When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models

AI summary

Overview

Research area: AI safety and security for generative vision models, specifically large image editing models (Computer Vision / multimodal safety).

Technical level: Intermediate. The attack concept (smuggling a harmful instruction into the image itself) is easy to grasp, but the paper assumes familiarity with diffusion/transformer image editors, Vision-Language Models, KV-Cache, RLHF alignment, and benchmark metrics such as attack success rate.

Scope: The paper introduces a vision-only jailbreak attack (VJA), a 1054-image safety benchmark (IESBench), and a training-free defense, evaluating seven mainstream commercial and open-source image editing models.

What This Paper Is About

Modern image editing models increasingly accept "vision prompts" — a user circles a region, draws an arrow, or types text inside the image — and infer the editing intent from those visual marks. The paper argues that this new interface creates a new attack surface: because existing safety guards and alignment are built for text, a malicious instruction can be embedded entirely inside the image, with the text box left empty, and slip past moderation. The goal is to demonstrate this vulnerability systematically, build a benchmark to measure it, and propose a cheap defense.

Key Contributions

1. A new attack paradigm — Vision-Centric Jailbreak Attack (VJA): described as the first visual-to-visual jailbreak attack for image editing models, where malicious intent is encoded exclusively in the visual modality and the textual input is intentionally left empty (the model is queried as M(I_adversarial, NULL; Θ)).
2. IESBench (Image Editing Safety Benchmark): described as the first standardized benchmark for evaluating image editing safety, organized as a hierarchical taxonomy covering 15 risk categories, 116 fine-grained editing attributes, 9 unique actions, and 1054 visually-prompted images, evaluated with MLLMs as judges.
3. A training-free defense based on introspective multimodal reasoning: a lightweight textual safety-alignment trigger that reuses the KV-Cache of the multimodal prompt to let a vision-language backbone judge whether the requested edit is safe, without auxiliary guard models.
4. A systematic evaluation across seven mainstream commercial and open-source large image editing models, plus a safety-enhanced reference model (Qwen-Image-Edit-Safe) built by applying the defense to Qwen-Image-Edit*.

Main Findings

• Vision-only attacks largely succeed. VJA achieves attack success rates of up to 80.9% on Nano Banana Pro and 70.1% on GPT-Image-1.5 (as stated in the abstract; Table 1 reports an ALL ASR of 80.9 for Nano Banana Pro and 70.3 for GPT Image 1.5). Across the four commercial systems the average ASR is 85.7%.
• Other commercial models are even more exposed. VJA reaches 97.5% ASR on Qwen-Image-Edit and 94.1% on Seedream 4.5.
• Open-source models without safeguards hit 100% ASR. For BAGEL, Flux2.0[dev], and the local Qwen-Image-Edit* (2512), no safeguard models are deployed, giving an ASR of 100% in every category, an average harmfulness score of about 4.3, and high-risk ratios of 84.6% (Flux2.0[dev]) and 90.3% (Qwen-Image-Edit*).
• Some harm categories are consistently exploitable. I13 (evidence tampering) and I15 (aversive manipulation) are repeatedly among the most vulnerable categories across models.
• Model-specific weaknesses differ. GPT Image 1.5 is highly susceptible to copyright tampering (I11, ASR 95.7%), whereas Nano Banana Pro is substantially more resistant on that category (ASR 41.3%).
• Risk-level vulnerability is uneven. Nano Banana Pro shows its lowest average harmfulness score at risk level 2, while GPT Image 1.5 shows its lowest at risk level 1.
• VJA beats text-centric attacks, especially on well-aligned models. On a category-balanced 20% sample, VJA raises ASR by +35.6 for Nano Banana Pro and +24.9 for GPT Image 1.5 versus Text-Centric Jailbreak Attacks (TJA). For Qwen-Image-Edit (+7.3) and Seedream 4.5 (+0.5), gains are marginal because those models are already weak at refusing.
• Better-aligned models can nonetheless be poor visual instruction followers. Qwen-Image-Edit and Seedream 4.5 sometimes fail to follow visual instructions, producing invalid, less harmful edits — which caps attack effectiveness on those models.
• The defense substantially improves a weakly aligned model. Qwen-Image-Edit-Safe reduces average ASR and HS by 33% and 1.2 respectively versus Qwen-Image-Edit*, bringing it to a level comparable with GPT Image 1.5 and Nano Banana Pro. On I13 and I15 its ASR falls to 61.5% and 55.3%.
• The defense detects attacks zero-shot, and reasoning is essential. In a binary classification test mixing malicious and benign visual-prompt requests, 75% of attacks are recognized with an AUC-ROC of 75.7%; removing the reasoning step drops detection to about half of attacks, near random guessing.
• Human judges are stricter than MLLM judges. Across five MLLM judges and human evaluators, MLLM judges assign consistently higher harmfulness and high-risk-ratio values than humans; human evaluation yields EV 86.4 and HS 3.7 ± 1.2 versus, for example, Qwen3-VL-8B-Thinking's EV 90.9 and HS 4.7 ± 0.9.
• Visual prompt details change attack outcomes. Sensitivity tests on a 7-image sample across colors, languages, fonts, sizes and shapes show that handwriting fonts and non-English languages produce poorer editing validity and thus worse ASR, and that larger visual prompts are recognized more easily, raising EV and lowering ASR as size increases.
• A stated limitation of the defense: it depends on a pre-aligned VLM (e.g., Qwen2.5-VL-8B-Instruct inside Qwen-Image) and remains less effective against attacks involving fabricated or misleading information that require large, up-to-date world knowledge.
• A stated limitation of the attack: VJA is less effective on models with limited visual perception and reasoning, which may fail to infer the editing intent purely from vision.

Methodology in Plain English

The researchers first define the threat model. They treat the victim editor as a black box and allow it to be queried with an image only — no text prompt at all. A benign image is edited to carry a visual instruction (a marked region plus a semantic cue and directional guidance such as an arrow), so the malicious request lives entirely in pixels.

To measure this, they build IESBench. They start from 15 risky image-editing categories identified from MLLM content policies and arrange them into three levels: Individual Rights Violations, Group-Targeted Harm, and Societal and Public Risks. They collect keywords per category, then generate scene images and gather open-source real-world images, discard unqualified ones, and annotate each image with a sample id, category tags, an intent label, attributes, operations (add, delete, replace) and text prompts. Only 15 images are carried over from a prior benchmark, because that benchmark's visuals were not designed as attack carriers.

Evaluation is automated: a multimodal LLM acts as judge, scoring each edited image. They report Attack Success Rate and Harmfulness Score (1–5), plus two editing-specific metrics: Editing Validity (whether a bypassed attack actually produced a meaningful edit) and High Risk Ratio (the share of edits that are both valid and scored 4 or higher).

For defense, they exploit a design detail: recent open-source editors (Qwen-Image-Edit and LongCat-Image-Edit) use a Vision-Language Model rather than a plain LLM to produce text embeddings. Because the image is already encoded in the KV-Cache, they append a short textual safety trigger — "You are an image editing safety evaluator. Please review the image and text of the user to predict whether the edited image will be safe/appropriate/legal." — and let the model's own language-space safety awareness make the call. This converts a vision-centric attack back into a text-centric judgment without a separate guard model and with negligible latency.

Why This Matters

The paper reframes image editing safety: the risk is no longer only what a user types, but what a user draws. Safety systems designed around text moderation can be bypassed by simply leaving the text box empty, which undermines the assumption that alignment on the language channel transfers to the visual channel.

Real-world applications affected:

• Photo and video editing tools used by consumers and professionals, where safeguards are typically prompt-based.
• Newsrooms and fact-checking workflows, given the demonstrated vulnerability of categories like evidence tampering (I13) and visual misinformation (I8), and the removal of watermarks and copyright notices (I11).
• Financial and commercial document handling, where price tags, expiration dates, contracts, ingredient lists and certification labels can be edited (I7).
• Model deployment in regulated or enterprise settings, where a cheap, guard-model-free safety check is operationally attractive.

Industry relevance: the evaluated models include Nano Banana Pro (Gemini 3 Pro Image), GPT Image 1.5, Qwen-Image-Edit and Seedream 4.5, so the findings apply directly to systems already in commercial use. The defense is positioned as practical because it needs no auxiliary guard model and adds negligible computation or inference latency.

Future Directions

• Extending the defense beyond visual fabrication. The authors note the current approach struggles with attacks that require large, up-to-date world knowledge, which points to better knowledge grounding.
• Closing the gap between MLLM judges and human judgment. MLLM judges score harm more aggressively than human evaluators, and small judges (e.g., Qwen3-VL-2B-Instruct, with only 6.9% of votes and an EV of 57.2) miss subtle visual edits — a clear target for improving the judging protocol.
• Hardening visual-instruction following. Since weak models sometimes fail to follow the attack at all, and stronger visual understanding raises the attack's apparent success, the relationship between perception capability and safety risk needs further study.
• Broadening the taxonomy and evaluation coverage. The paper does not report how the 15 categories, 116 attributes and 1054 images were balanced or how they might be extended to new editing operations and model families.

Target Audience

This paper is most useful to AI safety and security researchers working on multimodal and generative-vision systems; engineers and product teams shipping image editing features who need a concrete risk model and a low-cost mitigation; benchmark and evaluation researchers interested in MLLM-as-a-judge protocols for visual harm; and policy or trust-and-safety practitioners who need evidence that text-centric moderation is insufficient for visual editing interfaces.

Authors’ abstract

Recent advances in large image editing models have shifted the paradigm from text-driven instructions to vision-prompt editing, where user intent is inferred directly from visual inputs such as marks, arrows, and visual-text prompts. While this paradigm greatly expands usability, it also introduces a critical and underexplored safety risk: the attack surface itself becomes visual. In this work, we propose Vision-Centric Jailbreak Attack (VJA), the first visual-to-visual jailbreak attack that conveys malicious instructions purely through visual inputs. To systematically study this emerging threat, we introduce IESBench, a safety-oriented benchmark for image editing models. Extensive experiments on IESBench demonstrate that VJA effectively compromises state-of-the-art commercial models, achieving attack success rates of up to 80.9% on Nano Banana Pro and 70.1% on GPT-Image-1.5. To mitigate this vulnerability, we propose a training-free defense based on introspective multimodal reasoning, which substantially improves the safety of poorly aligned models to a level comparable with commercial systems, without auxiliary guard models and with negligible computational overhead. Our findings expose new vulnerabilities, provide both a benchmark and practical defense to advance safe and trustworthy modern image editing systems. Warning: This paper contains offensive images created by large image editing models.