Multimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization.
Proposed Method: Jailbreak Connectivity (JC)
We propose Jailbreak Connectivity (JC), a framework based on the observation that effective adversarial inputs can be connected through low-loss regions in image space. JC optimizes continuous adversarial paths:
- path sampling yields diverse jailbreak images,
- lightweight surrogate classifiers guide cross-model transfer,
- a distribution-level objective enables universal attacks across harmful queries.
Experimental Results
On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points.
In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively.
These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.