Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks

Excerpt

arXiv:2610.07009v1 Announce Type: cross Abstract: Image-to-text jailbreaks place harmful intent in text, image content, or the relationship between them. We examine image-side factors across four published attack families on a 313-prompt StrongREJECT slice, using five multimodal models and an additional appendix evaluation of InternVL3.5-8B. The harmful instruction is held constant across conditions; the baseline matrix uses one draw per prompt, and paired ablations use three draws with an autom