When Think-with-Image meets safety: what determines multimodal jailbreak robustness?

In Think-with-Image reasoning across multiple vision-language models, explicit image tool calls have the lowest jailbreak attack success rate, with an average relative reduction of about 30%. Even when the returned images are manually replaced or appear unsafe, the success rate remains low, and only under a pure-text previous-turn control does it rise back to near the level of direct answering. The paper proposes the image-tool safety vector framework, which models image tool calls as a residual shift of hidden representations toward the safety direction.