Jailbreak Connectivity links image paths for transferable MLLM jailbreaks
Original title: Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak
On MM-SafetyBench, reported success reaches 97.95% on Gemma-3-12B-IT and beats FigStep on GPT-5.6 and Gemini 3.1 Pro.
Jailbreak Connectivity treats effective visual jailbreaks as connected through low-loss regions of image space and optimizes continuous adversarial paths. Path sampling produces diverse images, surrogate classifiers target cross-model transfer, and a distribution-level objective aims at universal attacks across harmful queries. On MM-SafetyBench the authors report average success of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, up to 68.36 points above the strongest baselines. Black-box tests raise success over FigStep by 24.69 and 27.34 points on GPT-5.6 and Gemini 3.1 Pro.
Unconfirmed: Attack success rates are the authors’ benchmark results, not confirmed real-world misuse.
- White-box averages are 84.01%, 85.77%, and 97.95% on the three open models.
- The largest reported gain over baselines is 68.36 percentage points.
- Black-box gains over FigStep are 24.69 points on GPT-5.6 and 27.34 on Gemini 3.1 Pro.
From the original article
1 min read at arxiv.orgMultimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization. We propose Jailbreak Connectivity (JC), a framework based on the observation that effective adversarial inputs can be connected through low-loss regions in image space.
By Xu Zhang · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.