Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses

Xingwei Zhong, Kar Wai Fok, Vrizlynn L. L. Thing

TL;DR

This work addresses safety vulnerabilities in multimodal large language models (MLLMs) by introducing a black-box jailbreak framework that leverages enhanced text prompts and image prompts, plus a Re-attack strategy to cover failure cases. The authors evaluate the attacks across multiple open-source MLLMs and a closed-source GPT-4o, demonstrating substantial improvements in attack success rates and exposing defense gaps. To counter these risks, they propose enhanced training-time and inference-time defenses (Enhanced AdaShield and Enhanced JailGuard) and show that threshold tuning and defense prompt ordering can significantly mitigate harmful outputs without severely impacting benign performance. The results highlight a practical path for rigorous security assessment and more resilient defense mechanisms in real-world, multimodal contexts, with implications for safer deployment of MLLMs in sensitive domains.

Abstract

Multimodal large language models (MLLMs) comprise of both visual and textual modalities to process vision language tasks. However, MLLMs are vulnerable to security-related issues, such as jailbreak attacks that alter the model's input to induce unauthorized or harmful responses. The incorporation of the additional visual modality introduces new dimensions to security threats. In this paper, we proposed a black-box jailbreak method via both text and image prompts to evaluate MLLMs. In particular, we designed text prompts with provocative instructions, along with image prompts that introduced mutation and multi-image capabilities. To strengthen the evaluation, we also designed a Re-attack strategy. Empirical results show that our proposed work can improve capabilities to assess the security of both open-source and closed-source MLLMs. With that, we identified gaps in existing defense methods to propose new strategies for both training-time and inference-time defense methods, and evaluated them across the new jailbreak methods. The experiment results showed that the re-designed defense methods improved protections against the jailbreak attacks.

Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses

TL;DR

This work addresses safety vulnerabilities in multimodal large language models (MLLMs) by introducing a black-box jailbreak framework that leverages enhanced text prompts and image prompts, plus a Re-attack strategy to cover failure cases. The authors evaluate the attacks across multiple open-source MLLMs and a closed-source GPT-4o, demonstrating substantial improvements in attack success rates and exposing defense gaps. To counter these risks, they propose enhanced training-time and inference-time defenses (Enhanced AdaShield and Enhanced JailGuard) and show that threshold tuning and defense prompt ordering can significantly mitigate harmful outputs without severely impacting benign performance. The results highlight a practical path for rigorous security assessment and more resilient defense mechanisms in real-world, multimodal contexts, with implications for safer deployment of MLLMs in sensitive domains.

Abstract

Multimodal large language models (MLLMs) comprise of both visual and textual modalities to process vision language tasks. However, MLLMs are vulnerable to security-related issues, such as jailbreak attacks that alter the model's input to induce unauthorized or harmful responses. The incorporation of the additional visual modality introduces new dimensions to security threats. In this paper, we proposed a black-box jailbreak method via both text and image prompts to evaluate MLLMs. In particular, we designed text prompts with provocative instructions, along with image prompts that introduced mutation and multi-image capabilities. To strengthen the evaluation, we also designed a Re-attack strategy. Empirical results show that our proposed work can improve capabilities to assess the security of both open-source and closed-source MLLMs. With that, we identified gaps in existing defense methods to propose new strategies for both training-time and inference-time defense methods, and evaluated them across the new jailbreak methods. The experiment results showed that the re-designed defense methods improved protections against the jailbreak attacks.
Paper Structure (37 sections, 6 equations, 10 figures, 7 tables)

This paper contains 37 sections, 6 equations, 10 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Multimodal Large Language Models (MLLMs)
  4. Jailbreak Attacks on MLLMs
  5. Jailbreak Defense on MLLMs
  6. Background
  7. Overview of HADES
  8. Proposed Jailbreaking Methodology
  9. Proposed Text Prompt
  10. Proposed Image Prompt
  11. Proposed Mutation Method
  12. Proposed Multi-image Method
  13. Proposed Re-attack Strategy
  14. Experiment for the Proposed Jailbreaking Methodology
  15. Experiment Settings
  16. ...and 22 more sections

Figures (10)

  • Figure 1: An instruction example with the keyword ’hack’ referring to behavior and its corresponding HADES text prompt $T_{Opt}$ and proposed text prompt $T_{Pro}$.
  • Figure 2: Proposed multi-image jailbreak method. An example of the original image and text prompt of HADES is shown on the left, the image and text prompt of the propose multi-image method is shown on the right.
  • Figure 3: The process of the proposed Re-attack method.
  • Figure 4: Two cases can be successfully attacked by HADES hades but fail when using the proposed method. (a) shows the comparison between the proposed image prompt (Gaussian Blur) over HADES hades, while (b) shows the comparison between the proposed text prompt over HADES hades.
  • Figure 5: Failure jailbreak case by the HADES attack hades and successful jailbreak case by the proposed Re-attack method for the LLaVA-1.6-mistral-7b.
  • ...and 5 more figures