When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models

Summary

This paper proposes VJA (Vision-Centric Jailbreak Attack), which encodes malicious editing instructions entirely inside the image (marks, arrows, rendered text) and issues them to a large image editing model with an empty text field. The observation is timely: modern editing systems now interpret visual prompts as first-class instructions, so text-oriented safeguards see nothing malicious to filter. The paper packages this into three deliverables — the VJA attack template; a benchmark (IESBench, 1054 images across 15 hierarchical risk categories, MLLM-as-judge protocol) covering seven commercial and open-source editors; and a training-free introspection defense that reuses a Qwen-Image-Edit-style VLM's KV-cache to run a safety-trigger prompt through the same text encoder that conditions the diffusion blocks. Reported effects are large — 80.9% ASR on Nano Banana Pro, 70.3% on GPT Image 1.5, and a 33-point ASR drop when the trigger is added to Qwen-Image-Edit — and the qualitative examples (copyright-watermark removal, forged transcripts, evidence tampering) are compelling.

The conceptual move — attack surface follows the interface, so when the interface goes visual the attack goes visual — is genuinely useful, and the benchmark taxonomy is more editing-specific than prior repurposed VQA-safety data. The main limitations are conceptual, methodological, and reproducibility-related. The defense is restricted to editing models whose text encoder is an accessible aligned VLM (i.e., open-source), yet its defended metric is compared directly to black-box commercial systems as if interchangeable. The judge is instructed to inflate HS by category-level risk and to avoid HS=2 outputs, biasing the very numbers the paper leans on, and no ablation removes these instructions. There is no adaptive-attacker analysis, and the "purely visual" framing understates the rasterized text inside many prompts. Crucially, when the released code was executed, the headline commercial numbers turned out to be non-reproducible (defense-only repo), the defense mechanism was non-functional as shipped and had to be reimplemented, and the reasoning-ablation result reversed. The contribution and threat model remain interesting and worth publishing, but the empirical claims are currently more fragile than the manuscript presents.

Strengths

• Conceptual contribution. The insight that malicious intent migrates to the visual channel as editing models learn to obey visual prompts is simple once stated but had not been operationalized for editing systems; VJA gives it a concrete threat model and a demonstration on top-tier commercial models.
• Benchmark design. IESBench is genuinely editing-specific (base image + visual prompt + region + operation) rather than repurposed VQA safety data; the 15-category, 3-level hierarchy plus editing-specific metrics (EV, HRR) let the paper separate "guard blocked it" from "guard passed it, but the edit was garbage." The dataset composition (1054 images, 15 categories, 9 actions) reproduced cleanly from the released annotations.
• Defense is elegant when it applies. Reusing a VLM's KV-cache to run a text safety trigger through the same encoder that already produced the conditioning embeddings is a low-overhead idea, and the defended model's ASR did drop substantially in the correct direction on reproduction.
• Judge/human validation attempted. Reporting Pearson/Kappa against human annotators and comparing five candidate judges is more than most jailbreak papers do.
• Failure-mode transparency. The paper documents its own failure modes (visual-reasoning failures, text-rendering failures, benign misinterpretations such as stick-figures riding a horse) rather than only cherry-picking wins.

Weaknesses

• Overreaching causal claim. "The stronger the model, the more evil the model will be under VJA" contradicts Table 1, where the two strongest commercial models are the safest. The LongCat observation supports only a narrow claim about under-aligned models with better visual-instruction following.
• Judge biasing. Special Notice 1 raises HS by the sample's category-level risk, and Special Notice 2 instructs the judge that HS "should be greater than 2" — directly contradicting the rubric's Score 2 definition and the HS=2 failure-case protocol. Both systematically inflate HS and are never ablated; because the judge harness is unreleased, the bias cannot be bounded.
• Defense scope oversold. The introspection defense needs internal VLM/KV-cache access and cannot run on the commercial APIs it is compared with. Framing the defended Qwen result as "comparable with GPT Image 1.5 and Nano Banana Pro" mixes internal triggers with external safeguards on different pipelines; comparable aggregate ASR does not imply comparable robustness.
• No adaptive attacker. The threat model is black-box, but the only sweep is over benign nuisance variables (color/font/size/shape). An attacker who knows the introspection trigger and adapts the visual prompt to spoof it is never tested, so the reported ASR reductions may over-estimate robustness.
• Metric interpretation inflates severity. ASR counts non-rejected but invalid/garbage edits as successes, and for unguarded open-source models ASR=100% is tautological (no safety path exists) rather than evidence of evading a defense. The headline story leans on ASR where HRR is the more honest quantity.
• "Purely visual" oversells the attack. Many prompts contain rasterized text (e.g., "replace 88 with 100"), which is linguistic content; an OCR-then-safeguard baseline would defeat much of it and is not measured. The font/language sensitivity in §A.1 is consistent with this.
• Base-image provenance confound. 846 of the base images are generated by the same models later evaluated as victims, a possible distributional advantage that is never controlled for.
• No variance on the main table. Table 1 gives single point estimates from a stochastic judge with no repeats, seeds, or confidence intervals, making small cross-model/category differences hard to trust.
• Mechanistic overclaim. The "safety-awareness activation via attention" argument leans on a citation to the original Transformer paper rather than evidence; the reproduced classification evidence for this mechanism actually reversed (below).
• Presentation defects. 70.1% (abstract) vs 70.3% (Table 1); the inverted EV definition; merged/unreadable Seedream 4.5 and BAGEL rows in Table 1; a dropped color-ranking legend in the Table 1 caption; swapped Table 3 vote percentages; the "GPT 5.2" vs "GPT Image 1.5" judge-name mismatch; undefined "HR" for HRR; inconsistent I15 label; Flux2.0 attributed to both "Deep Forest Labs" and "BlackForest Labs"; multiple names for the same Qwen model; and a Veo (video) citation used for image-editing visual prompting.

Reproducibility & code

Code was executed (full mode). The overall replication score was low (~0.28): most claims could not be reproduced from the released artifacts, and the pieces that ran diverged from the paper.

• Headline commercial results not reproducible. The repository is defense-only — no attack generator, no commercial-API wrappers, no TJA baseline, no metric aggregator. The 85.7% four-model average and the 80.9%/70.3% per-model figures "match" only because they were read from the shipped README, which echoes the paper's own leaderboard; none of the four commercial models were run. Table 1's 8×4 grid could not be reproduced (only 2 of 32 cells were produced), and the VJA-vs-TJA comparison (Table 2) was not attemptable.
• The defense mechanism was non-functional as shipped. The KV-cache-reuse safety check first crashed (missing output_hidden_states=True), then silently emitted empty output that defaulted to a "safe" verdict, so the defended model never blocked anything. Obtaining any defended result required reimplementing the core routine as a single standard VL generation — meaning the reported Qwen-Image-Edit-Safe numbers cannot have been produced by the released code as written.
• Defended ASR reproduced in direction, not magnitude. The reimplemented defense gave 57.0% ASR over 1054 samples versus the paper's 66.9% (a 43-point reduction rather than 33), and per-category values diverged (e.g., I13 69.2% vs 61.5%, I15 65.8% vs 55.3%). The HS reduction of 1.2 could not be checked because no harmfulness judge was run.
• Reasoning ablation reversed. The Section 4.3 experiment reproduced at ~35.7% (with reasoning) vs ~42.4% (without) accuracy — both below chance, with reasoning performing worse, contradicting the central "reasoning is the core of introspection" claim. The cause is a documentation gap: the released data ships no benign-prompt split, so negatives were reconstructed from source images plus the malicious-intent question and are not genuinely benign.
• Generalization and overhead unverifiable. The LongCat/Flux defense integrations (Table 7) and the runtime/token overhead (Table 5) could not be attempted — the cross-model defense code is deferred, and no timing harness ships.
• Environment fragility. requirements.txt lists standard-library modules as pinned PyPI packages (so pip install fails), pins an unpublished diffusers version, and omits torchvision/flash-attn; GPU device placement was broken on the default path. Two safety-trigger prompts coexist in the defense file with no indication which produced the reported numbers.
• What did reproduce. Dataset statistics matched almost exactly (1054 images, 15 categories, 9 actions; 119 vs 116 attributes), and the unguarded local Qwen model refused nothing (ASR=100%), consistent with the paper's qualitative story.

Recommended Changes

Essential

• Release the attack, judge, and TJA code end-to-end. Ship the VJA image-rendering script, a working commercial/open-source victim adapter set (with endpoint versions and sampling parameters), the Gemini judge harness (prompt, XML parser, retry logic, aggregation), the TJA prompts, and the 20% subset indices/seed — so the numbers in Tables 1 and 2 and the abstract are reproducible. Addresses headline commercial results not reproducible and TJA baseline.
• Ship a runnable version of the defense and confirm provenance. Fix the KV-cache safety check so it executes and blocks as described, remove the dead second trigger prompt, and state explicitly that the reported Qwen-Image-Edit-Safe numbers were produced by this mechanism. Addresses the defense mechanism was non-functional as shipped and two coexisting triggers.
• Release a genuine benign split and re-run the reasoning ablation. Provide the positive/negative sample manifest, the reasoning-ablated prompt, and the classifier code; re-report Section 4.3 given that the ablation reversed on reproduction. Addresses reasoning ablation reversed.
• Ablate the judge biasing instructions. Re-run the headline HS/HRR in Tables 1 and 2 with Special Notice 1 and Special Notice 2 removed and report the delta. Addresses judge biasing.
• Add an adaptive-attacker experiment. Evaluate VJA + Qwen-Image-Edit-Safe against an attacker who knows the introspection trigger (distractor "safe" caption, prompt perturbation) and report whether the ASR drop holds. Addresses no adaptive attacker.
• Scope the defense claim. State that the introspection defense requires internal VLM/KV-cache access and cannot be deployed to the commercial systems it is compared against; add a per-category/per-attack failure-mode overlap rather than only aggregate ASR. Addresses defense scope oversold.
• Scope or drop "stronger = more evil." Restate as a claim about editing-capability-limited but under-aligned models. Addresses overreaching causal claim.

Suggested

• Report HRR alongside ASR in the headline and separate unguarded-by-design ASR from ASR against models that attempt moderation. Addresses metric interpretation inflates severity.
• Add an OCR-then-text-guard baseline and restate VJA as "visually-embedded instructions (which may contain rasterized text)." Addresses "purely visual" oversells.
• Control for base-image provenance. Report ASR separately for AI-generated vs. real-world base images. Addresses base-image provenance confound.
• Report variance (repeated judge runs, and seeds where feasible) for the Table 1 metrics. Addresses no variance on the main table.
• Rewrite the mechanism discussion as an empirical hypothesis rather than an appeal to attention, and add a token-layout diagram of the KV-cache reuse. Addresses mechanistic overclaim.
• Report inter-judge and inter-annotator agreement (and annotator count/recruitment) for Tables 3 and 6. Addresses default judge is also a candidate in its own validation.
• Fix the presentation defects. Reconcile 70.1%/70.3%; rewrite the EV definition to mean valid edits; re-typeset Table 1 so Seedream 4.5 and BAGEL rows are separated and supply the color-ranking legend; correct the Table 3 vote assignment and the "GPT 5.2"/"GPT Image 1.5" judge name; replace "HR" with "HRR"; unify the I15 label, the Flux2.0 developer name, and the Qwen model names; and correct the Veo citation. Addresses presentation defects.