Elamur Research⌕
☰
home / papers / 2026 / Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignment

Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignment

Paper · 2026 · Zhixue Song, Boyan Han, Yiwei Wang et al.

Summary

Vision-based context compression, as in DeepSeek-OCR and Glyph, renders long text as images so that a model needs fewer tokens. The authors ask whether this practice affects safety. They found that lowering rendering resolution makes multimodal LLMs much easier to jailbreak. They built 770 deduplicated harmful queries from three public benchmarks, wrapped them in a role-play jailbreak template, and rendered them at many DPI levels with the Glyph pipeline. Attack Success Rate follows an inverted-U curve as DPI drops. It peaks in an "Attack Comfort Zone" (ACZ), where text is still readable (OCR accuracy stays high) but refusals largely disappear. Noise, blur and geometric distortion produce similar effects. The authors' explanation is "Cognitive Overload": decoding hard-to-read input uses up capacity, so harmful meaning emerges too late for the shallow-layer safety mechanisms. As a fix, they propose "Structured Cognitive Offloading", a prompt that makes the model transcribe first, audit the text, then answer. This restores safety close to the high-resolution baseline. The work matters because it reveals a hidden cost of efficient long-context designs.

Key points

  • Benchmark and judging: 770 harmful queries were evaluated on models including Qwen3-VL, Doubao-seed-1.6 and GPT-4.1.
    • Jailbreaks were judged by DeepSeek-V3.2, Kimi-K2-0905 and GLM-4.6.
    • The three judges agreed on 95.9% of samples. The remaining 4.1% went to human review, where Cohen's κ between experts was 0.96.
  • Where the ACZ sits: The zone covers roughly DPI 45–90. A t-SNE analysis shows these inputs share a representation space with high-fidelity images (DPI 150–200), unlike noise-level inputs (DPI 15–30). This argues against an out-of-distribution explanation.
  • Ablations:
    • Padding ACZ images to the same token count as high-DPI inputs leaves ASR high (69.4% on Qwen3-VL), so the effect does not come from having fewer tokens.
    • ACZ inputs are more vulnerable even without jailbreak templates.
  • Defense results: The offloading prompt cut Qwen3-VL ASR from about 67.4% to 4%. On a 300-sample benign OCR-style subset, it caused no false refusals.
  • Limitations and code: The defense roughly doubles output length (+102%), which may limit real-time use. Code is available at github.com/Westlake-AGI-Lab/ACZ-Jailbreak.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Westlake UniversityHangzhou · China45 works · 8,028 citations🎓University of California, MercedMerced · United States11 works · 425 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Zhixue Song, Boyan Han, Yiwei Wang and Chi Zhang. 2026. Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignment. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.983

@inproceedings{song2026hard,
  title = {{Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignment}},
  author = {Zhixue Song, Boyan Han, Yiwei Wang and Chi Zhang},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.983},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.983}
}

References

31 references, 10 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2025a. Claude 4.5 haiku. Large language model, snapshot 2025-10-01. find
  2. Anthropic. 2025b. Claude 4.5 sonnet. Large language model, snapshot 2025-09-29. find
  3. Lei Bai, Zhongrui Cai, Maosong Cao, Weihan Cao, Chiyu Chen, Haojiong Chen, Kai Chen, Pengcheng Chen, Ying Chen, Yongkang Chen, Yu Cheng, Yu Cheng, Pei Chu, Tao Chu, Erfei Cui, Ganqu Cui, Long Cui, Ziyun Cui, Nianchen Deng, and 156 others. 2025a. Intern-s1: A scientific multimodal foundation model. P…
  4. Shuai Bai, Yuxuan Cai, Ruizhe Chen, Keqin Chen, Xionghui Chen, Zesen Cheng, Lianghao Deng, Wei Ding, Chang Gao, Chunjiang Ge, Wenbin Ge, Zhifang Guo, Qidong Huang, Jie Huang, Fei Huang, Binyuan Hui, Shutong Jiang, Zhaohai Li, Mingsheng Li, and 45 others. 2025b. Qwen3-vl technical report. arXiv prepr…
  5. Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2024. Image hijacks: adversarial images can control generative models at runtime. In Proceedings of the 41st International Conference on Machine Learning, ICML’24. JMLR.org. find
  6. Renmiao Chen, Shiyao Cui, Xuancheng Huang, Chengwei Pan, Victor Shea-Jay Huang, QingLin Zhang, Xuan Ouyang, Zhexin Zhang, Hongning Wang, and Minlie Huang. 2025. Jps: Jailbreak multimodal large language models with collaborative visual perturbation and textual steering. In Proceedings of the 33rd ACM… find
  7. Jiale Cheng, Yusen Liu, Xinyu Zhang, Yulin Fei, Wenyi Hong, Ruiliang Lyu, Weihan Wang, Zhe Su, Xiaotao Gu, Xiao Liu, Yushi Bai, Jie Tang, Hongning Wang, and Minlie Huang. 2025. Glyph: Scaling context windows via visual-text compression. arXiv preprint arXiv:2510.17800.
  8. Xuanming Cui, Alejandro Aparcedo, Young Kyun Jang, and Ser-Nam Lim. 2023. On the robustness of large multimodal models against image adversarial attacks. Preprint, arXiv:2312.03777. — [arXiv:2312.03777](https://arxiv.org/abs/2312.03777) find
  9. DeepSeek-AI. 2024. Deepseek-v3 technical report. Preprint, arXiv:2412.19437. find
  10. Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. How robust is google’s bard to adversarial image attacks? Preprint, arXiv:2309.11751. — [arXiv:2309.11751](https://arxiv.org/abs/2309.11751) find
  11. Google Gemini Team. 2025. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arXiv preprint arXiv:2507.06261.
  12. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the Thirty-Ninth AAAI Conference on Artificial Intelligence and Thirty-Seventh Confere… find
  13. Xiaowei Huang, Wenjie Ruan, Wei Huang, Gaojie Jin, Yi Dong, Changshun Wu, Saddek Bensalem, Ronghui Mu, Yi Qi, Xingyu Zhao, Kaiwen Cai, Yanghao Zhang, Sihao Wu, Peipei Xu, Dengyu Wu, Andre Freitas, and Mustafa A. Mustafa. 2023. A survey of safety and trustworthiness of large language models through t… find
  14. Shen Li, Liuyi Yao, Lan Zhang, and Yaliang Li. 2025. Safety layers in aligned large language models: The key to LLM security. In The Thirteenth International Conference on Learning Representations. find
  15. Tong Liu, Yingjie Zhang, Zhe Zhao, Yinpeng Dong, Guozhu Meng, and Kai Chen. 2024. Making them ask and answer: jailbreaking large language models in few queries via disguise and reconstruction. In Proceedings of the 33rd USENIX Conference on Security Symposium, SEC ’24, USA. USENIX Association. find
  16. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. In First Conference on Language Modeling. find
  17. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, David Forsyth, and Dan Hendrycks. 2024. Harmbench: a standardized evaluation framework for automated red teaming and robust refusal. In Proceedings of the 41st International Con…
  18. OpenAI. 2025. Gpt-4.1. Large language model, version 2025-04-14. find
  19. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the Thirty-Eighth AAAI Conference on Artificial Intelligence and Thirty-Sixth Conference on Innovative Application… find
  20. Zhengzhong Tu. 2025. Demystifying the visual quality paradox in multimodal large language models. arXiv preprint arXiv:2506.15645. — [arXiv:2506.15645](https://arxiv.org/abs/2506.15645) find
  21. Wei Zhao, Zhe Li, Yige Li, Ye Zhang, and Jun Sun. 2024. Defending large language models against jailbreak attacks via layer-specific editing. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 5094–5109, Miami, Florida, USA. Association for Computational Linguistics. find
  22. Weixiong Zheng, Peijian Zeng, YiWei Li, Hongyan Wu, Nankai Lin, Junhao Chen, Aimin Yang, and Yongmei Zhou. 2025. Jailbreaking? one step is enough! In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 11623–11642, Vienna, Austria. A… find
  23. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023a. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. Preprint, arXiv:2307.14539. find
  24. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models. arXiv preprint arXiv:2307.15043.
  25. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023b. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. Preprint, arXiv:2307.14539. find
  26. A ByteDance Seed Team. 2025. Seed 1.6: Pushing the frontiers of multimodal reasoning with adaptive chain-of-thought. Technical Report, ByteDance. Version doubao-seed-1.6-251015 released Oct 2025. find
  27. GLM Team, Aohan Zeng, Xin Lv, Qinkai Zheng, Zhenyu Hou, Bin Chen, Chengxing Xie, Cunxiang Wang, Da Yin, Hao Zeng, Jiajie Zhang, Kedong Wang, Lucen Zhong, Mingdao Liu, Rui Lu, Shulin Cao, Xiaohan Zhang, Xuancheng Huang, Yao Wei, and 152 others. 2025a. Glm-4.5: Agentic, reasoning, and coding (arc) fou…
  28. Kimi Team, Yifan Bai, Yiping Bao, Guanduo Chen, Jiahao Chen, Ningxin Chen, Ruijue Chen, Yanru Chen, Yuankun Chen, Yutian Chen, Zhuofu Chen, Jialei Cui, Hao Ding, Mengnan Dong, Angang Du, Chenzhuang Du, Dikang Du, Yulun Du, Yu Fan, and 150 others. 2025b. Kimi k2: Open agentic intelligence. Preprint,…
  29. V Team, Wenyi Hong, Wenmeng Yu, Xiaotao Gu, Guo Wang, Guobing Gan, Haomiao Tang, Jiale Cheng, Ji Qi, Junhui Ji, Lihang Pan, Shuaiqi Duan, Weihan Wang, Yan Wang, Yean Cheng, Zehai He, Zhe Su, Zhen Yang, Ziyang Pan, and 69 others. 2025c. Glm-4.5v and glm-4.1v-thinking: Towards versatile multimodal rea…
  30. Haoran Wei, Yaofeng Sun, and Yukun Li. 2025. Deepseek-ocr: Contexts optical compression. arXiv preprint arXiv:2510.18234.
  31. Shuo Xing, Lanqing Guo, Hongyuan Hua, Seoyoung Lee, Peiran Li, Yufei Wang, Zhangyang Wang, and Data Details find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/song-2026-hard-read-easy-jailbreak-how/