Skip to content

Translation in progress Some entries still include text in the original language.

Original
论文追踪· arXiv:2602.00420· Yihang Chen, Zhao Xu, Youyuan Jiang, Tianle Zheng, Cho-Jui Hsieh·Indexed by this site · Originally published

Researchers propose Text-DJ, jailbreaking large vision-language models by exploiting OCR capabilities

Text is All You Need for Vision-Language Model Jailbreaking

Quick read

Attacks

Based on 论文 PDF （AI 生成）; refer to the original

Text-DJ jailbreaks LVLMs with a split text image grid; on HADES, GPT 4.1 mini's average ASR is 64.27%.

Threat modelBlack-box, model-agnostic: does not access gradients or parameters, and is not tied to a single victim model. The attacker uses only text prompts, writing the split harmful sub-queries and unrelated distractor queries as an image grid with positioning instructions, to induce the LVLM to give harmful responses. Victim systems are open-source and closed-source LVLMs, including API models.

Questions
LVLM safety checks mostly target explicit text or related images, and white-box attacks requiring gradients cannot be applied to closed-source APIs. The authors want a black-box, model-agnostic jailbreak using only text prompts, exploiting OCR to read in split harmful sub-queries.
Methods
Text-DJ uses Qwen2.5-3B-Instruct to split the harmful query into 3 sub-queries, then uses all-MiniLM-L6-v2 to greedily select 9 most unrelated distractor questions, writes them into a 4×3 text image, places sub-queries at positions 6, 8, and 12, and instructs the model to answer these positions.
Experiments and results
On HADES and HEx-PHI, the average ASR of Text-DJ for the six LVLMs is higher than the baselines in the table. On HADES, GPT 4.1 mini achieves 64.27% and Gemini-2.5-Flash achieves 44.00%. The OpenAI refusal rate is 0.00%.
Limitations and future work
The paper does not specifically discuss method limitations. The conclusion calls for defenses for the OCR module that can resist cross-modal semantic interference. Guardrails and ablations only report on the open-source Qwen3-VL; the number of repetitions for the main experiment's ASR is not reported.
Experimental setupQwen/Qwen3-VL-4B-Instruct、Qwen/Qwen3-VL-8B-Instruct et al. · HADES、HEx-PHI · ASR、EASR et al.
Evaluated models
Qwen/Qwen3-VL-4B-InstructQwen/Qwen3-VL-8B-InstructQwen/Qwen3-VL-30B-A3B-Instructgpt-4o-minigpt-4.1-minigemini-2.5-flash
Benchmarks
HADESHEx-PHI
Metrics
ASREASRRR
AI summaryThe paper proposes Text-DJ, a jailbreak attack that exploits the OCR capability of large vision-language models to bypass existing safety alignment. The method has three steps: decompose a harmful query into multiple semantically related but more harmless sub-queries; select distractor queries least related to the harmful query; input the sub-queries and distractor queries simultaneously to the model as an image grid, with sub-queries placed in the middle of the grid. The authors attribute the attack's success to two factors: converting text prompts into images bypasses standard text filters; and the interference from many unrelated queries prevents the model's safety protocols from linking the scattered sub-queries. The authors claim this method bypasses the safety alignment of current state-of-the-art LVLMs and note the need for defenses designed for fragmented multimodal inputs. Paper number arXiv:2602.00420.

The paper proposes Text-DJ, a jailbreak attack that exploits the OCR capability of large vision-language models to bypass existing safety alignment. The method has three steps: decompose a harmful query into multiple semantically related but more harmless sub-queries; select distractor queries least related to the harmful query; input the sub-queries and distractor queries simultaneously to the model as an image grid, with sub-queries placed in the middle of the grid. The authors attribute the attack's success to two factors: converting text prompts into images bypasses standard text filters; and the interference from many unrelated queries prevents the model's safety protocols from linking the scattered sub-queries. The authors claim this method bypasses the safety alignment of current state-of-the-art LVLMs and note the need for defenses designed for fragmented multimodal inputs. Paper number arXiv:2602.00420.

Paper analysis

6 questions; open one to read the full answer

  1. What problem does this paper attempt to solve?

    Text-DJ splits harmful queries into OCR text grids, bypassing LVLM defenses that focus on explicit text under black-box settings.

    现有防护侧重显式文本或相关画面，Text-DJ改用OCR读入被拆散的文本图来越狱LVLM。

    • 场景：作者称LVLM把视觉编码器与LLM接在一起，用于视觉问答、图像描述和多模态推理。训练语料可能含有毒或敏感信息，带来隐私泄露或有害输出；视觉输入又可能绕过只做在文本上的对齐。
    • 现有不足：作者称不少越狱是white-box，要梯度或参数，因而用不到GPT系列、Gemini系列这类闭源API模型。许多攻击还model-specific，换模型后迁移性不足，生成专门对抗图像的开销也高于文本攻击。
    • 作者的判断：作者认为文本写成图像可绕过常规文本过滤，大量无关查询又使安全机制难以把拆散的子查询连起来。作者称OCR模块的安全对齐在很大程度上被忽略。
    • 本文做法：提出Text-DJ（Text Distraction Jailbreaking）。一条有害查询被拆成多个语义相关但更温和的子查询，再配上尽量无关的干扰查询，同时以图片网格送给模型，子查询放在网格中部。
    • 威胁模型：
      • 目标：绕过安全对齐，让LVLM对有害或不被允许的提示给出有害回复。
      • 知识：black-box、model-agnostic。不访问梯度或参数，也不绑定单一受害模型的结构。
      • 能力：只使用文本提示。攻击者把查询写成图片并附定位指令，不需要真实照片或扩散模型生成的有害图像。
      • 受害系统：开源与闭源LVLM，包括以API部署的GPT系列与Gemini系列。

  2. What related research exists?

    Related work covers LVLMs, white-box gradient attacks, and black-box image jailbreaks; the authors define Text-DJ as semantic interference.

    The paper organizes related work by LVLM architecture, white-box attacks, black-box image attacks, and query decomposition.

    LVLMs and Alignment

    • LLaVA (Liu et al., 2023), MiniGPT-4 (Zhu et al., 2023): Freeze the visual encoder (e.g., CLIP-ViT) and connect it to the LLM via a trainable projection, then perform vision-text alignment pretraining and visual instruction tuning.
    • Qwen-VL series (Bai et al., 2023; Yang et al., 2024, 2025): The authors state that they use DeepStack to fuse ViT features to handle high-resolution images, performing better on multilingual OCR and complex documents; this paper exploits such OCR capabilities.
    • GPT-4o (Hurst et al., 2024), Gemini 2.5 (Comanici et al., 2025): The authors state that both achieve state-of-the-art in complex reasoning and use post-training alignment to enhance trustworthiness. Text-side alignment includes RLHF and others.

    White-box LVLM Attacks

    • GCG (Zou et al., 2023), AutoDAN (Liu et al., 2023): Gradient attacks transferred from the pure language domain, optimizing adversarial suffixes added to text or image patches to break alignment. Other works use gradients to modify latent space, shifting internal states from harmful queries to safe queries.
    • The authors note that for closed-source LVLMs, architecture and parameters are unknown, making white-box attacks unusable; existing gradient attacks are typically model-specific and have transferability issues. The authors claim their black-box method does not depend on the victim model.

    Black-box Image Jailbreaks

    • FigStep (Gong et al., 2025) uses typographic transformations to hide harmful text in images; MM-SafetyBench (Liu et al., 2024) rewrites questions, extracts unsafe keywords, and converts them into images.
    • HADES (Li et al., 2024) uses diffusion models to generate harmful images and then optimizes them, examining how harmful images themselves break safety.
    • CS-DJ (Yang et al., 2025) writes decomposed harmful queries directly on images and also uses real images as visual distraction; the images themselves do not contain harmful information. The authors claim that in Text-DJ such visual images are optional, and semantic distraction is more effective than visual distraction.

    Query Decomposition

    • DrAttack (Li et al., 2024), agent-driven decomposition (Srivastav and Zhang, 2025), multi-turn jailbreak Crescendo (Russinovich et al., 2025): Decompose harmful queries into steps that appear more benign or vague individually. Text-DJ uses this as the first step.

    Baseline methods are HADES and CS-DJ. Benchmarks are HADES (5 categories, 150 per category, 750 total) and HEx-PHI (revised 10 categories, 30 per category, 300 total). The authors state that the HADES method generates adversarial images in a complex manner and performs poorly on the HADES dataset, so it was not included for HEx-PHI. The authors position Text-DJ as a black-box, model-agnostic method that relies only on text prompts, and claim it is more efficient and achieves higher ASR because it only requires writing text on images; the paper does not report query counts or time costs.

  3. How does the paper address this problem?

    First decompose into sub-queries, then greedily select the least related questions, and finally write them as a grid text image and specify positions for answering.

    Text-DJ分三步：拆有害查询、选语义最远的干扰问句、把全部文本画进同一张网格图，再让LVLM回答指定位置。

    对抗查询分解

    • 用带提示的LLM把有害查询q拆成m个子查询。每条应是原查询的一部分，来自不同角度或中间步骤，更不直接、更含蓄；合在一起应反映原有害意图。
    • 分解模型为Qwen/Qwen2.5-3B-Instruct。主实验m=3。附录C.1给出完整提示词。

    干扰查询构造

    • 从离线池Dd选n条问句，使它们与q彼此尽量不同。作者称这是NP-hard的diverse subset selection，用贪心作近似。
    • 编码器为sentence-transformers/all-MiniLM-L6-v2。第一条为 qd(1)=argminqd∈ Ddcos⟨ Embed(qd),Embed(q)⟩，即与q余弦相似度最小的问句。其后每条还要加上与已选干扰查询的余弦相似度之和，再取最小（式(1)）。
    • Dd是作者随机生成的100条科学与文化事实问句，与有害意图无关。提示在附录C.4。

    成图与呈现

    • TiI把子查询和干扰查询分别写成图片。文字与背景色随机；对比度按WCAG AA，下限4.5，以保证文字可见。颜色生成代码在附录C.5。
    • 主实验n=9，共12张图，排成4×3。位置从左上起、先行后列编号1–12，子查询放在6、8、12。Algorithm 1在非指定位置依次放入干扰图，在指定位置放入下一张子查询图。
    • 再附一条指令，让模型关注这些位置并同时作答，并说明其他图不是必需。全文在附录C.2。受害模型生成温度设为0.1。附录B.2用一条查询演示了三步，不在此处复述其文本。

    成功如何计算

    • ASR是N条回复中被判为不安全的比例。评审模型为PKU-Alignment/beaver-dam-7b，判定函数记为Is Unsafe。论文未写分数阈值。
    • EASR是一组模板中至少有一个模板成功的查询占比。具体重复方式放在实验部分。

  4. What experiments did the paper conduct?

    Across six LVLMs, Text-DJ's average ASR is higher than HADES and CS-DJ; in the guardrail experiment, OpenAI's rejection rate is 0.00%.

    实验设置

    • 受害模型：Qwen/Qwen3-VL-4B-Instruct、Qwen/Qwen3-VL-8B-Instruct、Qwen/Qwen3-VL-30B-A3B-Instruct、gpt-4o-mini、gpt-4.1-mini、gemini-2.5-flash。生成温度均为0.1。
    • 数据：HADES五类（Animal、Financial、Privacy、Self-Harm、Violence），每类150条，共750条。HEx-PHI在2024年8月19日修订中移除类别2后为10类，每类30条，共300条。干扰池为100条科学与文化问句。
    • 主设置：m=3，n=9，4×3网格，子查询在编号6、8、12；随机配色，最低对比度4.5。
    • 基线：HADES与CS-DJ。HEx-PHI未跑HADES方法。
    • 指标与评审：ASR为不安全回复占比；EASR在附录中按Algorithm 1跑5次、至少一次成功来算。评审为PKU-Alignment/beaver-dam-7b。分解用Qwen/Qwen2.5-3B-Instruct，句向量用all-MiniLM-L6-v2。主实验ASR的重复次数论文未报告。
    • 护栏：输入先经omni-moderation-latest，或GuardReasoner-VL-3B/7B；判为不安全则拒绝、不送入受害模型。后两者温度为0、top p为1.0。Table 3与Table 4只含三个开源模型和HADES类别。消融也只在开源模型上做，其余设置同主实验。

    主结果

    下表为平均ASR（%）。HADES三列据Table 1，HEx-PHI两列据Table 2。HEx-PHI未报告HADES方法。

    Swipe horizontally to read the table

    受害模型HADES Text-DJHADES CS-DJHADES方法HEx-PHI Text-DJHEx-PHI CS-DJ
    Qwen3-VL-4B48.1334.4011.8742.3327.33
    Qwen3-VL-8B52.6738.539.3347.3334.33
    Qwen3-VL-30B-A3B57.6056.2713.6048.3345.33
    GPT 4o mini59.3346.804.1359.0044.67
    GPT 4.1 mini64.2756.008.4060.3345.00
    Gemini-2.5-Flash44.0040.5321.3341.3341.00
    • 作者称Text-DJ的平均ASR持续高于先前基线。上表平均列确实都是Text-DJ更高，但逐类不是：HADES的Animal类，Qwen3-VL-8B上Text-DJ为42.67%、CS-DJ为49.33%；GPT 4.1 mini上为28.67%与33.33%（Table 1）。
    • HEx-PHI类别3上，Gemini-2.5-Flash的Text-DJ为23.33%，CS-DJ为40.00%（Table 2）。作者仍以平均ASR比较方法。
    • 作者把相对CS-DJ的优势解释为语义干扰比视觉干扰更有效。附录Fig. 10用单条示例比较输入形态，并称Text-DJ不需要真实图或生成图、ASR更高；汇总数字以上表为准。

    输入侧护栏

    • 测的是Text-DJ输入能否先被护栏拒绝。OpenAI Moderation API在三个Qwen3-VL上的ASR变化均为−0.00；Table 4拒绝率均为0.00%。作者称攻击几乎绕过该API的全部检测。
    • GuardReasoner-VL-7B下，HADES平均ASR为：Qwen3-VL-4B 39.20（Table 3记−8.93）、8B 43.47（−9.20）、30B-A3B 54.27（−3.33）。对应拒绝率平均为14.93%、14.93%、3.60%（Table 4）。
    • Table 3括号内降幅最大的一格是Qwen3-VL-8B的Financial：GuardReasoner-VL-7B下为52.67（−18.00）。作者称即便在这些输入过滤下，Text-DJ仍保持较高ASR。

    文本入图、分解数与干扰数

    • 去掉TiI（Table 6）：改为1×1白图占位加纯文本。有TiI时4B/8B/30B-A3B平均ASR为48.13%、52.67%、57.60%；无TiI时为20.13%、11.60%、20.27%。作者认为跨模态入图是绕过文本侧安全对齐的关键。
    • 子查询数m（Table 9）：m=1/2/3时，4B为12.13%、38.40%、48.13%；8B为9.07%、38.00%、52.67%；30B-A3B为22.13%、54.67%、57.60%。作者称m=1时安全机制仍能识别有害查询；更大的m未给数字，作者称没有ASR收益且分解更慢。
    • 干扰数n（Table 10）：n=0时三者为30.53%、27.20%、56.53%；n=9时为48.13%、52.67%、57.60%。作者称n=0时攻击无效，n=9或12较好。表中30B-A3B在n=0已为56.53%，n=3为53.87%，低于n=0；8B上n=9为52.67%，高于n=12的44.93%和n=15的46.80%。

    五次运行的EASR

    • 附录A.1把Algorithm 1跑5次，报告至少一次成功的比例。Table 5只列出三个开源模型：Text-DJ为74.67%、82.13%、82.53%，CS-DJ为70.13%、73.87%、82.27%。表注写了开源与闭源以及HADES方法，表内没有这两项。
    • 30B-A3B的Violence类，Text-DJ为90.00%，CS-DJ为94.00%。作者称Text-DJ持续高于CS-DJ；平均列如此，该类不是。

    其他消融与分析

    • 干扰策略（Table 7）：最无关对随机，4B为48.13对37.20，8B为52.67对48.13；30B-A3B随机58.40，高于最无关的57.60。作者称最无关更高。
    • 嵌入（Table 8）：句向量对clip-ViT-L-14图像向量，4B为48.13对48.66，8B为52.67对53.60，30B-A3B为57.60对56.27。作者称句向量略高；4B与8B的平均列并非如此。主实验仍用句向量。
    • 位置（Table 11）：4B中间/最前/最后/随机为48.13、35.47、39.87、45.60；8B随机53.07，高于中间52.67。该消融用红框标出子查询。作者称宜靠后，但不必是最后三个位置。
    • 配色（Table 12）：随机对固定红字白底，4B为48.13对42.40，30B-A3B为57.60对55.07；8B固定53.47，高于随机52.67。作者称随机配色ASR更高。
    • 排列（Table 13）：4×3、6×2、3×4、2×6。4B上2×6为49.47，高于4×3的48.13。作者称4×3稳健，ASR对排列不敏感。
    • 分辨率与字体（Table 14）：100×60与comic font。4B为47.47与44.80，对照主设置48.13。作者称文字可读时这两项不带来大的ASR差别。

  5. What are some points that can be further explored?

    The paper does not specifically discuss its own limitations; the conclusion calls for building defenses against cross-modal semantic interference for OCR modules.

    作者指出的局限与后续方向

    • 论文没有Limitations、Discussion或Future Work节，也没有把某一实验设定写成方法本身的不足。
    • Conclusion称当前安全对齐存在缺口，并呼吁为OCR模块开发能抵抗跨模态语义干扰攻击的防御。这是文中明确写出的后续方向。

    实验覆盖范围

    • 受害模型为三个Qwen3-VL Instruct变体，以及gpt-4o-mini、gpt-4.1-mini、gemini-2.5-flash，共6个；生成温度0.1（Sec. 4.1）。
    • 有害查询为HADES 750条与HEx-PHI 300条；干扰池为100条科学与文化问句（Sec. 4.2）。基线为HADES与CS-DJ；HEx-PHI未包含HADES方法（Sec. 4.3–4.4）。
    • 护栏为OpenAI Moderation API、GuardReasoner-VL-3B、GuardReasoner-VL-7B。Table 3与Table 4只报告三个开源模型和HADES类别。消融在开源模型上（Sec. 5）。
    • 评审为beaver-dam-7b；分解为Qwen2.5-3B-Instruct。EASR把Algorithm 1重复5次（附录A.1）。主实验ASR的重复次数论文未报告。
    • 论文未报告评审与人工判定的一致性，也未报告单次攻击的查询次数或耗时。

  6. Summarize the main content of the paper

    Text-DJ jailbreaks six LVLMs with a black-box text-image grid, achieving an average ASR higher than the listed baselines, and successful samples remain even under guardrails.

    Text-DJ is a black-box, model-agnostic LVLM jailbreak: it does not access gradients or parameters, and only writes text as images.

    • Problem: The authors believe existing defenses focus on text filtering or related images, and white-box and model-specific image attacks are difficult to apply to API models like GPT and Gemini. The paper exploits OCR to read in split harmful text.
    • Method: Qwen2.5-3B-Instruct splits the harmful query into 3 more implicit sub-queries; all-MiniLM-L6-v2 greedily selects 9 distractor questions with the lowest cosine similarity; TiI is made into a 4×3 image, with sub-queries placed at positions 6, 8, and 12, then the model is instructed to answer these positions. Victim model temperature is 0.1.
    • Main results: On HADES, Text-DJ's average ASR is 64.27% for GPT 4.1 mini, 44.00% for Gemini-2.5-Flash, and 48.13%, 52.67%, 57.60% for three Qwen3-VL models (Table 1). On HEx-PHI, GPT 4.1 mini is 60.33% (Table 2). The six-row averages are all higher than the CS-DJ and HADES methods in the table, but categories such as Animal have cells where Text-DJ is lower.
    • Guardrails and repetition: The OpenAI Moderation API's rejection rate for Text-DJ inputs is 0.00% (Table 4). Under GuardReasoner-VL-7B, Qwen3-VL-4B's HADES average ASR is 39.20% (Table 3). The EASR over five runs on Qwen3-VL-8B is 82.13% (Table 5).
    • Authors' conclusion: The authors believe the success comes from text-into-image bypassing text filtering, and the semantic interference caused by unrelated queries; they also believe this exploits a vulnerability in the LVLM's OCR capability. The Conclusion calls for defenses for OCR modules that can resist cross-modal semantic interference.
Read originalarxiv.org
#Jailbreaks and attacks