Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs

원문 초록

Intent-obfuscation-based jailbreak attacks on multimodal large language models (MLLMs) transform a harmful query into a concealed multimodal input to bypass safety mechanisms. We study these attacks through the lens of a reconstruction-concealment tradeoff: the transformed input must sufficiently obscure harmful intent while preserving enough information for the victim model to recover the underlying request. Through a reconstruction and concealment analysis of representative black-box methods, we find that existing transformations struggle to balance this tradeoff, limiting their effectiveness. In contrast, we show that character-removed variants, constructed by randomly removing characters from the original query, achieve a better balance, motivating their use as the basis for our attack construction. Building on this observation, we propose concealment-aware variant construction, which selects character-removed variants with low harmful keyword/phrase alignment and high mutual diversity, and instantiates them through five prompting strategies that distribute the transformed information across text and image channels. We further introduce keyword/phrase-related distractor images that depict the harmful concept in diverse contexts, providing more effective distraction than generic distractor images. Experiments across diverse closed-source and open-source MLLMs show that the proposed strategies substantially outperform the evaluated baselines. Code and reproduction instructions are available at https://github.com/Farhamdur/CRJ.