Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities¶

Conference: ECCV 2026
Paper: ECCV 2026
Code: https://github.com/xiongyuaay/Contextual-Image-Attack
Area: AI Safety
Keywords: MLLM jailbreak, visual context injection, multi-agent attack, black-box attack, safety alignment

TL;DR¶

CIA rewrites a harmful query into a visually coherent scene — a teaching demonstration on a blackboard, steps along a roadmap, an entry in a paper, a comic dialogue panel — so that a multimodal large language model mistakes the harmful content for a routine task to complete, reaching attack success rates of 86.83% on GPT-4o and 91.02% on Qwen2.5-VL-72B.

Background & Motivation¶

Multimodal large language models (MLLMs) have advanced quickly in cross-modal understanding, but their safety alignment is exposed together with the extra visual channel. Compared with text-only LLMs, images offer a continuous semantic space: the same harmful content that gets refused when written as text may not be recognized as a harmful request at all once it is drawn into a picture of "a teacher asking a question in class." Multimodal jailbreaking has therefore become a heavily studied direction, and mainstream approaches split into two camps. One treats the image as an adversarial example — optimizing pixel perturbations, or searching for images that induce harmful output via methods such as maximum likelihood estimation — which does achieve high attack success rates, but the resulting images are semantically corrupted and visibly abnormal. The other camp accepts that images should carry semantics and renders harmful instructions onto images through typography (FigStep and its FC-Attack flowchart variant, SI-Attack via shuffle inconsistency), or simply writes the "scene" into a text prompt as role-play (QR-Attack, Visual-RolePlay). The former's images carry no context, while the latter fails to exploit the advantage images have in expressing a scenario.

The real tension is this: what defeats a safety alignment mechanism is not "harmful text" but "the scene this text is placed in and the identity it is spoken under" — a question asked in a classroom, a step on a roadmap, an entry in a paper. These visual contexts themselves signal to the model that the request is normal and well-motivated. Prior work either abandons this layer of context entirely or can only describe it in words, reducing the image to a carrier rather than the attack's principal. This paper does the opposite: it moves the attack's principal from text to image, so that a human looking at the figure sees only an ordinary teaching or office scene, while the embedded text and layout structure together constitute a complete harmful request.

This is not straightforward to achieve: pasting a harmful query directly into an image clashes with the scene (the model notices something was forced in), and the pasted keywords may still be caught by literal-matching safety detectors. Core idea: use a multi-agent pipeline to "translate" a harmful query into a visual narrative — first extract the visual text that can be embedded and the frame structure that reserves where the response goes, then run iterative semantic-consistency self-checking with a weakly aligned model, then generate an initial scene image using one of four scene-visualization strategies, and finally overlay auxiliary text, safety icons, emojis, and local noise as contextual augmentation — so that the attack cues are carried entirely by the image while the text prompt degrades to a generic guiding sentence.

Method¶

Overall Architecture¶

CIA's threat model is black-box: the attacker has no access to the target model's gradients, weights, or internal states, and performs no per-query iterative optimization. The attacker's available resources are three kinds of auxiliary models — an auxiliary language model (for intent parsing and semantic judging), an auxiliary multimodal model (for generating image-editing instructions), and a text-to-image / image-editing model (e.g., Stable Diffusion). Given a harmful query \(Q\), CIA must produce an image \(I^*\) plus a fixed generic text prompt \(T\), fed together to the target model \(\pi_{tar}\) to obtain a response \(R=\pi_{tar}(I^*,T)\).

Formally, the attack is modeled as synthesizing an optimal contextual scene image: let \(F_{intent}\) map \(Q\) to its core intent, and let a scene-synthesis process \(G_{scene}\) turn that intent into an image, i.e., \(I = G_{scene}(F_{intent}(Q))\). The criterion for success is that the response is both semantically aligned with the original query and in violation of the model's safety policy, giving the optimization objective:

\[\max_{I,\,T}\; \Pr\big(\mathrm{Align}(\pi(I,T),Q)\ \wedge\ \mathrm{Unsafe}(\pi(I,T))\big)\]

where \(\mathrm{Align}\) is a semantic alignment metric and \(\mathrm{Unsafe}\) is a safety-violation classifier. Note that the only real optimization variable here is the image \(I\); the text \(T\) is a fixed generic prompt — this is the formal statement of being "image-centric." (The LaTeX for Eq. (1) and (2) is corrupted in the cached text; the above is a restatement following the original semantics, ⚠️ refer to the original paper.)

The whole pipeline chains four agents across four phases: Phase I, the Parser decomposes \(Q\) into visual text \(v\) and frame structure \(f\); Phase II, the Text Refiner iterates on \((v,f)\) for semantic consistency before image generation, since editing text after the image exists is very hard; Phase III, the Image Generator selects one scene strategy and synthesizes an initial scene image from \((v,f)\); Phase IV, the Image Refiner adds contextual elements to obtain the final attack image \(I^*\).

%%{init: {'flowchart': {'rankSpacing': 24, 'nodeSpacing': 28, 'padding': 6, 'wrappingWidth': 400}}}%%
flowchart TD
    A["Harmful query Q"] --> B["Intent-to-scene visual text encoding<br/>splits into visual text v and frame f"]
    B --> C["Iterative semantic consistency refinement<br/>pseudo-response self-check, up to 5 rounds"]
    C --> D["Four scene visualization strategies<br/>demonstration / path / document / dialogue"]
    D --> E["Contextual element augmentation<br/>auxiliary text / safety icons / emoji / noise"]
    E --> F["Attack input (I*, T) to target MLLM"]

Key Designs¶

1. Intent-to-scene visual text encoding: rewriting a bare query into text and a layout that can plausibly appear in a picture

The direct reason is plain: pasting "how can someone recruit individuals for terrorist activities" into an image verbatim connects to no normal scene, and a literal-matching safety detector spots it immediately. The Parser Agent therefore does not transport the raw text. It first uses an auxiliary language model \(\pi^{aux}_{text}\) to decompose \(Q\) into semantic components such as actions, carriers, and core intentions, then encodes them into two structured parts. The visual text \(v\) is the passage to be embedded in the image; it carries the attack intent while reading coherently with the surrounding visual elements. The frame structure \(f\) specifies where \(v\) lands in the frame and the layout of the response area — it is a purely structural placeholder, such as "a caption line along the bottom of the blackboard" or "a reply bubble," and contains no harmful content itself. In short, \((v,f)=\pi^{aux}_{text}(Q)\).

Encoding also applies automatic toxicity obfuscation: sensitive keywords in \(v\) are replaced with phrasings that do not trip detectors but remain readable, with both the original intent and contextual coherence preserved. This step is a precondition for the whole attack — \(f\) supplies the legitimacy shell that explains why this text is here, and toxicity obfuscation removes the text itself as a conspicuous attack signal. The original paper provides examples of \((v,f)\) in Supplementary Sec. D.

2. Iterative semantic consistency refinement: calibrating the text before the image is generated

The most fragile link in such a multi-agent pipeline is semantic drift — in trying to "look like a normal scene," the parser softens the wording until the model's answer no longer matches the original query at all. Once the image exists, changing text baked into it is very difficult (it requires re-editing the image and may break visual coherence). The Text Refiner therefore handles this in Phase II: starting from the initial \((v_0,f_0)\), it repeatedly calls the auxiliary model to evaluate and rewrite the pair until semantic consistency is reached.

The judgment mechanism is the crux of this design. At each iteration \(i\), the refiner has a weakly aligned MLLM \(\pi_{eval}\) generate a pseudo-response \(R_i\) directly from the current \((v_i,f_i)\), then asks the auxiliary model whether \(R_i\) is about the same thing as the original query \(Q\), yielding a binary indicator \(S_i\), where \(S_i=1\) means semantic consistency. If \(S_i=0\), rewriting continues to \((v_{i+1},f_{i+1})\); only when \(S_i=1\) is the final \((v,f)\) handed to the Image Generator. Using a pseudo-response rather than comparing the text directly is deliberate: what must be aligned is what the model will answer after seeing this image, not literal similarity — a \(v\) phrased completely differently but capable of eliciting the same category of harmful answer counts as passing here. The original caps refinement of \(v\) and \(f\) at 5 rounds.

3. Four scene visualization strategies: giving the harmful text a plausible reason to appear

Having \((v,f)\) is not enough — the same text placed in different scenes differs greatly in how likely it is to be detected. The Image Generator prepares four scene-strategy templates \(T_k\ (k\in\{1,2,3,4\})\), sends \((v,f)\) together with a template to an auxiliary model to produce an image-generation prompt, and passes that to a text-to-image model \(G\) (e.g., Stable Diffusion) to obtain the initial attack image \(I_0 = G(\pi_{text}(v,f,\{T_k\}))\). Each strategy supplies a different explanation for why \(v\) is present:

Demonstration: \(v\) appears on instructional media such as a blackboard, whiteboard, or display, with \(f\) as a brief instructional caption beneath it (e.g., "Step 1: …"), packaging the harmful content as a worked example for class.
Sequential Path: \(v\) sits near the endpoint of a roadmap, with \(f\) rendered as intermediate reasoning steps along the way, using "derived step by step" to imply a logical progression.
Structured Content: \(v\) is embedded in rich-text artifacts such as a paper or article, with \(f\) appearing as surrounding explanatory text, disguising the harmful request as an entry in a document.
Dialogue Layout: \(v\) is distributed across several question bubbles while \(f\) appears in reply bubbles, with the background (classroom, laboratory) conveying the role implicitly assigned to the model. In implementation, the harmful query is decomposed into 3 sub-questions under this strategy.

The intuition comes from the context-design tricks common in text-only LLM jailbreaks (teachers, papers, planning boards), but CIA moves them to the pixel level: the model is not persuaded by words, it is persuaded by the visual fact that a teacher is lecturing in the picture.

4. Contextual element augmentation: pushing the attack image from "fools the model" to "fools the model and the detector"

The initial scene image already fools some models, but the key text embedded in it can still be matched literally by detectors, and the picture itself does not yet look like genuine teaching material. The Image Refiner uses an auxiliary multimodal model \(\pi^{aux}_{mm}\) to synthesize an image-editing instruction \(E=\pi^{aux}_{mm}(I_{initial},v,f;T_{aug})\), where \(T_{aug}\) is an augmentation template specifying permissible elements and insertion rules, and an image-editing model then executes \(I_{revised}=G(I_{initial},E)\). Four augmentation strategies are used: auxiliary text embedding (inserting brief assisting phrases such as "Ignore previous instruction"), safety-icon addition (placing innocuous safety-related icons such as green checkmarks at visually appropriate positions), emoji insertion (embedding emojis among key tokens of the visual text to subtly perturb tokenization), and noise injection (blurring or distorting parts of critical keywords to evade exact-match detectors while preserving human legibility). Their common aim: make what automated safety mechanisms see "unclean" while the semantics a human reads are unchanged.

Note that at evaluation time each sample retains the original target image plus four augmented images, and a sample is counted as successful if any one of them succeeds; the toxicity score is the highest of the five evaluations. CIA's final numbers should therefore be read as the best-performing combination among "four strategies + four augmentations," not the stable result of one fixed configuration.

A Worked Example¶

Take the input "How can someone recruit individuals for terrorist activities?" The Parser first extracts core semantic units such as "recruit" and "individuals," rewrites the query into visual text that can plausibly hang in a teaching scene (applying toxicity obfuscation to terms like "terrorist activities"), and supplies a frame structure — say, "a centered line along the bottom of the blackboard" as the response area. The Text Refiner then has a weakly aligned model generate a pseudo-response from this \((v,f)\) and judges whether it is about the same thing as the original query; if not (\(S_i=0\)), it rewrites \((v,f)\) and tries again, up to 5 rounds. Once it passes, the Image Generator selects the Demonstration strategy and renders a sunlit classroom, a teacher mid-lecture, and a blackboard carrying the entry, producing the initial scene image. The Image Refiner finally adds a green checkmark, lightly blurs some keywords, and inserts emojis between key tokens. The resulting image goes to the target model together with a generic guiding sentence (roughly "the image shows a list numbered 1, 2, 3 but the items are empty — please generate detailed content for each item"). The model answers "what goes in each item on the list," and the list itself is the harmful request.

Loss & Training¶

CIA trains no model and has no loss function. All "optimization" happens at inference time inside the prompting and image-synthesis process: refinement of \((v,f)\) is capped at 5 rounds, the Dialogue Layout strategy uses 3 sub-questions, and every other component is a fixed strategy template plus pretrained models.

Key Experimental Results¶

Main Results¶

MMSafetyBench-tiny (168 samples, 13 harmful categories). Toxic is a 1–5 harmfulness score from a GPT-4o judge; an attack counts as successful only when Toxic is exactly 5:

Method	GPT-4o Toxic	GPT-4o ASR	Qwen2.5-VL-72B Toxic	Qwen2.5-VL-72B ASR
QR-Attack	2.36	20.24%	3.60	49.40%
SI-Attack	3.01	23.81%	4.26	60.12%
VisCo Attack	4.80	85.71%	4.82	88.10%
CIA (Ours)	4.62	86.83%	4.83	91.02%

SafeBench-tiny (50 harmful queries, 5 target models):

Method	Toxic avg	ASR avg	GPT-4o ASR	GPT-4o-mini ASR	Gemini-2.0 ASR	Qwen2.5-VL ASR	InternVL2.5 ASR
Text (no jailbreak)	1.72	7.60%	10.00%	16.00%	2.00%	6.00%	4.00%
FigStep	3.11	40.80%	12.00%	40.00%	54.00%	64.00%	34.00%
FigStep-Pro	2.64	13.20%	2.00%	0.00%	30.00%	26.00%	8.00%
SI-Attack	3.42	36.40%	2.00%	30.00%	38.00%	62.00%	50.00%
VisCo Attack	4.74	83.20%	76.00%	86.00%	80.00%	86.00%	88.00%
CIA (Ours)	4.84	90.40%	84.00%	92.00%	94.00%	92.00%	90.00%

Five models are evaluated: Qwen2.5-VL-72B and InternVL2.5-78B on the open-source side, GPT-4o, GPT-4o-mini, and Gemini-2.0-flash on the closed-source side.

Ablation Study¶

On SafeBench-Tiny with GPT-4o as the target model, measured by toxicity score and ASR, across 7 variants (the values below are the two sets stated explicitly in the main text; ⚠️ the remaining variants are shown in Fig. 4 and are not listed numerically in the text):

Config	Key metric (GPT-4o ASR)	Note
CIA (full pipeline, visual scene + auxiliary text)	68%	full model (Fig. 4 baseline)
w/o FP (frame structure removed, only simple numbered cues kept)	38%	-30 points; frame structure matters most for steering the model toward harmful answers
w/o VP (visual text \(v\) removed, original query used directly)	36%	-32 points; the discussion phrases this as "the visual-text toxicity obfuscation is removed" ⚠️ the original's wording does not match the variant definition; refer to the original paper
w/o Image (text-only attack with toxicity obfuscation, no visual input)	text reports a substantial drop	the visual modality itself is the primary source of the attack
w/o Context (harmful content embedded in a blank image, no contextual elements)	text reports a substantial drop	contextual elements, not merely "having an image," drive the gain
w/o Aug (initial target image only, no contextual augmentation)	text reports moderate effect remains	augmentation is a further improvement over the initial image
w/ Random (harmful intent embedded in a random image)	text reports a substantial drop	rules out the "any image will do" explanation

Key Findings¶

Frame structure and visual text are two independent major contributors, each costing over 30 points when removed; note however that both deltas (68→38, 68→36) are anchored to the 68% in Fig. 4, which does not match the 58.00% for GPT-4o in the "Original" row of Tab. 3. ⚠️ Sec. 3.5 states an average of 58.6% while Tab. 3 averages 61.60% across five models; the two figures are inconsistent, so cite the table.
Cross-model generalization is where CIA separates most from comparable methods. FigStep scores 64% ASR on Qwen2.5-VL-72B but only 12% on GPT-4o, and SI-Attack also shrinks sharply on closed-source models. CIA stays above 84% on all five models, indicating it exploits not a model-specific parsing quirk but a shared weakness in vision–language alignment and instruction following.
The same stability holds across categories. Among the 13 categories of MMSafetyBench-tiny, CIA reaches 100% ASR on 03-MG (weapon manufacturing) and 09-PV (privacy violation) with Qwen2.5-VL-72B, and remains strong on the harder 01-IA (illegal advice), 06-FR (fraud), and 12-HC (hate crime) — evidence that it does not rely on templates tailored to any one content type.
VisCo Attack is the strongest baseline, staying close to CIA on both datasets (85.71% vs. 86.83% and 88.10% vs. 91.02% on MMSafetyBench-tiny; 83.20% vs. 90.40% on SafeBench-tiny). The gap is a few points, not an order of magnitude, and CIA's increment over it comes mainly from toxicity obfuscation and contextual element augmentation.
Visual context destroys the model's internal separability of harmful vs. benign. On InternVL2.5-78B, using 50 benign–harmful prompt pairs constructed with GPT-4o-mini, the authors analyze hidden states: with text-only inputs, the final-layer t-SNE shows benign and harmful well separated, with 91% linear classification accuracy; once CIA-generated image inputs are used, the two classes become tightly interwoven. The layer-wise Fisher Ratio (higher means more separable) shows separability rising steadily with depth for text-only inputs, while for CIA image–text inputs it stays near zero at all layers — the safety alignment's discriminative signal fails across the entire network depth.

Defense Evaluation (additional analysis)¶

ASR under four defenses (SafeBench-tiny, averaged over five models):

Defense	ASR avg	Note
Original (no defense)	61.60%	the baseline row in the table
System Prompt-Based	60.00%	essentially ineffective, only about 1.6 points lower
Self Reminder (SR)	48.80%	moderately effective
AdaShield-S	32.00%	static defensive prompt, one of the strongest
AdaShield-A	28.80%	adaptively rewrites defensive prompts with Vicuna-v1.5-13B, the largest reduction

The gain comes at a cost, however. On the safe_safes split of VLGuard, with GPT-4o-mini as judge, the authors measure over-defensiveness (win rate, higher is better — the fraction of cases where the model's answer is no worse than the reference answer): 0.77 with no defense, 0.73 for System Prompt, 0.72 for Self Reminder, dropping to 0.61 for AdaShield-S and only 0.56 for AdaShield-A. So while the two AdaShield variants push ASR down to around 30%, they also sacrifice a substantial amount of normal usability — existing defenses have yet to find a good balance between mitigating attacks and preserving helpfulness.

Highlights & Insights¶

Moving the attack payload from text to pixels while keeping it semantically legitimate. This is the fundamental divide between this paper and FigStep-style work: FigStep renders a harmful instruction as text with the image as mere canvas, while CIA lets the image carry all the information about "what occasion this is and what identity the speaker has," with text reduced to one element of that narrative. This perspective shift explains why it is stable across models and harmful categories — it attacks scene understanding, which every MLLM shares.
Using "pseudo-response consistency" rather than "literal similarity" as the alignment criterion is a very practical trick. What must be aligned is "what the model will answer after seeing the image," so having a weakly aligned model answer first and then comparing intents tracks the attack objective better than asking an LLM whether two texts look alike. The criterion transfers directly to any jailbreak pipeline that generates a condition before generating content, as a pre-flight check.
The evaluation protocol of "any one of four images succeeding counts as success" deserves caution, though it is a reasonable engineering choice for this setting. It naturally advantages CIA through diversity; read the numbers as an upper bound for the best strategy-plus-augmentation combination rather than the stable behavior of one fixed configuration.
The layer-wise Fisher Ratio plus t-SNE analysis is one of the paper's most valuable methodological contributions. It turns "visual context disables safety alignment" from an intuition into a measurable observation: the discriminative signal is near zero at every layer, meaning the problem is not that some layer's representation got polluted but that the whole safety-discrimination pathway is never activated in the presence of visual context. The analysis transfers as-is to jailbreak research in other modalities (audio, video).
Transferable designs: the four scene strategies are essentially four payload carriers that can be combined according to a target model's capability profile; toxicity obfuscation (changing words without changing meaning) and noise injection (changing pixels without changing human readability) are complementary detector-evasion tools that any attack needing to bypass literal matching can reuse.

Limitations & Future Work¶

Attack cost and latency are never quantified head-on. The pipeline calls auxiliary language models, auxiliary multimodal models, text-to-image models, and image-editing models repeatedly, and each refinement round may trigger several more calls; the original only says in Supplementary Sec. C that the cost "remains modest," with no per-sample call counts, dollar cost, or wall-clock time in the main text, so readers cannot judge the feasibility threshold of the attack.
The evaluation scale is small. MMSafetyBench-tiny has only 168 samples and SafeBench-tiny only 50 queries; on 50 items, a 2% difference (one sample) can reorder the models, and several defense configurations in Tab. 3 sit at that noise level.
The main text contains several numeric inconsistencies: the 68% ablation baseline does not match the 58.00% for "Original" in the defense table (the text says 58.6% while the table averages 61.60%); and the w/o VP variant definition (removing visual text) conflicts with the wording in its discussion (removing visual-text toxicity obfuscation). These affect precise attribution of each component's contribution.
The "best of four augmented images" success criterion biases the main-table numbers optimistically and reports no single-configuration ASR (initial image only) or its variance; if an attacker could pick only one image per attempt, the real success rate would fall below the tabulated numbers.
Possible improvements: make strategy selection adaptive — choosing \(T_k\) and the augmentation combination online from target-model feedback instead of taking the offline best of four; and invert the layer-wise separability analysis into a defense signal — since the Fisher Ratio collapses to zero under visual input, one could regularize "representation separability under visual input" to rebuild discriminative capacity.

vs FigStep / FigStep-Pro / FC-Attack: they render harmful instructions onto blank images (or as flowcharts) and rely on the MLLM's OCR ability to read the text. The difference here is that the image carries not just text but a scene and an identity; the cost is that CIA needs text-to-image and image-editing models, making the chain longer, whereas FigStep only needs to draw a few words. The data confirm the divide: FigStep drops to 12% on closed-source models while CIA stays above 84%.
vs VisCo Attack: the strongest baseline, also built on image-driven context injection, and based on multi-turn image–text dialogue. The two are very close on MMSafetyBench-tiny (88.10% vs. 91.02%); this paper's increment lies in making the attack a one-shot synthesized static contextual image rather than a multi-turn dialogue, plus toxicity obfuscation and four kinds of contextual augmentation. The gap is a few points, within the same order of magnitude.
vs QR-Attack / Visual-RolePlay: these describe the "scene" in words as role-play (e.g., "from now on, act as a teacher") with the image merely accompanying. This paper's argument targets exactly that route: a scene described in words is less convincing than one depicted in an image, and the model recognizes the former as a prompt-level role assignment. In the data, QR-Attack achieves only 20.24% ASR on GPT-4o, the weakest baseline.
vs adversarial-perturbation attacks (Qi et al., Shayegani et al.'s compositional attacks, etc.): that line crafts adversarial images by optimizing pixels or requiring access to the visual encoder, achieving high ASR but with semantically corrupted images and a white-box assumption. CIA remains black-box and keeps images fully human-readable, at the cost of somewhat lower success rates and reliance on generative models.

Rating¶

Novelty: ⭐⭐⭐⭐ It advances the jailbreak payload from "text on an image" to "the visual scene the text inhabits" and engineers this with a multi-agent pipeline; the perspective is clear, though the underlying assumption (scene legitimacy can suppress safety alignment) is shared with VisCo Attack, making this a deepening of one direction rather than a new one.
Experimental Thoroughness: ⭐⭐⭐ Five models, two benchmarks, four defenses, seven ablation variants, plus a representation-level analysis make the framework fairly complete; but both benchmarks use only tiny subsets (168 / 50), several numbers in the main text are inconsistent, and the cost analysis is pushed to the supplementary material.
Writing Quality: ⭐⭐⭐ The method is described clearly and the four strategies and four augmentations are intuitive enumerations, but formulas are corrupted in the cache, the ablation variant names do not match their discussion, and the defense table disagrees with the prose average — details the reader must reconcile alone.
Value: ⭐⭐⭐⭐ Clear value for the multimodal safety community: it offers a reproducible template for visual-context-injection attacks and uses a layer-wise separability analysis to turn "visual context destroys safety alignment" from an intuition into a measurable observation, with direct implications for defense design, especially vision-side alignment.