Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

TL;DR

This paper reveals a new vulnerability in large vision-language models where unsafe content can be assembled from seemingly benign visual prompts, leading to unsafe outputs despite safety measures.

Contribution

The paper introduces StructAttack, a novel black-box attack method that exploits semantic slot filling to generate harmful outputs from benign-looking prompts.

Findings

StructAttack effectively induces unsafe outputs across multiple models.

Semantic slot decomposition can be exploited to assemble harmful content.

The attack works without triggering existing safety mechanisms.

Abstract

Despite the rapid progress of Large Vision-Language Models (LVLMs), the integration of visual modalities introduces new safety vulnerabilities that adversaries can exploit to elicit biased or malicious outputs. In this paper, we demonstrate an underexplored vulnerability via semantic slot filling, where LVLMs complete missing slot values with unsafe content even when the slot types are deliberately crafted to appear benign. Building on this finding, we propose StructAttack, a simple yet effective single-query jailbreak framework under black-box settings. StructAttack decomposes a harmful query into a central topic and a set of benign-looking slot types, then embeds them as structured visual prompts (e.g., mind maps, tables, or sunburst diagrams) with small random perturbations. Paired with a completion-guided instruction, LVLMs automatically recompose the concealed semantics and generate unsafe outputs without triggering safety mechanisms. Although each slot appears benign in isolation (local benignness), StructAttack exploits LVLMs' reasoning to assemble these slots into coherent harmful semantics. Extensive experiments on multiple models and benchmarks show the efficacy of our proposed StructAttack.