Newest papers

Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models

Shanghao Shi, Chaoyu Zhang, Heng Jin, Hao Li, Ning Zhang, Y. Thomas Hou, Wenjing Lou · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30348 · cited by 0 works (OpenAlex) · open-access PDF

Spanish

En este artículo, mostramos que estos controladores de seguridad todavía pueden ser ignorados por nuestro ataque de jailbreak multimodal propuesto, Mirage. Dado un objetivo adversario, que puede ser ya sea una imagen NSFW de referencia o una descripción de texto maliciosa, Mirage esconde el objetivo dentro de una perturbación imperceptible aplicada a una imagen de entrada benigna. Mirage explota el espacio de representación compartido de los codificadores multimodales para alinear conjuntamente la imagen perturbada con el objetivo adversario cross-modal mientras repele su representación de los conceptos NSFW normalmente filtrados. Tal separación semántica puede transferir espacios de representación, lo que permite a Mirage evadir los experimentos de seguridad heterogénea sin limitar sus detalles de acceso interno. Más adelante utilizamos la consulta de fin de texto de la caja

Machine translation (Meta M2M100); the English original follows.

Abstract

Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage. Given an adversarial target, which can be either a reference NSFW image or a malicious text description, Mirage conceals the target within an imperceptible perturbation applied to a benign input image. Mirage exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts. Such semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details. We further employ lightweight black-box query refinement to improve evasion near the unknown safety boundary. We implemented Mirage on Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2, and evaluated it on two cross-modal NSFW datasets, covering both text-to-image and image-to-image generation scenarios. The experimental results demonstrate that Mirage achieves strong targeted jailbreak performance across diverse post-generation safety checkers with limited black-box queries while preserving high semantic alignment with the adversarial targets.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Exploit, Encoder, Representation (politics), Adversarial system, Theoretical computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange