PaperlayerView exact revision on arXiv

Source-linked AI summary

Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Models

Wenyun Li, Guiping Cao, Xiangyuan Lan, Zheng Zhang

arXiv:2608.22312v1cs.CL

TL;DR

MLLM safety behavior learned in textual space may not reliably transfer to fused cross-modal representations, leaving multimodal jailbreak vulnerabilities. TA-SPA addresses this gap with text-anchored semantic factorization and semantic-preserving augmentation, and reports strong effectiveness and transfer to commercial MLLMs under evaluated defenses. The authors interpret the findings as consistent with representation-level vulnerability while not establishing a causal mechanism.

  • Problem

    Text-centered safety alignment may insufficiently cover harmful intent encoded in fused multimodal representations, motivating multimodal-specific safety evaluation.

  • Method

    TA-SPA is a black-box framework that factorizes text-anchored semantic and modality-specific residual factors, then diversifies harmful target anchors while preserving semantic consistency.

  • Results

    TA-SPA achieves strong attack effectiveness and cross-model transfer across evaluated open-source and commercial MLLMs, with competitive performance under defenses.

  • Takeaways & Limitations

    The results motivate representation-level safety alignment beyond input-level filtering.

  • Takeaways & Limitations

    TA-SPA is mainly validated on image-text MLLMs and fixed benchmarks and defenses, while metric coverage and stronger representation-level defense co-evaluation remain limited.

Abstract

from arXiv · show

Multimodal Large Language Models (MLLMs) have achieved remarkable progress in vision-language interaction, yet their safety alignment remains vulnerable to jailbreak attacks. A key challenge is that safety behavior learned in the textual space does not reliably transfer to fused cross-modal representations, leaving multimodal inputs exploitable through latent semantic cues. We propose Text-Anchored Semantic Perturbation Attack (TA-SPA), a black-box jailbreak framework that optimizes transferable perturbations in a text-anchored semantic space. TA-SPA integrates Text-Anchored Semantic Factorization (TASF), which encourages the separation of cross-modal semantic factors from modality-specific residuals, with Semantic-Preserving Augmentation (SPA), which diversifies harmful target anchors while preserving semantic consistency. Experiments show strong attack effectiveness and transfer to commercial MLLMs, with competitive performance under representative defenses. Additional controls and probing support the intended factorization without implying perfect disentanglement, motivating representation-level safety alignment beyond input-level filtering.

1 Introduction

MLLM safety alignment is vulnerable because text-centered safety behavior may not transfer reliably to fused cross-modal representations. TA-SPA addresses this gap by optimizing text-anchored semantic perturbations with factorization and semantic-preserving augmentation, achieving strong effectiveness and transfer under evaluated defenses.

  • Motivation: Text-centered alignment may leave MLLMs vulnerable to harmful multimodal inputs encoded outside textual representations.MLLM decisions operate over fused cross-modal representations, creating a potential gap between where safety is learned and where multimodal inputs are processed.
  • Motivation: Existing multimodal jailbreaks exploit visual text, crafted images, or distributed cross-modal intent, but often depend on surface-level forms.These dependencies can limit transferability and expose attacks to OCR, visual sanitization, or prompt-level defenses.
  • Motivation: Semantic–residual entanglement may promote overfitting to model-specific textures, layouts, noise, lexical patterns, and alignment shortcuts.The paper frames this entanglement as a potential contributor to fragile safety alignment and weak transfer to unknown black-box MLLMs.
  • Approach: TA-SPA combines TASF, which separates text-anchored semantic intent from modality-specific residuals, with SPA, which diversifies residual variations while preserving semantics.The framework optimizes perturbations toward cross-modal semantics rather than superficial artifacts or a single lexical pattern.
  • Results: TA-SPA shows strong attack effectiveness and cross-model transfer across evaluated open-source and commercial MLLMs, with competitive performance under defenses.The authors use these results to motivate representation-level safety alignment beyond input-level filtering.

2 Related Work

Related work establishes that MLLM safety lags behind multimodal capability and that attacks increasingly exploit visual and cross-modal channels. TA-SPA differs by factorizing image–text representations and optimizing semantic rather than unfactorized, modality-specific features.

  • Multimodal Large Language Models: MLLMs connect modality-specific encoders with language-model backbones for multimodal perception and reasoning tasks.Representative applications include image captioning, visual question answering, and speech transcription.
  • Multimodal Large Language Models: Text-oriented safety alignment may not cover harmful intent encoded through visual or cross-modal inputs.This gap motivates multimodal red-team evaluations rather than treating MLLM safety as a direct extension of text-only safety.
  • Multimodal Jailbreak Attacks: Multimodal jailbreak research attacks visual channels, typographic prompts, feature activations, and intermediate representations.These directions demonstrate that harmful intent can be injected through multiple multimodal pathways.
  • Positioning of TA-SPA: TA-SPA factorizes paired image–text representations into text-anchored semantic and modality-residual components before optimizing a cross-modal jailbreak objective.This distinguishes it from attacks on unfactorized CNN feature maps and other modality-specific surface patterns.

3 Problem Setup

The problem setup models a black-box adversary that constructs a quasi-imperceptible multimodal input to increase unsafe responses while preserving the malicious query context. Success means eliciting actionable or substantive harmful assistance instead of refusal.

  • Attack Objective: A multimodal jailbreak seeks an adversarial input xadv that increases the probability of unsafe or policy-violating outputs while remaining imperceptible.The perturbation budget ϵ constrains xadv relative to the original input.
  • Adversary Capabilities: Under the black-box threat model, the adversary can submit inputs and observe responses but cannot access parameters or internal safety mechanisms.The adversary also cannot modify, remove, or introduce unspecified system components.
  • Attack Objective: The attack targets harmful or policy-violating generation in response to a malicious textual query.The objective is to bypass the model’s intended safety behavior rather than alter the query itself.
  • Success Criterion: An attack is successful when the model provides actionable or substantive assistance instead of maintaining refusal behavior.This operationalizes jailbreak success at the level of the generated response.

4 Method

TA-SPA builds a cleaner optimization space by factorizing frozen-CLIP image–text representations into semantic and residual factors, then augments residuals while preserving semantic factors. It optimizes adversarial images toward diverse harmful paraphrases and away from source-conditioned residual shortcuts.

  • Text-Anchored Semantic Factorization: TASF uses frozen CLIP encoders to separate cross-modal semantics from modality-specific form without accessing the victim model.The resulting text-anchored space targets semantic factors rather than low-level modality artifacts.
  • Text-Anchored Semantic Factorization: TASF learns semantic factors from paired harmful queries and associated source visual carriers that are semantically aligned.The factorization decomposes each representation into semantic and residual components and uses reconstruction to recover original CLIP features.
  • Text-Anchored Semantic Factorization: TASF’s multi-term loss aligns paired semantic factors, encourages complementary information, preserves reconstruction, and anchors factors to CLIP geometry.These terms jointly support a text-anchored semantic optimization space.
  • Semantic-Preserving Augmentation: SPA perturbs only residual factors while keeping the semantic factor fixed, using dropout and Gaussian noise to diversify residual geometry.The augmented residuals are recomposed with the source visual semantic factor to form source-conditioned anchors.
  • Adversarial Optimization: The anchor neighborhood varies residual realizations around a shared semantic factor, reducing reliance on a single lexical trigger and improving transfer across prompts and tokenizers.During optimization, source-conditioned anchors act as negatives while a contrastive margin objective attracts multiple harmful target variants.
  • Adversarial Optimization: The black-box attack optimizes perturbations in TASF space using frozen CLIP features before transferring the adversarial image to the victim MLLM.The procedure is designed for victims whose parameters, gradients, logits, and internal safety mechanisms are inaccessible.

5 Experiments

Experiments evaluate TA-SPA across open-source and commercial MLLMs, benchmarks, surrogate architectures, controls, and defenses. Results indicate strong attack effectiveness, transferability, robustness, and support for the intended factorization.

  • Experimental Setup: The evaluation covers AdvBench, MM-SafetyBench, and VAJM across three open-source victim MLLMs, using dictionary-based ASR, GPT-based ASR, and toxicity metrics.The benchmarks contain 520, 4,680, and 1,225 harmful requests, respectively.
  • Attack Effectiveness: TA-SPA achieves the best GPT-based ASR on 8 out of 9 model–dataset pairs and maintains strong performance across refusal bypassing, harmful instruction following, and toxicity.The reported metric gap shows that some baselines bypass refusal patterns without consistently producing coherent harmful responses.
  • Ablation: The ablation improves average GPT-based ASR from 18.2% with direct CLIP target matching to 60.0% with full TA-SPA.TASF, target paraphrases, and source repulsion raise performance successively to 23.4%, 43.1%, and 55.6%.
  • Perturbation Controls: Matched controls show full TA-SPA reaches 60.0% G-ASR, 15.0 points above the 45.0% clean proxy, while random bounded noise gives 46.0%.These controls use the same source proxy, query/paraphrase, victim, and evaluator settings.
  • Validation and Robustness: Linear probing recovers harm-category information more readily from the semantic factor than the residual, with 0.75 macro-F1 versus 0.46, supporting intended separation without proving perfect disentanglement.Non-CLIP surrogates achieve 50.0% and 55.0% ASR versus 60.0% for CLIP, indicating transfer is not solely explained by CLIP-family sharing.
  • Defense Robustness: Under four defenses, TA-SPA achieves the highest average ASR under every defense and ranks first in 10 out of 12 defense–model combinations.The evaluation includes VLGuard, ProEAT, AdaShield, and BlueSuffix.
  • Cross-Dataset Generalization: TASF generalizes across datasets despite distribution shifts, with high in-domain diagonal results and competitive off-diagonal entries.The pattern indicates that learned factors are not tied to a single benchmark-specific query format.

6 Conclusion

TA-SPA is presented as a transferable black-box jailbreak framework that targets text-anchored semantic representations and combines TASF with SPA. The reported findings support strong effectiveness and transfer across evaluated MLLMs, while motivating representation-level safety alignment beyond input filtering.

  • TA-SPA attacks text-anchored semantic representations rather than superficial modality cues.
  • Combining TASF and SPA, TA-SPA achieves strong effectiveness and transfer across evaluated open-source and commercial MLLMs.
  • TA-SPA shows competitive performance under evaluated defenses.
  • The results are consistent with a representation-level vulnerability and motivate safety alignment beyond input-level filtering, without establishing a causal mechanism.

Limitations

The evaluation is limited to image-text MLLMs and a fixed set of benchmarks and defenses, leaving performance in other deployment settings unverified.

  • TA-SPA is mainly validated on image-text MLLMs and a fixed set of benchmarks and defenses.
  • Performance under other modalities, safety policies, and deployment pipelines remains to be verified.
  • The automatic metrics may not fully capture fine-grained harm severity, and stronger representation-level defense co-evaluation is left to future work.

Ethical Considerations

The work frames TA-SPA as a red-team evaluation and safety-improvement effort conducted in controlled benchmark settings rather than as a source of actionable harmful outputs.

  • TA-SPA is intended for red-team evaluation and safety improvement of MLLMs.
  • All experiments use controlled benchmark settings and report aggregate metrics rather than actionable harmful outputs.
  • The stated goal is to reveal limitations of text-centered and input-level defenses and encourage stronger representation-level safety alignment.

A.1 Details of training process of TASF

TASF is trained offline to learn a text-anchored factorized space from paired image-text anchors using frozen CLIP encoders and several representation-learning objectives.

  • TASF learns a text-anchored factorized space for transfer attack optimization during an offline representation-learning stage.
  • Paired image-text anchors are processed with frozen public CLIP encoders before TASF factorizes each modality into semantic and residual factors.
  • The factorized features are recombined to reconstruct CLIP-space representations.
  • TASF combines reconstruction, CLIP-space consistency, cross-modal semantic alignment, and semantic-residual disentanglement objectives.
  • The alignment term pulls paired image and text semantic factors together, while the disentanglement term suppresses redundancy between semantic and residual channels.
  • Only lightweight factorization modules are optimized; after offline training on 128 anchor requests, the fixed TASF modules are reused for SPA and perturbation optimization.

A.2 Implementation Details and Hyperparameters

TA-SPA uses frozen CLIP-based components, paraphrase augmentation, PGD optimization, and GPT-4 binary judging to generate and evaluate adversarial images. Hyperparameter studies select β = 0.7 and m = 5, while qualitative examples show unsafe responses from commercial GPT-4o APIs.

  • Hyperparameter Tuning: For β values 0.3, 0.5, 0.7, and 0.9, ASR is 72.2%, 75.4%, 76.2%, and 75.1%, respectively.Performance peaks at β = 0.7 before slightly declining at β = 0.9.
  • Hyperparameter Tuning: For m values 1, 3, 5, and 7, ASR is 72.6%, 75.3%, 80.1%, and 80.0%, while runtime is 86s, 130s, 180s, and 245s.Increasing m from 5 to 7 adds 65s while reducing ASR by 0.1 points, so the default is m = 5.
  • Evaluation: GPT-4 evaluates jailbreaks with a binary label, assigning 1 to actionable harmful assistance without refusal and 0 otherwise.The evaluator receives the harmful query and model response and outputs only 1 or 0.
  • Implementation: TA-SPA uses frozen CLIP encoders, TASF modules, an augmentation operator, paraphrases, and PGD to produce an adversarial image.The algorithm takes a source visual proxy and harmful query, then outputs xadv under a perturbation budget.
  • Semantic-Preserving Augmentation: Each harmful query yields five intent-preserving paraphrases with varied wording and syntax, excluding malformed variants or topic drift.GPT-4 generates the paraphrases using instructions to preserve intent and add no new details.
  • Qualitative Results: Qualitative examples show TA-SPA inducing unsafe, actionable responses from commercial GPT-4o APIs in the black-box setting.Reported examples include detailed plagiarism-related and weapons-related assistance.
Loading 2608.22312v1…