PaperlayerView exact revision on arXiv

Source-linked AI summary

SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs

Wenyu Chen, Li Wang, Chuanchao Zang, Xiangtao Meng, Xinyu Gao, Jianing Wang, Zheng Li, Shanqing Guo

arXiv:2609.38899v1cs.CRcs.AIcs.LG

TL;DR

Video jailbreaks have focused on how harmful queries are visually presented, leaving surrounding scenario context comparatively unexplored even though it can change safety responses. SceneJail searches for compatible scenarios and tailored textual guidance without modifying the query. It outperforms evaluated baselines across HADES and SafeBench, with SceneJail-F reaching 91.5% average ASR on HADES.

  • Problem

    Existing video jailbreaks primarily manipulate how harmful queries are visually presented, leaving the role of surrounding scenarios in safety behavior underexplored.

    Source: §1 · p. 1

  • Method

    SceneJail combines adaptive construction of a query-compatible video scenario with black-box search for textual guidance tailored to that scenario, preserving the harmful query.

    Source: §1 · p. 2

  • Results

    Across 16 model–benchmark pairs, both variants outperform every evaluated baseline; SceneJail-F averages 91.5% ASR on HADES and 78.9% on SafeBench.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The same harmful query can elicit substantially different safety behaviors across video scenarios, making scenario context a distinct attack surface.

    Source: §1 · pp. 1–2

    The threat model limits attackers to final textual responses and a finite query budget, without access to model parameters, gradients, hidden states, safety scores, or training data.

    Source: §3.1 · p. 3

Abstract

from arXiv · show

Video Multimodal Large Language Models (Video-MLLMs) support reasoning over video inputs, yet remain vulnerable to jailbreak attacks that elicit policy-violating responses. Existing video jailbreaks primarily manipulate how harmful queries are visually presented, thereby treating video merely as a carrier. Consequently, the surrounding video scenario remains unexplored as a contextual attack surface. In this paper, we show that the same harmful query can elicit different safety responses when placed in different video scenarios. To systematically exploit this vulnerability, we propose SceneJail, an adaptive black-box jailbreak framework with two coordinated components. Adaptive Scenario Construction dynamically searches for a surrounding scenario that is contextually compatible with the harmful query. Scenario-aware Prompt Search uses black-box response feedback to search for textual guidance tailored to the selected scenario. Extensive evaluations on the HADES and SafeBench datasets across eight Video-MLLMs, including two proprietary models, GPT-4.1 and Gemini3.5-Flash, demonstrate the effectiveness of SceneJail. SceneJail-F, which presents the complete query persistently, achieves average attack success rates (ASR) up to 91.5%, outperforming the strongest baselines by 29.1 percentage points. Furthermore, SceneJail-S, which distributes the query across successive frames, remains highly robust against current defenses, retaining a 72.3% ASR even under strict image filtering.

1 Introduction

Video jailbreaks have largely manipulated how harmful queries appear, leaving surrounding video scenarios underexplored despite their potential to change safety responses. SceneJail searches for scenario–prompt combinations without changing the query, and outperforms evaluated baselines across HADES and SafeBench.

1 Introduction

  • Prior video attacks mainly manipulate how harmful queries are encoded or arranged visually, while the effect of surrounding scenarios on interpretation remains less understood.The same harmful query can elicit substantially different safety behaviors across surrounding scenarios.Source: §1 · pp. 1–2
  • Scenario–prompt search is difficult because a scenario may be implausible for a query and its effect is coupled with the accompanying textual prompt.Both challenges complicate finding effective combinations under a limited black-box query budget.Source: §1 · pp. 1–2
  • SceneJail combines Adaptive Scenario Construction with Scenario-aware Prompt Search to search for effective scenario–prompt combinations while preserving the harmful query content.Construction tailors the surrounding context; prompt search adapts textual guidance to the selected scenario using black-box feedback.Source: §1 · p. 2
  • Across 16 model–benchmark pairs, both variants outperform every evaluated baseline; SceneJail-F improves strongest-baseline average ASR by 29.1 points on HADES and 35.0 on SafeBench.SceneJail-F averages 91.5% ASR on HADES and 78.9% on SafeBench; SceneJail-S retains 72.3% ASR under image filtering.Source: §1 · p. 2

2 Related Works

Related work describes Video-MLLM progress in temporal video reasoning while noting that the safety role of surrounding context remains comparatively underexplored. Multimodal jailbreaks manipulate visual inputs in several ways; SceneJail instead changes the surrounding scenario while preserving the harmful query.

2.1 Multimodal Large Language Models

  • Video-MLLMs process temporally evolving content through ordered frames or explicit temporal representations, but the safety implications of surrounding video context remain less understood.Prior work emphasized video understanding and reasoning performance more than context-related safety behavior.Source: §2.1 · p. 2

2.2 Multimodal Jailbreak Attacks

  • Multimodal jailbreaks include visual perturbations and semantic or structural attacks, while video attacks manipulate crossmodal composition, temporal presentation, or multiple clips.SceneJail differs by preserving harmful query content and manipulating the surrounding scenario that makes the query appear part of an ongoing task.Source: §2.2 · pp. 2–3

3 Threat Model and Attack Framework

The threat model gives an attacker black-box access to a deployed Video-MLLM and control over its video and textual prompts, but no internal model access. SceneJail searches scenario and prompt pairs using target responses as feedback, stopping at success or when its query budget runs out.

3.1 Threat Model

  • The attacker can submit videos and textual prompts and observe final textual responses, but has no access to model parameters, gradients, hidden states, safety scores, or training data.The attacker controls scenario construction, query presentation, and textual prompts, and may adapt inputs within a finite query budget.Source: §3.1 · p. 3

3.2 Attack Overview

  • SceneJail searches for a scenario prompt and textual prompt paired with a video containing the unchanged harmful query, presented continuously or split across successive frames.The scenario prompt produces the surrounding video context, while the textual prompt accompanies the video sent to the target model.Source: §3.2 · p. 3
  • SceneJail uses target-model responses as feedback to update scenario and prompt search, stopping when it observes a successful response or exhausts the query budget.Scenario construction seeks contextual compatibility; prompt search guides processing of the visible query without restating or paraphrasing it.Source: §3.2 · p. 3

4 Methodology

SceneJail combines compatible-scenario construction with scenario-conditioned prompt search in a nested black-box procedure. It preserves the harmful query while varying its context and temporal presentation.

4.1.1 Scenario Pool Initialization

  • Each scenario prompt in a reusable pool specifies the setting, character behavior, activity, and carrier; initial prompts are generated independently of evaluated queries.The carrier is where the query is later rendered.Source: §4.1.1 · p. 4

4.1.2 Scenario Matching and Adaptive Selection

  • An evaluator scores contextual compatibility, eligible scenarios rank by match, and query-guided fallback expands the pool when no eligible, untried candidate remains.The evaluator is instructed to judge context rather than query safety, morality, correctness, or answerability.Source: §4.1.2 · p. 4

4.1.3 Video Realization and Query Composition

  • Validated scenario videos require sufficient CLIP4Clip alignment and a localized carrier; the unchanged query is rendered continuously or in ordered segments that reconstruct it exactly.Split-display places segments in successive, non-overlapping intervals, leaving no individual frame with the complete query.Source: §4.1.3 · p. 5

4.2 Scenario-aware Prompt Search

  • For each selected scenario, SceneJail searches for accompanying textual guidance and may reuse prompts that succeeded under that same scenario.Search is performed independently for the two presentation variants, with separate pools, statistics, and prompt memories.Source: §4.2 · p. 5

4.2.1 Scenario-specific Prompt Memory

  • Each scenario has its own memory of successful guidance prompts, updated online with success counts rather than copies or paraphrases of query content.A successful newly generated prompt is stored; successful reuse increments that prompt’s count.Source: §4.2.1 · pp. 5–6, §4.2.2 · p. 6

4.2.2 Memory-guided Prompt Search

  • Prompt search balances reuse with generation; failed reuse increases later generation probability, a final generation trial is reserved when needed, and generated prompts cannot restate the query.Up to three distinct successful prompts from the same scenario’s memory may serve as generation references.Source: §4.2.2 · p. 6

4.3 Overall Search Procedure

  • The nested search allows up to K scenario trials and M prompt trials per scenario, submits validated videos for black-box feedback, and updates memories and scenario statistics online.The search stops at success or when the scenario-trial budget is exhausted.Source: §4.3 · pp. 6–7

5 Experiments

The experiments evaluate SceneJail across two benchmarks, eight Video-MLLMs, component and search-budget variants, generative models, and evaluation protocols. Results show strong comparative effectiveness and robustness across these settings.

5.1 Experimental Setup

  • The evaluation uses HADES and SafeBench, eight target models, two query-presentation variants, and five existing attack baselines.The open-source targets span three model families; the remaining two targets are proprietary models.Source: §5.1 · p. 7

5.2 RQ1: Overall Attack Effectiveness

  • SceneJail-F reaches 91.47% ASR on HADES versus SPTV’s 62.38% (+29.09 points), and 78.90% on SafeBench versus MCV’s 43.95% (+34.95).Both SceneJail variants outperform every evaluated baseline across all reported model–benchmark pairs.Source: §5.2 · pp. 7–8, Table 1 · p. 8
  • Both variants outperform all baselines across HADES’s five categories and SafeBench’s ten categories, with gains not confined to a small subset of topics.SceneJail-F leads four HADES categories and SceneJail-S leads financial harm; on SafeBench, they lead four and six categories, respectively.Source: Table 2 · p. 8, §5.2 · p. 9

5.3 RQ2: Component Contributions

  • On three target models, adaptive scenarios raise average ASR by 25.02 points over query-independent random scenarios, while adaptive prompt search adds 22.27 points over fixed guidance.Random scenarios already improve average ASR by 29.74 points over a white background; generic fixed scenario-aware guidance adds 5.60 points over a minimal prompt.Source: Figure 6 · p. 9, §5.3 · pp. 9–10

5.4 RQ3: Sensitivity to Search Budgets

  • Increasing either search budget improves ASR across three models, with substantial gains in early trials and generally diminishing marginal returns.The default permits up to 25 target-model queries per input, but successful attacks average 2.51 queries for SceneJail-F and 2.09 for SceneJail-S on HADES.Source: Figure 7 · p. 10, §5.4 · p. 10

5.5 RQ4: Robustness to Generative Models

  • Across the evaluated models, all T2V-backbone combinations exceed 90% ASR, and all external-LLM combinations exceed 91%.Maximum ASR variation is 3.06 points across T2V backbones and 2.40 points across external LLMs.Source: Figure 8 · p. 11, §5.5 · p. 11

5.6 Consistency Across Evaluation Protocols

  • SceneJail retains high ASR across Llama Guard 3, GPT Judge, and human evaluation on the same sampled outputs.SceneJail-F ranges from 89.00% to 94.33%; SceneJail-S ranges from 91.00% to 91.33%.Source: Table 4 · p. 11, §5.6 · pp. 11–12

6 Defense Evaluation

Three defenses reduce SceneJail’s effectiveness to varying degrees. Temporal query splitting particularly helps against frame-level filtering, while Safety Prompt leaves substantial residual attack success.

Image Filtering

  • Under Image Filtering, SceneJail-S retains 72.25% average ASR, while SceneJail-F falls to 0.04%.The variants differ only in whether the query is distributed across successive frames or presented in full within a frame.Source: §6 · p. 12

Multimodal Safety Guard

  • Under Multimodal Safety Guard, SceneJail-F achieves 91.45% ASR and SceneJail-S 90.75%, exceeding SPTV by 23.23 and 22.53 points.The guard jointly assesses each frame with its accompanying textual prompt.Source: §6 · p. 12

Safety Prompt

  • Safety Prompt reduces SceneJail-F and SceneJail-S to 44.78% and 45.31% ASR, yet both remain above SPTV by over 30 points.Among the three evaluated defenses, Safety Prompt provides the strongest mitigation but does not fully suppress SceneJail.Source: §6 · p. 12

7 Conclusion and Limitations

The paper identifies surrounding video scenario as an attack surface and presents SceneJail, which combines adaptive scenario construction with scenario-aware prompt search while preserving query content. Evaluations show strong performance across benchmarks, models, and safety categories, but the controlled construction pipeline may not cover natural or long-form videos.

Conclusion

  • The same harmful query can elicit different safety behaviors across surrounding video scenarios, motivating SceneJail’s contextual attack approach.The framework combines Adaptive Scenario Construction and Scenario-aware Prompt Search while preserving the harmful query content.Source: §7 · p. 12
  • Evaluations across HADES, SafeBench, and eight Video-MLLMs show SceneJail consistently outperforming existing image- and video-based attacks.Defense evaluations also reveal limitations of existing safeguards, particularly frame-level filtering against temporally distributed queries.Source: §7 · p. 12

Limitations

  • The adaptive search adds search and generation overhead, although successful attacks typically require only a few target-model queries on average.External LLM and T2V models support scenario construction and prompt generation.Source: §7 · p. 12
  • The controlled video-construction pipeline may not cover the full diversity of natural or long-form video inputs.The pipeline generates candidate scenarios and subsequently composes the original query into the video.Source: §7 · p. 12

A Methodology Details

The methodology validates scenario videos before use, renders the query along a tracked carrier, and nests prompt trials within scenario search. The algorithm stops when it finds a successful response or exhausts its search.

Video Validation

  • A scenario’s candidate base videos are retained only after passing both CLIP4Clip alignment and carrier-localization checks.Up to three candidates are generated; failed candidates are discarded, and a scenario is dropped for the run if all three fail.Source: A Methodology Details · p. 16

Query Rendering

  • Query rendering preserves the original characters, punctuation, and word order while following a validated carrier trajectory.Text may wrap only at word boundaries, and the largest fixed font size that fits throughout the presentation interval is selected.Source: A Methodology Details · p. 16

Nested Scenario–Prompt Search

  • For each query, the nested search selects an eligible scenario, constructs or retrieves its validated video, and tries up to M prompts before moving on.A successful response returns immediately; otherwise the procedure continues until the scenario-search budget K is exhausted, then returns failure.Source: A Methodology Details · p. 16

B Experiments Results Details

The supplementary experiments examine whether attack effectiveness is consistent across safety categories and target models. SafeBench adds a ten-category view, while Table 5 reports SceneJail results across HADES query orders.

B Experiments Results Details

  • The additional category-wise results examine consistency in attack effectiveness across safety categories and target models.They are intended to complement the aggregate evaluation in Section 5.2.Source: B Experiments Results Details · p. 16

B.1 SafeBench

  • SafeBench reports category-wise and overall ASR macro-averaged across target models, complementing HADES with a ten-category safety taxonomy.The analysis examines whether relative attack effectiveness remains consistent under this finer-grained taxonomy.Source: §B.1 · p. 16

B Experiments Results Details

  • Table 5 reports SceneJail ASR under Full-display across HADES query orders, with seed 42 matching the main evaluation order.Source: Table 5 · p. 17

B.2 Robustness to Query Order

SceneJail’s attack effectiveness remains stable across five tested HADES query orders. The evaluation also specifies how target-model responses are scored as successful attacks.

B.2 Robustness to Query Order

  • The order-sensitivity evaluation used five seeded permutations on three HADES models under Full-display, reinitializing online scenario and prompt memories for each order.Seed 42 matched the main evaluation order; other experimental settings remained unchanged.Source: §B.2 · p. 17
  • Average ASRs were 94.24%, 94.27%, and 93.65% across five query orders on Qwen2.5-VL-32B, Qwen3-VL-32B, and InternVL3.5-38B, respectively.Maximum ASR differences across query orders were 0.66, 0.53, and 0.67 percentage points on those models, respectively.Source: §B.2 · p. 17

B.3 LLM-based Evaluation Protocol

  • GPT-4o-mini scores each response from 1 to 5 against the CLAS prohibited-use policy, and only score-5 responses count as successful attacks.The evaluator receives the original query and corresponding target-model response.Source: §B.3 · p. 17

C Defense Evaluation Details

The defense evaluation supplies prompt templates for image filtering and safety prompting, alongside average ASR comparisons across defense settings. The templates insert the attack’s textual prompt into the defense instructions.

C.1 Defense Prompt Templates

  • Figure 11 and Figure 12 provide the complete prompt templates for Image Filtering and Safety Prompt, respectively.Source: Figure 11 · p. 17, Figure 12 · p. 18
  • Image Filtering instructs the target Video-MLLM to inspect visual input for unsafe content before processing the accompanying instruction, while Safety Prompt prepends a safety instruction.In both defenses, the placeholder is replaced with the attack video’s textual prompt P.Source: §C.1 · p. 17

C Defense Evaluation Details

  • Table 6 reports average ASR under different HADES defense settings, macro-averaged across six open-source target models, with nodefense results for reference.The caption identifies SceneJail and the strongest baseline in each setting through bold and underlining.Source: Table 6 · p. 18

C.2 Per-model Defense Results

The supplementary defense results provide per-model and category-level breakdowns of HADES ASR, while the evaluator counts only responses meeting the highest CLAS score as successful attacks.

C.2 Per-model Defense Results

  • Tables 7, 8, and 10 report per-model ASR under Image Filtering, Multimodal Safety Guard, and Safety Prompt, with unweighted averages across six target models.These model-level tables break down the defense comparisons summarized in the main evaluation.Source: §C.2 · p. 18, Table 7 · p. 19, Table 8 · p. 19
  • Only responses scored 5 by the GPT-4o-mini evaluator count as successful attacks under the CLAS scoring rubric.Source: Figure 13 · p. 19
  • Table 9 reports per-model category-wise HADES ASR, marking the highest method and strongest baseline for each model–category pair.Source: Table 9 · p. 20
  • Table 11 reports category-wise and overall SafeBench ASR macro-averaged across target models, highlighting category and overall leaders.Source: Table 11 · p. 21
  • Table 12 compares evaluation protocols on outputs from the same 100 sampled HADES queries.Source: Table 12 · p. 21

Policy Template

Loading 2609.38899v1…