Gradient-based Jailbreak Images for Multimodal Fusion Models

Javier Rando, Hannah Korevaar, Erik Brinkman, Ivan Evtimov, Florian Tramèr
10/4/2024
cs.CRcs.AI

No official code found. Best implementation: facebookresearch/multimodal-fusion-jailbreaks (21 stars, last commit 2024-10-22).

Abstract

Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evaluate our attacks on Chameleon models and obtain jailbreak images that elicit harmful information for 72.5% of prompts. Jailbreak images outperform text jailbreaks optimized with the same objective and require 3x lower compute budget to optimize 50x more input tokens. Finally, we find that representation engineering defenses, like Circuit Breakers, trained only on text attacks can effectively transfer to adversarial image inputs.

View on arXivView PDF

Code Implementations(1)

facebookresearch/multimodal-fusion-jailbreaksCommunity100%

Official repository for the paper "Gradient-based Jailbreak Images for Multimodal Fusion Models" (https//arxiv.org/abs/2410.03489)

211PythonOct 11, 20241 years agoNOASSERTION

Similar Papers

Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt

90% match1 repo612024

Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization

89% match2025

HTS-Attack: Heuristic Token Search for Jailbreaking Text-to-Image Models

89% match2024

Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models

89% match1 repo272026

White-box Multimodal Jailbreaks Against Large Vision-Language Models

88% match1 repo342024

Directional Embedding Smoothing for Robust Vision Language Models

88% match2026

Cite this paper

@article{rando2024gradientbased,
  title  = {Gradient-based Jailbreak Images for Multimodal Fusion Models},
  author = {Javier Rando and Hannah Korevaar and Erik Brinkman and Ivan Evtimov and Florian Tramèr},
  year   = {2024},
  eprint = {2410.03489},
  archivePrefix = {arXiv},
  url    = {http://arxiv.org/abs/2410.03489v2}
}

Add a badge to your README

Shows whether official code is linked for this paper.

Code of Paper badge
[![Code of Paper](https://codeofpaper.com/badge/2410.03489.svg)](https://codeofpaper.com/paper/2410.03489)

Discussion