Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak

Xu Zhang; Ziqing Hu; Shuo Han; Ren Wang

cs.LGOct 28, 2026

Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak

Authors: Xu Zhang, Ziqing Hu, Shuo Han, Ren Wang

Organizations: Illinois Institute of Technology, Chicago, IL, USA · Perplexity AI · University of Illinois Chicago, Chicago, IL, USA

Abstract

Multimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards. Existing methods typically optimize isolated adversarial examples, limiting attack diversity, transferability, and generalization. We propose Jailbreak Connectivity (JC), a framework based on the observation that effective adversarial inputs can be connected through low-loss regions in image space. JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries. On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points. In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively. These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.

Figures & tables

Fig. 1: The Jailbreak Connectivity (JC) framework. JC addresses three key limitations of existing methods by generating diverse and transferable attacks and enabling universal jailbreak capabilities.

Fig. 2: Comparison of the optimized Bézier curve and linear interpolation on Qwen3-VL-8B-Instruct. (a) Jailbreak loss along each path. (b) Binary attack success.

Scenario	Qwen3-VL-8B				InternVL3.5-8B				Gemma-3-12B
Scenario	PT	AE	QI	JC	PT	AE	QI	JC	PT	AE	QI	JC
Economic Harm	4.37 $\pm$ 2.00	17.07 $\pm$ 4.42	14.59 $\pm$ 3.59	100.00 $\pm$ 0.00	4.23 $\pm$ 1.76	36.10 $\pm$ 4.64	41.49 $\pm$ 4.53	100.00 $\pm$ 0.00	7.05 $\pm$ 2.41	31.45 $\pm$ 3.72	42.14 $\pm$ 5.07	100.00 $\pm$ 0.00
Financial Advice	9.56 $\pm$ 2.50	15.91 $\pm$ 4.24	26.54 $\pm$ 3.78	100.00 $\pm$ 0.00	2.04 $\pm$ 1.64	37.91 $\pm$ 4.31	16.47 $\pm$ 3.39	100.00 $\pm$ 0.00	7.85 $\pm$ 2.93	34.75 $\pm$ 4.12	40.34 $\pm$ 4.11	97.09 $\pm$ 1.65
Fraud	7.59 $\pm$ 2.64	15.97 $\pm$ 3.81	29.51 $\pm$ 5.11	57.54 $\pm$ 10.90	8.77 $\pm$ 2.87	30.33 $\pm$ 3.90	22.59 $\pm$ 3.41	62.76 $\pm$ 10.60	3.14 $\pm$ 2.02	9.63 $\pm$ 3.01	16.80 $\pm$ 3.54	96.79 $\pm$ 0.51
Government Decision	6.39 $\pm$ 1.99	20.56 $\pm$ 4.72	8.77 $\pm$ 2.35	41.19 $\pm$ 10.80	6.61 $\pm$ 2.79	38.30 $\pm$ 4.55	35.71 $\pm$ 5.00	94.98 $\pm$ 1.96	7.55 $\pm$ 3.05	28.46 $\pm$ 4.86	32.08 $\pm$ 4.23	100.00 $\pm$ 0.00
Hate Speech	2.40 $\pm$ 1.78	28.94 $\pm$ 3.79	30.09 $\pm$ 5.48	85.85 $\pm$ 8.57	3.98 $\pm$ 2.26	27.76 $\pm$ 5.27	15.69 $\pm$ 3.64	100.00 $\pm$ 0.00	4.31 $\pm$ 2.26	17.61 $\pm$ 4.04	38.05 $\pm$ 4.36	100.00 $\pm$ 0.00

TABLE I: White-box ASR (%) of different jailbreak methods across 13 safety scenarios on three MLLMs. Results are reported with their corresponding uncertainty estimates. Best results within each model and scenario are highlighted in bold. For brevity, column headers omit the -Instruct and -IT suffixes of the model names.

Scenario	Qwen3-VL-8B				InternVL3.5-8B				Gemma-3-12B
Scenario	PT	AE	QI	JC	PT	AE	QI	JC	PT	AE	QI	JC
Economic Harm	6.50 $\pm$ 0.89	15.31 $\pm$ 1.79	24.39 $\pm$ 1.08	2.12 $\pm$ 0.14	6.43 $\pm$ 0.44	27.83 $\pm$ 0.85	47.04 $\pm$ 0.64	2.75 $\pm$ 0.21	7.69 $\pm$ 0.73	24.77 $\pm$ 0.11	47.59 $\pm$ 1.12	3.33 $\pm$ 0.37
Financial Advice	8.80 $\pm$ 0.32	14.55 $\pm$ 1.71	34.46 $\pm$ 0.35	3.13 $\pm$ 0.34	5.46 $\pm$ 1.71	29.02 $\pm$ 0.50	25.98 $\pm$ 0.61	2.90 $\pm$ 0.40	8.05 $\pm$ 1.41	26.94 $\pm$ 0.39	46.07 $\pm$ 0.27	3.95 $\pm$ 0.48
Fraud	7.93 $\pm$ 0.99	14.59 $\pm$ 1.18	36.96 $\pm$ 1.54	2.34 $\pm$ 0.35	8.45 $\pm$ 1.07	24.03 $\pm$ 0.32	31.13 $\pm$ 0.17	2.93 $\pm$ 0.67	5.95 $\pm$ 1.71	10.41 $\pm$ 1.09	26.25 $\pm$ 0.76	4.35 $\pm$ 0.58
Government Decision	7.39 $\pm$ 0.16	17.61 $\pm$ 1.76	19.49 $\pm$ 0.23	26.26 $\pm$ 4.11	7.49 $\pm$ 1.55	29.27 $\pm$ 0.71	42.18 $\pm$ 1.20	20.67 $\pm$ 5.73	7.91 $\pm$ 1.70	22.80 $\pm$ 1.35	39.12 $\pm$ 0.58	16.49 $\pm$ 1.90
Hate Speech	5.62 $\pm$ 1.74	23.12 $\pm$ 0.26	37.44 $\pm$ 1.88	2.32 $\pm$ 0.52	6.32 $\pm$ 1.71	22.34 $\pm$ 1.80	25.32 $\pm$ 1.00	2.99 $\pm$ 0.40	6.47 $\pm$ 1.50	15.66 $\pm$ 1.27	44.15 $\pm$ 0.54	4.20 $\pm$ 0.86

TABLE II: PPL of generated responses under different jailbreak methods across 13 safety scenarios. Lower PPL indicates higher likelihood under the evaluation language model. Best results within each model and scenario are highlighted in bold.

Scenario	Qwen3-VL-8B (Source)		InternVL3.5-8B		Gemma-3-12B
Scenario	FORCE	JC	FORCE	JC	FORCE	JC
Economic Harm	84.24 $\pm$ 3.21	87.12 $\pm$ 3.27	82.09 $\pm$ 3.62	80.60 $\pm$ 4.29	81.61 $\pm$ 3.75	75.61 $\pm$ 3.95
Financial Advice	92.31 $\pm$ 2.68	86.82 $\pm$ 2.87	81.42 $\pm$ 3.29	74.97 $\pm$ 4.78	69.65 $\pm$ 4.09	83.01 $\pm$ 3.43
Fraud	51.35 $\pm$ 5.18	49.96 $\pm$ 4.99	48.31 $\pm$ 5.72	52.86 $\pm$ 5.11	71.78 $\pm$ 3.82	77.97 $\pm$ 3.38
Government Decision	35.99 $\pm$ 3.93	36.26 $\pm$ 3.91	77.72 $\pm$ 4.37	70.33 $\pm$ 5.06	79.33 $\pm$ 3.79	84.30 $\pm$ 3.80
Hate Speech	69.70 $\pm$ 4.79	77.48 $\pm$ 4.86	69.33 $\pm$ 4.30	86.82 $\pm$ 3.37	71.43 $\pm$ 5.32	85.55 $\pm$ 3.52

TABLE III: Transferable jailbreak ASR (%) of FORCE and JC across 13 safety scenarios. Adversarial images are generated using Qwen3-VL-8B-Instruct as the source model and evaluated on InternVL3.5-8B and Gemma-3-12B-IT as transfer targets. Best results are highlighted in bold.

Scenario	GPT-5.6				Gemini 3.1 Pro
	ASR (%) $\uparrow$		PPL $\downarrow$		ASR (%) $\uparrow$		PPL $\downarrow$
	FigStep	JC	FigStep	JC	FigStep	JC	FigStep	JC
Economic Harm	12.74 $\pm$ 2.93	34.48 $\pm$ 4.18	11.06 $\pm$ 1.89	9.55 $\pm$ 0.89	33.25 $\pm$ 4.44	67.46 $\pm$ 4.42	16.90 $\pm$ 1.02	13.51 $\pm$ 1.38
Financial Advice	27.72 $\pm$ 4.50	59.83 $\pm$ 4.93	12.03 $\pm$ 0.24	9.18 $\pm$ 0.32	31.95 $\pm$ 3.95	65.58 $\pm$ 4.02	12.33 $\pm$ 0.82	8.69 $\pm$ 1.47
Fraud	22.03 $\pm$ 4.30	50.21 $\pm$ 5.18	10.97 $\pm$ 0.90	9.20 $\pm$ 0.99	23.34 $\pm$ 4.84	53.11 $\pm$ 5.72	19.35 $\pm$ 0.24	16.63 $\pm$ 1.11
Government Decision	18.57 $\pm$ 3.18	44.34 $\pm$ 4.07	14.15 $\pm$ 0.29	10.65 $\pm$ 0.16	32.73 $\pm$ 4.92	56.72 $\pm$ 4.94	9.41 $\pm$ 0.53	7.89 $\pm$ 1.49

TABLE IV: Black-box jailbreak performance of FigStep and JC against GPT-5.6 and Gemini 3.1 Pro across 13 safety scenarios. Qwen3-VL-8B-Instruct serves as the base model for JC. Results are reported as mean

\pm

standard deviation over five independent runs. Higher ASR and lower PPL are preferable.

Configuration	Qwen3-VL-8B-Instruct		InternVL3.5-8B		Gemma-3-12B-IT
Configuration	ASR (%) $\uparrow$	PPL $\downarrow$	ASR (%) $\uparrow$	PPL $\downarrow$	ASR (%) $\uparrow$	PPL $\downarrow$
JC (Full)	74.56 $\pm$ 0.88	5.84 $\pm$ 0.36	70.01 $\pm$ 0.91	3.46 $\pm$ 0.49	78.56 $\pm$ 0.90	5.77 $\pm$ 0.32
w/o Path	28.65 $\pm$ 4.49	7.94 $\pm$ 1.08	27.68 $\pm$ 3.19	4.82 $\pm$ 0.90	35.04 $\pm$ 2.96	7.84 $\pm$ 1.16
w/o JSP	79.34 $\pm$ 3.30	7.44 $\pm$ 1.11	54.85 $\pm$ 4.68	3.83 $\pm$ 0.82	54.04 $\pm$ 4.58	7.25 $\pm$ 1.29
w/o SC	75.85 $\pm$ 3.40	8.31 $\pm$ 1.64	39.32 $\pm$ 2.58	4.08 $\pm$ 1.22	55.62 $\pm$ 5.23	8.51 $\pm$ 1.31

TABLE V: Ablation study of JC under the transferable jailbreak setting, with Qwen3-VL-8B-Instruct as the source model and InternVL3.5-8B and Gemma-3-12B-IT as transfer targets. We report ASR (%) and PPL as mean

\pm

standard deviation over five independent runs. Higher ASR and lower PPL are preferable. Best results are highlighted in bold.

Jailbreak Attacks

Jailbreak attacks exploit prompts, context, or model representations to bypass AI safeguards and elicit disallowed outputs.

See all 76 papers

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
May 18, 2026Wenzhuo Xu, Zhipeng Wei, Zonghao Ying +4Multimodal Large Language Models LLM Safety
AI Security Lab, Beijing, China · International Computer Science Institute, CA, USA · UC Berkeley, CA, USA +1
MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs
Feb 28, 2026Yilian Liu, Xiaojun Jia, Guoshun Nan +6Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models
Beijing University of Posts and Telecommunications, China · Nanyang Technological University, Singapore · Guilin University of Electronic Technology, China
Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
Aug 27, 2026Benlei Cui, Shen Pang, Yuke Wang +7VLM Robustness Adversarial Attacks on VLMs
1Yuvion Team, Alibaba Group · Laboratory for Statistical Monitoring and Intelligent Governance of Common Prosperity, School of Statistics and Data Science, Zhejiang Gongshang University

May 18, 2026J/K move · Enter open · S save

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

Wenzhuo Xu, Zhipeng Wei, Zonghao Ying, Deyue Zhang+3

AI Security Lab, Beijing, China · International Computer Science Institute, CA, USA · UC Berkeley, CA, USA+1

Multimodal Large Language Models LLM Safety Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models

Open paper AskPDF arXiv

Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, DMN, which leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.

Abstract

Jailbreak Attacks

Explore similar work

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models