Scene Semantics Becomes a New Attack Surface for MLLM Jailbreaks
Start here
An arXiv paper released on October 9, 2026 points out that multimodal large language models have a neglected vulnerability: task-related scene semantics alone, even when the image contains no additional attack instructions and the original task intent remains unchanged, can shift the model from refusal to compliance. The researchers formalize this as a scene-semantic visual safety vulnerability, build SceneSafetyBench covering eight categories of risk and nine white-box and black-box MLLMs, and propose Scene-Grounded Attacks (SGA), which construct validated scene-semantic queries while preserving the original task and combine their independent answers, achieving an average attack success rate above 86% on nine target models.
Generated by AI from reports · Updated 29 days ago
Attention and developments
Attention, hourly
Now 38, 0% in 24 hours·Peak 38 (Nov 6 03:00)
Related research
This event's paper
- Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs
arXiv · 2026-10-08 · Deep reading
Progress timeline
- arXiv: Jailbreaks, Prompt Injection, Poisoning & DefensesThe Scene Is the Attack Surface: Revealing Overlooked Scene-Semantic Safety Failures in Multimodal Large Models
The researchers reveal a class of vulnerabilities in multimodal large models: based solely on task-relevant scene semantics, even when the image input contains no additional attack instructions and the original task intent is unchanged, the model may shift from refusal to compliance. They formalize this failure as a scene-semantic visual safety vulnerability and construct SceneSafetyBench, covering eight risk categories and nine white-box and black-box MLLMs. On this basis, they propose Scene-Grounded Attacks (SGA), which construct validated scene-semantic queries while preserving the original task and combine their independent answers. SGA achieves an average attack success rate of 86.17% across nine target MLLMs, 8.55 percentage points higher than the strongest baseline, and achieves the highest ASR on eight models. Analysis shows the failure is related to how task-relevant visual evidence affects downstream safety representations, and the researchers believe visual grounding alone cannot fully explain the observed safety shift.