Source-linked AI summary
MMJailBench: A Factorized Benchmark for Disentangling Multimodal Jailbreak Vulnerabilities
Tianshi Wang, Jingsong Wang, Yafei Huang, Fengling Li, Xin Li, Lei Zhu
TL;DR
Existing multimodal jailbreak benchmarks couple harmful intent with framing, visual semantics, and instruction carrier, limiting diagnosis of vulnerability sources. MMJailBench factorizes these factors under controlled configurations and evaluates 16 MLLMs, finding heterogeneous, model-dependent profiles in which prompt framing dominates variation while visual semantics and instruction carriers have distinct effects.
Problem
Existing benchmarks entangle harmful intent, prompt framing, visual semantics, and instruction carrier, limiting fine-grained attribution of multimodal jailbreak vulnerabilities.
Method
MMJailBench systematically varies four factors in matched multimodal configurations and provides modular full and lightweight auditing suites with multiple judges and multidimensional metrics.
Results
Across 16 MLLMs, vulnerability profiles are heterogeneous and model-dependent: prompt framing varies outcomes most, visual semantics weaken refusal, and rendered instructions are not consistently more susceptible than textual ones.
Takeaways & Limitations
Factorized evaluation enables fine-grained comparison and attribution of multimodal jailbreak vulnerabilities for reproducible, scalable, and cost-efficient safety auditing.
Abstract
from arXiv · showhide
Multimodal Large Language Models (MLLMs) are increasingly deployed in real-world applications, yet how different factors shape their jailbreak vulnerabilities remains poorly understood. Existing benchmarks often couple harmful intent, prompt framing, visual semantics, and instruction carrier within individual jailbreak instances, obscuring the specific sources of observed vulnerabilities. To address this limitation, we introduce MMJailBench, a factorized benchmark that systematically varies and combines these factors under controlled configurations, enabling fine-grained comparison and factor-level attribution. Large-scale evaluations across 16 open-weight and proprietary MLLMs reveal highly heterogeneous and model-dependent vulnerability profiles. Jailbreak vulnerability varies markedly across harm domains, exposing uneven coverage in current multimodal safety alignment. Prompt framing emerges as the dominant source of variation, task-relevant visual semantics systematically increase jailbreak susceptibility with authority-like cues exposing particularly pronounced vulnerabilities, and visually rendered instructions do not consistently increase jailbreak susceptibility relative to direct textual instructions. To further investigate the risks introduced by multimodal context, we conduct diagnostic analyses on a representative open-weight model and identify vulnerability-associated patterns in internal representations and cross-modal interactions. Finally, we develop a modular multimodal jailbreak evaluation suite with full and lightweight configurations, multiple judge options, and multidimensional metrics, enabling reproducible, scalable, and cost-efficient multimodal jailbreak auditing.
1 Introduction
MMJailBench addresses the limited factor-level diagnosis of existing multimodal jailbreak benchmarks by independently varying key factors in controlled configurations. Evaluations across 16 MLLMs reveal heterogeneous vulnerabilities, with prompt framing, visual semantics, and instruction carriers contributing unevenly across models and contexts.
- Motivation: Existing benchmarks entangle harmful intent, prompt framing, visual semantics, and instruction carrier within fixed instances, limiting fine-grained vulnerability diagnosis.Their attack success rates mainly reflect aggregate vulnerability on particular test sets.
- Benchmark design: MMJailBench combines 272 harmful intents, 6 prompt templates, 5 visual semantic types, and 2 instruction carriers in a controlled evaluation space.Matched combinations enable factor-level attribution of observed vulnerabilities.
- Findings: Across 16 open-weight and proprietary MLLMs, jailbreak vulnerabilities vary substantially across harm domains and models.The results identify uneven vulnerabilities and vulnerability-associated patterns in internal representations and cross-modal interactions.
- Findings: Prompt framing is the dominant source of variation, while task-relevant visual semantics weaken refusal, especially with authority-like cues.Visually rendered instructions do not consistently increase susceptibility relative to direct textual instructions.
- Evaluation suite: The work also provides a modular evaluation suite with full and lightweight configurations, multiple judges, and multidimensional metrics for scalable auditing.The suite is intended to support reproducible and cost-efficient multimodal jailbreak evaluation.
2 Related Work
Prior benchmarks broaden multimodal jailbreak coverage and standardization, but generally do not independently manipulate the linguistic and semantic factors shaping safety decisions. MMJailBench complements this work with matched, factorized variation for fine-grained comparison and attribution.
- Multimodal jailbreaks: Early multimodal jailbreak research identifies attack surfaces spanning language, vision, adversarial images, typographic prompts, and cross-modal constructions.Defenses include safety alignment, input transformation, and inference-time safeguards.
- Benchmarking: Standardized benchmarks establish taxonomies and reproducible protocols for harmful behavior and refusal robustness across text and multimodal settings.Examples include SafetyBench, HarmBench, MM-SafetyBench, FigStep, JailBreakV, and VLJailbreakBench.
- Structured evaluation: Recent benchmarks improve attack coverage, evaluation standardization, modality comparison, and attack-defense evaluation with multidimensional metrics.Omni-SafetyBench uses parallel harmful seeds across modality configurations to assess cross-modal safety consistency.
- Research gap: MMJailBench differs by independently varying prompt framing, task-relevant visual semantics, and instruction carrier over matched harmful intents.This design enables fine-grained comparison and factor-level attribution within multimodal interactions.
3 MMJailBench
MMJailBench constructs matched multimodal jailbreak scenarios by factorizing harmful intent, prompt framing, visual semantics, and instruction carrier. Its controlled combinations support comparisons of how contextual factors relate to MLLM safety behavior across harm categories.
- Factorized design: MMJailBench replaces entangled fixed instances with matched scenarios that systematically vary four safety-relevant factors.The factors are harmful intent, prompt framing, visual semantics, and instruction carrier.
- Factorized design: Each instance pairs an instruction component L(h, t, c) with a visual input V(h, v) derived from shared harmful intent and controlled conditions.The construction keeps the harmful objective fixed while varying contextual factors.
- Benchmark scale: The benchmark contains 272 harmful intents, 6 prompt framing strategies, 5 visual semantic conditions, and 2 instruction carriers, yielding 16,320 controlled instances.Cartesian combinations support consistent comparisons across models and harm categories.
- Harmful intent: Harmful intents are intent-level behavioral seeds spanning 9 harm domains, allowing contextual factors to vary without changing the unsafe objective.The domains include physical harm, cyber abuse, economic harm, privacy and IP, regulated advice, and others.
- Prompt framing: Prompt framing changes the linguistic presentation of an unchanged harmful intent through six strategies, including academic, system, story, code, and safety-paradox framing.The strategies represent different narrative structures and interaction styles.
- Visual semantics: Visual semantics add contextual meaning through five conditions, including professional-role context, identity credentials, and authorization documents.These signals represent legitimacy-, expertise-, or authority-related context without modifying the underlying harmful intent.
- Instruction carrier: Instruction carrier compares direct textual instructions with semantically preserved instructions rendered in text-containing images.The benchmark also measures recognition mismatch to account for OCR-related input-understanding failures.
4 Experimental Setup
MMJailBench evaluates 16 open-weight and proprietary MLLMs under controlled multimodal jailbreak conditions using complementary safety metrics, GPT-5 judgments, and full or lightweight configurations.
- Evaluation Models and Configurations: 16 representative MLLMs are evaluated, covering both open-weight and proprietary-access systems.The complete benchmark configuration contains 16,320 multimodal jailbreak instances and produces 261,120 model responses across systems.
- Metrics and Judge Models: Attack Success Rate (ASR) measures the proportion of responses providing substantive assistance to the targeted harmful intent.Responses with harmfulness scores s_i≥4 on a 1–5 scale count as successful jailbreak cases.
- Metrics and Judge Models: Conditional Attack Success Rate (CASR) evaluates safety robustness after excluding inputs the model failed to understand.Mismatch cases include OCR failures, irrelevant responses, and intent misinterpretations, separating end-to-end vulnerability from conditioned safety behavior.
- Metrics and Judge Models: GPT-5 serves as the main judge, assigning harmfulness, jailbreak-success, and instruction-mismatch labels to generated responses.Refusals, safety warnings, and high-level discussions are not counted as successful jailbreaks; a lightweight judge is also developed for cost-efficient follow-up evaluation.
- Evaluation Models and Configurations: The full configuration provides complete factor coverage, while the lightweight configuration samples representative instances for efficient auditing and regression testing.Both configurations preserve coverage across harmful domains, prompt framings, visual semantics, and instruction carriers.
5 Results and Analysis
Across 16 MLLMs, MMJailBench reveals strongly model-dependent and domain-dependent jailbreak vulnerability. Prompt framing drives the largest variation, task-relevant visual semantics increase susceptibility, and OCR instructions are not inherently stronger carriers than direct text.
- Overall Jailbreak Landscape: Average ASR ranges from 2.17% for GPT-5 to 78.38% for GLM-4.6V across identical multimodal jailbreak configurations.Models with comparable multimodal capabilities can nevertheless show substantially different vulnerability profiles.
- Harmful Intent: Cyber abuse, economic harm, privacy-related behaviors, and deception-related tasks generally show higher ASR than physical harm and sensitive content categories.The uneven distribution indicates that aggregate safety scores can conceal domain-specific weaknesses.
- Prompt Framing: Prompt framing produces the largest factor-level variation, with story, structured, and academic framings generally yielding higher ASR than system-style and safety-paradox framings.The gap between the most and least vulnerable strategies exceeds 40 percentage points while harmful intent remains unchanged.
- Visual Semantics: Task-relevant visual semantics consistently increase ASR relative to no-image inputs, led by authorization documents (+12.96%), identity credentials (+10.47%), and task scenarios (+10.10%).Blank, noise, and nature-image controls produce changes of less than 2.2%, indicating that contextual meaning matters more than images alone.
- Instruction Carrier: OCR-based instructions achieve lower ASR than direct text inputs, at 40.59% versus 50.70%, and remain lower after excluding mismatch cases, at 42.34% versus 50.89%.Visually rendered instructions are therefore not inherently stronger jailbreak carriers; carrier effects depend on model-specific multimodal processing.
- Model-Dependent Profiles: Model vulnerability profiles are heterogeneous: some models have ΔPrompt above 80 percentage points, while visual-semantic effects are smaller but consistently positive.Factorized evaluation characterizes these distinct sensitivity combinations beyond aggregate jailbreak success rates.
6 Diagnostic Analysis
Diagnostic analyses of gemma3-12b connect authority-document contexts with higher-layer representation shifts and redistributed cross-modal attention. These internal patterns are consistent across held-out samples and harm domains.
- Diagnostic Setup: The diagnostic subset uses matched MMJailBench instances emphasizing authority-document scenarios to examine layer-wise representations and cross-modal attention in gemma3-12b.The analysis provides a model-internal view of how authority-related visual contexts shape response generation.
- Representation Diagnostics: Representation divergence between authority and danger conditions increases with depth, with the sharpest rise at layer 42.The visual contexts become increasingly separated in higher-layer representations before response generation.
- Representation Diagnostics: An authority-minus-danger representation direction learned on discovery samples displaces authority-document contexts in held-out pairs.Positive shifts appear across all harm domains, indicating a shared higher-layer pattern associated with authority-related cues.
- Cross-Modal Attention: At the representation-sensitive layer, authority-document contexts allocate less attention to both harm-related task-label tokens and visual tokens.The combined representation displacement and attention redistribution is presented as an internal explanation for increased susceptibility under authority-related contexts.
7 Conclusion
MMJailBench systematically analyzes multimodal jailbreak vulnerabilities through controlled factor variations and reveals diverse, model-dependent safety behaviors.
- MMJailBench varies harmful intents, prompt framings, visual semantics, and instruction carriers under controlled conditions.
- Evaluations across 16 open-weight and proprietary MLLMs reveal substantial diversity in multimodal safety behaviors.
- Prompt framing introduces the largest variation, while visual semantics add contextual vulnerability and instruction carriers have model-dependent effects.
- Diagnostic analyses identify vulnerability-associated patterns in internal representations and cross-modal interactions.
- Modular full and lightweight configurations, flexible judges, and multidimensional metrics support reproducible, scalable multimodal safety evaluation.
A Benchmark Construction
MMJailBench constructs a factorized benchmark from a diverse harmful-intent taxonomy, controlled prompt and visual conditions, two instruction carriers, and standardized evaluation procedures.
- Harmful-intent taxonomy: The taxonomy contains 272 unique harmful intents spanning 9 major harm domains and 18 harm scenarios.
- Harmful-intent taxonomy: Embedding similarity analysis and manual review remove near-duplicates, while PCA visualizes semantic diversity across harm domains.
- Prompt framing: Six prompt templates preserve each harmful intent while varying contextual framing for controlled comparison of jailbreak susceptibility.
- Visual semantics: Five visual semantic categories vary contextual cues while preserving the harmful intent and prompt framing.
- Instruction carriers: Instruction carriers compare direct text input with visually embedded OCR instructions using a standardized layout.
- Evaluation protocol: The benchmark evaluates 16 MLLMs on the complete Cartesian product of its factors, producing 16,320 instances per model and 261,120 total responses.
- Evaluation protocol: GPT-5 judges responses using instruction-mismatch detection and a 1∼5 harmfulness rubric, with anti-deception rules for packaged harmful content.
B.3 Full and Lightweight Benchmark Settings
The benchmark offers a comprehensive full configuration and cost-reduced alternatives while validating evaluation consistency and judging reliability.
- Full configuration: The full configuration covers all 272 intents, 6 prompt templates, 5 visual conditions, and 2 carrier modes.
- Full configuration: The harmfulness scoring rubric defines the response-evaluation standard used by the benchmark.
- Full configuration: Category-level results pool both instruction carriers for ASR and report ΔT−O as the TEXT-minus-OCR difference.
- Lightweight configuration: A lightweight 1,500-instance configuration uses stratified sampling to preserve the full benchmark’s factor distribution and main evaluation characteristics.
- Evaluation validation: A qwen3-8b lightweight judge predicts harmfulness and mismatch labels under the GPT-5 protocol, with consistency validated against GPT-5.
C.1 Extended Factor-Level Results
Extended analyses show category-, model-, and factor-specific jailbreak patterns, alongside evidence that lightweight evaluation and judging remain consistent with the full pipeline.
- Harm categories: Cyber & Tech Abuse, Economic Harm, and Privacy & IP show relatively higher ASR, while Sensitive Regulated Advice and Sexual Content show lower ASR.
- Harm categories: ΔT−O remains positive across all harmful categories, ranging from 5.81 to 12.46.
- Factor sensitivity: Models differ substantially in sensitivity to prompt framing and visual semantic conditions, producing distinct vulnerability patterns.
- Factor sensitivity: K-means clustering identifies prompt-dominant, visual-responsive, carrier-sensitive, and low-variation model profiles.
- Semantic image ablation: Step3-vl-10b and doubao-seed-2.0-lite show larger task-relevant versus control visual gaps, whereas gemma3-12b shows smaller separation.
- Semantic image ablation: Claude-sonnet-4.5 has relatively higher ASR without images, indicating less dependence on semantic visual cues.
- Efficiency and validation: The lightweight configuration closely matches the full setting with small ASR differences and strong agreement across matched evaluations.
- Efficiency and validation: GPT-5 judgments agree strongly with human annotations and the lightweight judge for harmfulness scoring and mismatch detection.
D.1 Ethics and Data Release
MMJailBench is released for research-only multimodal safety evaluation, with documentation and tools intended to support reproducible and responsible use. Its materials undergo predefined filtering and validation, while the authors determine the final benchmark design and protocols.
- MMJailBench is released for research purposes only, with documentation and evaluation tools supporting reproducible and responsible use.
- The benchmark reports consistency between Full and Lightweight settings and agreement among GPT-5, human experts, and a lightweight judge.
- Users are encouraged to apply the released resources to research on improving model safety and robustness.
- LLMs assist with harmful-intent organization, visual prompt generation, and response evaluation.
- Generated materials are filtered and validated through predefined procedures, while authors determine the final benchmark design and protocols.