Gradient-based Jailbreak Images for Multimodal Fusion Models

TL;DR

This paper introduces a novel gradient-based attack method using tokenizer shortcuts to generate jailbreak images for multimodal fusion models, revealing vulnerabilities and evaluating defenses.

Contribution

It presents the first end-to-end gradient image attack leveraging tokenizer shortcuts for multimodal models, demonstrating effectiveness and efficiency over text-based attacks.

Findings

Jailbreak images elicit harmful responses in 72.5% of prompts.

Attacks outperform text jailbreaks with 3x lower compute.

Representation engineering defenses transfer effectively to image attacks.

Abstract

Augmenting language models with image inputs may enable more effective jailbreak attacks through continuous optimization, unlike text inputs that require discrete optimization. However, new multimodal fusion models tokenize all input modalities using non-differentiable functions, which hinders straightforward attacks. In this work, we introduce the notion of a tokenizer shortcut that approximates tokenization with a continuous function and enables continuous optimization. We use tokenizer shortcuts to create the first end-to-end gradient image attacks against multimodal fusion models. We evaluate our attacks on Chameleon models and obtain jailbreak images that elicit harmful information for 72.5% of prompts. Jailbreak images outperform text jailbreaks optimized with the same objective and require 3x lower compute budget to optimize 50x more input tokens. Finally, we find that representation engineering defenses, like Circuit Breakers, trained only on text attacks can effectively transfer to adversarial image inputs.