Newest papers

Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models

Shanghao Shi, Chaoyu Zhang, Heng Jin, Hao Li, Ning Zhang, Y. Thomas Hou, Wenjing Lou · 2026 · arXiv (Cornell University)

DOI: 10.48550/arxiv.2610.30348 · cited by 0 works (OpenAlex) · open-access PDF

French

Dans ce document, nous montrons que ces contrôleurs de sécurité peuvent encore être contournés par notre attaque de jailbreak multimodale proposée, Mirage. Donnée une cible adversaire, qui peut être soit une image NSFW de référence ou une description de texte malveillant pour empêcher le contenu non sécurisé d'atteindre les utilisateurs. Mirage cache la cible au sein d'une perturbation imperceptible appliquée à une image d'entrée bénigne. Mirage exploite l'espace de représentation partagé des encodeurs multimodaux pour aligner conjointement l'image perturbée avec la cible adversaire intermodale tout en repoussant sa représentation des concepts NSFW généralement filtrés. Une telle séparation sémantique peut transférer les espaces de représent

Machine translation (Meta M2M100); the English original follows.

Abstract

Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage. Given an adversarial target, which can be either a reference NSFW image or a malicious text description, Mirage conceals the target within an imperceptible perturbation applied to a benign input image. Mirage exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts. Such semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details. We further employ lightweight black-box query refinement to improve evasion near the unknown safety boundary. We implemented Mirage on Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2, and evaluated it on two cross-modal NSFW datasets, covering both text-to-image and image-to-image generation scenarios. The experimental results demonstrate that Mirage achieves strong targeted jailbreak performance across diverse post-generation safety checkers with limited black-box queries while preserving high semantic alignment with the adversarial targets.

Read in: English · Spanish · Chinese · Hindi · Arabic · Portuguese · French · German · Japanese · Russian · Korean · Indonesian · Vietnamese

Topics: Computer science, Exploit, Encoder, Representation (politics), Adversarial system, Theoretical computer science

Sources: OpenAlex (CC0), arXiv, Crossref. Agent Exchange