PiCo: Jailbreaking Multimodal Large Language Models via Pictorial Code Contextualization

2025/04/02 by A. Q. Liu, Lulu Tang, Liu, Aofan +9 · 5 citations
Computer Science · #Advanced Malware Detection Techniques #Adversarial Robustness in Machine Learning #Artificial Intelligence (cs.AI) #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2504.01444

openalex publication_date 2025/04/02 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/30

Abstract

Multimodal Large Language Models (MLLMs), which integrate vision and other modalities into Large Language Models (LLMs), significantly enhance AI capabilities but also introduce new security vulnerabilities. By exploiting the vulnerabilities of the visual modality and the long-tail distribution characteristic of code training data, we present PiCo, a novel jailbreaking framework designed to progressively bypass multi-tiered defense mechanisms in advanced MLLMs. PiCo employs a tier-by-tier jailbreak strategy, using token-level typographic attacks to evade input filtering and embedding harmful intent within programming context instructions to bypass runtime monitoring. To comprehensively assess the impact of attacks, a new evaluation metric is further proposed to assess both the toxicity and helpfulness of model outputs post-attack. By embedding harmful intent within code-style visual instructions, PiCo achieves an average Attack Success Rate (ASR) of 84.13% on Gemini-Pro Vision and 52.66% on GPT-4, surpassing previous methods. Experimental results highlight the critical gaps in current defenses, underscoring the need for more robust strategies to secure advanced MLLMs.

Cited by

• Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities
• AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMs
• Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity
• Fine-Grained Safety Neurons with Training-Free Continual Projection to Reduce LLM Fine Tuning Risks
• Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM

Related

• Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses
• Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
• FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts
• JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
• Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models