Source-linked AI summary
When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models
Jiacheng Hou, Yining Sun, Ruochong Jin, Haochen Han, Fangming Liu, Wai Kin Victor Chan, Alex Jinpeng Wang
TL;DR
Vision-prompt editing creates an underexplored safety gap because malicious intent can be conveyed entirely through visual inputs, beyond text-centric safeguards. The paper introduces VJA and IESBench to evaluate this threat, then proposes a training-free introspective multimodal defense. VJA compromises commercial and open-source image editing models, while the defense substantially improves the safety of poorly aligned models without auxiliary guard models and with negligible overhead.
Problem
Vision-prompt editing allows malicious instructions to be conveyed visually, while existing safeguards predominantly moderate textual prompts and responses.
Method
The paper introduces VJA, IESBench, and a training-free defense based on introspective multimodal reasoning for image-editing safety.
Results
VJA shows strong attack effectiveness across commercial and open-source models, including 70.3% ASR on GPT Image 1.5, while the defense improves poorly aligned models to a level comparable with leading commercial systems.
Takeaways & Limitations
IESBench and the defense support evaluating and improving safety against vision-centric jailbreaks in modern image editing systems.
Takeaways & Limitations
The defense is less effective against fabricated or misleading information requiring large, up-to-date world knowledge, and VJA is less effective on models with limited visual reasoning.
Abstract
from arXiv · showhide
Recent advances in large image editing models have shifted the paradigm from text-driven instructions to vision-prompt editing, where user intent is inferred directly from visual inputs such as marks, arrows, and visual-text prompts. While this paradigm greatly expands usability, it also introduces a critical and underexplored safety risk: the attack surface itself becomes visual. In this work, we propose Vision-Centric Jailbreak Attack (VJA), the first visual-to-visual jailbreak attack that conveys malicious instructions purely through visual inputs. To systematically study this emerging threat, we introduce IESBench, a safety-oriented benchmark for image editing models. Extensive experiments on IESBench demonstrate that VJA effectively compromises state-of-the-art commercial models, achieving attack success rates of up to 80.9% on Nano Banana Pro and 70.1% on GPT-Image-1.5. To mitigate this vulnerability, we propose a training-free defense based on introspective multimodal reasoning, which substantially improves the safety of poorly aligned models to a level comparable with commercial systems, without auxiliary guard models and with negligible computational overhead. Our findings expose new vulnerabilities, provide both a benchmark and practical defense to advance safe and trustworthy modern image editing systems. Warning: This paper contains offensive images created by large image editing models.
1. Introduction
Vision-prompt editing expands image manipulation beyond text, but visually embedded malicious instructions can evade text-centric safeguards. The paper introduces VJA, IESBench, and a training-free defense to study and mitigate this vulnerability.
- Vision-prompt editing lets models infer user intent from marks, arrows, and mixed visual–text cues rather than text alone.
- Text-centric safeguards may miss malicious instructions embedded directly in images, making harmful requests more covert.
- VJA is a visual-to-visual jailbreak attack that embeds malicious editing intent in the input image instead of explicit textual instructions.
- IESBench benchmarks image-editing safety with free-form visual prompts, a hierarchical taxonomy, and multimodal-model judges.Its taxonomy covers 15 risk categories, 116 editing attributes, 9 actions, and 1054 visually prompted images.
- Commercial models reject most malicious text requests yet remain highly vulnerable to VJA, while weakly aligned models are vulnerable to both attack types.
- The proposed training-free defense uses introspective multimodal reasoning to redirect safety analysis from vision toward language with negligible overhead.It requires no auxiliary guard models or additional inference latency.
2. VJA: Jailbreak Attack in Vision
VJA embeds malicious editing intent in visual inputs, allowing image editing models to be attacked without textual instructions. The section also presents a training-free introspective defense that restores visual intent into a form the model can assess for safety.
- VJA: Jailbreak Attack in Vision: VJA is a black-box prompt-level attack that transforms benign images and malicious instructions into adversarial images, which can trigger harmful edits without textual input.The attacker manipulates only model inputs and does not require access to model parameters, architecture, or hyper-parameters.
- Vision-Centric Safety Misalignment: The attack embeds malicious visual cues in images while leaving the textual input intentionally empty, aligning with image editing workflows.Visual prompts include varied marker sizes, colors, shapes, and fonts.
- Vision-Centric Safety Misalignment: Text-centric safeguards mismatch image-to-image execution because models increasingly interpret malicious intent through visual signals.The paper attributes the vulnerability to the need for complex visual reasoning and to complex visual prompts appearing out of distribution.
- Introspective-Based Defense: The defense uses a safety trigger and multimodal reasoning to restore obscure visual instructions into explicit intent that can be judged for maliciousness.Its central design transforms a vision-centric attack back into a text-centric attack in the language space, where VLMs often have better immunity.
- Introspective-Based Defense: Reusing KV-Cache avoids repetitive image and text encoding, yielding negligible computational overhead and latency compared with additional guard models.The paper describes the defense as training-free and reports efficiency validation in Appendix A.4.
3. IESBench: Benchmarking the Safety of Large Image Editing Models
IESBench is designed specifically for safety evaluation of image editing, combining hierarchical risk coverage, curated visual prompts, and scalable multimodal judging. Its metrics distinguish successful, harmful, valid, and high-risk edits.
- Benchmark Design: IESBench organizes image-editing risks hierarchically because image editing combines diverse objects, regions, colors, texts, and operations that a flat taxonomy cannot capture.The benchmark identifies 15 risky categories across three levels: individual rights violations, group-targeted harm, and societal and public risks.
- Dataset Curation Pipeline: The benchmark curates high-quality benign base images from generated and open-source scenes, removing unrealistic, mismatched, or duplicate samples.Only 15 suitable images are selected from a prior benchmark because existing multimodal jailbreak datasets often use low-quality or weakly semantic visuals.
- Dataset Curation Pipeline: Visual prompts mark target regions and connect semantic editing cues to them with directional guidance, while one base image can support multiple edit intents and operations.Annotations include categories, intent, attributes, operations, and text prompts, supporting transfer to other tasks.
- Evaluation: IESBench uses MLLMs as judges and evaluates attacks with ASR, HS, EV, and HRR to capture bypass success, harmfulness, edit validity, and high-risk valid outputs.HS ranges from 1 to 5, while HRR counts valid edited images with harmfulness scores greater than or equal to 4.
4. Experiments
Experiments evaluate VJA and the proposed defense across image-editing models using IESBench, comparing attack effectiveness, risk patterns, and safety improvements. Results show strong vulnerability to visual attacks, uneven robustness across risks, and substantial gains from the training-free defense.
- Main Results: VJA achieves an average ASR of 85.7% on four commercial systems, including 70.3% on GPT Image 1.5 with an average HRR of 52.0%.These results indicate that VJA can produce valid, highly harmful edits even against the most conservative evaluated commercial model.
- Main Results: Open-source models without safeguard models reach 100% ASR, with average HS of 4.3 and HRR values up to 90.3%.Their security relies solely on RLHF-induced content moderation, which the experiments find insufficient to prevent highly harmful outputs.
- Main Results: Vulnerabilities differ across risk categories and levels, with evidence tampering and aversive manipulation especially exploitable and safety mechanisms generalizing unevenly.GPT Image 1.5 reaches 95.7% ASR for copyright tampering, while models also show different harmfulness patterns across risk levels.
- Defense Evaluation: The defense reduces Qwen-Image-Edit* average ASR by 33% and average HS by 1.2 in a training-free security-enhanced version.In categories I13 and I15, ASR falls to 61.5% and 55.3%, respectively, while performance becomes comparable with leading commercial systems.
- VJA versus TJA: VJA raises ASR by 35.6% for Nano Banana Pro and 24.9% for GPT Image 1.5 over TJA, while gains are marginal for already weak models.For Qwen-Image-Edit and Seedream 4.5, limited visual-prompt understanding can produce invalid and less harmful edits.
- Defense Evaluation: With reasoning, the defense recognizes 75% of attacks and reaches 75.7% AUC-ROC, whereas removing reasoning detects only about half.The binary zero-shot experiment mixes benign and malicious visual requests and evaluates Accuracy, AUC-ROC, Precision, and Recall.
5. Related Work
Prior work covers text-centric jailbreaks, multimodal jailbreaks, instruction-based image editing, and visual prompting for multimodal models. Together, these lines of research motivate studying safety risks specific to visual interaction in image editing.
- From Text Jailbreaks to Multimodal Jailbreaks: Earlier jailbreak research focused on bypassing language-model safety alignment through prompt injection and standardized adversarial text benchmarks.The emergence of multimodal models adds visual inputs as another potential route for eliciting unsafe outputs.
- Instruction-based Image Editing: Instruction-based image editing evolved from diffusion-based generation toward fine-grained textual control and interactive vision-language reasoning.Large image editing models support high-quality generation with increasingly flexible user instructions.
- Visual Prompting for MLLMs: Visual prompting complements text prompting for multimodal models and has also enabled controllable frame-conditioned workflows in video generation.This prior work establishes visual inputs as an increasingly important interaction interface.
6. Conclusion and Limitations
The study identifies malicious visual inputs as a safety risk, introduces VJA and IESBench to study it, and proposes a training-free defense. It notes that VJA is less effective against models with limited visual perception and reasoning.
- VJA exposes a previously underexplored vulnerability in which malicious intent is conveyed entirely through visual inputs.
- The proposed defense is training-free and uses introspective multimodal reasoning to improve safety before image editing.
- IESBench provides a benchmark for systematically evaluating image-editing safety under vision-instruction attacks.
- VJA is less effective on models with limited visual perception and reasoning capabilities because they may not infer editing intent from vision alone.
Impact Statement
The paper frames visual jailbreaks as a safety risk that could enable harmful visual-content generation and manipulation. Its supplementary materials support systematic analysis through qualitative cases, benchmark details, and experimental setup information.
- Visual prompts alone can convey malicious intent, creating risks for misleading, harmful, or inappropriate visual content.
- The supplementary material documents additional results, benchmark construction and scoring, failure cases, and experimental setup.
- Qualitative figures showcase 15 risk categories, model outputs, attack comparisons, failure cases, and sensitivity-test inputs.
A.1. Sensitivity Experiments
Sensitivity experiments show that visual-prompt variables substantially affect image-editing evaluation outcomes. Nano Banana Pro is more robust to these changes, while other models exhibit substantial volatility and local judge models differ in identification ability.
- Sensitivity Experiments: Colors, languages, fonts, sizes, and shapes can substantially alter image-editing outputs across four evaluated models.The tested variables include four languages, four fonts, three sizes, and three shapes.
- Sensitivity Experiments: 28% and 50% are the maximum boosts in HR and EV from color or shape changes for some models, while other models decline by 25.8% and 33.3%.
- Robustness Analysis: Nano Banana Pro significantly outperforms the other three models in robustness to changes in visual-prompt variables.
- Robustness Analysis: For the other models, HS and EV fluctuate substantially, while valid responses retain highly similar distributions and high HS scores.
- Judge-Model Evaluation: Gemini 3 Pro identifies harmfulness differences more effectively than Qwen3-VL-8B-Instruct, whose evaluations show more severe hallucination and weaker discrimination.
A.3. Qualitative Attack Results Comparison of VJA on IESBench
Qualitative comparisons reveal a behavioral gap between commercial and open-source models under policy-violating visual edits. Commercial models more often suppress or soften malicious edits, whereas open-source models more often execute them directly and faithfully.
- The qualitative analysis selects representative cases across categories I1–I15 to expose salient policy-violating effects.
- Commercial models tend to suppress, sanitize, or refuse explicit sexual or graphic-violence edits, often producing benign alternatives or minimal modifications.
- Open-source models more often follow malicious visual instructions literally and generate the intended prohibited content.
- Even when both model types attempt an edit, commercial models use more conservative transformations, while open-source models more often produce direct, high-fidelity malicious edits.
A.4. Complexity Analysis of Our Defense Method
The defense adds around 300 input/output tokens per judgment and approximately 3% runtime over the base model. Its evaluation also uses MLLM judges with statistically strong agreement with human judges and transfers across additional image-editing models.
- Complexity: Around 300 extra input/output tokens per judgment and approximately 3% additional runtime indicate low defense overhead.The comparison uses Qwen-Image-Edit and LongCat-Image-Edit as base models.
- Judge consistency: Gemini 3 Pro achieves statistically strong agreement with human judges in Pearson and Kappa consistency analyses.The consistency results are reported in Table 6.
- Generalization: Integrating the defense consistently improves safety on LongCat-Image and Flux2.0[dev].The authors attribute transferability to safety alignment in the language space.
B.5. Failure Cases
The reported failure cases arise from visual-reasoning errors, text-rendering failures, and advanced multimodal safeguards that neutralize VJA. Additional benign but semantically surprising edits reveal mismatches between prompt semantics and visual grounding.
- Visual reasoning: Weak models may fail to understand complicated visual prompts, producing unchanged inputs classified as successful but invalid attacks.These cases receive harmfulness score 2 and validity 0.
- Text editing: Models that are weak at text rendering can produce garbled, blurred, or nonsensical text, which the evaluation treats as invalid.This failure mode is especially observed in local models.
- VJA: Some commercially deployed models with advanced multimodal safety alignment neutralize VJA by transforming malicious edits into benign outputs.These outputs are harmless despite the attack evading safeguard models.
- Other failures: Benign but semantically surprising edits can reflect partial prompt-semantic alignment alongside divergent visual grounding, object composition, and edit locality.Examples include stick-figure humans riding a horse, a wheeled hedgehog, and a lemon-like object with a face.
- Evaluation metrics: HRR supplements average harmfulness by measuring the ratio of high-risk, valid editing outcomes after filtering low-harmfulness attacks and invalid outputs.The threshold τ filters low-harmfulness attacks, while editing validity filters invalid outputs.
C.2. Evaluated Models
The study evaluates commercial and open-source large image editing models using APIs or local deployments. The model set spans recent systems with different architectures, capabilities, and release dates.
- Open-source models: The open-source group includes BAGEL and LongCat-Image-Edit, deployed locally according to official implementations.The study separately treats open-source models because commercial systems include additional safeguard models.
- Model comparison: Table 8 compares all evaluated image-editing models with their associated MLLMs and lists them by release date.The comparison covers the models included in the study.
- Experimental setup: Experiments use eight Nvidia Tesla V100 GPUs, and local models receive a prompt enhancer for visual-prompt handling.The defense is implemented on Qwen-Image-Edit-Local for the corresponding experiments.