PaperlayerView exact revision on arXiv

Source-linked AI summary

Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models

Benlei Cui, Shen Pang, Yuke Wang, Xuemei Dong, Yuwen Zhai, Jingqun Tang, Haiyang Yu, Hui Xue, Longtao Huang, Haiwen Hong

arXiv:2608.27531v1cs.CRcs.CV

TL;DR

Existing multimodal jailbreaks adapt attack content but leave their meta-level strategy or attacker parameters static, limiting adaptation against evolving defenses. MAMJ jointly adapts the strategy prompt and attacker weights over groups of attack trajectories, then achieves high ASR and transfers without retraining to unseen victims and defenses.

  • Problem

    Existing multimodal jailbreaks either freeze image–text layouts or adapt per-query content while keeping attack strategies and attacker parameters fixed.

  • Method

    MAMJ first refines an attack strategy prompt θ through LLM-based critique, then updates attacker weights ϕ using group-aggregated ASR rewards with θ⋆ fixed.

  • Results

    81.0%, 78.9%, and 82.3% ASR are reported against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, respectively, with up to 24.1 percentage points over the strongest sample-level baseline.

  • Takeaways & Limitations

    The learned attacker (θ⋆,ϕ⋆) transfers without retraining to unseen victim VLMs and remains effective under representative defenses.

  • Takeaways & Limitations

    Training and evaluation use MM-SafetyBench, which covers 13 safety scenarios but does not exhaust multimodal harms or establish generalization to other benchmarks or attack surfaces.

Abstract

from arXiv · show

The safety of large vision-language models is increasingly stress-tested by multimodal jailbreaks, yet existing attacks remain largely static at the meta level: template-based attacks freeze the image--text layout, while iterative attacks adapt only the image--text content with fixed attack strategies and frozen attacker parameters. We propose Meta-Adaptive Multimodal Jailbreaking (MAMJ), which instead optimizes the attacker itself along two axes: an attack strategy prompt (ASP) $θ$ governing attack iteration and attacker weights $φ$ determining attack effectiveness. Across groups of multimodal attack trajectories, an LLM-based critique first refines $θ$, after which group-aggregated attack-success-rate (ASR) rewards update $φ$. On MM-SafetyBench, MAMJ achieves $81.0\%$, $78.9\%$, and $82.3\%$ ASR against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, respectively, outperforming the strongest sample-level baseline by up to $24.1$ percentage points. The learned attacker $(θ^\star,φ^\star)$ also transfers without retraining to unseen victims and remains effective under representative defenses. These results reveal a systemic vulnerability of frontier VLMs to meta-adaptive jailbreaks and motivate defenses against meta-level adversaries. Code is available at https://github.com/Alibaba-VELLDEPTH/MetaJailbreak-VLM.

1. Introduction

Multimodal jailbreaks can bypass VLM safeguards, while prior attacks remain static at the meta level. MAMJ instead evolves both the attack strategy and attacker parameters across trajectory groups, achieving strong ASR and transfer.

  • Motivation: Existing template-based attacks freeze image–text layouts and payloads, allowing defenses to target recognizable patterns and preventing attack evolution.Examples of countermeasures include OCR filters, layout detectors, and keyword scanners.
  • Motivation: Sample-level attacks rewrite image–text pairs using victim feedback but retain fixed iteration strategies and frozen attacker parameters.Their adaptation occurs within individual queries rather than at the meta level.
  • MAMJ: MAMJ optimizes an attack strategy prompt θ and attacker weights ϕ across groups of multimodal attack trajectories.The strategy prompt governs attack iteration, while attacker weights determine attainable attack success rate.
  • MAMJ: MAMJ first uses LLM-based critique to refine θ, then updates ϕ with group-aggregated attack-success-rate rewards while holding θ⋆ fixed.This staged procedure targets aggregate rather than per-query gains.
  • Results: 81.0%, 78.9%, and 82.3% ASR are reported against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, respectively, exceeding the strongest sample-level baseline by up to 24.1 percentage points.The learned attacker transfers without retraining to unseen victims and remains effective under representative defenses.

2. Related Work

Multimodal jailbreaks progress from fixed templates to sample-level feedback loops, but these approaches still leave the attacker strategy and parameters static.

  • Template-Based Attacks: Template-based attacks construct adversarial image–text pairs from predefined visual structures or static datasets without adapting to the victim.Rigid layouts, fragmented sub-images, and hidden keywords are representative constructions.
  • Template-Based Attacks: Pattern-specific defenses such as OCR filters, layout detectors, and keyword scanners can neutralize fixed attacks once recognized.Static attacks cannot react after detection.
  • Sample-Level Attacks: Sample-level attacks use victim responses to refine image–text pairs for the same query across multiple rounds.IDEATOR alternates attacker and victim VLMs, whereas VisCo uses structured contrastive feedback.
  • Sample-Level Attacks: Despite improved per-query diversity and resistance to naive pattern matching, sample-level feedback loops rely on fixed hand-crafted iteration templates.They adapt attack content but not the meta-level strategy.

3. Methodology

MAMJ models multimodal attacks as a pipeline from malicious goals to generated images, textual payloads, victim responses, and judged rewards. It then refines the strategy prompt through grouped diagnostics and optimizes attacker weights with gated, group-normalized reinforcement learning.

  • 3.1. Problem Formulation: Given a malicious goal q, attacker Aϕ conditioned on ASP θ generates an image prompt timg and textual payload u, image generator G renders I, and victim V returns y.The attacker uses Qwen3-VL-32B-Thinking as its base model; its vision encoder remains inactive in text-only operation.
  • 3.1. Problem Formulation: A judge assigns toxic score s from 1 to 5, normalizes it to reward r=(s−1)/4, and defines success as s≥4 or r≥0.75.The full execution trace contains the goal, generated prompts, image, victim response, and reward.
  • 3.1. Problem Formulation: MAMJ maximizes expected attack reward through alternating updates that first optimize θ in language space with weights frozen, producing θ⋆.The joint objective is f(θ,ϕ)=E_q E_(timg,u)∼πθ,ϕ[R(q,timg,u)].
  • 3.2. Adaptive Attack Strategy Prompt: Failed trajectories are independently critiqued, their diagnoses are aggregated by a Reflector, and a complete candidate ASP revision is retained only after empirical acceptance testing.The archive preserves strategies that perform best on different probe examples, maintaining complementary strategy diversity.
  • 3.3. Adaptive Multimodal Attack Model via Reinforcement Learning: The selected θ⋆ is fixed while reinforcement learning updates attacker weights ϕ using format-validity-gated rewards and group-normalized rollout feedback.The gated reward first requires complete reasoning, image-generation, and textual-payload fields before semantic reward contributes.

4. Experiments

MAMJ is evaluated on MM-SafetyBench against multiple commercial VLMs, sample-level baselines, and representative defenses. It consistently improves ASR, transfers across unseen victims, and retains effectiveness under defenses without additional tuning.

  • Main results: 82.0%, 79.3%, and 83.0% average ASR are achieved against GPT-4o, Gemini-3-Pro-Preview, and Seed 2.0, respectively.These results exceed IDEATOR by +20.2, +22.6, and +20.12 percentage points, respectively.
  • Main results: MAMJ outperforms iterative baselines despite using fewer per-query interaction rounds: Niter = 2 versus 3 for IDEATOR and 4 for VisCo.The gains are especially pronounced on scenarios where sample-level methods struggle to maintain stable attack trajectories.
  • Cross-victim transfer: Training against GPT-4o transfers to unseen victims, retaining nearly the same effectiveness on Gemini-3-Pro-Preview and improving on Seed 2.0 without retraining.The transfer also extends across benchmarks, reaching 87.8% ASR on SafeBench.
  • Robustness against defenses: MAMJ remains the strongest method under four representative defenses, exceeding IDEATOR by +4.7, +6.4, +13.04, and +14.5 percentage points.The same optimized attacker pair (θ⋆, ϕ⋆) is reused across all defenses without defense-specific adaptation.
  • Evaluation setup: The evaluations use MM-SafetyBench across 13 safety categories, with average ASR computed as a sample-level micro-average over 1,680 test samples.The study compares template-based and iterative multimodal jailbreak baselines under a unified attacker setup.

5. Ablations

Ablations show that both MAMJ optimization axes contribute, with strategy-prompt optimization providing the largest standalone gain and group-based feedback improving strategy learning. Group-relative reward normalization further stabilizes reinforcement-learning optimization.

  • Experimental setup: The ablations average ASR over three random seeds on the MM-SafetyBench evaluation split against GPT-4o without defenses.The study separately tests the two-axis architecture, diagnostic aggregation, and reward normalization.
  • 5.1. Component ablation: Optimizing the attack strategy prompt alone improves over the Base attacker by +33.3 pp, making ASP the primary driver of effectiveness.RL alone underperforms ASP-only optimization, indicating that GRPO benefits from a strong strategic initialization.
  • 5.1. Component ablation: Combining ASP optimization with GRPO achieves the best performance, with GRPO further increasing the success rate attainable under θ⋆.The ablation disables each optimization axis individually on GPT-4o without defenses.
  • 5.2. Diagnostic aggregation strategies: MAMJ’s group diagnostic aggregation beats Aggregator-only by 5.9 pp and sample-wise editing by 12.3 pp.The comparison identifies group aggregation and per-trajectory causal attribution as complementary ingredients for strategy optimization.
  • 5.3. Reward normalization: Group-relative normalization performs best because each trajectory is compared only with rollouts for the same query.Global normalization is unstable under reward-scale drift, while rollout-wise normalization dilutes the per-query learning signal by pooling unrelated queries.

6. Conclusion

MAMJ moves multimodal jailbreak adaptation from individual samples to the attacker’s meta-level policy by optimizing strategy prompts and attacker weights over trajectory groups. Its optimized attacker reaches high ASR and transfers without retraining to unseen victims and defenses.

  • 6. Conclusion: MAMJ optimizes an attack strategy prompt θ and attacker weights ϕ over groups of multimodal attack trajectories.A critique of failed trajectories evolves θ, then group-aggregated ASR rewards update ϕ with θ⋆ fixed.
  • 6. Conclusion: 82.3% ASR is achieved on MM-SafetyBench, exceeding the strongest sample-level baseline by up to 24.1 pp.The learned pair (θ⋆, ϕ⋆) transfers without retraining to unseen victims and defenses.
  • 6. Conclusion: The principal risk identified is an adversary that adapts at the meta level rather than relying on static patterns.The paper notes that limitations and ethical considerations are discussed in Appendix 6.

Limitations

The study identifies benchmark coverage, training cost, and the fixed image-generation model as limitations that bound MAMJ’s current scope and motivate future work.

  • MM-SafetyBench covers 13 safety scenarios but does not exhaust multimodal harms, leaving generalization to other benchmarks or attack surfaces unestablished.Both training and evaluation use MM-SafetyBench.
  • MAMJ’s practical training overhead is dominated by external image-generation API calls, whose absolute cost depends on service pricing and throughput.Amortized inference remains favorable relative to per-sample iterative baselines, but upfront training investment is non-trivial.
  • The image-generation model G remains fixed and external because MAMJ optimizes θ and ϕ without fine-tuning G itself.

Ethics Statement

The ethics statement frames MAMJ as controlled red-teaming research with dual-use risks, mitigated through defender-focused positioning, controlled evaluation, responsible disclosure, and use of public benchmark data.

  • MAMJ produces a transferable parametric artifact that could in principle be misused to elicit harmful outputs from deployed systems.
  • The authors position MAMJ strictly as a safety-evaluation tool for defenders and model vendors rather than a deployable attack.
  • Experiments use standard victim-model interfaces in controlled research settings, and findings were shared with relevant vendors before broad dissemination.
  • All experiments use publicly available MM-SafetyBench data under its intended research use, without collecting new human-subject data.

C.3. Reasoning-Chain Log-Prob in the GRPO Objective

The GRPO implementation computes policy ratios and KL penalties over the complete reasoning-plus-output sequence rather than only the final structured outputs. Ablation results show that truncating this scope harms ASR and destabilizes optimization.

  • Reasoning-chain scope: The generated sequence includes an internal reasoning chain followed by image-generation instruction and textual payload, all sampled from πϕ.
  • Reasoning-chain scope: Truncating log-probabilities to final outputs omits reasoning-token probability mass and prevents policy gradients from crediting reasoning behavior.
  • Empirical ablation: A 9.0 pp ASR reduction and increased seed variance result from truncating the log-probability computation.The truncated variant also becomes unstable around step 40 in all three runs, with two runs requiring early stopping.
  • Empirical ablation: Incomplete-sequence ratios and KL penalties produce mis-calibrated policy updates, explaining the observed optimization instability.
  • Optimization stability: Training uses a 60-step GRPO cap, with reward rising early and saturating after roughly 50 steps while policy entropy decreases smoothly.The optimization uses KL anchoring, gradient clipping, and warmup followed by cosine learning-rate decay.

E.2.1. Supplementary ablations

The supplementary analyses examine KL regularization, training dynamics, infrastructure, image-generation cost, and optimization stochasticity. They show stable GRPO behavior, an interior KL optimum, and diffusion-dominated computation, while repeated ASP optimization addresses run-to-run variability.

  • KL sensitivity: βKL = 0.01 is the interior optimum: weaker regularization permits excessive policy drift, whereas stronger regularization suppresses learning.
  • Training dynamics: Mean attack reward steadily increases and stabilizes near convergence as policy entropy decreases smoothly, indicating stable policy specialization without optimization collapse.
  • Parallel infrastructure: MAMJ uses a disaggregated actor–rollout–reference architecture on 48 NVIDIA H100 GPUs, overlapping rollout generation, reward computation, and gradient updates.
  • Image-generation cost: The 1280 × 1280 Z-Image generation configuration consumes approximately 7.3 × 10^5 equivalent tokens for a 6B-parameter LLM, with roughly 20%–30% absolute-FLOPs uncertainty.
  • Stochasticity: Repeated ASP optimization mitigates stochasticity from sampling, generation, and critique modules, which can otherwise yield noticeably different strategies and probe-set performance.
  • Image-generation cost: Image synthesis accounts for 96.7% of reinforcement-learning consumption, while all text components together account for under 3.4%.

G.5. End-to-End Cost Comparison against IDEATOR

The end-to-end comparison charges MAMJ for both offline training and bounded inference against IDEATOR’s inference-only cost. MAMJ costs more per trained setup but becomes cheaper across the full evaluation suite and amortizes beyond a calculable instance threshold.

  • Per-instance cost: MAMJ reduces per-instance inference cost by 33.4% versus IDEATOR, using two attack rounds instead of three and one fewer diffusion synthesis.MAMJ uses 1.42 × 10^6 equivalent tokens per instance versus IDEATOR’s 2.13 × 10^6.
  • Aggregate cost: MAMJ’s full evaluation cost combines 1.67 × 10^10 inference tokens with approximately 6.34 × 10^9 one-time training tokens.
  • Aggregate cost: Across 11,760 attack instances, MAMJ’s end-to-end cost is 2.30 × 10^10 equivalent tokens, 8.1% lower than IDEATOR’s.The comparison includes complete MAMJ training plus bounded inference.
  • Amortization: The crossover occurs at approximately 8,892 instances, after which MAMJ’s trained artifact amortizes linearly across additional queries.The artifact transfers across victims and defenses without retraining, whereas per-sample methods repeat their search.

H. Additional Results on SafeBench

On a balanced 500-goal SafeBench split, MAMJ is evaluated without benchmark-specific retraining. It maintains higher ASR than sample-level baselines across all ten safety categories while using a smaller per-query budget.

  • Transfer evaluation: MAMJ reuses the artifact optimized on MM-SafetyBench against GPT-4o without SafeBench-specific tuning.
  • SafeBench results: 87.8% average ASR on SafeBench exceeds IDEATOR’s 79.0% by 8.8 percentage points and VisCo by 10.8 percentage points.
  • SafeBench results: The improvement is consistent across all ten safety categories while using Niter = 2 instead of IDEATOR’s three rounds.
  • Transfer evaluation: The results indicate that MAMJ’s learned meta-level strategy transfers across both victim models and benchmarks.

I. Robustness to the Choice of Judge

The judge-robustness analysis re-scores fixed GPT-4o attack responses with Seed 2.0 under the same rubric and success criterion. Absolute ASR and method rankings remain essentially unchanged, with MAMJ retaining a wide lead.

  • Evaluation design: Only the judge changes: the victim, attacker, image generator, and attack outputs remain fixed under the identical scoring rubric and sJ ≥4 criterion.
  • Judge robustness: 81.13% ASR under the Seed 2.0 judge versus 82.02% under GPT-4o differs by under 2 percentage points.
  • Judge robustness: MAMJ remains the strongest method, leading IDEATOR by roughly 20 percentage points under either judge.
  • Evaluation design: The attack-strategy pipeline diagnoses failed trajectories, aggregates recurring weaknesses, and rewrites the global ASP through candidate strategy generation.
Loading 2608.27531v1…