← 研踪 PaperTrailarXiv:2605.05709 · v2
Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs
首次提交 2026-05-07 13:54
版本更新 2026-11-08 13:43
雷达观测 2026-11-10 12:16
摘要
Intent-obfuscation-based jailbreak attacks on multimodal large language models (MLLMs) transform a harmful query into a concealed multimodal input to bypass safety mechanisms. We study these attacks through the lens of a reconstruction-concealment tradeoff: the transformed input must sufficiently obscure harmful intent while preserving enough information for the victim model to recover the underlying request. Through a reconstruction and concealment analysis of representative black-box methods, we find that existing transformations struggle to balance this tradeoff, limiting their effectiveness. In contrast, we show that character-removed variants, constructed by randomly removing characters from the original query, achieve a better balance, motivating their use as the basis for our attack construction. Building on this observation, we propose concealment-aware variant construction, which selects character-removed variants with low harmful keyword/phrase alignment and high mutual diversity, and instantiates them through five prompting strategies that distribute the transformed information across text and image channels. We further introduce keyword/phrase-related distractor images that depict the harmful concept in diverse contexts, providing more effective distraction than generic distractor images. Experiments across diverse closed-source and open-source MLLMs show that the proposed strategies substantially outperform the evaluated baselines. Code and reproduction instructions are available at https://github.com/Farhamdur/CRJ.
作者备注：NeurIPS 2026 camera-ready version; 43 pages, including appendices
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v2 · 2026-11-08 13:43 · 最新观测版本
Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs
Intent-obfuscation-based jailbreak attacks on multimodal large language models (MLLMs) transform a harmful query into a concealed multimodal input to bypass safety mechanisms. We study these attacks through the lens of a reconstruction-concealment tradeoff: the transformed input must sufficiently obscure harmful intent while preserving enough information for the victim model to recover the underlying request. Through a reconstruction and concealment analysis of representative black-box methods, we find that existing transformations struggle to balance this tradeoff, limiting their effectiveness. In contrast, we show that character-removed variants, constructed by randomly removing characters from the original query, achieve a better balance, motivating their use as the basis for our attack construction. Building on this observation, we propose concealment-aware variant construction, which selects character-removed variants with low harmful keyword/phrase alignment and high mutual diversity, and instantiates them through five prompting strategies that distribute the transformed information across text and image channels. We further introduce keyword/phrase-related distractor images that depict the harmful concept in diverse contexts, providing more effective distraction than generic distractor images. Experiments across diverse closed-source and open-source MLLMs show that the proposed strategies substantially outperform the evaluated baselines. Code and reproduction instructions are available at https://github.com/Farhamdur/CRJ.
查看此版本解读 →查看此版本原文 ↗