Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models

AI summary

Overview

Research area: Adversarial machine learning and multimodal AI safety, specifically jailbreak attacks against Vision-Language Models (VLMs).

Technical level: Advanced. The paper assumes familiarity with gradient-based adversarial optimisation, embedding spaces, loss landscapes, and LLM safety alignment.

Scope: The paper proposes and empirically evaluates UltraBreak, a framework that trains a single universal adversarial image on one surrogate VLM and measures how well that image elicits harmful responses from unseen open-source and proprietary VLMs across multiple jailbreak benchmarks.

What This Paper Is About

Vision-Language Models combine a vision encoder with a language model, which lets users condition text generation on images—but also gives attackers a continuous, high-dimensional space to manipulate. Existing gradient-based jailbreaks overfit to the one "surrogate" model used to craft the adversarial image, so they transfer poorly to other (often closed-source) models and generalise poorly across different harmful goals. The paper's goal is to produce one trained image that is simultaneously universal (works across many different harmful prompts) and transferable (works across many different unseen victim models) using only a single surrogate model.

Key Contributions

1. UltraBreak, described as the first jailbreak framework to achieve effective cross-target universality and cross-model transferability simultaneously against VLMs using a single surrogate model.
2. A constrained optimisation space combining randomised image transformations (translation, rotation, scaling), an affine projection onto constrained pixel values, and a Total Variation (TV) regularisation term, designed to induce robust, recognisable adversarial patterns rather than fragile pixel-level artifacts.
3. Semantically weighted targets: a semantic loss defined in the target LLM's textual embedding space that replaces strict cross-entropy supervision over exact tokens, using Gaussian-perturbed target embeddings and an attention mechanism with sinusoidal positional encoding and a temperature parameter to weight future target tokens dynamically.
4. Extensive experiments on SafeBench, AdvBench, and MM-SafetyBench showing large gains in black-box average ASR over prior gradient-based methods, plus ablations and loss-landscape visualisations explaining why earlier approaches fail to transfer.

Main Findings

• SafeBench black-box average ASR: UltraBreak reaches 71.05% versus 66.54% for FigStep, 41.46% for VAJM, 20.00% for UMK, and 40.57% for no attack (surrogate: Qwen2-VL-7B-Instruct).
• AdvBench black-box average ASR: 52.19% for UltraBreak versus 5.96% (no attack), 5.61% (VAJM), and 5.19% (UMK). FigStep is excluded from this benchmark because it requires a distinct image per target.
• MM-SafetyBench black-box average ASR: 58.50% for UltraBreak versus 35.10% (no attack), 28.16% (VAJM), and 21.82% (UMK).
• Per-model exceptions: VAJM slightly outperforms UltraBreak on GLM-4.1V for SafeBench (67.62% vs 66.03%), but on AdvBench UltraBreak exceeds VAJM by over 26% on that same model (30.00% vs 3.65%).
• Closed-source transfer: On a curated combined subset, UltraBreak averages 32.26% ASR, beating no attack (20.00%), VAJM (11.48%), and UMK (14.59%). Individual results are GPT-4.1-nano 38.78%, Gemini-2.5-flash-lite 42.00%, and Claude-3-haiku 16.00%. A less harmful affirming phrase, '[START LIST]', was used for these evaluations.
• Response quality (StrongREJECT, 0–1 scale): UltraBreak's jailbroken answers score higher on average, e.g. 0.79 on LLaVA-v1.6-mistral-7b-hf, 0.55 on Qwen-VL-Chat, 0.45 on Qwen2-VL-7B-Instruct, 0.27 on Qwen2.5-VL-7B-Instruct, and 0.19 on GLM-4.1V-9B-Thinking, versus baseline scores that are mostly at or near 0.18 and below.
• Ablation on SafeBench (average over black-box models): removing the jailbreak image gives 40.79%; removing constraints gives 51.99%; removing the semantic loss gives 55.80%; removing attention weighting gives 57.54%; the full method gives 71.83%. On AdvBench the same order is 25.48%, 29.86%, 40.15%, 41.83%, and 57.64%.
• Constraints and semantic loss play complementary roles: without constraints, ASR on the surrogate is high but transfers poorly (overfitting); with constraints but only cross-entropy loss, transferability improves but ASR drops because the constrained space produces a spiky loss landscape.
• Loss landscape analysis: visualising loss over a 30×30 grid across a 20×20 image-space range shows cross-entropy loss has sharp fluctuations and scattered minima, while the semantic loss produces well-clustered low-loss regions. Global landscapes over a 200×200 grid confirm the pattern.
• Attention temperature (τ): at τ = 0 (attending only to the current token) the landscape resembles cross-entropy loss and is highly spiky; as τ → ∞ it becomes smoother and more convex but develops sharper minima, suggesting an overfitting risk. τ = 0.5 is used in the main configuration.
• Visual pattern emergence: with no constraints the adversarial image has no discernible structure; random transformations produce text-like patterns; adding TV loss makes the patterns smoother and more coherent, which the authors argue act as model-invariant cues because VLMs are trained on OCR and pattern-recognition tasks.
• Surrogate model choice: transferability to black-box models increases consistently regardless of the chosen surrogate, with the exception of LLaVA-v1.6-Mistral, where transfer is weaker—attributed to weaker alignment of its underlying LLM, evidenced by its high no-attack ASR.
• Model size: using 2B and 7B Qwen2-VL-Instruct as surrogates and 3B, 7B, and 32B Qwen2.5-VL-Instruct as victims, transferability generally improves as the surrogate grows or the victim shrinks.

Methodology in Plain English

The attacker cannot see inside the victim model, so they train against one open-source "surrogate" model and hope the resulting image works elsewhere. UltraBreak changes two things about how that training is done.

First, it restricts what the image is allowed to look like during training. Instead of letting the optimiser freely adjust every pixel, each training step randomly translates, rotates, and rescales the image before feeding it to the model, so the optimiser is pushed toward patterns that survive those changes—like letters or shapes rather than brittle pixel noise. The image is also rescaled and shifted using CLIP's normalisation statistics and clipped back into the [0, 1] pixel range, and a Total Variation penalty smooths neighbouring pixels so the image does not depend on fragile high-frequency detail. Training used translations in (0, 112), rotations in (-15, 15), scaling in (0.8, 1.2), and a TV weight λ_TV = 0.5.

Second, it changes the training goal. Standard jailbreaks use cross-entropy to force the model to emit an exact target string token by token. UltraBreak instead converts both the model's next-token predictions (via softmax times the embedding matrix) and the target tokens into vectors in the model's embedding space, adds Gaussian noise to the target embeddings, and rewards cosine similarity to a weighted combination of future target tokens. An attention mechanism with sinusoidal positional encoding and a causal mask decides how much weight each future token gets, with temperature τ = 0.5. This rewards any output that means the right thing rather than one exact phrasing.

The training data is SafeBench-Tiny, five harmful queries per topic, with a "Targeted Prompt Guidance" step that asks the model to enumerate steps and begin with a chosen affirming phrase (p = '[Jailbroken Mode]' for open-source targets). The image itself was optimised with Adam from a random initialisation for 1,300 steps. All training targets were excluded from the held-out evaluation set. Evaluation uses Attack Success Rate judged by an LLM, plus the StrongREJECT rubric.

Why This Matters

The paper challenges the assumption that multiple surrogate models are necessary to achieve transferable jailbreaks, and it argues that smoothing the loss landscape through semantic objectives is the key mechanism. It also shows that a single image trained on one open-source 7B model can affect proprietary commercial systems, which has direct implications for how VLM safety is evaluated.

Real-world applications and relevance:

• Safety evaluation of VLMs: Provides a stronger red-teaming tool for testing whether deployed multimodal models resist image-based manipulation, including closed-source systems.
• Content moderation and platform trust and safety: The finding that text-like adversarial patterns transfer across architectures suggests moderation pipelines need image-level screening, not only prompt filtering.
• Healthcare and autonomous driving deployments: The paper opens by noting VLMs in these safety-critical domains, where a bypass of safety alignment could carry severe consequences.
• Multimodal agent and embodied AI security: Systems combining vision and language (e.g., the authors' Fudan affiliation is an Institute of Trustworthy Embodied AI) face an expanded attack surface that this work quantifies.

Industry relevance: model providers relying on safety alignment rather than architectural robustness should treat the reported cross-model transfer rates as evidence that alignment does not guarantee protection against a surrogate-trained visual trigger.

Future Directions

• Scaling the surrogate: the paper reports that transferability improves with larger surrogates and smaller victims, but leaves systematic investigation of attacking even larger models to future work due to computational limits.
• Defences: the authors explicitly call for robust and generalisable alignment strategies for VLMs, and for research into effective defences against multimodal jailbreaks.
• Explaining weaker transfer cases: the anomalously weak transfer from LLaVA-v1.6-Mistral and its high no-attack ASR raise the question of how underlying LLM alignment quality determines transferability.
• Deeper investigation of the attention temperature trade-off: the analysis shows τ → ∞ smooths the landscape but produces sharper minima and attention that drifts toward irrelevant outputs, suggesting further work on controlling this balance.

Target Audience

Researchers and practitioners in adversarial machine learning, multimodal model safety, and AI red teaming; VLM developers and safety alignment engineers who need to understand transferable image-based attacks; and policy or trust-and-safety teams evaluating the robustness of deployed vision-language systems. Readers without a background in gradient-based adversarial optimisation or embedding-space losses will find the methodology sections demanding.

Authors’ abstract

Vision-language models (VLMs) extend large language models (LLMs) with vision encoders, enabling text generation conditioned on both images and text. However, this multimodal integration expands the attack surface by exposing the model to image-based jailbreaks crafted to induce harmful responses. Existing gradient-based jailbreak methods transfer poorly, as adversarial patterns overfit to a single white-box surrogate and fail to generalise to black-box models. In this work, we propose Universal and transferable jailbreak (UltraBreak), a framework that constrains adversarial patterns through transformations and regularisation in the vision space, while relaxing textual targets through semantic-based objectives. By defining its loss in the textual embedding space of the target LLM, UltraBreak discovers universal adversarial patterns that generalise across diverse jailbreak objectives. This combination of vision-level regularisation and semantically guided textual supervision mitigates surrogate overfitting and enables strong transferability across both models and attack targets. Extensive experiments show that UltraBreak consistently outperforms prior jailbreak methods. Further analysis reveals why earlier approaches fail to transfer, highlighting that smoothing the loss landscape via semantic objectives is crucial for enabling universal and transferable jailbreaks. The code is publicly available in our \href{https://github.com/kaiyuanCui/UltraBreak}{GitHub repository}.