Sequential Comics for Jailbreaking Multimodal Large Language Models via Structured Visual Storytelling

TL;DR

This work presents Sequential Comic Jailbreak (SCJ), a four-phase attack that splits harmful queries into semantically rich but visually innocuous narrative components, renders them as diffusion-generated comic panels, and prompts multimodal LLMs to complete the narrative, thereby bypassing safety alignments. SCJ demonstrates high effectiveness across eleven state-of-the-art models and across diverse harm categories, with an average ASR around $0.835$, significantly outperforming prior visual jailbreaks. The study also reveals substantial vulnerabilities in open-source models and partial resilience in commercial systems, and shows that defense mechanisms such as Llama Guard and LLaVA Guard offer limited mitigation against narrative-based attacks. The findings call for narrative-aware safety solutions that analyze cross-panel semantics and temporal patterns, with implications for video-language models and future multimodal safety research.

Abstract

Multimodal large language models (MLLMs) exhibit remarkable capabilities but remain susceptible to jailbreak attacks exploiting cross-modal vulnerabilities. In this work, we introduce a novel method that leverages sequential comic-style visual narratives to circumvent safety alignments in state-of-the-art MLLMs. Our method decomposes malicious queries into visually innocuous storytelling elements using an auxiliary LLM, generates corresponding image sequences through diffusion models, and exploits the models' reliance on narrative coherence to elicit harmful outputs. Extensive experiments on harmful textual queries from established safety benchmarks show that our approach achieves an average attack success rate of 83.5\%, surpassing prior state-of-the-art by 46\%. Compared with existing visual jailbreak methods, our sequential narrative strategy demonstrates superior effectiveness across diverse categories of harmful content. We further analyze attack patterns, uncover key vulnerability factors in multimodal safety mechanisms, and evaluate the limitations of current defense strategies against narrative-driven attacks, revealing significant gaps in existing protections.

Figures (7)

• Figure 1: Architecture of the proposed SCJ. The pipeline leverages query decomposition through auxiliary LLMs to extract semantic intentions (gain intent, critical resources, role specification, and implementation steps), followed by narrative script generation and visual synthesis using diffusion models. The resulting comic sequences exploit the asymmetric safety alignment between visual narratives and textual inputs in target MLLMs, achieving high attack success rates across multiple models.
• Figure 2: Distribution of selected harmful categories from MM-SafetyBench dataset. The pie chart shows the count and percentage of queries in each of the six harmful categories used in our evaluation, totaling 806 queries.
• Figure 3: Category-specific attack success rate analysis using radar charts. (a) Comparison of different attack methods on GPT-4o across 11 harmful categories. (b) Performance of our SCJ method across 6 different models.
• Figure 4: Ablation study results on six harmful categories from MM-SafetyBench. We compare three visual formats: direct image conversion (image), concatenated comic sequence (comic-single), and multi-image sequential input (comic-mul), with different prompt templates (PT1, PT2, PT3). The results show progressive improvement from basic single-image format to our SCJ (comic-mul + PT1 + PT2 + PT3).
• Figure 5: Comprehensive ablation study results across six harmful categories from MM-SafetyBench. The dashed vertical line separates individual categories from the overall average performance.