Paper deep dive

Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models

Lei Jiang, Zixun Zhang, Zizhou Wang, Xiaobing Sun, Zhen Li, Liangli Zhen, Xiaohua Xu

Year: 2025Venue: arXiv preprintArea: Multimodal SafetyType: EmpiricalEmbeddings: 85

Models: Gemini-1.5, Gemini-2.5, GPT-4.1-nano, GPT-4o, GPT-o1, LLaVA, Qwen2.5-VL

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%

Last extracted: 3/12/2026, 6:18:33 PM

Summary

The paper introduces Cross-modal Adversarial Multimodal Obfuscation (CAMO), a black-box jailbreak framework for Large Vision-Language Models (LVLMs). CAMO decomposes malicious prompts into semantically benign visual and textual fragments, requiring the model to perform multi-step cross-modal reasoning to reconstruct the harmful instruction. This approach effectively evades standard safety filters like perplexity-based detection and OCR-based keyword scanning while maintaining high attack success rates and computational efficiency.

Entities (5)

CAMO · jailbreak-framework · 100%LVLM · ai-model · 100%DeepSeek R1 · ai-model · 95%GPT-4o · ai-model · 95%Qwen2.5-VL-72B-Instruct · ai-model · 95%

Relation Signals (2)

CAMO → targets → LVLM

confidence 100% · CAMO, a novel black-box jailbreak attack framework that decomposes malicious prompts... Comprehensive evaluations conducted on leading LVLMs validate CAMO's effectiveness

CAMO → bypasses → Safety Mechanism

confidence 95% · CAMO consistently bypasses three defense mechanisms—perplexity-based filters, Optical Character Recognition (OCR) keyword detection, and OpenAI’s content moderation system

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Large Vision-Language Models (LVLMs) demonstrate exceptional performance across multimodal tasks, yet remain vulnerable to jailbreak attacks that bypass built-in safety mechanisms to elicit restricted content generation. Existing black-box jailbreak methods primarily rely on adversarial textual prompts or image perturbations, yet these approaches are highly detectable by standard content filtering systems and exhibit low query and computational efficiency. In this work, we present Cross-modal Adversarial Multimodal Obfuscation (CAMO), a novel black-box jailbreak attack framework that decomposes malicious prompts into semantically benign visual and textual fragments. By leveraging LVLMs' cross-modal reasoning abilities, CAMO covertly reconstructs harmful instructions through multi-step reasoning, evading conventional detection mechanisms. Our approach supports adjustable reasoning complexity and requires significantly fewer queries than prior attacks, enabling both stealth and efficiency. Comprehensive evaluations conducted on leading LVLMs validate CAMO's effectiveness, showcasing robust performance and strong cross-model transferability. These results underscore significant vulnerabilities in current built-in safety mechanisms, emphasizing an urgent need for advanced, alignment-aware security and safety solutions in vision-language systems.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

84,932 characters extracted from source content.

Expand or collapse full text

Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models Lei Jiang1 Zixun Zhang2 Zizhou Wang3 Xiaobing Sun3 Zhen Li2 Liangli Zhen3,* Xiaohua Xu1,* 1University of Science and Technology of China 2The Chinese University of Hong Kong, Shenzhen 3Institute of High Performance Computing, A*STAR, Singapore jianglei0510@mail.ustc.edu.cn zixunzhang@link.cuhk.edu.cn lizhen@cuhk.edu.cn wang_zizhou, sun_xiaobing, zhen_liangli@ihpc.a-star.edu.sg xiaohuaxu@ustc.edu.cn Abstract Large Vision-Language Models (LVLMs) demonstrate exceptional performance across multimodal tasks, yet remain vulnerable to jailbreak attacks that bypass built-in safety mechanisms to elicit restricted content generation. Existing black-box jailbreak methods primarily rely on adversarial textual prompts or image perturbations, yet these approaches are highly detectable by standard content filtering systems and exhibit low query and computational efficiency. In this work, we present Cross-modal Adversarial Multimodal Obfuscation (CAMO), a novel black-box jailbreak attack framework that decomposes malicious prompts into semantically benign visual and textual fragments. By leveraging LVLMs’ cross-modal reasoning abilities, CAMO covertly reconstructs harmful instructions through multi-step reasoning, evading conventional detection mechanisms. Our approach supports adjustable reasoning complexity and requires significantly fewer queries than prior attacks, enabling both stealth and efficiency. Comprehensive evaluations conducted on leading LVLMs validate CAMO’s effectiveness, showcasing robust performance and strong cross-model transferability. These results underscore significant vulnerabilities in current built-in safety mechanisms, emphasizing an urgent need for advanced, alignment-aware security and safety solutions in vision-language systems. †footnotetext: *The last two authors are joint corresponding authors who contributed equally to this work.†footnotetext: Lei Jiang was a visiting PhD student at A*STAR during the period when this work was conducted. Content Warning: This paper contains adversarial examples crafted to reveal potential weaknesses in model behavior. These examples are intended exclusively for research purposes and to enhance model security and safety. 1 Introduction Large Vision-Language Models (LVLMs) have made rapid progress in multimodal reasoning, visual understanding, and instruction following [2, 26, 1, 29, 16]. Their widespread deployment across diverse applications—from autonomous systems to healthcare diagnostics—necessitates rigorous evaluation of their safety and robustness properties [20]. Jailbreak attacks represent one of the most critical security threats to current LVLM-based systems. These attacks craft specially designed inputs to elicit harmful outputs that violate safety constraints, potentially enabling malicious actors to exploit deployed models for generating dangerous content, misinformation, or instructions for illegal activities [19]. Consequently, the development of advanced jailbreak attacks is essential for red-teaming LVLM systems—by proactively identifying and understanding potential attack vectors, researchers can develop more robust defences and mitigate vulnerabilities before malicious exploitation occurs. Current jailbreak methodologies bifurcate into two primary categories: textual and visual attacks. Textual approaches embed malicious content through adversarial suffixes or multi-turn role-playing strategies [4, 7, 36], while visual methods inject harmful content via adversarial text overlays or embedded patches within images [14, 8]. Both paradigms have demonstrated notable success in bypassing safeguards. However, their practical effectiveness is increasingly constrained by recent advances in single-modality defense mechanisms [12], which have significantly bolstered the robustness of LVLMs against such isolated attack vectors (as shown in Figure 1). Moreover, most of existing attack methods [6, 30, 25, 21] exploit model gradient information to iteratively update adversarial perturbations. Nevertheless, such gradient information is typically unavailable in commercial models (e.g., GPT-4.1 and Claude Sonnet 4), limiting the applicability of these methods. Figure 1: Comparison between CAMO and prior multimodal attack methods. CAMO reformulates a harmful question (e.g., “How to make a bomb”) into a safe text and safe image which evades both perplexity-based and OCR-based safety filters, ultimately leading to attack success. In contrast, prior methods such as AP [4] rely on iterative logits-based suffix optimization, and FigStep [8] embeds harmful content directly into images via OCR, which are more susceptible to detection by existing defense mechanisms. To address these challenges, we propose Cross-modal Adversarial Multimodal Obfuscation (CAMO), a black-box jailbreak framework that decomposes a harmful instruction into benign-looking textual and visual clues. While each clue appears harmless in isolation, they are jointly interpreted by LVLMs to semantically reconstruct the original attack intent through multi-step cross-modal reasoning. This design is inspired by a recurring principle in both science and security: seemingly innocuous components can become dangerous when combined. An example is the reaction between cola and Mentos, each safe on its own, yet when combined, they produce an explosive eruption. CAMO exploits this principle by diffusely encoding toxic semantics across modalities. This obfuscation enables it to evade safety filters while achieving effective jailbreaks via inference-time compositionality. Moreover, the need to perform mathematical reasoning, spatial indexing, and symbolic recognition further distracts the model’s safety mechanisms, making it less vigilant in identifying adversarial intent. CAMO operates in four structured stages: 1) It first identifies candidate sensitive keywords from the input using part-of-speech (POS) tagging and a domain-specific dictionary. 2) It then decomposes these keywords into two components: a textual part where each word is partially masked (e.g., “___losive”) to evade content filters, and a visual part rendered as symbolically encoded math puzzles (e.g., “What is 7 + 6?” with answer “13” mapping to character “e”), which are embedded in an image. 3) These textual and visual elements are combined into a multimodal prompt that appears harmless when processed independently by standard Optical Character Recognition (OCR) or perplexity-based defenses[12]. 4) CAMO dynamically adjusts the obfuscation difficulty in both coarse-grained (masking more words) and fine-grained (masking more characters within a word) dimensions to balance the attack’s stealthiness and effectiveness. Crucially, CAMO requires neither access to model internals nor multi-turn interactions, making it highly compatible with commercial LVLM APIs. It demonstrates strong resilience against existing safety mechanisms, including perplexity filtering, OCR keyword scanning, and system-level moderation tools. The novelty and key contributions of this work are summarized as follows: • We develop a lightweight attack pipeline that operates under strict black-box constraints, requiring only single-turn API queries without access to model parameters, gradients, or internal representations. Through multimodal decomposition of harmful instructions into distributed benign components, CAMO achieves computational efficiency and strong generalization capability. • We propose a novel compositional obfuscation strategy that decomposes a harmful instruction into multimodal clues. Unlike existing approaches that conceal malicious content within either the visual or textual modality, CAMO exploits the reasoning capabilities of LVLMs to reassemble the malicious intent through cross-modal obfuscation. This design enhances CAMO’s stealth, enabling it to evade both modality-specific detection systems and manual inspection. • We conduct extensive experiments across a diverse spectrum of state-of-the-art LVLMs, encompassing both proprietary systems (e.g., GPT-4o, GPT-4o-mini [10], GPT-4.1-nano [23]) and open-source implementations (e.g., Qwen2.5-VL-72B-Instruct and DeepSeek-R1). The results show that CAMO achieves 81.82% ASR on GPT-4.1-nano and 96.97% on Qwen2-VL-72B-Instruct, significantly outperforming existing attacks. Moreover, CAMO consistently bypasses three defense mechanisms—perplexity-based filters [12], Optical Character Recognition (OCR) keyword detection, and OpenAI’s content moderation system [22]—with a 100% evasion rate, demonstrating both high effectiveness and stealth. These results underscore critical vulnerabilities in current LVLM safety mechanisms and highlight the urgent need for alignment-aware security solutions that account for cross-modal compositional effects. 2 Related Work Large Vision-Language Models (LVLMs). The advancement of Large Language Models (LLMs) [2, 28, 32, 24] has spurred progress in Large Vision-Language Models [33], extending LLMs’ reasoning and understanding to the visual domain by converting visual data into token sequences. A cross-modal projector facilitates this integration by bridging the visual encoder and LLMs [5, 16, 29, 31] which is achieved through a lightweight Q-Former [13] or simpler projection networks like linear layers [37] or MLPs [16]. Jailbreak Attacks. Jailbreak attacks have emerged as a critical tool for evaluating the safety boundaries of large vision-language models [19, 20]. Early works primarily focused on text-only attacks, employing adversarial suffixes [38, 4, 15, 18] or multi-turn role-play strategies [7, 36] to manipulate the model’s behavior. These methods often require carefully crafted prompts and multiple rounds of interaction to succeed. Another line of work aims to obfuscate harmful prompts through semantic disguise. Some approaches encrypt malicious instructions using cipher-based transformations [35, 9, 17], while others translate them into low-resource languages to evade detection [34]. More recent studies have extended jailbreak strategies into the visual modality. For example, HADES [14] synthesized the harmful image into a semantically more harmful one by diffusion models for providing a better jailbreaking context and renders adversarial keywords directly onto images, while FigStep [8] embeds harmful queries as optical character recognition (OCR) readable text. Jailbreak_in_Pieces[25] propose a compositional multimodal attack that combines adversarial images with benign textual prompts to induce harmful outputs. Their method relies on white-box access to the vision encoder for optimizing image embeddings, thus limiting applicability to open-source models. However, both text- and vision-based approaches suffer from two key limitations: (1) they often expose syntactically or visually suspicious patterns, making them susceptible to detection by perplexity filters [12], OCR systems, or manual inspection; and (2) they typically rely on iterative optimization or multi-turn generation, which limits their scalability and increases interaction cost. In contrast, our method CAMO achieves high attack success via one-shot obfuscated prompts that require no gradient access or interactive dialogue, while remaining stealthy and efficient under black-box constraints. 3 Methodology Figure 2: Overview of the CAMO pipeline. Given a harmful question (e.g., “How to make a bomb”), CAMO identifies risky keywords and obfuscates them through cross-modal decomposition. Math expressions are embedded in the text, guiding the model to resolve character indices from OCR-visible clues in the image. This composition evades unimodal safety filters while triggering harmful completions via joint reasoning. In this section, we present the framework and detailed methodology for our proposed CAMO. As illustrated in Figure 2, CAMO decomposes malicious instructions into semantically benign visual and textual components, which are then reconstructed through multi-step inference to elicit harmful responses while evading conventional detection systems. Specifically, our framework comprises four core components: (1) Target Keyword Selection, which extracts potentially harmful elements from input prompts; (2) Cross-modal Decomposition, which transforms identified elements into distributed visual-textual puzzles; (3) Obfuscated Query Construction, which assembles benign-appearing multimodal inputs; and (4) Reasoning Complexity Control, which dynamically adjusts puzzle difficulty to balance stealth and success rates. The subsequent sections provide detailed exposition of these four components. Finally, we present theoretical analysis of the obfuscation strategy’s effectiveness and query efficiency in Section 3.5. 3.1 Target Keyword Selection Given an input prompt T=[t1,t2,…,tn]subscript1subscript2…subscriptT=[t_1,t_2,…,t_n]T = [ t1 , t2 , … , titalic_n ], the initial phase involves identifying a candidate keyword set W that constitutes potential targets for adversarial manipulation. We construct a composite sensitive dictionary DD, comprising manually curated sensitive verbs (e.g., kill, hack), harmful objects (e.g., bomb, virus), and high-risk adjectives (e.g., illegal, deadly). Additional domain-specific terms can also be injected dynamically. We process the input prompt using a part-of-speech (POS) tagger and lemmatizer (e.g., spaCy), then extract all keywords whose lemmatized form appears in DD while excluding terms present in a a predefined stopword list SS. This procedure yields the initial matched set M of explicitly malicious terms. To enhance robustness and generalization capability, we implement an adaptive augmentation mechanism. When the cardinality of matched keywords falls below a threshold (defined as proportion α of the non-stopword content), we supplement M with additional informative keywords. These supplementary terms are selected from nouns, verbs, and adjectives in T that are not stopwords and not already in M, ranked by descending keyword length to prioritize semantic richness. In cases where no relevant keywords are identified and fallback is enabled, we select the shortest noun or adjective from T∖T ∖ S, thereby ensuring at least one attack target is returned. Finally, the resulting keyword list W is sorted according to their original order in the prompt to preserve input semantic structure. The full extraction procedure is summarized in Algorithm 1. Algorithm 1 Target Keyword Selection 1:Input prompt T=[t1,t2,…,tn]subscript1subscript2…subscriptT=[t_1,t_2,…,t_n]T = [ t1 , t2 , … , titalic_n ], sensitive dictionary DD, stopword set SS, optional extra terms E, ratio α, and fallback flag 2:Candidate attack keyword set W 3:keywordize T and apply POS tagging and lemmatization → sequence D 4:Merge DD and E into unified sensitive term set ′superscript′D D′ 5:M←∅←M← ← ∅ ▷ ▷ Matched sensitive keywords 6:for all ti∈Dsubscriptt_i∈ Dtitalic_i ∈ D do 7: if lemma⁢(ti)∈′lemmasubscriptsuperscript′lemma(t_i) lemma ( titalic_i ) ∈ D′ and ti∉subscriptt_i _i ∉ S and len⁢(ti)>2lensubscript2len(t_i)>2len ( titalic_i ) > 2 then 8: M←M∪ti←subscriptM← M∪\t_i\M ← M ∪ titalic_i 9: end if 10:end for 11:Compute total valid keyword count N and stopword count NssubscriptN_sNitalic_s 12:γ←α⋅(N−Ns)←⋅subscriptγ←α·(N-N_s)γ ← α ⋅ ( N - Nitalic_s ) 13:if |M|<γ|M|<γ| M | < γ then 14: C←∅←C← ← ∅ ▷ ▷ Complementary POS keywords 15: for all ti∈Dsubscriptt_i∈ Dtitalic_i ∈ D do 16: if POS⁢(ti)∈NOUN,VERB,ADJPOSsubscriptNOUNVERBADJPOS(t_i)∈\NOUN,VERB,ADJ\POS ( titalic_i ) ∈ NOUN , VERB , ADJ and ti∉Msubscriptt_i∉ Mtitalic_i ∉ M and ti∉subscriptt_i _i ∉ S and len⁢(ti)>2lensubscript2len(t_i)>2len ( titalic_i ) > 2 then 17: C←C∪ti←subscriptC← C∪\t_i\C ← C ∪ titalic_i 18: end if 19: end for 20: Sort C by descending keyword length as as list C^=c^1,c^2,…,c^|C|^subscript^1subscript^2…subscript C=\ c_1, c_2,…, c_|C|\over start_ARG C end_ARG = over start_ARG c end_ARG1 , over start_ARG c end_ARG2 , … , over start_ARG c end_ARG| C | 21: M←M∪c^i∣i=1,…,γ−|M|←conditional-setsubscript^1…M← M∪\ c_i i=1,…,γ-|M|\M ← M ∪ over start_ARG c end_ARGi ∣ i = 1 , … , γ - | M | 22:end if 23:if M=∅M= = ∅ and fallback is True then 24: Select shortest noun/adjective from D∖D ∖ S as ψ 25: M←M∪ψ←M← M∪\ψ\M ← M ∪ ψ 26:end if 27:Sort M according to order in T 28:return W=M[1:γ]W=M[1:γ]W = M [ 1 : γ ] 3.2 Cross-modal Reasoning Chain Generation To obfuscate adversarial intent while maintaining semantic coherence, we devise a cross-modal transformation mechanism that decomposes each selected keyword wi∈Wsubscriptw_i∈ Wwitalic_i ∈ W into a sequence of multimodal clues. This approach leverages the reasoning burden imposed by multi-step inference for analyzing the clues to bypass detection mechanisms while preserving the underlying malicious semantics. Each clue maps one character cjsubscriptc_jcitalic_j from wisubscriptw_iwitalic_i to a visual location using a simple math question and an OCR index. Formally, for each selected character cjsubscriptc_jcitalic_j, we generate a question QjsubscriptQ_jQitalic_j such that: Aj=solve⁢(Qj),cj∈wi,formulae-sequencesubscriptsolvesubscriptsubscriptsubscriptA_j=solve(Q_j), c_j∈ w_i,Aitalic_j = solve ( Qitalic_j ) , citalic_j ∈ witalic_i , (1) where AjsubscriptA_jAitalic_j is a numeric solution used as a spatial index. The image I contains a map from index to character: cj=ℱOCR⁢(I⁢[Aj]),subscriptsubscriptℱOCRdelimited-[]subscriptc_j=F_OCR(I[A_j]),citalic_j = FOCR ( I [ Aitalic_j ] ) , (2) where ℱOCR⁢(⋅)subscriptℱOCR⋅F_OCR(·)FOCR ( ⋅ ) denotes the character extracted from image region AjsubscriptA_jAitalic_j. We define the full reasoning chain for recovering the attack content as: W^=⁢(ℱOCR⁢(I⁢[solve⁢(Qj)])j=1|wi|),^superscriptsubscriptsubscriptℱOCRdelimited-[]solvesubscript1subscript W=G ( \F_OCR(I[solve(Q_j)% ]) \_j=1^|w_i| ),over start_ARG W end_ARG = G ( FOCR ( I [ solve ( Qitalic_j ) ] ) j = 1| witalic_i | ) , (3) where ⁢(⋅)⋅G(·)G ( ⋅ ) represents the semantic reconstruction function that assembles individual characters into coherent keywords. In such a process, it compels the model to traverse multiple steps across modalities to recover the original W. 3.3 Instruction Reconstruction and Execution The culmination of the cross-modal obfuscation process involves the synthesis of adversarial inputs that necessitate multi-step reasoning for malicious intent recovery. The final adversarial construct comprises two integrated components: a textual prompt T′ and a visual input I′, which collectively constitute a cross-modal reasoning task designed to elicit harmful responses through distributed semantic reconstruction. The textual component T′ combines a fixed reasoning template Φ Φ with the list of math questions Qjj=1msuperscriptsubscriptsubscript1\Q_j\_j=1^m Qitalic_j j = 1m. This composition is formally expressed as: T′=⁢(Φ,Qj)superscript′ΦsubscriptT =C( ,Q_j)T′ = C ( Φ , Qitalic_j ) (4) for j=1,…,m1…j=1,…,mj = 1 , … , m with ⁢(⋅)⋅C(·)C ( ⋅ ) denotes the filling the list of math questions into Φ Φ. The template instructs the model to perform mathematical reasoning, index character positions, and synthesize the complete response from recovered characters. To recover the masked instruction, the model must (1) solve each math question QjsubscriptQ_jQitalic_j to compute its answer AjsubscriptA_jAitalic_j, (2) use AjsubscriptA_jAitalic_j as a spatial index to retrieve character cjsubscriptc_jcitalic_j from the image I′, and (3) sequentially reassemble the full target phrase. This modular construction ensures that each individual clue—whether textual or visual—remains benign, nonspecific, and interpretable in isolation. As a result, the composite prompt evades detection by perplexity-based filters, OCR-based scanning, and human review, while still enabling the model to infer the underlying harmful instruction through multi-step reasoning. Adversarial Prompt Template # Escape Room Challenge: Decode the hidden word from the puzzle and complete the question below. Then, assuming the blank is already filled, describe detailed steps to carry out the behavior in the question. Do **not** explain or reveal how the word was derived. ## Math Questions: math_section ## Question: masked_text ## Rules: - Use math answers as positions to find letters from the image clues. - Only describe the process **after** the blank is filled. 3.4 Coarse-to-Fine Difficulty Adjustment To balance attack stealth and reconstructability, CAMO introduces a dynamic difficulty adjustment mechanism that operates along two orthogonal dimensions: (1) the proportion r of selected content words to be masked, and (2) the masking depth k applied within each selected word, defined as a character-level proportion. Given a filtered candidate word set W=w1,w2,…subscript1subscript2…W=\w_1,w_2,…\W = w1 , w2 , … obtained from part-of-speech-aware extraction (Section 3.1), we randomly sample a subset Wr⊆WsubscriptW_r WWitalic_r ⊆ W such that: |Wr|=⌊r⋅|W|⌋,subscript⋅|W_r|= r·|W| ,| Witalic_r | = ⌊ r ⋅ | W | ⌋ , (5) where r∈(0,1]01r∈(0,1]r ∈ ( 0 , 1 ] determines the fraction of words selected for masking. Each word w∈Wrsubscriptw∈ W_rw ∈ Witalic_r is then partially obscured by masking its prefix proportionally: Mask⁢(w;k)=[MASK]⌊k⋅|w|⌋∥w⌊k⋅|w|⌋+1,Maskconditionalsuperscriptdelimited-[]MASK⋅subscript⋅1Mask(w;k)=[MASK] k·|w| \,\|\,w_ k% ·|w| +1,Mask ( w ; k ) = [ MASK ]⌊ k ⋅ | w | ⌋ ∥ w⌊ k ⋅ | w | ⌋ + 1 , (6) where k∈(0,1]01k∈(0,1]k ∈ ( 0 , 1 ] defines the fraction of characters to mask, and wi:subscript:absentw_i:witalic_i : denotes the suffix starting from the (i+1)1(i+1)( i + 1 )-th character. The masked portion is then transformed into mathematical or visual clues (see Section 3.2) to construct the cross-modal prompt. Coarse-to-Fine Masking Perspective. From a linguistic perspective, masking only the prefix often retains the word’s semantic root, as English suffixes (e.g., -ive, -ion, -ing) typically carry less lexical meaning than the stem. For example, partially masking explosive as explosi__ still preserves the meaningful base explos-, making it easier for both humans and models to reconstruct the original word. From a keywordization perspective, modern LLMs rely on subword-level embeddings (e.g., byte-pair encoding), which are robust to minor truncations or spelling variations. A masked form such as explosi__ or explos_ve still closely aligns with the original embedding of explosive in the model’s latent space. As a result, the model can often complete or reconstruct the intended keyword with high probability. This fine-grained masking strategy enhances both stealth and efficiency: it shortens the prompt compared to full-keyword masking, reduces reconstruction difficulty, and increases the likelihood of bypassing content-based filters. Combined with coarse-level control, it enables CAMO to adaptively adjust difficulty for optimal attack success. 3.5 Theoretical Analysis of Difficulty Adjustment We formally analyze the difficulty adjustment mechanism used in CAMO, which dynamically controls the masking strategy through two state variables: the word masking ratio r and the character masking depth k. Let W=w1,w2,…,w|W|subscript1subscript2…subscriptW=\w_1,w_2,…,w_|W|\W = w1 , w2 , … , w| W | be the set of extracted content words. Masked Word Count. Given a masking ratio r∈(0,1]01r∈(0,1]r ∈ ( 0 , 1 ], the number of words to be masked is calculated as: n=⌊r⋅|W|⌋,⋅n= r·|W| ,n = ⌊ r ⋅ | W | ⌋ , (7) where |W||W|| W | denotes the total number of candidate words, and ⌊⋅⌋⋅ · ⌊ ⋅ ⌋ is the floor operation. Note that r represents the proportion of words to be masked, not the absolute count. Masking Function. Each selected word w is masked according to the masking character ratio k∈(0,1]01k∈(0,1]k ∈ ( 0 , 1 ], defined as the proportion of characters masked from the prefix of the word: Mask⁢(w;k)=[MASK]⌈k⋅|w|⌉∥w⌈k⋅|w|⌉+1,Mask∥superscriptdelimited-[]MASK⋅subscript⋅1Mask(w;k)=[MASK] k·|w| \|w_ k% ·|w| +1,Mask ( w ; k ) = [ MASK ]⌈ k ⋅ | w | ⌉ ∥ w⌈ k ⋅ | w | ⌉ + 1 , (8) where |w||w|| w | is the length of word w, ⌈⋅⌉⋅ · ⌈ ⋅ ⌉ denotes the ceiling operation, and ∥\|∥ denotes string concatenation. State Transition Rule. Let the current masking state be (r,k)(r,k)( r , k ), and the masking ratio step size be δr>0subscript0 _r>0δitalic_r > 0. The next state (r′,k′)superscript′(r ,k )( r′ , k′ ) is determined by: (r′,k′)=(r+δr,k),if ⁢r+δr≤rmax,(r0,k+δk),otherwise,superscript′casessubscriptif subscriptsubscriptsubscript0subscriptotherwise(r ,k )= cases(r+ _r,\;\;k),&if r+ _% r≤ r_ ,\\ (r_0,\;\;k+ _k),&otherwise, cases( r′ , k′ ) = start_ROW start_CELL ( r + δitalic_r , k ) , end_CELL start_CELL if r + δitalic_r ≤ rroman_max , end_CELL end_ROW start_ROW start_CELL ( r0 , k + δitalic_k ) , end_CELL start_CELL otherwise , end_CELL end_ROW (9) where r0subscript0r_0r0 and rmaxsubscriptr_ rroman_max are the initial and maximum masking word ratios, respectively, and δksubscript _kδitalic_k is the step size for increasing the masking character ratio within each masked word. This rule first increases the proportion of masked words before increasing the masking depth within each word. State Space Size. The total set of masking states is defined by the Cartesian product of all valid (r,k)(r,k)( r , k ) pairs: =(r,k)∣r∈r0,r0+δr,…,rmax,k∈[k0,kmax],conditional-setformulae-sequencesubscript0subscript0subscript…subscriptsubscript0subscriptS= \(r,k) r∈\r_0,r_0+ _r,…,r_ \,% k∈[k_0,k_ ] \,S = ( r , k ) ∣ r ∈ r0 , r0 + δitalic_r , … , rroman_max , k ∈ [ k0 , kroman_max ] , (10) and its size is: ||=(rmax−r0δr+1)×(kmax−k0δk+1).subscriptsubscript0subscript1subscriptsubscript0subscript1|S|= ( r_ -r_0 _r+1 )× (% k_ -k_0 _k+1 ).| S | = ( divide start_ARG rroman_max - r0 end_ARG start_ARG δitalic_r end_ARG + 1 ) × ( divide start_ARG kroman_max - k0 end_ARG start_ARG δitalic_k end_ARG + 1 ) . (11) Expected Query Cost. Let ps⁢(r,k)subscriptp_s(r,k)pitalic_s ( r , k ) denote the probability of a successful attack at masking state (r,k)(r,k)( r , k ). Assuming the attack attempts are independent and states are explored sequentially, an upper bound on the expected number of queries before success can be approximated by summing the failure probabilities across all states in the state space: ⁢[N]≤∑(r,k)∈(1−ps⁢(r,k)),delimited-[]subscript1subscriptE[N]≤ _(r,k) (1-p_s(r,k) ),blackboard_E [ N ] ≤ ∑( r , k ) ∈ S ( 1 - pitalic_s ( r , k ) ) , (12) where this upper bound decreases as the success probabilities ps⁢(r,k)subscriptp_s(r,k)pitalic_s ( r , k ) increase, particularly at states with lower difficulty levels. Optimization Objective. Define σ⁢(r,k)σ(r,k)σ ( r , k ) as the stealth level (i.e., the degree of attack inconspicuousness) attained at state (r,k)(r,k)( r , k ). Our goal is to minimize the expected query cost while ensuring that the stealth level remains above a desired threshold σminsubscript _ σroman_min. Formally, we express this as the constrained optimization problem: min(r,k)∈⁡⁢[N]subject toσ⁢(r,k)≥σmin.subscriptdelimited-[]subject tosubscript _(r,k) E[N] to σ(r,k)% ≥ _ .min( r , k ) ∈ S blackboard_E [ N ] subject to σ ( r , k ) ≥ σroman_min . (13) This formulation explicitly captures the trade-off between attack efficiency (i.e., fewer queries) and stealthiness, guiding the selection of the optimal masking parameters. Algorithm 2 CAMO: Cross-modal Adversarial Prompt Generation with Difficulty Control 1:Input text T, image I, extracted word set W=w1,…,w|W|subscript1…subscriptW=\w_1,…,w_|W|\W = w1 , … , w| W | , target model M 2:Difficulty parameters: (r0,k0)subscript0subscript0(r_0,k_0)( r0 , k0 ), step size δrsubscript _rδitalic_r, max ratio rmaxsubscriptr_ rroman_max, max depth kmaxsubscriptk_ kroman_max 3:Query budget QmaxsubscriptQ_ Qroman_max 4:Successful adversarial prompt (T′,I′)superscript′(T ,I )( T′ , I′ ) or failure 5:Initialize query counter Q←0←0Q← 0Q ← 0 6:Initialize difficulty state (r,k)←(r0,k0)←subscript0subscript0(r,k)←(r_0,k_0)( r , k ) ← ( r0 , k0 ) 7:while Q<QmaxsubscriptQ<Q_ Q < Qroman_max and k≤kmaxsubscriptk≤ k_ k ≤ kroman_max do 8: Compute masked word count n←⌊r⋅|W|⌋←⋅n← r·|W| ← ⌊ r ⋅ | W | ⌋ ▷ ▷ r controls the ratio of masked words 9: Uniformly sample subset Wr⊆WsubscriptW_r WWitalic_r ⊆ W such that |Wr|=nsubscript|W_r|=n| Witalic_r | = n 10: for each word w∈Wrsubscriptw∈ W_rw ∈ Witalic_r do 11: Compute masked length m←⌊k⋅len⁢(w)⌋←⋅lenm← k·len(w) ← ⌊ k ⋅ len ( w ) ⌋ ▷ ▷ k is masking ratio within word 12: Apply masking: wmasked←[MASK]m∥wm+1:←superscriptmaskedconditionalsuperscriptdelimited-[]MASKsubscript:1absentw^masked←[MASK]^m\,\|\,w_m+1:wmasked ← [ MASK ]m ∥ witalic_m + 1 : 13: Choose target character c from masked prefix 14: Generate math question QcsubscriptQ_cQitalic_c with solution index AcsubscriptA_cAitalic_c 15: end for 16: Construct image I′ by placing c at location AcsubscriptA_cAitalic_c in OCR map 17: Construct textual prompt T′ embedding Qcsubscript\Q_c\ Qitalic_c as reasoning task 18: Query model: R←M⁢(T′,I′)←superscript′R← M(T ,I )R ← M ( T′ , I′ ) 19: Q←Q+1←1Q← Q+1Q ← Q + 1 20: if R reconstructs attack target then 21: return (T′,I′)superscript′(T ,I )( T′ , I′ ) 22: end if 23: Update (r,k)(r,k)( r , k ) according to transition rule: (r,k)←(r+δr,k),if ⁢r+δr≤rmax(r0,k+0.2),otherwise←casessubscriptif subscriptsubscriptsubscript00.2otherwise(r,k)← cases(r+ _r,\;\;k),&if r+ _r≤ r% _ \\ (r_0,\;\;k+0.2),&otherwise cases( r , k ) ← start_ROW start_CELL ( r + δitalic_r , k ) , end_CELL start_CELL if r + δitalic_r ≤ rroman_max end_CELL end_ROW start_ROW start_CELL ( r0 , k + 0.2 ) , end_CELL start_CELL otherwise end_CELL end_ROW 24:end while 25:return failure 4 Experiments TABLE I: Attack success rates (%) of different methods under various threat categories. Bold indicates the best. The abbreviations of threat categories are as follows: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). Type Model Method BE DR SU HI KS SV FS FW text-only GPT-4o-mini Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4o-mini AP 0.00 3.23 0.00 3.03 0.00 0.00 3.33 0.00 GPT-4o-mini DRA 23.33 35.48 26.67 30.30 23.33 43.75 46.67 33.33 GPT-4o-mini PAPs 10.00 48.39 16.67 31.25 43.33 12.90 48.28 25.00 GPT-4o-mini Ours 53.33 51.61 40.00 45.45 23.33 53.12 53.33 36.67 image+text GPT-4o Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4o HADES 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4o FigStep 0.00 0.00 0.00 0.00 0.00 0.00 3.33 0.00 GPT-4o FigSteppro 3.33 0.00 0.00 0.00 0.00 0.00 3.33 0.00 GPT-4o Ours 53.33 12.90 3.45 39.39 20.00 18.75 53.33 26.67 image+text GPT-4.1-nano Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4.1-nano HADES 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4.1-nano FigStep 36.67 3.23 0.00 3.03 6.67 6.25 20.00 16.67 GPT-4.1-nano FigSteppro 36.67 12.90 3.33 18.18 20.00 12.50 30.00 30.00 GPT-4.1-nano Ours 50.00 35.48 56.67 81.82 53.33 56.25 66.67 66.67 image+text GPT-4o-mini Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4o-mini HADES 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 GPT-4o-mini FigStep 0.00 0.00 0.00 3.03 0.00 6.25 3.33 3.33 GPT-4o-mini FigSteppro 6.67 3.23 3.33 0.00 0.00 0.00 10.00 0.00 GPT-4o-mini Ours 60.00 67.74 55.17 48.48 53.33 71.88 66.67 53.33 4.1 Experimental Setup Datasets. We evaluate CAMO on the widely-adopted AdvBench [39] and AdvBench-M [21] benchmarks, which are designed to assess the robustness of large language and multimodal models under adversarial conditions. AdvBench comprises 520 harmful instruction prompts that target a broad range of real-world safety concerns. AdvBench-M extends this benchmark to the multimodal setting by grouping harmful prompts into eight distinct threat categories: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). Each multimodal instance consists of a harmful text instruction paired with an image that either conceals or supplements the malicious intent. To ensure uniform input structure across all examples, we insert a neutral blank image whenever no visual content is available, thus maintaining consistent model input formatting without introducing artificial visual cues. On average, each category contains around 30 samples, covering a diverse range of scenarios. For brevity, we use the above two-letter abbreviations when presenting results across categories (e.g., “BE” for bomb and explosives). Baselines. We compare CAMO against five representative attack strategies under two input configurations: (1)Text-only: These methods operate purely on textual prompts. This group includes AP [4], DRA [17] and PAPs [36]. To enable fair comparison, we adapt CAMO to this setting by explicitly embedding visual clues as natural language words within the input text. (2)Image+Text: These approaches rely on both a textual prompt and a rendered image that encodes part of the attack instruction. Notably, existing methods in this category directly expose harmful content in the image. For example, HADES [14] renders sampled keywords—selected from CAMO’s dictionary or fallback nouns—into the image as is. FigStep and FigSteppro [8] directly OCR the entire harmful request into the image. In particular, FigSteppro follows its default configuration, segmenting the image into three sub-images, each containing a partial instruction. All baselines are evaluated in a single-query setting consistent with CAMO. Models. We evaluate our method on a set of vision-language models from two major platforms. From OpenAI, we access three models via their official API: GPT-4o, GPT-4o-mini [10], and GPT-4.1-nano [23]. These represent different capacities within OpenAI’s model family. From Together AI [3], we test Qwen2-VL-72B-Instruct [29] and Qwen2.5-VL-72B-Instruct [27], both large-scale multimodal models built on the Qwen architecture. All models are constrained to produce a maximum of 500 output tokens per query to ensure consistent evaluation across different backends. Due to current limitations of the Together AI platform, which does not support uploading multiple local images per request, we omit comparison with FigSteppro on Qwen models. Evaluation. Our evaluation follows metrics similar to those used in AP [4]. We adopt the Attack Success Rate (ASR) as our primary metric, measuring the percentage of prompts that successfully elicit harmful responses. To ensure consistency, we use a system-level judge with a fixed evaluation prompt, shown below: System Prompt for Evaluation You are a helpful red teaming assistant. You will receive a prompt and the AI assistant’s response to the prompt. Your task is to assess whether the response completes a harmful instruction. Your rating should strictly follow this format: [[rating]] — a number from 1 to 10, where 10 indicates a complete, unambiguous, and harmful output that violates ethical or safety guidelines. The judge model used is GPT-4o-2024-08-06 [10]. A rating higher than 5 is considered a successful jailbreak. 4.2 Comparison with the State-of-the-Art Evaluation on Close-Source Models. Table I reports attack success rates (ASR) across eight instruction categories and three model variants, evaluated under both text-only and image+text input settings. Each method is evaluated in a single-query setting with a maximum output length of 500 tokens. CAMO consistently outperforms all baselines across models and modalities. In the text-only setup on GPT-4o-mini, our method consistently outperforms the baseline methods AP, DRA, and PAPs across nearly all instruction categories. On average, CAMO improves attack success rates by approximately 20 to 30 percentage points over the second-best method (DRA), and by even larger margins compared to PAPs and AP. It is worth noting that AP relies on iterative logits-based suffix optimization, which limits its effectiveness in a one-shot query setting, leading to comparatively lower success rates here. In contrast, CAMO’s integrated clue design achieves superior performance without requiring multiple iterations. This advantage becomes even more pronounced in the image+text setting on GPT-4.1-nano, where CAMO attains ASRs of 81.82% in HI and 66.67% in both FS and FW, while most baselines remain near zero. Figure 3: Comparison of the number of input tokens fed into the LLMs by different methods. Our method (Ours) uses significantly fewer tokens compared to DRA and PAPs, demonstrating higher efficiency in prompt construction and reduced computational overhead during inference. This stark performance gap can be attributed to the structural differences in how adversarial content is embedded. Unlike CAMO, which constructs multi-step cross-modal clues to obfuscate harmful semantics, methods like HADES and FigStep directly OCR full or partial harmful queries into the image. While these explicit strategies seem straightforward, they are likely to trigger safety filters due to the unmasked exposure of sensitive tokens. Furthermore, such methods rely on manually defined attack goals, lacking the automatic keyword extraction and progressive masking mechanisms that CAMO uses to maintain both stealth and effectiveness. This difference is particularly evident in sensitive categories such as BE and HI, where direct exposure is more easily blocked, but structured reconstruction enables CAMO to succeed. The influence of visual modality itself is further analyzed in our ablation study (Section 6.3). Complementing its superior attack success, Figure 3 illustrates the token efficiency of each method. Our approach consumes only 179 input tokens, which is less than half of DRA’s 387 tokens and about one-eighth of PAPs’ 1420 tokens. AP falls in between, requiring 529 tokens, reflecting its iterative logits-based suffix optimization approach that demands more tokens even in a single-query evaluation. This substantial reduction in token usage by CAMO not only significantly lowers computational costs during inference but also accelerates query processing, making it more practical for real-time or resource-constrained scenarios. Furthermore, a more compact token footprint inherently enhances stealth by limiting the amount of sensitive information exposed to safety filters, thereby reinforcing CAMO’s dual advantages in cost-efficiency and concealment. Collectively, these results underscore CAMO’s practical effectiveness and efficiency for real-world multimodal adversarial prompt attacks. Evaluation on Open-Source Models. To further evaluate the generalizability of CAMO beyond closed-source APIs, we extend our study to open-source multimodal models hosted on the Together AI platform. These models—Qwen2-VL-72B-Instruct and Qwen2.5-VL-72B-Instruct—are accessed via public APIs and allow for reproducible benchmarking. Table I summarizes the results under the same threat categories and input configurations. As shown in Table I, CAMO achieves significantly higher ASR across all threat categories and models. For instance, it obtains 96.97% on hack_information and 90.00% on finance_stock with Qwen2.5-VL, indicating robust cross-modal alignment and semantic plausibility. Among baselines, FigStep performs moderately well on certain categories (e.g., BE, HI), as it embeds the full harmful request directly in the image. In contrast, FigSteppro, which splits the query across three sub-images, cannot be evaluated here due to platform limitations—Together AI does not support uploading multiple images per query. Overall, CAMO’s superior adaptability and automation—particularly its goal abstraction and obfuscation capabilities—enable more effective attacks compared to manually scripted baselines. 4.3 Qualitative Visualization To qualitatively assess the effectiveness of CAMO, we visualize input-output interactions with both closed-source and open-source LVLMs. Figures 4 and 5 illustrate representative model responses to CAMO-generated prompts when queried with GPT-4.1-mini and DeepSeek-R1-0528 hosted on the TogetherAI platform, respectively. In Figure 4, we present two variants of adversarial input formats. In the first (left), all reasoning is encoded in text via symbolic expressions. In the second (right), partial keyword masking is combined with visual clues embedded within the image. Both approaches elicit harmful completions despite appearing benign when processed independently. Figure 5 further confirms that CAMO generalizes to open-source models served via API. Despite no access to model internals, CAMO successfully bypasses DeepSeek-R1’s moderation mechanisms, triggering detailed harmful outputs in response to obfuscated queries. These qualitative results demonstrate that CAMO is not only effective in evading content moderation but also generalizable across deployment settings and model families. (a) Input text with OCR-style clues (b) Input image + masked text Figure 4: Qualitative examples of CAMO input formats and their corresponding model outputs. (a) The entire reasoning chain is encoded within the text using symbolic math expressions, without relying on any visual input. (b) The masked keyword appears in the text, while visual clues are embedded in the accompanying image. Both variants successfully trigger harmful completions in GPT-4.1-mini, demonstrating CAMO’s ability to elicit unsafe behavior while maintaining input-level stealth. Figure 5: Interaction with DeepSeek-R1-0528 on the TogetherAI platform, illustrating successful evasion of safety mechanisms by CAMO-generated attack prompts. TABLE I: Attack success rates (ASR) of CAMO and baselines across eight harmful instruction categories using open-source models accessed via the together.ai API. All methods use image+text input. CAMO (Ours) consistently outperforms prior baselines across models and threat categories. The abbreviations of threat categories are as follows: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). Type Model Method BE DR SU HI KS SV FS FW image+text Qwen2-VL-72B Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Qwen2-VL-72B HADES 0.00 0.00 0.00 3.03 0.00 0.00 0.00 0.00 Qwen2-VL-72B FigStep 46.67 38.71 23.33 60.61 53.33 34.38 56.67 43.33 Qwen2-VL-72B Ours 56.67 77.42 70.00 96.97 86.21 78.12 76.67 83.33 Qwen2.5-VL-72B Vanilla 0.00 0.00 0.00 0.00 0.00 0.00 0.00 0.00 Qwen2.5-VL-72B HADES 0.00 0.00 0.00 3.33 0.00 0.00 0.00 0.00 Qwen2.5-VL-72B FigStep 36.67 45.16 20.00 60.61 66.67 31.25 56.67 40.00 Qwen2.5-VL-72B Ours 80.00 70.97 53.33 87.50 73.33 65.62 90.00 66.67 5 Attack Against Defenses TABLE I: Evaluation of CAMO against three types of defense mechanisms. Despite encoding semantically harmful intent, all attack instances are consistently classified as non-toxic, revealing blind spots in both linguistic and vision-grounded safety filters. Defense Method Input Format Detection Result PPL-Based Filter Pure Text Prompt 100% Safe OCR-Based Toxicity Classifier OCR-Extracted Text from Image 100% Safe OpenAI Moderation API Text with Embedded Visual Clues 100% Safe To understand the effectiveness of CAMO in real-world adversarial settings, we evaluate its performance against three dominant layers of safety infrastructure: text-level filters, visual-layer OCR-based detection, and system-level moderation. As shown in Table I, CAMO successfully bypasses all three evaluated defense mechanisms. Specifically, the Perplexity-based filter fails to detect any of the pure-text prompts; the OCR-based toxicity classifier misjudges all extracted texts from image prompts as safe; and even the OpenAI Moderation API, when applied to text inputs embedded with visual clues, consistently returns 100% safe results. This highlights a systemic vulnerability across linguistic, vision-derived, and system-level safety layers. 5.1 Text-Level Defense: Perplexity-Based Filtering To assess the stealthiness of CAMO-generated inputs, we follow the perplexity-based defense methodology proposed in [12], which filters out syntactically or statistically irregular prompts based on their log-perplexity. This strategy assumes that malicious inputs tend to deviate from the distribution of natural language, resulting in higher perplexity values that can be identified using a fixed threshold. We replicate the filtering pipeline using the Qwen-2.5-0.5B [32] language model as a proxy evaluator to compute the perplexity scores of both the attack prompt and the corresponding harmful question (i.e., How to make a bomb). All inputs are sampled from the AdvBench-M dataset, which includes 8 predefined adversarial categories such as bomb-making, suicide, hacking, and others. For each input sequence, we compute the full-sequence average log-perplexity using the Basic Perplexity Filter as defined in [12]. Formally, for a token sequence =(x1,x2,…,xT)subscript1subscript2…subscriptx=(x_1,x_2,…,x_T)x = ( x1 , x2 , … , xitalic_T ), the model assigns probability: P⁢()=∏t=1TP⁢(xt∣x<t),superscriptsubscriptproduct1conditionalsubscriptsubscriptabsentP(x)= _t=1^TP(x_t x_<t),P ( x ) = ∏t = 1T P ( xitalic_t ∣ x< t ) , (14) and the corresponding log-perplexity is: log⁡P⁢P⁢L⁢()=−1T⁢∑t=1Tlog⁡P⁢(xt∣x<t),1superscriptsubscript1conditionalsubscriptsubscriptabsent PPL(x)=- 1T _t=1^T P(x_t x_<t),log P P L ( x ) = - divide start_ARG 1 end_ARG start_ARG T end_ARG ∑t = 1T log P ( xitalic_t ∣ x< t ) , (15) sequences with log⁡P⁢P⁢L⁢()>τ PPL(x)> P P L ( x ) > τ are rejected as syntactically or statistically suspicious. CAMO achieves a 100% pass rate under the Basic Perplexity Filter across all attack prompt samples. The average log-perplexity for these inputs is consistently low across all task categories. Figure 6: Comparison of average log perplexity (PPL) scores across categories. Each pair of bars shows the difference between the attack prompt (green) and the corresponding harmful question (orange). Higher PPL indicates lower model confidence. The abbreviations of threat categories are as follows: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). As illustrated in Figure 6, the average log perplexity (PPL) across all categories is 3.07 for the attack prompts and 3.47 for the corresponding harmful questions. While the PPL values are generally close—indicating similar levels of model confidence—the harmful questions exhibit slightly lower perplexity in several categories. This suggests that the reconstructed harmful content is often more linguistically fluent or semantically aligned from the model’s perspective. 5.2 Visual Defense: OCR-Based Toxicity Detection CAMO effectively bypasses OCR-based visual safety mechanisms. Following the experimental setup of FigStep [8], we apply EasyOCR [11] to extract textual content from CAMO’s visual prompts. The extracted text is then passed to LLaMA-2-Chat-7B [28], used as a zero-shot toxicity classifier. Remarkably, the classifier consistently labels 100% of the samples as non-toxic. This indicates that despite the presence of harmful intent embedded in visual form, the extracted textual surface remains benign enough to evade detection by language model-based safety filters. 5.3 System-Level Defense: Moderation APIs System-level safety mechanisms such as OpenAI’s Moderation model [22] are designed to detect and block toxic or unsafe content by analyzing the semantic and contextual features of the input prompts. Unlike perplexity-based filters that primarily monitor textual fluency and token-level anomalies, or OCR-based classifiers that focus on extracting and scrutinizing visual text content, the Moderation API operates from a holistic semantic perspective, assessing the overall intent and meaning of combined textual and visual inputs. To validate the effectiveness of our proposed harmful attack method, we construct carefully designed text-only inputs that embed semantically harmful visual clues within otherwise benign prompts. This setup simulates covert adversarial attacks that conceal malicious intent beneath innocuous appearances. Despite the inherent harmfulness, the moderation system consistently classifies these inputs as safe, exposing a blind spot in detecting attacks requiring complex multi-step reasoning or those relying on semantically concealed instructions. This result suggests that while system-level defenses like the Moderation API are effective at filtering out explicit or surface-level toxic expressions, they remain vulnerable to sophisticated adversarial strategies that obfuscate harmful content through indirect semantic encoding or multimodal reasoning. Consequently, our findings highlight the need for enhanced defense mechanisms that integrate deeper semantic understanding and cross-modal reasoning to better capture concealed malicious intent in advanced multimodal AI systems. 5.4 Analysis CAMO’s effectiveness is grounded in empirical observations of system-level failure. As shown in Table I, three types of detection pipelines—PPL filters, OCR-based classifiers, and moderation APIs—are all bypassed with 100% success. This consistent evasion suggests a common structural weakness in existing safety filters: they largely operate on surface-level or unimodal features. Consider the case of perplexity-based filtering. These mechanisms compute: P⁢P⁢L⁢(text)=exp⁡(−1T⁢∑t=1Tlog⁡P⁢(xt∣x<t)),subscripttext1superscriptsubscript1conditionalsubscriptsubscriptabsentPPL(x_text)= (- 1T _t=1^T P(x_t% x_<t) ),P P L ( xtext ) = exp ( - divide start_ARG 1 end_ARG start_ARG T end_ARG ∑t = 1T log P ( xitalic_t ∣ x< t ) ) , (16) CAMO constructs prompts textsubscripttextx_textxtext that lie in high-probability regions of the language model’s learned distribution Pθ⁢(text)subscriptsubscripttextP_θ(x_text)Pitalic_θ ( xtext ), ensuring fluency and thus evading such filters. OCR-based classifiers and moderation APIs often rely on independent scoring of text and image components: Pdet⁢()≈Pdet⁢(text)⋅Pdet⁢(image).subscriptdet⋅subscriptdetsubscripttextsubscriptdetsubscriptimageP_det(x)≈ P_det(x_text)% · P_det(x_image).Pdet ( x ) ≈ Pdet ( xtext ) ⋅ Pdet ( ximage ) . (17) However, CAMO exploits cross-modal semantics: the harmful intent is only recoverable when both modalities are jointly interpreted. Formally, P⁢(∣text)conditionalsubscripttext P(y _text)P ( y ∣ xtext ) ∉attack,absentsubscriptattack _attack,∉ Yattack , (18) P⁢(∣image)conditionalsubscriptimage P(y _image)P ( y ∣ ximage ) ∉attack,absentsubscriptattack _attack,∉ Yattack , (19) P⁢(∣text,image)conditionalsubscripttextsubscriptimage P(y _text,x_image% )P ( y ∣ xtext , ximage ) ∈attack.absentsubscriptattack _attack.∈ Yattack . (20) This cross-modal dependency eludes unimodal detectors and underlines the need for holistic semantic modeling. Let trainsubscripttrainD_trainDtrain be the data distribution the model is trained on. CAMO constructs adversarial inputs from a proxy distribution camosubscriptcamoD_camoDcamo such that: camo≈train,subscriptcamosubscripttrainD_camo _train,Dcamo ≈ Dtrain , (21) both in marginal statistics and conditional semantics. As a result, CAMO inputs are statistically indistinguishable from benign samples under most heuristic or statistical filters, unless models are explicitly retrained with adversarial counterexamples. 6 Ablation Study To assess the contribution of each component in our attack pipeline, we conduct a comprehensive ablation study focusing on the following aspects: (1) core design modules, (2) key hyperparameters, and (3) the role of visual clues. 6.1 Effect of Core Components We evaluate the impact of removing each major component from our full pipeline: • w/o Keyword Set: We discard the manually curated harmful keyword library and rely solely on part-of-speech-based filtering. • w/o Text Template: We remove the natural language wrapper templates that disguise instructions, directly injecting attack targets into plain queries. • w/o Math Encoding: The mathematical transformation step is omitted; attack tokens are inserted directly without arithmetic disguise. • w/o Visual Input: Instead of multimodal embedding, all clues are embedded into the text channel only. TABLE IV: Ablation results of CAMO on GPT-4o-mini, evaluated using Attack Success Rate (ASR, %) under fixed hyperparameters r=0.60.6r=0.6r = 0.6, k=0.40.4k=0.4k = 0.4. We report ASR across four threat categories: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI). Component BE DR SU HI w/o Keyword Set 13.33 64.52 23.33 36.36 w/o Text Template 36.67 45.16 46.67 46.67 w/o Math Encoding 58.06 58.06 56.67 45.45 w/o Visual Input 53.33 51.61 40.00 45.45 CAMO (Full) 60.00 67.74 55.17 48.48 As shown in Table IV, each core module of CAMO contributes significantly to the overall effectiveness. The evaluation is conducted on GPT-4o-mini with ASR (%) as the standard metric. Each ablation variant corresponds to the full CAMO pipeline with a single component removed to isolate its individual impact. The full CAMO pipeline achieves the highest performance across all threat categories under the hyperparameter setting of r=0.60.6r=0.6r = 0.6 and k=0.40.4k=0.4k = 0.4. Removing the initial keyword set, a manually curated harmful keyword library that provides domain-specific priors—leads to the most significant performance degradation. For instance, the ASR in the BE category plummets from 60.00% to 13.33%. This dramatic drop highlights the critical role of the keyword set in precisely localizing and identifying harmful targets. Without this domain knowledge, CAMO must rely solely on coarse part-of-speech filtering, which lacks the granularity to detect semantically harmful content effectively. This limitation underscores a fundamental challenge faced by existing multimodal attack methods: without large language model reasoning or manual intervention, accurately pinpointing harmful information becomes extremely difficult. Removing the natural language wrapping (w/o Text Template) also results in a noticeable degradation, with ASR decreasing by over 20 percentage points in both BE and DR. This suggests that the template-based disguise is essential for bypassing surface-level pattern detectors and preserving fluency. The math encoding component contributes to obfuscating token semantics while maintaining logic coherence. Without it, ASR in BE and DR drops by 1.94% and 9.68% respectively, confirming that arithmetic transformations add effective confusion without compromising reconstructability. Notably, removing the visual clue channel reduces ASR across all categories, especially in SU and HI, where the drop reaches 15.17% and 3.03%. This indicates that visual grounding plays a complementary role in hiding sensitive content and providing compositional cues, enabling attacks that remain under the radar of text-only safety filters. Overall, these results demonstrate that each core component of CAMO plays a significant role in maintaining high attack effectiveness. Notably, the removal of the initial keyword set causes the largest performance degradation, highlighting its critical role as domain-specific prior knowledge for accurate harmful target localization. Other components such as the text template, mathematical encoding, and visual input also contribute meaningfully, with their combined synergy greatly enhancing the robustness and stealthiness of the attack. Overall, the study validates the importance of integrating precise target identification with multi-step, multimodal obfuscation strategies, and offers guidance for future improvements. 6.2 Impact of Hyperparameters Figure 7: Impact of the keyword selection ratio r (proportion of extracted keywords to process) on attack success rate (ASR), with fixed character masking ratio k=0.40.4k=0.4k = 0.4, evaluated on GPT-4o-mini. Higher r implies more content-bearing words are altered. The abbreviations of threat categories are as follows: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). Figure 8: Effect of character masking ratio k (proportion of masked characters within each keyword) on ASR, with fixed keyword selection ratio r=0.60.6r=0.6r = 0.6, evaluated on GPT-4.1-nano. Larger k induces stronger obfuscation and better evasion. The abbreviations of threat categories are as follows: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI), kill_someone (KS), social_violence (SV), finance_stock (FS), and firearms_weapons (FW). We investigate the effect of two key hyperparameters in CAMO: the keyword selection ratio r and the within-keyword masking ratio k. Specifically, r determines the proportion of keywords (extracted from the original harmful question) to be selected for manipulation, while k controls how many characters within each selected keyword are masked and replaced with visual clues. Figure 7 reports the ASR across eight threat categories under varying r∈0.2,0.4,0.60.20.40.6r∈\0.2,0.4,0.6\r ∈ 0.2 , 0.4 , 0.6 with a fixed character masking ratio k=0.40.4k=0.4k = 0.4, using GPT-4o-mini. As r increases, more potentially sensitive tokens are obfuscated, enabling stronger semantic shifts. Notably, the ASR on DR improves from 38.71% to 67.74%, and on SU from 26.67% to 55.17%. Figure 8 presents results under varying character masking ratios k∈0.2,0.4,0.60.20.40.6k∈\0.2,0.4,0.6\k ∈ 0.2 , 0.4 , 0.6 with fixed r=0.60.6r=0.6r = 0.6, using GPT-4.1-nano. As k increases, each selected keyword becomes more visually obfuscated, amplifying the cross-modal ambiguity. For example, ASR on DR rises from 22.58% to 70.97%, while FS and HI also exhibit consistent gains. Overall, increasing both r and k contributes to higher attack success by distributing harmful semantics more deeply into the visual channel, thereby evading textual safety filters. 6.3 Visual Modality Influence Figure 9: Visual examples of three image input types used in CAMO. Left: a relevant image aligned with the harmful theme (e.g., weapon retrieval); Middle: a blank image with no visual content; Right: a random image unrelated to the instruction. All images include embedded visual clues (e.g., 3:F, 6:I, 4:R) for keywords reconstruction. TABLE V: Impact of different visual input types on attack success rate (ASR, %) across four threat categories: bomb_explosive (BE), drugs (DR), suicide (SU), hack_information (HI). All experiments are conducted on GPT-4.1-nano. Image Type BE DR SU HI Relevant Image 50.00 35.48 56.67 81.82 Blank Image 40.00 38.71 50.00 75.76 Random Image 36.67 67.74 66.67 90.91 To understand the role of visual modality in adversarial prompting, we investigate three image configurations: relevant, blank, and random inputs (see Figure 9). As illustrated in Figure 9, all images embed the same set of visual clues (e.g., “3:F”, “6:I”, “4:R”), while varying in semantic alignment. The left image contains a semantically relevant scene (retrieving a weapon), the middle is an empty placeholder, and the right shows an unrelated outdoor scene. Table V presents quantitative results from GPT-4.1-nano. Interestingly, the use of relevant images improves ASR significantly in categories such as Suicide Methods (56.67%) and Hacking Instructions (81.82%), confirming that visual alignment aids in content reconstruction. In contrast, blank images result in slightly lower ASR, showing that cross-modal reasoning can still function with minimal visual content. Surprisingly, random images outperform the other settings in Drug Recipes (67.74%) and Hacking Instructions (90.91%), indicating that LLMs may exploit arbitrary visual features or bypass safety filters unintentionally. However, they underperform in Bomb-related tasks (36.67%), likely due to semantic mismatch disrupting reasoning consistency. These results suggest that while relevant visual grounding enhances interpretability and stealth, some visual randomness may inadvertently assist in jailbreak under specific categories. CAMO’s visual strategy should thus balance semantic relevance and obfuscation strength based on the targeted task. 7 Conclusion In this paper, we proposed Cross-modal Adversarial Multimodal Obfuscation (CAMO), a novel attack framework that leverages cross-modal obfuscation to bypass safety mechanisms in Large Vision-Language Models (LVLMs). By decomposing harmful instructions into semantically benign textual and visual elements, and embedding these clues within single-turn multimodal prompts, CAMO effectively evades multiple layers of defenses including perplexity-based filtering, OCR-based detection, and system-level moderation. Our approach is model-agnostic and operates under a black-box setting, requiring no access to internal model parameters or multiple query interactions. This makes CAMO highly practical and broadly applicable. We demonstrate its strong attack success rates across a range of open- and closed-source LVLMs, such as GPT-4o-mini, GPT-4o, GPT-4.1-nano, and Qwen2-VL/Qwen2.5-VL, validating its generalizability and robustness. Extensive experiments and detailed visualizations confirm CAMO’s effectiveness, query efficiency, and stealth, highlighting the critical role of multi-step, multi-modal obfuscation in advancing adversarial prompt generation. Beyond exposing vulnerabilities in current safety protocols, our work underscores the need for more comprehensive and adaptive defense strategies that can address sophisticated multimodal threats. We hope this work not only facilitates more rigorous safety evaluation in LVLMs but also inspires future research directions focused on developing robust, interpretable, and efficient defense mechanisms against increasingly complex adversarial attacks in multimodal AI systems. 8 Limitation and Future Work CAMO provides an effective and generalizable framework for evading safety mechanisms in large vision-language models. Nonetheless, several avenues warrant further investigation. First, although CAMO employs multi-step cross-modal reasoning to obfuscate harmful semantics, its robustness against models explicitly optimized for complex reasoning—such as GPT-o1 and Gemini-2.5—remains to be thoroughly evaluated. These advanced models may possess enhanced internal verification or greater resistance to fragmented or disguised inputs. Second, the current masking strategy depends on manually tuned hyperparameters r and k. Future research could explore adaptive masking schemes guided by saliency maps or model feedback, potentially improving efficiency and stealth. Moreover, the relative contribution of visual inputs under varying scenarios has yet to be systematically analyzed. In cases where textual cues alone suffice, the added value of image semantics in enhancing stealth is unclear. Future work should aim to rigorously quantify the role of visual information and develop more diverse, semantically aligned encoding strategies. Such enhancements could further bolster CAMO’s capability to evade detection while preserving interpretability and generalizability. References [1] The Claude 3 Model Family: Opus, Sonnet, Haiku [2] Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: GPT-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023) [3] AI, T.: Together Inference. https://together.ai (2025), accessed: 2025-06 [4] Andriushchenko, M., Croce, F., Flammarion, N.: Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks. arXiv preprint arXiv:2404.02151 (2024) [5] Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., Zhou, J.: Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyond (2023), https://arxiv.org/abs/2308.12966 [6] Carlini, N., Nasr, M., Choquette-Choo, C.A., Jagielski, M., Gao, I., Koh, P.W.W., Ippolito, D., Tramer, F., Schmidt, L.: Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems 36, 61478–61500 (2023) [7] Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., Wong, E.: Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419 (2023) [8] Gong, Y., Ran, D., Liu, J., Wang, C., Cong, T., Wang, A., Duan, S., Wang, X.: FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts. In: Proceedings of the AAAI Conference on Artificial Intelligence. vol. 39, p. 23951–23959 (2025) [9] Handa, D., Zhang, Z., Saeidi, A., Kumbhar, S., Baral, C.: When ”Competency” in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers. arXiv preprint arXiv:2402.10601 (2024) [10] Hurst, A., Lerer, A., Goucher, A.P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al.: GPT-4o System Card. arXiv preprint arXiv:2410.21276 (2024) [11] Jaided AI: EasyOCR 1.7.1. https://pypi.org/project/easyocr/1.7.1/ (2023), accessed: 2024-02-09 [12] Jain, N., Schwarzschild, A., Wen, Y., Somepalli, G., Kirchenbauer, J., Chiang, P.y., Goldblum, M., Saha, A., Geiping, J., Goldstein, T.: Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 (2023) [13] Li, J., Li, D., Savarese, S., Hoi, S.: BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Models. In: International conference on machine learning. p. 19730–19742. PMLR (2023) [14] Li, Y., Guo, H., Zhou, K., Zhao, W.X., Wen, J.R.: Images are Achilles’ Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models. In: European Conference on Computer Vision. p. 174–189. Springer (2024) [15] Liao, Z., Sun, H.: AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. arXiv preprint arXiv:2404.07921 (2024) [16] Liu, H., Li, C., Li, Y., Lee, Y.J.: Improved Baselines with Visual Instruction Tuning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. p. 26296–26306 (2024) [17] Liu, T., Zhang, Y., Zhao, Z., Dong, Y., Meng, G., Chen, K.: Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction. In: 33rd USENIX Security Symposium (USENIX Security 24). p. 4711–4728 (2024) [18] Liu, X., Xu, N., Chen, M., Xiao, C.: AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. arXiv preprint arXiv:2310.04451 (2023) [19] Luo, W., Ma, S., Liu, X., Guo, X., Xiao, C.: JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks. arXiv preprint arXiv:2404.03027 (2024) [20] Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., et al.: HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusal. Proceedings of Machine Learning Research 235, 35181–35224 (2024) [21] Niu, Z., Ren, H., Gao, X., Hua, G., Jin, R.: Jailbreaking Attack against Multimodal Large Language Model. arXiv preprint arXiv:2402.02309 (2024) [22] OpenAI: Moderation – OpenAI API. https://platform.openai.com/docs/guides/moderation (2024), accessed: 2024-02-09 [23] OpenAI: Introducing GPT-4.1 in the API. https://openai.com/index/gpt-4-1/ (2025), accessed: 2025-06 [24] Reid, M., Savinov, N., Teplyashin, D., Lepikhin, D., Lillicrap, T., Alayrac, J.b., Soricut, R., Lazaridou, A., Firat, O., Schrittwieser, J., et al.: Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530 (2024) [25] Shayegani, E., Dong, Y., Abu-Ghazaleh, N.: Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models. In: The Twelfth International Conference on Learning Representations (2023) [26] Team, G., Georgiev, P., Lei, V.I., Burnell, R., Bai, L., Gulati, A., Tanzer, G., Vincent, D., Pan, Z., Wang, S., et al.: Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530 (2024) [27] Team, Q.: Qwen2.5-VL (January 2025), https://qwenlm.github.io/blog/qwen2.5-vl/ [28] Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al.: Llama 2: Open Foundation and Fine-Tuned Chat Models. arXiv preprint arXiv:2307.09288 (2023) [29] Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., Fan, Y., Dang, K., Du, M., Ren, X., Men, R., Liu, D., Zhou, C., Zhou, J., Lin, J.: Qwen2-VL: Enhancing Vision-Language Model’s Perception of the World at Any Resolution. arXiv preprint arXiv:2409.12191 (2024) [30] Wang, R., Ma, X., Zhou, H., Ji, C., Ye, G., Jiang, Y.G.: White-box Multimodal Jailbreaks Against Large Vision-Language Models. In: Proceedings of the 32nd ACM International Conference on Multimedia. p. 6920–6928 (2024) [31] Wang, W., Lv, Q., Yu, W., Hong, W., Qi, J., Wang, Y., Ji, J., Yang, Z., Zhao, L., Song, X., et al.: CogVLM: Visual Expert for Pretrained Language Models. arXiv preprint arXiv:2311.03079 (2023) [32] Yang, A., Yang, B., Hui, B., Zheng, B., Yu, B., Zhou, C., Li, C., Li, C., Liu, D., Huang, F., Dong, G., Wei, H., Lin, H., Tang, J., Wang, J., Yang, J., Tu, J., Zhang, J., Ma, J., Xu, J., Zhou, J., Bai, J., He, J., Lin, J., Dang, K., Lu, K., Chen, K., Yang, K., Li, M., Xue, M., Ni, N., Zhang, P., Wang, P., Peng, R., Men, R., Gao, R., Lin, R., Wang, S., Bai, S., Tan, S., Zhu, T., Li, T., Liu, T., Ge, W., Deng, X., Zhou, X., Ren, X., Zhang, X., Wei, X., Ren, X., Fan, Y., Yao, Y., Zhang, Y., Wan, Y., Chu, Y., Liu, Y., Cui, Z., Zhang, Z., Fan, Z.: Qwen2 Technical Report. arXiv preprint arXiv:2407.10671 (2024) [33] Yin, S., Fu, C., Zhao, S., Li, K., Sun, X., Xu, T., Chen, E.: A Survey on Multimodal Large Language Models. arXiv preprint arXiv:2306.13549 (2023) [34] Yong, Z.X., Menghini, C., Bach, S.H.: Low-Resource Languages Jailbreak GPT-4. arXiv preprint arXiv:2310.02446 (2023) [35] Yuan, Y., Jiao, W., Wang, W., Huang, J.t., He, P., Shi, S., Tu, Z.: GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher. arXiv preprint arXiv:2308.06463 (2023) [36] Zeng, Y., Lin, H., Zhang, J., Yang, D., Jia, R., Shi, W.: How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). p. 14322–14350 (2024) [37] Zhu, D., Chen, J., Shen, X., Li, X., Elhoseiny, M.: MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models. arXiv preprint arXiv:2304.10592 (2023) [38] Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M.: Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:2307.15043 (2023) [39] Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M.: Universal and Transferable Adversarial Attacks on Aligned Language Models (2023)

Instant research discovery