MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Yilian Liu; Xiaojun Jia; Guoshun Nan; Jiuyang Lyu; Zhican Chen; Tao Guan; Shuyuan Luo; Zhongyi Zhai

cs.CVFeb 28, 2026

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Authors: Yilian Liu, Xiaojun Jia, Guoshun Nan, Jiuyang Lyu, Zhican Chen, Tao Guan, Shuyuan Luo, Zhongyi Zhai,

Organizations: Beijing University of Posts and Telecommunications, China · Nanyang Technological University, Singapore · Guilin University of Electronic Technology, China

Abstract

Multimodal Large Language Models (MLLMs) have achieved remarkable performance but remain vulnerable to jailbreak attacks that can induce harmful content and undermine their secure deployment. Previous studies have shown that introducing additional inference steps, which disrupt security attention, can make MLLMs more susceptible to being misled into generating malicious content. However, these methods rely on single-image masking or isolated visual cues, which only modestly extend reasoning paths and thus achieve limited effectiveness, particularly against strongly aligned commercial closed-source models. To address this problem, in this paper, we propose Multi-Image Dispersion and Semantic Reconstruction (MIDAS), a multimodal jailbreak framework that decomposes harmful semantics into risk-bearing subunits, disperses them across multiple visual clues, and leverages cross-image reasoning to gradually reconstruct the malicious intent, thereby bypassing existing safety mechanisms. The proposed MIDAS enforces longer and more structured multi-image chained reasoning, substantially increases the model's reliance on visual cues while delaying the exposure of malicious semantics and significantly reducing the model's security attention, thereby improving the performance of jailbreak against advanced MLLMs. Extensive experiments across different datasets and MLLMs demonstrate that the proposed MIDAS outperforms state-of-the-art jailbreak attacks for MLLMs and achieves an average attack success rate of 81.46% across 4 closed-source MLLMs. Our code is available at this link.

Figures & tables

Figure 1: Overview. (a) Compared to text-only (T) and text+image (T+I) attacks that are blocked by safety filters, our proposed MIDAS leverages Game-based Visual Reasoning (GVR) to bypass defenses and induce harmful outputs. (b) Examples of visual reasoning puzzles used in our MIDAS. (c) Our proposed MIDAS achieves significantly higher Attack Success Rate (ASR) and Harmfulness Rating (HR) than other baselines.

Figure 2: Pipeline of MIDAS . (1) Text Process : extract risk-bearing units, decompose them into subunits, and replace them with placeholders; (2) Image Process : embed the subunits into multiple benign-looking puzzle images that enforce step-by-step reasoning; (3) Model Output : the model decodes puzzle fragments, reconstructs the hidden semantics, and generates harmful responses under persona-driven reasoning guidance.

Panel of Figure 3 — Figure 3: Hyper-parameter sensitivity analysis. ASR and HR under different hyper-parameter settings: (a) varying the number of decomposed keywords $k$ , and (b) varying the number of reasoning images $H$ .

Method	Gemini-2.5-FT		Gemini-2.5-Pro		GPT-4o		GPT-5-Chat		QVQ-Max		Qwen2.5-VL		InternVL2.5
Method	ASR	HR	ASR	HR	ASR	HR	ASR	HR	ASR	HR	ASR	HR	ASR	HR
FigStep ( Gong et al., 2025 )	6.32	0.25	3.21	0.12	2.78	0.12	0.00	0.03	38.78	1.61	4.02	0.20	14.86	0.48
HADES ( Li et al., 2024b )	2.43	0.11	12.44	0.53	5.62	0.24	2.40	0.14	43.37	1.74	10.04	0.42	14.86	0.48
SI-Attack ( Zhao et al., 2025b )	4.11	0.87	0.00	0.50	8.10	0.55	1.64	0.41	11.89	1.01	29.32	1.31	24.79	1.16
VisCRA ( Sima et al., 2025 )	46.98	2.22	12.05	0.74	34.28	1.34	7.69	0.39	65.87	2.83	10.04	0.43	19.68	0.66
HIMRD ( Teng et al., 2024 )	8.40	0.42	40.20	1.43	40.10	1.46	8.80	0.37	17.00	0.93	65.80	2.47	/	/

Table 1: Comparison results with state-of-the-art jailbreak methods on the HADES benchmark across 4 commercial models and 3 open-source models. Bold numbers indicate the best jailbreak performance.

Method	Gemini-2.5-FT		Gemini-2.5-Pro		GPT-4o		GPT-5-Chat		QVQ-Max
Method	ASR	HR	ASR	HR	ASR	HR	ASR	HR	ASR	HR
FigStep ( Gong et al., 2025 )	20.56	0.71	11.82	0.46	11.93	0.51	11.82	0.49	22.78	0.94
SI-Attack ( Zhao et al., 2025b )	5.52	0.89	0.60	0.86	0.00	0.38	5.52	0.63	13.94	1.29
VisCRA ( Sima et al., 2025 )	49.70	2.29	35.92	1.69	37.12	1.68	20.24	0.97	82.20	3.53
HIMRD ( Teng et al., 2024 )	10.20	0.67	38.30	1.38	26.40	0.95	26.40	0.97	16.80	1.10
MIDAS (ours)	99.16	4.35	92.17	3.94	61.07	2.53	81.54	3.49	98.65	4.21

Table 2: Comparison results with state-of-the-art jailbreak methods on the MM-SafetyBench (tiny) benchmark across 4 commercial models and 1 open-source model. Bold numbers indicate the best jailbreak performance.

Method	Gemini-2.5-FT		Gemini-2.5-Pro		GPT-4o		GPT-5-Chat		QVQ-Max
Method	ASR	HR	ASR	HR	ASR	HR	ASR	HR	ASR	HR
FigStep ( Gong et al., 2025 )	0.00	0.60	4.00	0.52	0.00	0.35	0.00	0.00	30.61	1.04
HIMRD ( Teng et al., 2024 )	18.30	0.71	2.00	0.12	12.00	0.54	0.00	0.08	10.20	0.67
MIDAS (ours)	90.00	4.57	97.96	3.90	80.00	3.12	64.00	3.02	95.83	4.19

Table 3: Comparison results with state-of-the-art jailbreak methods on Advbench benchmark across 4 commercial models and 1 open-source model. Bold numbers indicate the best jailbreak performance.

Method	Gemini-2.5-Pro (s)	GPT-5-Chat (s)
HIMRD	3357.00	105.71
VisCRA	258.98	128.47
MIDAS	190.23	55.63

Table 4: Runtime comparison of different jailbreak methods on Gemini-2.5-Pro and GPT-5-Chat.

Method Variant	ASR (%)	HR
w/o Multi-Image (Single Image)	50	2.04
w/o Dispersion (Intact Semantics)	70	2.90
w/o Game-Style Reasoning	22	0.92
w/o Role-Driven Induction	59	2.53
Full MIDAS	80	3.12

Table 5: Ablation study of MIDAS on Advbench.

	VisCRA	MIDAS (ours)
Avg. kw. pos. (%)	$48.44$	64.53
Avg. reason. len. (tok.)	$419.64$	3195.30

Table 6: Comparison of keyword exposure position and reasoning length on the HADES benchmark.

Panel of Figure 4 — Figure 4: Evaluation using safety mechanisms. (a) Evaluation results using LlamaGuard, showing the percentage of safe versus unsafe responses for the original model, HIMRD, and our proposed method. (b) Attack Success Rate (ASR) across different defense strategies (VisCRA and MIDAS). The annotated values indicate the relative ASR drop compared to the baseline (No Defense).

Figure 5: Case study of MIDAS: a dispersed harmful query evades safety detection and is progressively reconstructed through cross-modal reasoning into a harmful output.

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6: GVR Case: Letter Equation Puzzle, the answer is “A”

Figure 7: GVR Case: Rank-and-Read Puzzle, the answer is “cin”

Figure 8: GVR Case: Odd-One-Out Puzzle, the answer is “PLA”

Figure 9: GVR Case: Jigsaw Letter Puzzle, the answer is “ha”

Figure 10: GVR Case: Navigate-and-Read Puzzle, the answer is “ha”

Figure 11: GVR Case: CAPTCHA Puzzle, the answer is “ranso”

Method	No Defense	ShieldLM	Self-Reminder
VisCRA	49.70%	17.81%	14.88%
MIDAS (Ours)	99.16%	48.81%	88.10%

Appendix

Table 7: ASR comparison between VisCRA and our MIDAS under different defense mechanisms. MIDAS demonstrates significantly higher robustness against both external filtering and internal self-correction.

Model	Method	Original	System Prompt 1	System Prompt 2	System Prompt 3
Gemini-2.5-Pro	VisCRA	35.92%	11.90%	10.12%	5.36%
Gemini-2.5-Pro	MIDAS (Ours)	92.17%	75.00%	66.67%	67.26%
GPT-5-Chat	VisCRA	20.24%	3.57%	0.00%	0.00%
GPT-5-Chat	MIDAS (Ours)	81.54%	39.88%	22.02%	35.71%

Appendix

Table 8: ASR comparison under different defensive system prompts.

Template	ASR (%)
Jigsaw Letter	89.30
Rank-and-Read	89.80
Odd-One-Out	91.84
Navigate-and-Read	91.66
CAPTCHA	87.94
All Templates (Combined)	97.96

Appendix

Table 9: ASR of different puzzle templates on Advbench attacking Gemini-2.5-Pro.

Template	Vis.	Rule	Reason.	Search	Prior	Overall
Letter Equation	2.43	3.23	3.23	1.73	2.13	12.75
Jigsaw Letter	3.54	2.04	2.72	3.00	1.69	12.99
Rank-and-Read	2.05	2.04	2.03	1.62	1.20	8.94
Odd-One-Out	3.06	2.19	2.19	2.77	1.05	11.26
Navigate-and-Read	2.87	2.45	2.38	1.68	1.44	10.82
CAPTCHA	3.68	3.13	3.20	2.62	2.05	14.68

Appendix

Table 10: Scores across five dimensions of game-based reasoning (1–5 scale for each dimension). Higher scores indicate greater cognitive or perceptual difficulty.

Complexity Level	ASR (%)	HR
Easy	66.67	2.97
Medium (Ours)	97.96	3.90
Hard	85.71	3.88

Appendix

Table 11: ASR and HR under different manually adjust complexity levels on Gemini-2.5-Pro.

Target Model	Method	Gemini-2.5-FT		Qwen3		DeepSeek-R1		GPT-5-nano
Target Model	Method	ASR (%)	HR	ASR (%)	HR	ASR (%)	HR	ASR (%)	HR
GPT-4o	FigStep	5.95	0.18	9.52	0.33	8.33	0.32	11.82	0.51
	VisCRA	35.71	1.40	26.20	1.00	38.10	1.26	37.12	1.68
	HIMRD	20.24	1.02	19.04	0.85	25.00	1.05	26.40	0.97
	MIDAS (Ours)	61.90	2.46	61.90	2.46	61.90	2.44	61.07	2.53
GPT-5-Chat	FigStep	10.12	0.34	10.12	0.32	10.12	0.34	11.82	0.49

Appendix

Table 12: Cross-judge evaluation results attacking GPT-4o and GPT-5-Chat. While absolute scores vary slightly due to different judge strictness, MIDAS consistently outperforms all baselines across every evaluator, confirming that our results are robust to the choice of judge.

Panel of Figure 12 — Figure 12: Comparative Visualizations(1)

Figure 13: Case 1 on Gemini-2.5-Pro of HADES-Selfharm

Figure 14: Case 2 on GPT-5-Chat of AdvBench

Figure 15: Case 3 on GPT-5-Chat on MM-SafetyBench

Figure 16: Case 4 on GPT-5-Chat of HADES-Privacy

Figure 17: Case 5 on Qwen2.5-VL of HADES-Financial

Figure 18: Case 6 on InternVL2.5 on HADES-Animal

Multimodal Jailbreak Attacks

Multimodal jailbreak attacks exploit text, images, audio, or video to make AI systems bypass safety constraints.

See all 28 papers

May 18, 2026

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, DMN, which leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.

Wenzhuo Xu, Zhipeng Wei, Zonghao Ying +4

AI Security Lab, Beijing, China · International Computer Science Institute, CA, USA · UC Berkeley, CA, USA +1

Multimodal Large Language Models LLM Safety Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models

Ask PDF

May 7, 2026

Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs

Intent-obfuscation-based jailbreak attacks on multimodal large language models (MLLMs) transform a harmful query into a concealed multimodal input to bypass safety mechanisms. We show that such attacks are governed by a reconstruction--concealment tradeoff: the transformed input must hide harmful intent from safety filters while remaining recoverable enough for the victim model to reconstruct the original request. Through a reconstruction analysis of three representative black-box methods, we find that existing transformations struggle to balance this tradeoff, limiting their effectiveness. In contrast, we show that character-removed variants achieve a better balance. Building on this, we propose concealment-aware variant construction, which greedily selects character-removed variants that are low in harmful-keyword alignment and mutually diverse, and instantiates them through five modality-aware prompting strategies. We further introduce keyword-related distractor images that depict the harmful keyword in diverse contexts, providing more effective auxiliary visual context than generic distractor images. Experiments across closed-source and open-source MLLMs show the proposed strategies outperform strong baselines, revealing an underexplored vulnerability: a model's own reconstruction ability can be exploited to recover hidden harmful intent and produce unsafe responses.

Md Farhamdur Reza, Richeng Jin, Tianfu Wu +1

1NC State University · 2Zhejiang University

Multimodal Large Language Models Jailbreak Attacks Multimodal Jailbreak Attacks Adversarial Text Attacks

Ask PDF

Dec 21, 2024

Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models

Large language models (LLMs) are widely applied in various fields of society due to their powerful reasoning, understanding, and generation capabilities. However, the security issues associated with these models are becoming increasingly severe. Jailbreaking attacks, as an important method for detecting vulnerabilities in LLMs, have been explored by researchers who attempt to induce these models to generate harmful content through various attack methods. Nevertheless, existing jailbreaking methods face numerous limitations, such as excessive query counts, limited coverage of jailbreak modalities, low attack success rates, and simplistic evaluation methods. To overcome these constraints, this paper proposes a multimodal jailbreaking method: JMLLM. This method integrates multiple strategies to perform comprehensive jailbreak attacks across text, visual, and auditory modalities. Additionally, we contribute a new and comprehensive dataset for multimodal jailbreaking research: TriJail, which includes jailbreak prompts for all three modalities. Experiments on the TriJail dataset and the benchmark dataset AdvBench, conducted on 13 popular LLMs, demonstrate advanced attack success rates and significant reduction in time overhead.

Yanxu Mao, Peipei Liu, Tiehan Cui +3

School of Computer Science and Technology, Shanghai Jiao Tong University, Shanghai, China · Zhongguancun Laboratory, Beijing, China · School of Software, Henan University, Kaifeng, China +1

Adversarial Attacks on LLMs Multimodal Large Language Models LLM Safety Multimodal Jailbreak Attacks

Ask PDF

Abstract

Multimodal Jailbreak Attacks

Explore similar work

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs

Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models