Jailbreak Connectivity: Enhancing Security in Multimodal AI Models

Paper: Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak

Authors: Xu Zhang, Ziqing Hu, Shuo Han, Ren Wang

Executive Summary

Recent research highlights significant vulnerabilities in multimodal large language models (MLLMs), specifically their susceptibility to visual jailbreak attacks that can bypass established safety measures. This study introduces a new framework called Jailbreak Connectivity (JC), which addresses limitations in existing methods that often focus on optimizing individual adversarial examples. Such conventional approaches resulted in a lack of diversity, transferability, and general applicability of attacks.

The JC framework is built on the principle that effective adversarial inputs can be linked through specific low-loss areas within the image space. By optimizing continuous adversarial paths, JC can generate a variety of jailbreak images. This process involves sampling paths that create diverse attack vectors and utilizing lightweight surrogate classifiers to facilitate cross-model transfer of these attacks. Additionally, the framework employs a distribution-level objective that aims for universal attacks across a range of harmful queries.

The effectiveness of JC was validated using a benchmark known as MM-SafetyBench. The framework achieved impressive average attack success rates: 84.01% on the Qwen3-VL-8B-Instruct model, 85.77% on InternVL3.5-8B, and 97.95% on Gemma-3-12B-IT. Notably, these results surpassed the best-performing existing methods by margins of up to 68.36 percentage points. In black-box evaluations, JC demonstrated its strength by enhancing attack success rates against models like GPT-5.6 and Gemini 3.1 Pro by 24.69 and 27.34 percentage points, respectively.

These findings underscore critical gaps in the safety alignment of MLLMs. By revealing structured vulnerabilities, the research provides insights that could inform the development of more robust security measures. Organizations utilizing MLLMs should be aware of these vulnerabilities as they highlight the need for ongoing security evaluations and enhancements in their AI systems. As enterprises increasingly rely on MLLMs for various applications, understanding and addressing these vulnerabilities could be essential in safeguarding against potential attacks.

Academic Abstract

Multimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization. We propose Jailbreak Connectivity (JC), a framework based on the observation that effective adversarial inputs can be connected through low-loss regions in image space. JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries. On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points. In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively. These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.