjoint training and test prompt sets.
- 3.2. deltaJP-based Jailbreak: The deltaJP attack adds a bounded perturbation to an input image, preserving similarity while enabling objectionable outputs across an image distribution.The perturbation is optimized over query–answer pairs and can aggregate updates across sampled images from a distribution D.
- 3.3. Ensemble Learning for Model-transferability: Ensembling surrogate MLLMs enables attack transfer to MiniGPT-v2, LLaVA, InstructBLIP, and mPLUG-Owl2.The method trains on multiple surrogate models to improve transferability in black-box settings.
- 3.4. Construction-base Method for LLM-jailbreaks: The construction-based attack builds an MLLM around a target LLM, obtains an embJP, and reverses it into candidate txtJPs.De-embedding identifies nearby token embeddings, while De-tokenizer conversion yields a K×L word pool for sampling.
- 3.4. Construction-base Method for LLM-jailbreaks: The construction-based attack improves sampling efficiency by reducing the search space from a large Z×L word pool to candidates derived from a successful embJP.The prior pool size satisfies Z >> K.
4. Experiments
Experiments evaluate AdvBench-M, white-box imgJP and deltaJP jailbreaks, model transferability, and construction-based LLM jailbreaks. The approach achieves strong prompt-universal, image-universal, transferability, and efficiency results, while deltaJP remains more challenging.
- 4.1. Implementation: AdvBench-M extends AdvBench into eight harmful-behavior categories with 30 relevant images per category for multimodal jailbreak evaluation.The dataset supports evaluation of image-universal attacks by pairing harmful instructions with category-relevant images.
- 4.2. White-box Jailbreaks: 77% ASR is achieved when independently jailbreaking each of three MLLMs with imgJP.The Individual setting focuses on one harmful prompt at a time.
- 4.2. White-box Jailbreaks: 88% or 92% train ASR is achieved in the Multiple setting, while test ASR is even higher, indicating strong prompt-universal performance.The Multiple setting learns from 25 prompts and evaluates on 100 remaining prompts.
- 4.2. White-box Jailbreaks: DeltaJP exhibits some image-universal behavior, but performance varies across categories and is lowest for the suicide class.The deltaJP scenario is more challenging than imgJP-based jailbreaking.
- 4.3. Model-transferability: Black-box attacks succeed on all four target MLLMs, with mPLUG-Owl2 and MiniGPT-v2 reaching a total ASR of 59.0%.The transferred imgJP is generated using surrogate models; ensembling more models improves transferability, and LLaVA is easier to jailbreak than InstructBLIP.
- 4.4. Construction-base LLM-jailbreaks: With N = 20, the construction-based ensemble reaches 92% train ASR and 93% test ASR, while requiring inference rather than GCG’s time-consuming sampling.The ensemble outperforms GCG on test ASR already at N = 5.
5. Conclusion
The paper presents maximum likelihood-based imgJP attacks with data-universal and model-transferable behavior, connects MLLM- and LLM-jailbreaks, and introduces an efficient construction-based LLM attack. It concludes that MLLMs are easier to jailbreak than LLMs, raising alignment concerns.
- 5. Conclusion: The proposed imgJP approach jailbreaks MLLMs across unseen prompts and images and transfers to multiple models in black-box settings.The paper reports transferability to LLaVA, InstructBLIP, and mPLUG-Owl2.
- 5. Conclusion: The construction-based method leverages the MLLM–LLM connection to jailbreak LLMs more efficiently than state-of-the-art methods.The conclusion identifies this connection as a basis for transferring the approach from MLLMs to LLMs.
- 5. Conclusion: The paper concludes that jailbreaking MLLMs is easier than jailbreaking LLMs and emphasizes serious concerns about MLLM alignment.The conclusion frames this as a broader alignment concern.
6. Ethics and Broader Impact
The paper warns that its disclosed techniques may enable jailbreaking of public MLLMs. It argues that vulnerable visual modules make MLLMs more susceptible to jailbreaking and harder to align than pure LLMs.
- 6. Ethics and Broader Impact: The research contains material that could allow people to jailbreak some public MLLMs.The authors justify full disclosure despite the associated risks.
- 6. Ethics and Broader Impact: Vulnerable visual modules make MLLMs more susceptible to jailbreaking and harder to align than pure LLMs.The paper anticipates that risks may grow with widespread MLLM adoption.
A. Appendix I: More Results for MLLM-Jailbreaks.
The appendix presents examples of jailbreaks across MLLMs and an LLM, showing prompt-universal behavior, model transferability, and construction-based transfer from multimodal to text attacks.
- MLLM jailbreak examples: Four testing examples on MiniGPT-4 demonstrate that imgJP-based jailbreaks generalize across unseen harmful prompts.The examples are explicitly sampled from testing data and are presented as evidence of prompt-universal behavior.
- MLLM jailbreak examples: Testing examples on MiniGPT-4 and MiniGPT-v2 likewise demonstrate prompt-universal deltaJP-based jailbreaks.The reported examples exclude the Suicide class but are otherwise sampled from testing data.
- Model transferability: Black-box examples show that the attack transfers across mPLUG-Owl2, LLaVA, MiniGPT-v2, and InstructBLIP.This supports model-transferability when the target model differs from the model used to generate the attack.
- Construction-based LLM attack: A construction-based attack uses txtJP obtained from MLLM-jailbreaking to attack an LLM.The appendix illustrates this construction-based transfer with examples targeting harmful requests such as network intrusion and transportation disruption.
- Observed responses: The displayed responses show successful elicitation of harmful procedural content, including instructions involving explosives, self-harm, drugs, and cyber abuse.These examples document the attack outcome rather than establishing safety or prevalence beyond the shown cases.