Elamur Research⌕
☰
home / papers / 2025 / Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection

Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection

Paper · 2025 · Miao Ziqi, Yi Ding, Lijun Li et al.

Summary

The paper argues that most image-based jailbreaks of multimodal LLMs use the picture as a trigger. They paint harmful text onto it, add adversarial noise, or generate a loosely related image, but the visual content rarely defines a coherent scenario. The authors introduce a vision-centric jailbreak setting, where the image must supply cues that the harmful request depends on. They then propose VisCo (Visual Contextual) Attack, a two-stage black-box pipeline. First, a red-team assistant model builds a fake multi-turn dialogue history around the image, using one of four vision-focused strategies and synthesizing extra images if needed. Second, the final prompt is iteratively refined so it hides its toxicity while staying faithful to the original intent. On MM-SafetyBench against GPT-4o, VisCo reaches roughly four times the baseline attack success rate. The work shows that fabricated, visually grounded conversation context is a serious weak spot in current MLLM safety alignment. This motivates defenses that inspect the whole dialogue history rather than only the final turn.

Key points

  • Main results on MM-SafetyBench:
    • Against GPT-4o, VisCo scores toxicity 4.78 and ASR 85%, versus 2.48 and 22.2% for the baseline.
    • On Gemini-2.0-Flash it reaches 4.88 and 91.07%.
  • Ablation on SafeBench-Tiny (GPT-4o target):
    • The full attack gives 50% ASR and toxicity 3.72.
    • Removing the fabricated context lowers ASR to 36%.
    • Removing the refinement step lowers ASR to 42%.
    • A 2-round context gives 42% ASR and a 4-round context gives 54%; 3 rounds is the default, balancing effectiveness and cost.
  • Red-team assistant choice:
    • The default assistant is Gemini-2.0-Flash-Thinking-Exp-01-21.
    • Replacing it with open-source Qwen2.5-72B-Instruct drops ASR from 76% to 68%, with toxicity nearly unchanged (4.60 vs 4.58).
    • Both clearly beat FigStep, which gets 12% ASR and toxicity 1.74.
  • Other evaluations: Open-source targets such as Qwen2.5-VL-72B-Instruct and InternVL2.5 were also tested, plus HarmBench multimodal behaviors (in the appendix). Code is released on GitHub.
  • Limitation: Context fabrication still relies on hand-designed strategy templates, which restricts scalability. The authors plan fully automatic context generation.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🔬Shanghai Artificial Intelligence LaboratoryShanghai · China117 works · 11,281 citations🎓Purdue University West LafayetteWest Lafayette · United States23 works · 1,417 citations

 Fields, topics and concepts

📚 Shelves 2The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Miao Ziqi, Yi Ding, Lijun Li and Jing Shao. 2025. Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection. Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2025.emnlp-main.487

@inproceedings{ziqi2025visual,
  title = {{Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection}},
  author = {Miao Ziqi, Yi Ding, Lijun Li and Jing Shao},
  booktitle = {Proceedings of the 2025 Conference on Empirical Methods in Natural Language Processing},
  year = {2025},
  doi = {10.18653/v1/2025.emnlp-main.487},
  url = {https://doi.org/10.18653/v1/2025.emnlp-main.487}
}

References

56 references, 14 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  2. Yangyi Chen, Karan Sikka, Michael Cogswell, Heng Ji, and Ajay Divakaran. 2024a. Dress: Instructing large vision-language models to align and interact with humans via natural language feedback. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 14239–14250. find
  3. Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shenglong Ye, Hao Tian, Zhaoyang Liu, and 1 others. 2024b. Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling. arXiv preprint arXiv:2412.05271.
  4. Cognitive Computations. 2023. Wizard-vicuna-13b-uncensored. https://huggingface.co/cognitivecomputations/Wizard-Vicuna-13B-Uncensored. ↗
  5. Chenhang Cui, Gelei Deng, An Zhang, Jingnan Zheng, Yicong Li, Lianli Gao, Tianwei Zhang, and Tat-Seng Chua. 2024. Safe+ safe= unsafe? exploring how safe images can be exploited to jailbreak large vision-language models. arXiv preprint arXiv:2411.11496. — [arXiv:2411.11496](https://arxiv.org/abs/2411.11496) find
  6. Aobotao Dai, Xinyu Ma, Lei Chen, Songze Li, and Lin Wang. 2025. When data manipulation meets attack goals: An in-depth survey of attacks for vlms. arXiv preprint arXiv:2502.06390. — [arXiv:2502.06390](https://arxiv.org/abs/2502.06390) find
  7. Yunkai Dang, Kaichen Huang, Jiahao Huo, Yibo Yan, Sirui Huang, Dongrui Liu, Mengxi Gao, Jie Zhang, Chen Qian, Kun Wang, and 1 others. 2024. Explainable and interpretable multimodal large language models: A comprehensive survey. arXiv preprint arXiv:2412.02104. — [arXiv:2412.02104](https://arxiv.org/abs/2412.02104) find
  8. Yi Ding, Bolian Li, and Ruqi Zhang. 2024. Eta: Evaluating then aligning safety of vision language models at inference time. arXiv preprint arXiv:2410.06625. — [arXiv:2410.06625](https://arxiv.org/abs/2410.06625) find
  9. Yi Ding, Lijun Li, Bing Cao, and Jing Shao. 2025. Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533. — [arXiv:2501.18533](https://arxiv.org/abs/2501.18533) find
  10. Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, and 1 others. 2024. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning. find
  11. Kuofeng Gao, Yang Bai, Jiawang Bai, Yong Yang, and Shu-Tao Xia. 2024. Adversarial robustness for visual grounding of multimodal large language models. arXiv preprint arXiv:2405.09981. — [arXiv:2405.09981](https://arxiv.org/abs/2405.09981) find
  12. Cem Anil, Esin Durmus, Nina Panickssery, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel Ford, and 1 others. 2024. Many-shot jailbreaking. Advances in Neural Information Processing Systems, 37:129696–129742. find
  13. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608. find
  14. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923. — Qwen2.5-VL Technical Report
  15. Xuhao Hu, Dongrui Liu, Hao Li, Xuanjing Huang, and Jing Shao. 2024. Vlsbench: Unveiling visual leakage in multimodal safety. arXiv preprint arXiv:2411.19939.
  16. Haibo Jin, Leyang Hu, Xinuo Li, Peiyan Zhang, Chonghan Chen, Jun Zhuang, and Haohan Wang. 2024. Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models. arXiv preprint arXiv:2407.01599. — [arXiv:2407.01599](https://arxiv.org/abs/2407.01599) find
  17. Martin Kuo, Jianyi Zhang, Aolin Ding, Qinsi Wang, Louis DiValentin, Yujia Bao, Wei Wei, Hai Li, and Yiran Chen. 2025. H-cot: Hijacking the chain-of-thought safety reasoning mechanism to jailbreak large reasoning models, including openai o1/o3, deepseek-r1, and gemini 2.0 flash thinking. arXiv prepri… — [arXiv:2502.12893](https://arxiv.org/abs/2502.12893) find
  18. Lijun Li, Bowen Dong, Ruohui Wang, Xuhao Hu, Wangmeng Zuo, Dahua Lin, Yu Qiao, and Jing Shao. 2024. Salad-bench: A hierarchical and comprehensive safety benchmark for large language models. arXiv preprint arXiv:2402.05044.
  19. Lijun Li, Zhelun Shi, Xuhao Hu, Bowen Dong, Yiran Qin, Xihui Liu, Lu Sheng, and Jing Shao. 2025. T2isafety: Benchmark for assessing fairness, toxicity, and privacy in image generation. arXiv preprint arXiv:2501.12612. — [arXiv:2501.12612](https://arxiv.org/abs/2501.12612) find
  20. Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024a. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296–26306.
  21. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual instruction tuning. Advances in neural information processing systems, 36:34892– 34916.
  22. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024b. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. Springer. find
  23. Yue Liu, Hongcheng Gao, Shengfang Zhai, Xia Jun, Tianyi Wu, Zhiwei Xue, Yulin Chen, Kenji Kawaguchi, Jiaheng Zhang, and Bryan Hooi. 2025a. Guardreasoner: Towards reasoning-based llm safeguards. arXiv preprint arXiv:2501.18492. — [arXiv:2501.18492](https://arxiv.org/abs/2501.18492) find
  24. Yue Liu, Xiaoxin He, Miao Xiong, Jinlan Fu, Shumin Deng, and Bryan Hooi. 2024c. Flipattack: Jailbreak llms via flipping. arXiv preprint arXiv:2410.02832. — [arXiv:2410.02832](https://arxiv.org/abs/2410.02832) find
  25. Yue Liu, Shengfang Zhai, Mingzhe Du, Yulin Chen, Tri Cao, Hongcheng Gao, Cheng Wang, Xinfeng Li, Kun Wang, Junfeng Fang, Jiaheng Zhang, and Bryan Hooi. 2025b. Guardreasoner-vl: Safeguarding vlms via reinforced reasoning. arXiv preprint arXiv:2505.11049. — [arXiv:2505.11049](https://arxiv.org/abs/2505.11049) find
  26. Chaochao Lu, Chen Qian, Guodong Zheng, Hongxing Fan, Hongzhi Gao, Jie Zhang, Jing Shao, Jingyi Deng, Jinlan Fu, Kexin Huang, and 1 others. 2024. From gpt-4 to gemini and beyond: Assessing the landscape of mllms on generalizability, trustworthiness and causality through four modalities. arXiv preprin… — [arXiv:2401.15071](https://arxiv.org/abs/2401.15071) find
  27. Mantas Mazeika, Long Phan, Xuwang Yin, Andy Zou, Zifan Wang, Norman Mu, Elham Sakhaee, Nathaniel Li, Steven Basart, Bo Li, and 1 others. 2024. Harmbench: A standardized evaluation framework for automated red teaming and robust refusal. arXiv preprint arXiv:2402.04249.
  28. Wenlong Meng, Fan Zhang, Wendao Yao, Zhenyuan Guo, Yuwei Li, Chengkun Wei, and Wenzhi Chen. 2025. Dialogue injection attack: Jailbreaking llms through context manipulation. arXiv preprint arXiv:2503.08195. — [arXiv:2503.08195](https://arxiv.org/abs/2503.08195) find
  29. Ziqi Miao, Lijun Li, Yuan Xiong, Zhenhua Liu, Pengyu Zhu, and Jing Shao. 2025. Response attack: Exploiting contextual priming to jailbreak large language models. arXiv preprint arXiv:2507.05248. — [arXiv:2507.05248](https://arxiv.org/abs/2507.05248) find
  30. Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. Mllm-protector: Ensuring mllm’s safety without hurting performance. arXiv preprint arXiv:2401.02906.
  31. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536. find
  32. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693.
  33. Salman Rahman, Liwei Jiang, James Shiffer, Genglin Liu, Sheriff Issaka, Md Rizwan Parvez, Hamid Palangi, Kai-Wei Chang, Yejin Choi, and Saadia Gabriel. 2025. X-teaming: Multi-turn jailbreaks and defenses with adaptive multi-agents. arXiv preprint arXiv:2504.13203. — [arXiv:2504.13203](https://arxiv.org/abs/2504.13203) find
  34. Qibing Ren, Hao Li, Dongrui Liu, Zhanxu Xie, Xiaoya Lu, Yu Qiao, Lei Sha, Junchi Yan, Lizhuang Ma, and Jing Shao. 2024. Derail yourself: Multi-turn llm jailbreak attack through self-discovered clues. arXiv preprint arXiv:2410.10700. — [arXiv:2410.10700](https://arxiv.org/abs/2410.10700) find
  35. Mark Russinovich and Ahmed Salem. 2025. Jailbreaking is (mostly) simpler than you think. arXiv preprint arXiv:2503.05264. — [arXiv:2503.05264](https://arxiv.org/abs/2503.05264) find
  36. Mark Russinovich, Ahmed Salem, and Ronen Eldan. 2024. Great, now write an article about that: The crescendo multi-turn llm jailbreak attack. arXiv preprint arXiv:2404.01833. find
  37. Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, and 1 others. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530.
  38. Kimi Team, Angang Du, Bohong Yin, Bowei Xing, Bowen Qu, Bowen Wang, Cheng Chen, Chenlin Zhang, Chenzhuang Du, Chu Wei, and 1 others. 2025. Kimi-vl technical report. arXiv preprint arXiv:2504.07491.
  39. Ziyi Zhang, Zhen Sun, Zongmin Zhang, Jihui Guo, and Xinlei He. 2025. Fc-attack: Jailbreaking large vision-language models via auto-generated flowcharts. arXiv preprint arXiv:2502.21059. — [arXiv:2502.21059](https://arxiv.org/abs/2502.21059) find
  40. Jason Vega, Isha Chaudhary, Changming Xu, and Gagandeep Singh. 2023. Bypassing the safety training of open-source llms with priming attacks. arXiv preprint arXiv:2312.12321. — [arXiv:2312.12321](https://arxiv.org/abs/2312.12321) find
  41. Shiji Zhao, Ranjie Duan, Fengxiang Wang, Chi Chen, Caixin Kang, Jialing Tao, YueFeng Chen, Hui Xue, and Xingxing Wei. 2025. Jailbreaking multimodal large language models via shuffle inconsistency. arXiv preprint arXiv:2501.04931. — [arXiv:2501.04931](https://arxiv.org/abs/2501.04931) find
  42. Cheng Wang, Yue Liu, Baolong Li, Duzhen Zhang, Zhongzhi Li, and Junfeng Fang. 2025. Safety in large reasoning models: A survey. arXiv preprint arXiv:2504.17704. find
  43. Kaiwen Zhou, Chengzhi Liu, Xuandong Zhao, Anderson Compalas, Dawn Song, and Xin Eric Wang. 2024a. Multimodal situational safety. arXiv preprint arXiv:2410.06172. — [arXiv:2410.06172](https://arxiv.org/abs/2410.06172) find
  44. Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuanjing Huang. 2024a. Cross-modality safety alignment. arXiv preprint arXiv:2406.15279. — [arXiv:2406.15279](https://arxiv.org/abs/2406.15279) find
  45. Zhenhong Zhou, Jiuyang Xiang, Haopeng Chen, Quan Liu, Zherui Li, and Sen Su. 2024b. Speak out of turn: Safety vulnerability of large language models in multi-turn dialogue. arXiv preprint arXiv:2402.17262. — [arXiv:2402.17262](https://arxiv.org/abs/2402.17262) find
  46. Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. 2024b. Jailbreak large visual language models through multi-modal linkage. arXiv preprint arXiv:2412.00473. — [arXiv:2412.00473](https://arxiv.org/abs/2412.00473) find
  47. Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023. Jailbreak and guard aligned language models with only few in-context demonstrations. arXiv preprint arXiv:2310.06387.
  48. Zixuan Weng, Xiaolong Jin, Jinyuan Jia, and Xiangyu Zhang. 2025. Foot-in-the-door: A multi-turn jailbreak for llms. arXiv preprint arXiv:2502.19820. find
  49. Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Yuchen Duan, Hao Tian, Weijie Su, Jie Shao, and 1 others. 2025. Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models. arXiv preprint arXiv:2504.10479.
  50. Yongshuo Zong, Ondrej Bohdal, Tingyang Yu, Yongxin Yang, and Timothy Hospedales. 2024. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207. find
  51. Tianyi Xiong, Bo Li, Dong Guo, Huizhuo Yuan, Quanquan Gu, and Chunyuan Li. 2024. Llava-onevision-chat: Improving chat with preference learning. find
  52. An Yang, Baosong Yang, Beichen Zhang, Binyuan Hui, Bo Zheng, Bowen Yu, Chengyuan Li, Dayiheng Liu, Fei Huang, Haoran Wei, and 1 others. 2024a. Qwen2. 5 technical report. arXiv e-prints, pages arXiv–2412. find
  53. Xikang Yang, Xuehai Tang, Songlin Hu, and Jizhong Han. 2024b. Chain of attack: a semantic-driven contextual multi-turn attacker for llm. arXiv preprint arXiv:2405.05610. — [arXiv:2405.05610](https://arxiv.org/abs/2405.05610) find
  54. Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Changyu Dong, and 1 others. 2025. Distraction is all you need for multimodal large language model jailbreaking. arXiv preprint arXiv:2502.10794. — [arXiv:2502.10794](https://arxiv.org/abs/2502.10794) find
  55. Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. 2025. A survey of safety on large vision-language models: Attacks, defenses and evaluations. arXiv preprint arXiv:2502.14881. — [arXiv:2502.14881](https://arxiv.org/abs/2502.14881) find
  56. Jie Zhang, Dongrui Liu, Chen Qian, Ziyue Gan, Yong Liu, Yu Qiao, and Jing Shao. 2024. The better angels of machine personality: How personality relates to llm safety. arXiv preprint arXiv:2407.12344. — [arXiv:2407.12344](https://arxiv.org/abs/2407.12344) find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/ziqi-2025-visual-contextual-attack-jailbreaking-mllms/