arXiv:2603.00565cs.CVcs.AI2026-03被引 3

通过多图分散与语义重构,突破MLLM安全机制实现高效越狱

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

  • 将恶意语义拆解并分散至多张图像,诱导跨图推理重建攻击意图
  • 在4个闭源模型上平均成功率81.46%,显著优于现有方法
  • 适合研究模型安全漏洞或对抗攻击的开发者参考

多模态大语言模型(MLLM)虽表现优异,但易受越狱攻击,可能生成有害内容并威胁其安全部署。以往方法依赖单图掩码或孤立视觉线索,仅有限扩展推理路径,对强对齐的闭源模型效果有限。本文提出多图分散与语义重构框架(MIDAS),将有害语义分解为风险子单元,分散至多个视觉线索中,利用跨图像推理逐步重构恶意意图,从而绕过现有安全机制。MIDAS强制模型进行更长且结构化的多图链式推理,大幅增加对视觉线索的依赖,延迟恶意语义暴露,显著降低模型的安全注意力,提升越狱效果。在多个数据集和MLLM上的实验表明,MIDAS超越现有最先进越狱攻击,在4个闭源模型上平均攻击成功率达81.46%。代码已公开。

原文摘要 · Abstract (English)

Multimodal Large Language Models (MLLMs) have achieved remarkable performance but remain vulnerable to jailbreak attacks that can induce harmful content and undermine their secure deployment. Previous studies have shown that introducing additional inference steps, which disrupt security attention, can make MLLMs more susceptible to being misled into generating malicious content. However, these methods rely on single-image masking or isolated visual cues, which only modestly extend reasoning paths and thus achieve limited effectiveness, particularly against strongly aligned commercial closed-source models. To address this problem, in this paper, we propose Multi-Image Dispersion and Semantic Reconstruction (MIDAS), a multimodal jailbreak framework that decomposes harmful semantics into risk-bearing subunits, disperses them across multiple visual clues, and leverages cross-image reasoning to gradually reconstruct the malicious intent, thereby bypassing existing safety mechanisms. The proposed MIDAS enforces longer and more structured multi-image chained reasoning, substantially increases the model's reliance on visual cues while delaying the exposure of malicious semantics and significantly reducing the model's security attention, thereby improving the performance of jailbreak against advanced MLLMs. Extensive experiments across different datasets and MLLMs demonstrate that the proposed MIDAS outperforms state-of-the-art jailbreak attacks for MLLMs and achieves an average attack success rate of 81.46% across 4 closed-source MLLMs. Our code is available at this [link](https://github.com/Winnie-Lian/MIDAS).

越狱攻击多模态模型安全机制对抗样本

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。