Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography

TL;DR

Odysseus introduces a novel dual steganography method to covertly embed malicious content in images, effectively bypassing safety filters in commercial multimodal LLM systems and exposing security vulnerabilities.

Contribution

This paper presents Odysseus, a new jailbreak approach using dual steganography to evade safety filters in multimodal LLMs, revealing a critical security blind spot.

Findings

Achieves up to 99% success rate in bypassing safety filters

Reveals limitations of current defenses relying on explicit visibility of malicious content

Demonstrates effectiveness across multiple real-world MLLM systems

Abstract

By integrating language understanding with perceptual modalities such as images, multimodal large language models (MLLMs) constitute a critical substrate for modern AI systems, particularly intelligent agents operating in open and interactive environments. However, their increasing accessibility also raises heightened risks of misuse, such as generating harmful or unsafe content. To mitigate these risks, alignment techniques are commonly applied to align model behavior with human values. Despite these efforts, recent studies have shown that jailbreak attacks can circumvent alignment and elicit unsafe outputs. Currently, most existing jailbreak methods are tailored for open-source models and exhibit limited effectiveness against commercial MLLM-integrated systems, which often employ additional filters. These filters can detect and prevent malicious input and output content, significantly reducing jailbreak threats. In this paper, we reveal that the success of these safety filters heavily relies on a critical assumption that malicious content must be explicitly visible in either the input or the output. This assumption, while often valid for traditional LLM-integrated systems, breaks down in MLLM-integrated systems, where attackers can leverage multiple modalities to conceal adversarial intent, leading to a false sense of security in existing MLLM-integrated systems. To challenge this assumption, we propose Odysseus, a novel jailbreak paradigm that introduces dual steganography to covertly embed malicious queries and responses into benign-looking images. Extensive experiments on benchmark datasets demonstrate that our Odysseus successfully jailbreaks several pioneering and realistic MLLM-integrated systems, achieving up to 99% attack success rate. It exposes a fundamental blind spot in existing defenses, and calls for rethinking cross-modal security in MLLM-integrated systems.