{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/gradient-based-jailbreak-images-for","title":"Gradient-based Jailbreak Images for Multimodal Fusion Models","arxiv_id":"2410.03489","date":"2024-10-04","proceeding":null,"authors":["Javier Rando","Hannah Korevaar","Erik Brinkman","Ivan Evtimov","Florian Tramèr"],"abstract":"Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evaluate our attacks on Chameleon models and obtain jailbreak images that elicit harmful information for 72.5% of prompts. Jailbreak images outperform text jailbreaks optimized with the same objective and require 3x lower compute budget to optimize 50x more input tokens. Finally, we find that representation engineering defenses, like Circuit Breakers, trained only on text attacks can effectively transfer to adversarial image inputs.","url_abs":"https://arxiv.org/abs/2410.03489v2","url_pdf":"https://arxiv.org/pdf/2410.03489v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"gradient-based-jailbreak-images-for","repo_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"NOASSERTION"}}],"tasks":[],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2410.03489","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2410.03489"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks","reach":{"status":"ok","spdx":"NOASSERTION"}}],"summary":{"ran":1,"unverified":6},"by_repo_kind":{"official":{"samples":7,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":7,"samples":[{"code_sha256_prefix":"2230390d89a3e149","entry":"chunk","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/utils.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"2230390d89a3e149"}},{"code_sha256_prefix":"8da2df16935a5aa0","entry":"generate","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/eval/evaluation.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/eval/evaluation.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"8da2df16935a5aa0"}},{"code_sha256_prefix":"9834b49dec126f63","entry":"generate_gcg","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/eval/eval_gcg.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/eval/eval_gcg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"9834b49dec126f63"}},{"code_sha256_prefix":"e89425a90bf15fab","entry":"generate_llava","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/eval/transferability_llava.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/eval/transferability_llava.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"e89425a90bf15fab"}},{"code_sha256_prefix":"bafa57feeb336e0a","entry":"generate_llava_gcg","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/eval/transferability_llava.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/eval/transferability_llava.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"bafa57feeb336e0a"}},{"code_sha256_prefix":"4da4b38a1de57017","entry":"prepare_inputs","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/utils.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"4da4b38a1de57017"}},{"code_sha256_prefix":"806b606dc7d1d65a","entry":"prepare_train_dataset","repo":"facebookresearch/multimodal-fusion-jailbreaks","repo_kind":"official","path":"src/fusion_jailbreaks/utils.py","file_url":"https://github.com/facebookresearch/multimodal-fusion-jailbreaks/blob/HEAD/src/fusion_jailbreaks/utils.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NOASSERTION","inline_ok":false,"mcp_get_code":{"code_sha256":"806b606dc7d1d65a"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}