Model as Lego builder: assembling malicious content from harmless blocks using a semantic blueprint

LVLMs may write harmful content when completing individually seemingly harmless semantic slots; the authors accordingly propose the black-box, single-query StructAttack.

• Scenario: The authors state that LVLMs are pretrained on open data and safety-aligned with SFT and RLHF, but vulnerabilities may remain. The authors state that the visual modality further amplifies potential safety risks, and red teaming needs diverse attacks to probe them.
• Limitations of existing work: The authors state that image adversarial perturbations usually require white-box parameters and are time-consuming to optimize. FigStep and HADES put malicious intent into typography or OCR; the authors state that as OCR filtering improves, such typography-based methods have become ineffective. SI-Attack and JOOD require iterative adjustment of shuffle order or mixup rate for each sample.
• Core observation: The authors state that task-oriented queries can often be decomposed into slot types and slot values while preserving the original meaning. When used in reverse, the model fills in deliberately left-empty, individually seemingly harmless slots, thereby assembling harmful semantics.
• Threat model:
  • Goal: Induce LVLMs to complete unsafe content, bypassing safety mechanisms that mainly perform surface-level intent recognition.
  • Knowledge: black-box, without access to model parameters or gradients.
  • Capability: Use an external LLM for slot decomposition; submit structured visual prompts with small random perturbations and one completion-guiding instruction to the victim model; query the victim model only once, without iterative optimization.
  • Victim systems: Open-source and closed-source LVLMs. The experiments use ASR and HF to measure whether a jailbreak occurs and the degree of harmfulness.
• Approach in this paper: StructAttack includes semantic slot decomposition (SSD) and visual structure injection (VSI), decomposing harmful queries into a central theme, malicious slots, and distractor slots, then embedding them into mind maps, tables, or sunburst charts.

LLM jailbreak

• Manual prompts: The paper categorizes role-playing (Shen et al., 2024), hypothetical scenarios (Li et al., 2023), and multi-turn long-context memory (Anil et al., 2024) as manual methods that rely on human creativity and language understanding.
• Automatic attacks: GCG by Zou et al. (2023) uses greedy coordinate gradient search for adversarial suffixes. Andriushchenko et al. (2024) combine templates, randomly optimized adversarial suffixes, and self-transfer; the paper paraphrases their claim that simple adaptive attacks can reliably jailbreak aligned LLMs.
• Other automatic red-teaming: The paper treats automatic methods as a recent focus and cites multiple works, without comparing them one by one in the main text.

LVLM image perturbation

• White-box perturbation: The paper groups a set of methods that add adversarial perturbations to images into one category and states that optimization is usually time-consuming and requires white-box parameters. The main text does not single out or criticize each work.

Typography and harmful images

• FigStep: Renders harmful instructions as OCR text on a blank image.
• HADES: Studies the impact of harmful images on LVLMs, using stable diffusion to optimize and adding harmful keyword typography. The authors state that after progress in OCR filtering, such typography methods have become ineffective.

OOD visual inputs and slot filling

• JOOD and SI-Attack: JOOD uses mixup to construct OOD visual inputs; SI-Attack randomly shuffles image patches and text tokens. The paper states that both require iterative attempts, with higher time and computational costs. Yang et al. (2025) is grouped into the OOD direction, without detailed comparison in the main text.
• NLU slot filling: Zhang et al. (2018) and Zhang and Wang (2016) split queries into slot types and slot values while preserving the original semantics. The paper uses this phenomenon to introduce reverse slot filling, without criticizing these two works.

Baselines and benchmarks: Comparison baselines are FigStep, FigStep-Pro, HADES, SI-Attack, and JOOD; benchmarks are Advbench-M and SafeBench. In the main experiments, HADES is modified to concatenate OCR keywords with optimized harmful images, and the iteration counts of SI-Attack and JOOD are limited to 1.

The authors position StructAttack as an optimization-free, single-query black-box method that leverages semantic slot filling, rather than white-box perturbation, full-sentence harmful-text typography, or OOD iteration.

StructAttack first splits harmful queries into individually harmless-looking slots, then draws them into structural diagrams, and uses a single completion instruction to make the LVLM reassemble semantics and fill the slots. Figure 2 divides the process into SSD and VSI, querying the victim model only once.

Semantic Slot Filling Probe

• Reverse slot filling: The authors start from NLU slot filling, but instead of providing slot values, they put sensitive slot types into templates and let the model complete them. Text probes are in Appendix A.1; prompts are not reproduced here.
• Visual probe: Figure 3 places slots into mind maps, tables, or sunburst charts. The comparison target is GPT-4o, with 70 samples drawn from Advbench-M; ASR numbers are in Question 4.
• Authors' interpretation: The authors believe the model automatically fills slot values without recognizing the user's overall harmful intent. This is their interpretation, not a causal conclusion from intervention experiments.

Semantic Slot Decomposition

• Two criteria: Local Benignness means a single slot is harmless in isolation, to bypass OCR safety filters; Global Coherence means slots remain aligned with the central theme, and their combination implies the original malicious intent. The paper uses slot names like process and ingredients in examples, without harmful questions here.
• Decomposer: D is Deepseek-Chat, with role prompts in Appendix A.2. D(Q)=T,{S_i^(m)}_i=1^n_m maps the original query Q to a central theme T and nm malicious slots; nm is determined by the decomposer based on input.
• Distractor slots: F is the same LLM with another set of role prompts; Appendix A.3 gives the full prompt. It generates nd distractor slots that are related to the theme and called harmless by the authors. Experiments set nd=2. The authors state distractor slots dilute malicious density and divert safety attention.

Visual Structure Injection

• Rendering: I=ψ(T,{S_i^(m)},{S_j^(d)}) means ψ draws the theme, malicious slots, and distractor slots into a structural diagram. ψ takes mind map, table, or sunburst chart, corresponding to v1, v2, v3 later. Implementation is Python scripts with Matplotlib, mapping slots to nodes.
• Perturbation: A random perturbation operator P is applied to get the final image. Main text examples are position jitter and angle rotation; Appendix A.4 varies angle, radius, horizontal alignment, or sector order and width per layout. The authors state the method is layout-agnostic.
• Text side: The structural diagram is paired with a fixed completion instruction that asks to complete each branch and limits the length of each branch. Appendix C.1 treats per-branch word count as a variable. The exact instruction and word count lower bound are not listed here.

How Outputs Are Considered Successful

• ASR: Determined by LLaMA-Guard-3-8B. The main text does not specify the label-to-success mapping details.
• HF: Scored by GPT-4o-mini from 0 to 10, with higher scores corresponding to more detailed and instruction-following harmful information. The full scoring prompt is in Appendix B.2.

Experimental Setup

• Victim models: GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash, Qwen3-VL-Flash, Qwen2.5VL-7B, InternVL-3-9B.
• Data: Advbench-M has 216 items total, with 7 categories: BE, D, FW, HI, KS, SV, S. SafeBench has 350 items. Appendix C.3 splits SafeBench into IA, HS, MG, PH, F, AC, PV; the main table does not give numbers by category.
• Baselines and protocols: Vanilla, FigStep, FigStep-Pro, HADES, SI-Attack, JOOD. Black-box HADES only concatenates OCR keywords with optimized harmful images. The main table limits SI-Attack and JOOD to 1 iteration to align with single-query settings.
• Variants and metrics: v1 is a mind map, v2 is a table, v3 is a sunburst chart. ASR is given by LLaMA-Guard-3-8B; HF is scored by GPT-4o-mini on a 0–10 scale. The appendix writes the same guard as Llama-Guard-3-8B.
• Attack side: Both the decomposer and the distractor are Deepseek-Chat; nd=2, nm is determined by the decomposer. Structure diagrams are made with Matplotlib. Hardware is NVIDIA RTX 4090. The paper does not report the number of repetitions for the main experiments.
• Subset: The ablation uses 10 items per category from Advbench-M, 70 in total, with GPT-4o (1120) as the victim model.

Main Results

The table below shows the ASR (%) for Advbench-M from Table 1. HF and SafeBench are not included.

Swipe horizontally to read the table

Model	v1	v2	v3	FigStep-Pro	SI-Attack
GPT-4o	69.0	69.0	65.3	10.7	32.9
Gemini-2.0-Flash	69.9	73.6	70.4	62.5	47.7
Gemini-2.5-Flash	52.3	49.1	49.5	8.3	21.3
Qwen3-VL-Flash	59.3	70.8	70.4	48.6	3.7
Qwen2.5VL-7B	88.4	84.7	86.6	64.4	11.1
InternVL-3-9B	87.0	92.1	89.8	86.1	1.9

• Authors' summary: The authors state that closed-source commercial models have lower overall ASR and HF, and claim the method achieves the highest average ASR and HF across LVLMs. The abstract says the two open-source models have an average ASR of 80% and the four closed-source commercial models about 60%; Section 4.2 says closed-source 66.4%, open-source 90.4%. Neither place specifies the dataset or variant. In the table above, the three variants for the two open-source models all have higher ASR than the four closed-source models.
• SafeBench counterexample: On Gemini-2.0-Flash, FigStep-Pro's ASR is 63.1%, higher than v2's 60.0% and v3's 59.7%; on InternVL-3-9B, FigStep-Pro is 65.1%, higher than v3's 60.6%. InternVL-3-9B's v3 is 60.6%, lower than Gemini-2.0-Flash's v1 67.7% (all according to Table 1).
• Named comparisons by authors: The authors state that on Advbench-M, GPT-4o's ASR is 69.0%, higher than FigStep-Pro's 10.7% and HADES's 10.2%; Gemini-2.5-Flash's v1 has ASR 52.3% and HF 6.1, higher than SI-Attack's 21.3% and JOOD's 5.1%. The authors also state that on Qwen2.5VL-7B, FigStep-Pro is 64.4%, higher than FigStep's 2.8% and HADES's 22.7%.

Layouts, Components, and Distractor Slots

• Layouts: Table 2 compares structure diagrams under the same slot type, with the metric being the number of jailbroken samples out of 70. Vanilla is 0, Tree Map is 47, Table and Sunburst Diagram are 45, Pyramid Diagram is 50. The category counts for the Mind Map row do not match the All total, so that row is not cited. The authors state that the layouts are similar and the effect does not depend on any single layout, and list three requirements: single-slot harmless, main slot identifiable, and structured layout.
• Components: Table 3 fixes the slot type and uses a mind map. Vanilla is 0, text attack with only SSD is 38, adding VSI gives 44, adding random perturbation gives 48. The authors state that the visual form better triggers slot-filling vulnerabilities, and perturbation can further increase this number.
• Distractor slots: In Table 4, 0 distractor slots is 41, 2 is 48, and the sum of category counts matches All for both rows. The authors state that without distractor slots, high-risk categories are more likely to be directly rejected, with BE being 3 vs 6. The row with 1 distractor slot has category counts that do not sum to All, so it is not cited.

System Prompt Defense and Query Counts

• Defense setting: Section 4.4 adds a system prompt from Appendix B.1 on GPT-4o, requiring verification of harmful content in visual inputs and rejection of violating queries. The paper does not specify the sample size for this table.
• Table 5: ASR from no defense to defense: FigStep 0% to 0%, FigStep-Pro 7.1% to 0%, HADES 14.3% to 0%, JOOD 22.9% to 4.3%, SI-Attack 28.6% to 2.9%, StructAttack 65.7% to 47.2%; the latter's HF goes from 5.3 to 3.3. The main text writes the OOD decrease as 14.3% to 2.9% and 22.9% to 4.3%, which does not match the method correspondence in the table; here we follow the table.
• Authors' interpretation and multiple iterations: The authors state that most attacks are suppressed, and that StructAttack after defense has an ASR of 47.2%, retaining most of its attack effectiveness; in the table, this is a decrease relative to 65.7%. In Table 6, SI-Attack, JOOD, and StructAttack have per-sample iterations of 10, 45, and 1, with ASR of 37.1%, 38.6%, and 65.7%, and refusal rates of 28.6%, 27.1%, and 7.1%. The paper does not specify the dataset for Table 6; its 65.7% matches the no-defense row in Table 5.

Reviewer Agreement and Unsuccessful Samples

• Human comparison: Appendix B.2 randomly samples 70 responses from Advbench-M. Llama-Guard-3-8B has an ASR of 67.1% and an agreement rate with humans of 82.9%; GPT-4o-mini at HF≥4 has an ASR of 64.3% and agreement 85.7%, at HF≥5 it is 57.1% and 84.3%; human ASR is 61.4% (Table 8). The authors state that all automatic settings have agreement rates with humans above 80%.
• Failure classification: Appendix D.3 divides unsuccessful attempts into two categories without giving counts. One is decomposition drift under overly long or complex instructions, where recombination results in benign or vague queries. The other is on high-risk topics, such as GPT-4o identifying sensitive topics during reasoning and giving educational or strong refusals instead of following the generation instructions.
• Examples: Figure 6 and Appendix D.1 show slot-filling outputs on multiple models; the appendix only states that the induced model writes harmful content in malicious slots, so outputs are not cited here. Figure 8 embeds structures into natural scenes, and the authors state that jailbreak effectiveness is maintained under background interference, with no quantitative numbers.

Other Ablations and Analyses

• Pilot experiment: GPT-4o, 70 items from Advbench-M, pure-text SSF has an ASR of 54% (Section 3.2); for the visual variants in Figure 4, the paper only states they further increase, without giving numbers in the figure.
• Figure 5: The authors give HF for SI-Attack on GPT-4o and Advbench-M, with SV/HI/BE at 3.5/3.8/1.2, and for JOOD FW/D at 3.4/1.7; the category numbers for the three StructAttack variants are not written out.
• Table 1: On SafeBench, SI-Attack on Gemini-2.0-Flash is 51.4% and on GPT-4o is 17.7%; on Advbench-M, SI-Attack on InternVL-3-9B is 1.9%, lower than that model's vanilla 2.3%.
• Table 7 (GPT-4o, dataset not specified): StructAttack's ASR without/with layout perturbation is 62.9%/67.1%, and HF is 4.9/5.3; the authors state that the high success rate mainly comes from slot filling rather than the perturbation itself.
• Table 10 (model not specified) All HF: for 100, 300, 500, 1000 words per branch, it is 5.3, 5.6, 5.5, 5.2. SV at 500 words is 2.4, lower than 3.3 at 100 words. The authors state that 100 to 500 words increases slightly, 1000 words gives no extra benefit, and 300–500 words is more appropriate.
• Table 9: StructAttack uses 1 victim query per sample, 1652±651 tokens, 2 auxiliary LLM calls, 568±4 tokens, totaling 2220±655 tokens and 22.79±9.56 seconds; JOOD uses 45 calls, 21847±13742 tokens, 193.44±84.23 seconds; SI-Attack uses 10 calls, 2791±980 tokens, 25.48±10.92 seconds. The paper does not specify the dataset. In Figure 7, the authors state that vanilla and StructAttack form separable clusters on the two open-source models; the paper does not specify the layer number, and the text has no usable coordinates.

Limitations and Future Directions Noted by the Authors

The paper does not specifically discuss limitations. The Conclusion only restates the method and experimental results, with no Future Work. Appendix D.3 gives two categories of failures but does not frame them as limitations or future directions.

Experimental Coverage

• Victim models are GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash, Qwen3-VL-Flash, Qwen2.5VL-7B, InternVL-3-9B, totaling 6 (Section 4.1). Decomposition and distractor slots are generated by Deepseek-Chat.
• Main benchmarks are Advbench-M (216 items, 7 categories) and SafeBench (350 items). The ablation samples 10 items per category from Advbench-M, 70 in total, with GPT-4o (1120) as the victim model (Section 4.3).
• Main comparison baselines are FigStep, FigStep-Pro, HADES, SI-Attack, JOOD; the main table limits the latter two to 1 iteration. Multi-iteration numbers are in Table 6 and Appendix B.3. Defense experiments use the system prompt from Appendix B.1, compared on GPT-4o (Table 5).
• ASR is determined by LLaMA-Guard-3-8B, HF is scored by GPT-4o-mini on a 0–10 scale. Agreement rates with human labels are reported on 70 Advbench-M responses (Table 8).
• The paper does not report the number of repetitions for the main experiments, nor the sample sizes and datasets for Tables 5, 6, and 7; Table 10 does not specify the model. Figure 7 only plots the two open-source models, and the paper does not write the layer number.

StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into individually seemingly harmless slots, draws them into a structure graph, and then makes the model reassemble the slots into harmful content.

• Problem: The authors believe that safety-aligned LVLMs still perform semantic slot filling. When slot types are individually harmless, the model may still fill in unsafe slot values. White-box perturbation requires parameters and is time-consuming, layout methods are affected by OCR filtering, and OOD methods require iteration.
• Method: Deepseek-Chat decomposes the query into a central theme, malicious slots, and distractor slots (the number of distractor slots is set to 2), then uses Matplotlib to draw them into a mind map, table, or sunburst chart with small random perturbations, paired with a completion-guiding instruction. No gradients and no iteration are required against the victim model.
• Main results: On Advbench-M in Table 1, the v1/v2 ASR for GPT-4o is 69.0%, and the v2 for InternVL-3-9B is 92.1%. On SafeBench, the v1/v3 for GPT-4o is 56.0%. The authors state that the average ASR is 80% for open-source and about 60% for closed-source in the abstract, and 90.4% for open-source and 66.4% for closed-source in Section 4.2; neither place specifies the measurement basis. On SafeBench, FigStep-Pro has cells higher than some variants.
• Other evidence: On a 70-item subset, the plain-text slot-filling ASR is 54%; after adding vision and perturbation, the number of jailbroken samples in the component ablation reaches 48. After system prompt defense, the ASR in Table 5 goes from 65.7% to 47.2%. On the 70 items, the agreement rates between automatic review and human review are 82.9%, 85.7%, and 84.3%.
• Authors' conclusion: The authors state that this vulnerability comes from the model's completion bias toward locally harmless slots, so StructAttack can induce unsafe output under a black-box single query, and still obtains the above ASRs in defense settings and query-count comparisons. The paper does not have a dedicated section listing limitations.