Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

This paper demonstrates that individually safe images and prompts can be combined to jailbreak Large Vision-Language Models (LVLMs), exploiting two inherent model properties: universal reasoning capabilities and the safety snowball effect. The authors formalize this into Safety Snowball Agent (SSA), a black-box, agent-based two-stage framework that achieves up to 96.9% jailbreak success rate on GPT-4o using only verified-safe input images.

Problem

Existing jailbreak defenses for LVLMs focus on detecting and filtering unsafe inputs (harmful images, adversarial perturbations, typographic injections). This leaves a critical gap: inputs that individually pass safety filters can be combined to elicit harmful outputs. Prior work targets alignment flaws; this work exposes a more fundamental vulnerability rooted in the models' own reasoning capabilities, making input-filtering defenses insufficient.

Method

SSA operates in two stages:

Stage 1 — Initial Response Generation: 1. Intent recognition: A helper LVLM (GPT-4o) classifies the harmful topic h latent in the input image v. 2. Jailbreak image retrieval: A keyword qt is derived from h, images are retrieved via search API, and CLIP cosine similarity selects the best-matching image v* (still safe per Google Cloud Vision). 3. Overinterpretation trigger: The target LVLM Θ receives {v, v*} plus a non-overtly-harmful question framed around h, producing an initial response yf that implicitly accepts the harmful premise.

Stage 2 — Harmful Snowballing: Building on the established context yf, a refined follow-up prompt A(h ⊕ ps) is issued in a second turn, inducing progressively more harmful outputs ys. This exploits the autoregressive context dependence: once the model has committed to an unsafe framing, single-turn self-correction is unavailable due to transformer depth limitations.

The safety snowball effect is independently validated: LVLMs shown their own harmful outputs via an extra reasoning step correctly label them unsafe (Figure 4), confirming the problem is architectural, not knowledge-based.

Key Contributions

• First demonstration that virtually any image — verified safe by Google Cloud Vision — can serve as a jailbreak vector when combined with safe secondary images and prompts.
• Identification and empirical validation of the safety snowball effect in LVLMs: initial ambiguous responses cascade into overt harmful content across multi-turn interaction.
• SSA: a black-box, fully automated, agent-based jailbreak framework requiring only query access to the target LVLM.
• SafeAttack-Bench: a new red-teaming benchmark of 1,347 Google-Cloud-Vision-verified safe images across six harm categories (violence, terrorism, harassment, hate, self-harm, dangerous objects).
• Neuron-level analysis showing that safe images processed through SSA activate the same "dangerous neurons" in Qwen-VL2 as explicitly unsafe images, explaining mechanistically why safe inputs suffice.

Results

• GPT-4o on MM-SafetyBench: SSA achieves 96.9% unsafe ratio vs. 62.9% for the next-best baseline (Fuzzer); GPT-Score 3.99 vs. 3.72.
• Qwen-VL2 72B on MM-SafetyBench: 85.6% unsafe ratio (SSA) vs. 67.0% (Fuzzer).
• Intern-VL 40B on MM-SafetyBench: 93.8% unsafe ratio (SSA) vs. 62.9% (Fuzzer).
• SafeAttack-Bench (safe images only):
• GPT-4o: unsafe ratio 0.970 (Self-Harm), 0.952 (Dangerous Object), 0.953 (Terrorism).
• InternVL: 0.929 (Dangerous Object), 0.917 (Terrorism).
• Stronger reasoning models (GPT, InternVL) show higher unsafe ratios than weaker ones, consistent with the reasoning-as-vulnerability hypothesis.
• Ablation: Both jailbreak image (visual) and harmful context components are necessary; average GPT-Score with both = 3.64 vs. 1.53 baseline, 2.89 (visual only), 2.65 (context only) on Violence category.
• Harmfulness parity: GPT-4o harmfulness scores from safe vs. unsafe images are nearly identical (4.45 vs. 4.48 on a 0–5 scale).

Limitations

• Evaluation of jailbreak success uses GPT-4o as an automated judge, introducing potential circularity (GPT-4o judges its own outputs in some settings).
• LLaMA3-Guard unsafe ratios are substantially lower than Unsafe Ratio and GPT-Score metrics, indicating metric inconsistency that may inflate reported success rates.
• SSA requires multi-turn interaction; single-turn deployments or strict session-length limits would constrain the attack.
• Defense evaluation is limited to input-level moderators (OpenAI Moderation, Google Vision); output-level filters or multi-step reasoning guards are not fully assessed as mitigations.
• The agent relies on a capable external LVLM (GPT-4o) for intent recognition and prompt generation, creating a practical dependency on API access.

Relevance to Vision-Language Models

This paper reveals a systemic safety failure mode intrinsic to how LVLMs process multi-modal context, distinct from alignment-specific exploits — meaning architectural advances (better reasoning, stronger context integration) may increase vulnerability rather than reduce it. For VLM safety researchers, the safety snowball effect challenges the standard assumption that filtering unsafe inputs is sufficient, and the neuron-activation analysis provides mechanistic grounding for why visual and textual modalities jointly lower the safety threshold. The SafeAttack-Bench benchmark fills a gap for evaluating safe-input attacks, and the finding that more capable models (GPT-4o, InternVL) are more susceptible has direct implications for deployment risk assessment of frontier VLMs.