Jailbreaking Frontier Foundation Models Through Intention Deception¶

🕒 Published (v1): 2026-04-27 06:12 UTC · Source: Arxiv · Venue: CVPR 2026 · link

Why this paper was selected

Jailbreaks via intention deception bypass safety training; CVPR 2026 novel vector

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

TL;DR¶

iDecep is a multi-turn jailbreaking attack that disguises malicious goals behind a coherent benign narrative, exploiting the "safe completion" paradigm (as in GPT-5) rather than traditional refusal-based safety. It introduces para-jailbreaking: the victim model refuses to directly answer a harmful query yet discloses exploitable harmful information in its "safe" alternative response. The method achieves high attack success rates against GPT-5-thinking and Claude-Sonnet-4.5, including on highly restricted categories such as biological and chemical weapons.

Problem¶

State-of-the-art frontier models have shifted from hard refusal training to safe completion—maximizing helpfulness while self-monitoring outputs. This replaces a single binary refusal decision with a dual decomposition \((y^{\text{direct}}, y^{\text{alt}})\), where the model is rewarded for providing helpful alternatives to unsafe queries. The attack surface this introduces—particularly the risk that \(y^{\text{alt}}\) is deemed safe internally but is externally harmful—has not been systematically studied or exploited. Prior multi-turn attacks (Crescendo, CoA) start with neutral queries and steer gradually; iDecep instead maintains close alignment with the harmful goal from the start, embedded inside a plausible benign framing. Multi-turn VLM attacks are also underexplored.

Method¶

iDecep operates as a black-box attacker against a victim VLM \(M_\theta\) with safe-completion policy \(\pi_\theta^{\text{safe}}\). The framework has three components: (1) a query generator \(f_Q = (f_Q^{\text{intention}}, f_Q^{\text{query}})\), (2) an evaluator \(f_E = (f_E^{\text{bin}}, f_E^{\text{trace}})\), and (3) a memory module \(\Sigma_t\). A benign cover intention \(I\) is sampled from \(f_Q^{\text{intention}}(G)\) and accepted only if \(f_E^{\text{bin}}(I, G; \phi_{\text{intent}}) = 1\), enforcing that it is topically relevant yet innocuous-appearing. Each query \(x_{t+1} \sim f_Q^{\text{query}}(\cdot \mid \Sigma_t)\) anchors on segments of the previous victim response that simultaneously reinforce the benign cover and steer toward \(G\). The explore-then-exploit algorithm (Algorithm 1) first runs \(T_{\text{explore}}\) turns of open dialogue to identify exploitable response segments, then fans out into tree-structured sub-dialogues via DialogBranch (Algorithm 2), each probing a candidate exploitation point with a regeneration budget \(B_{\text{regen}}\). For VLM targets, benign images from public sources are injected alongside text to reinforce the legitimate framing and lower safety thresholds. Para-jailbreaking is formalized as \(\delta_{\text{para}} = P[f_J(y^{\text{alt}}, G)=1,\; f_J(y^{\text{direct}}, G)=0 \mid f_S(y,H)=1]\): the external judge \(f_J\) deems the alternative harmful even though the internal safeguard \(f_S\) passed it.

Theoretical results (Theorems 1–3): Under safe completion, intention deception provably increases \(P_{\text{para}}(\mu^{\text{id}}) \geq P_{\text{para}}(\mu^0)\); with an informative internal evaluator (correlation advantage \(\gamma > 0\)), the lower bound on total attack success \(P^{\text{attack}}(\mu^{\text{id}}) \geq P^{\text{attack}}(\mu^0)\) is certified; a mild non-negativity assumption on the incremental direct hazard extends this to a guaranteed increase in total success rate.

Key Contributions¶

iDecep attack: a multi-turn, intention-deception jailbreak maintaining a coherent benign narrative from turn 1, targeting both \(y^{\text{direct}}\) and \(y^{\text{alt}}\) failure modes.
Para-jailbreaking: formally defines and quantifies a new vulnerability class where \(f_J(y^{\text{alt}}, G) = 1\) despite \(f_S(y, H) = 1\)—harmful content leaks through "safe" alternatives.
Automated explore-then-exploit: tree-structured branching algorithm that scales the attack without requiring human-in-the-loop prompt engineering.
Multimodal extension: demonstrates that pairing benign images with text queries increases harmful output frequency in VLMs.
Theoretical guarantees: three theorems proving that intention deception monotonically increases para-jailbreaking risk and (under mild assumptions) total attack success under safe-completion policies.

Results¶

High success rates against GPT-5-thinking and Claude-Sonnet-4.5, including on explicitly restricted categories (biological warfare, chemical weapons).
iDecep outperforms prior multi-turn baselines (Crescendo, Chain-of-Attack) on multimodal VLM targets.
Adding benign images to queries increases the occurrence of harmful answers compared to text-only iDecep.
Para-jailbreaking is shown to occur systematically (not incidentally) under safe-completion models, including cases where the model explicitly refuses the direct query yet provides exploitable lists of equipment, procedures, or transfer pathways.
(Specific ASR percentages are not reported in the provided text.)

Limitations¶

Attack success rates are not numerically tabulated in the provided excerpt; exact ASR figures and per-category breakdowns are deferred to Section 5.
The method requires an LLM/VLM as the attacker model itself, increasing operational cost relative to single-turn prompt injection.
The theoretical guarantees rely on the assumption that intention deception does not reduce expected direct hazard (Eq. 29), which is asserted but not proven to hold universally.
Defense implications are discussed but no countermeasure is proposed or evaluated; the paper identifies para-jailbreaking as an open problem for future safeguard design.
Evaluation is limited to two frontier models (GPT-5-thinking, Claude-Sonnet-4.5) and unspecified VLM targets; generalization to other frontier systems is not demonstrated.

Relevance to Vision-Language Models¶

This work directly implicates VLMs as a distinct and underexplored attack surface: the vision modality both enriches benign framing and lowers the safety threshold, systematically increasing harmful output rates beyond text-only attacks. The paper extends the formal safe-completion failure decomposition to multimodal inputs \(x_t = (v_t, s_t)\), showing that safety alignment trained on text-only interactions does not transfer robustly to multimodal contexts. For researchers tracking VLMs, the para-jailbreaking concept is particularly actionable: it signals that evaluating VLM safety solely on direct-answer refusal rates substantially underestimates real harm exposure, since harmful content can leak through image-anchored alternative responses that pass internal safeguards. This motivates rethinking both attack benchmarks and safety evaluation protocols for multimodal systems.