{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/viscra-a-visual-chain-reasoning-attack-for","title":"VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models","arxiv_id":"2505.19684","date":"2025-05-26","proceeding":null,"authors":["Bingrui Sima","Linhua Cong","Wenxuan Wang","Kun He"],"abstract":"The emergence of Multimodal Large Language Models (MLRMs) has enabled sophisticated visual reasoning capabilities by integrating reinforcement learning and Chain-of-Thought (CoT) supervision. However, while these enhanced reasoning capabilities improve performance, they also introduce new and underexplored safety risks. In this work, we systematically investigate the security implications of advanced visual reasoning in MLRMs. Our analysis reveals a fundamental trade-off: as visual reasoning improves, models become more vulnerable to jailbreak attacks. Motivated by this critical finding, we introduce VisCRA (Visual Chain Reasoning Attack), a novel jailbreak framework that exploits the visual reasoning chains to bypass safety mechanisms. VisCRA combines targeted visual attention masking with a two-stage reasoning induction strategy to precisely control harmful outputs. Extensive experiments demonstrate VisCRA's significant effectiveness, achieving high attack success rates on leading closed-source MLRMs: 76.48% on Gemini 2.0 Flash Thinking, 68.56% on QvQ-Max, and 56.60% on GPT-4o. Our findings highlight a critical insight: the very capability that empowers MLRMs -- their visual reasoning -- can also serve as an attack vector, posing significant security risks.","url_abs":"https://arxiv.org/abs/2505.19684v1","url_pdf":"https://arxiv.org/pdf/2505.19684v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[],"tasks":[{"task_slug":"visual-reasoning","task_name":"Visual Reasoning"}],"methods":[{"method_slug":"attention","method_name":"Attention"},{"method_slug":"softmax","method_name":"Softmax"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2505.19684","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2505.19684"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"deterministic:regex_extraction","url":"https://github.com/DyMessi/VisCRA","reach":{"status":"ok","spdx":"Apache-2.0"}}],"summary":{"ran_draft_wrong":1,"unverified":11},"by_repo_kind":{"found_in_text":{"samples":12,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"f41cb1a19b154297","entry":"encode_image","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/gemini.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/gemini.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"f41cb1a19b154297"}},{"code_sha256_prefix":"cfe427db2f2f5fcc","entry":"encode_image","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/QvQ_Max.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/QvQ_Max.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"cfe427db2f2f5fcc"}},{"code_sha256_prefix":"747918e3fc43514d","entry":"find_top3_blocks_with_stride","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"qwenmask.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/qwenmask.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"747918e3fc43514d"}},{"code_sha256_prefix":"85fe3245f510864a","entry":"generate_response","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/gemini.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/gemini.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"85fe3245f510864a"}},{"code_sha256_prefix":"a7841c5371a659a2","entry":"generate_response","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/gpt4o.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/gpt4o.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"a7841c5371a659a2"}},{"code_sha256_prefix":"8176c7a3579cba1d","entry":"guess_image_type_from_base64","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/gemini.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/gemini.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"8176c7a3579cba1d"}},{"code_sha256_prefix":"d3ece86e3359d0bb","entry":"guess_image_type_from_base64","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/QvQ_Max.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/QvQ_Max.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"d3ece86e3359d0bb"}},{"code_sha256_prefix":"59c478e3cad8958d","entry":"load_dataset","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"evaluation/o4-mini.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/evaluation/o4-mini.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"59c478e3cad8958d"}},{"code_sha256_prefix":"317d970e6d4be3bc","entry":"load_model","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"qwenmask.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/qwenmask.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"317d970e6d4be3bc"}},{"code_sha256_prefix":"5a87ea6c5cf68cbc","entry":"process_hades_data","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"utils/hades.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/utils/hades.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"5a87ea6c5cf68cbc"}},{"code_sha256_prefix":"adb7a4c52bd43387","entry":"read_mm_safebench","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"utils/mmsafebench.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/utils/mmsafebench.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"adb7a4c52bd43387"}},{"code_sha256_prefix":"4f5467687896e741","entry":"visualize_attention","repo":"DyMessi/VisCRA","repo_kind":"found_in_text","path":"qwenmask.py","file_url":"https://github.com/DyMessi/VisCRA/blob/HEAD/qwenmask.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"4f5467687896e741"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}