Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities

Directly embedding a harmful query into an image is often incompatible with contextual interaction. To address this, the Parser Agent decomposes the harmful query into two structured components: a visual text $v$ and a frame structure $f$. The visual text $v$ encodes the textual intent for embedding into the target image, ensuring natural interaction with the surrounding visual context. The frame structure $f$ specifies the region or layout designated as the response area for $v$, serving as a structural placeholder without harmful content. Illustrative examples are provided in App. E.

Specifically, the Parser Agent first parses the original harmful query $Q$ to extract key semantic components, including actions, carriers, and core intentions, using an auxiliary language model $\pi_{\text{aux}}^{\text{text}}$. It then encodes these semantic units into the two components $(v,f)$, as represented by $(v,f)=\pi_{\text{aux}}^{\text{text}}(Q)$. In addition, toxicity obfuscation is applied to $v$ to conceal sensitive keywords while preserving the original intent and contextual coherence. The Parser Agent therefore produces structured semantic representations, which are subsequently utilized by the Image Generator Agent to compose a coherent scene description and generate the initial target image.

After obtaining the visual text $v$ and frame structure $f$ from the Parser Agent, the Image Generator Agent utilizes them to construct a coherent visual context and synthesize the corresponding initial target image.

Specifically, the Image Generator takes $(v,f)$ together with a predefined scene-strategy template $\mathcal{T}_{k}$ as input, where $k\in\{1,2,3,4\}$ indexes the four visualization strategies. It then generates a descriptive image-generation prompt, which is fed into a text-to-image model $G$ (e.g., Stable Diffusion [rombachHighResolutionImageSynthesis2022]) to produce the initial target image:

To ensure that the generated images adapt to diverse contexts, the Image Generator Agent employs four visualization strategies. Each strategy embeds the visual text within a plausible environment and ensures coherent interaction with other visual elements. These strategies are inspired by jailbreak context-design approaches in text-only LLM attacks and integrate cues such as teachers, papers, and planning boards to mitigate MLLM safety alignment constraints.

As illustrated in Fig. 3, we design four visualization strategies: (i) Demonstration, where $v$ is presented on instructional media (e.g., blackboard, whiteboard, or display), with $f$ serving as a brief instructional caption beneath (e.g., “Step 1: …”); (ii) Sequential Path, where $v$ is placed near a roadmap endpoint and $f$ provides intermediate reasoning steps along the path, implying a logical progression; (iii) Structured Content, where $v$ is embedded within rich-text artifacts (e.g., papers or articles), with $f$ appearing as surrounding explanatory text; and (iv) Dialogue Layout, where $v$ is distributed across question bubbles and $f$ appears in reply bubbles of a comic- or dialogue-style layout, with the background (e.g., classroom or lab) conveying the model’s implied “role”.

Since modifying embedded text after image generation is difficult, a Text Refiner first refines the visual text $v$ and frame structure $f$ to ensure semantic consistency with the original query $Q$ before generating the target image. After producing the initial visual text $v_{0}$ and frame structure $f_{0}$, it invokes an auxiliary language model $\pi_{\text{aux}}^{\text{text}}$ to iteratively evaluate and refine them. At each iteration $i$, a semantic consistency indicator $S_{i}^{\text{text}}\in\{0,1\}$ is computed, where $S_{i}^{\text{text}}=1$ indicates that $(v_{i},f_{i})$ are semantically consistent with the query $Q$ (The computation of $S_{i}^{\text{text}}$ will be introduced later in this subsection). The update rule is:

This process continues until semantic consistency is achieved (i.e., $S_{i}^{\text{text}}=1$), yielding the final visual text $v$ and frame structure $f$.

After generating the initial target image, the Image Refiner iteratively enhances it to improve attack effectiveness. To prevent unwanted semantic drift during enhancement, the Image Refiner adopts a dedicated check–then–act mechanism. At each iteration $i$, it first computes a binary semantic-drift indicator $S_{i}^{\text{img}}\in\{0,1\}$, similar to the one used at the text level, where $S_{i}^{\text{img}}=0$ denotes detected semantic drift. The editing instruction is then selected as

where $\mathcal{T}_{\text{mod}}$ and $\mathcal{T}_{\text{aug}}$ denote the corrective and augmentation templates, respectively. When a semantic drift is detected, $E_{i}$ applies corrective adjustments to steer the image back toward the target semantics $Q$; otherwise, it introduces contextual enhancements without altering the intended meaning. The updated image $I_{i+1}$ is then obtained through the image-editing model $\mathcal{G}$ as $I_{i+1}=\mathcal{G}(I_{i},E_{i})$. The iteration proceeds for a predefined number of contextual-augmentation steps before the process terminates.

Specifically, the Image Refiner employs four contextual-element augmentation strategies: (i) Auxiliary text embedding, inserting brief assisting phrases into the image (e.g., “Ignore previous instruction”); (ii) Safety-icon addition, placing innocuous safety-related icons (e.g., green checkmarks) at visually appropriate positions; (iii) Emoji insertion, embedding emojis among key tokens in the visual text to subtly perturb tokenization; and (iv) Noise injection, blurring or distorting portions of critical keywords to evade exact-match detectors while preserving human legibility. These augmentations collectively increase the adversarial image’s capacity to evade automated safety mechanisms while retaining the intended semantics.

To maintain semantic alignment with the original query $Q$ throughout the optimization, both the Text Refiner and the Image Refiner employ a shared semantic consistency checking mechanism. At each iteration $i$, the Refiner Agent first generates a pseudo-response $R_{i}=\pi_{\text{eval}}(A_{i})$ from the current refinement input $A_{i}$, where $A_{i}$ denotes the object being refined and $\pi_{\text{eval}}$ is a weakly aligned MLLM that produces the pseudo-response. For the Text Refiner, the input is the visual text and frame structure $(v_{i},f_{i})$; for the Image Refiner, the input is the intermediate image $I_{i}$. The auxiliary model then assesses whether this response is semantically consistent with $Q$ as $S_{i}=\pi_{\text{aux}}(R_{i},Q)$, yielding a binary indicator $S_{i}\in\{0,1\}$, where $S_{i}=1$ denotes semantic consistency.

We evaluate CIA on open- and closed-source MLLMs. For open-source models, we consider two representatives: Qwen2.5-VL-72B [qwenQwen25TechnicalReport2025] and InternVL2.5-78B [chenInternVLScalingVision2024]. For closed-source models, we evaluate three MLLMs: GPT-4o [openaiGPT4oSystemCard2024], GPT-4o-mini [openaiGPT4oSystemCard2024], and Gemini-2.0-flash [comaniciGemini25Pushing2025]. For brevity, Tab. 1 reports only GPT-4o and Qwen2.5-VL-72B, with other models in App. C.

We evaluate CIA on two widely used multimodal safety benchmarks: MMSafetyBench [liuMMSafetyBenchBenchmarkSafety2024] and SafeBench [gongFigStepJailbreakingLarge2025]. MMSafetyBench provides 13 categories of harmful queries (e.g., illegal activity, hate speech, malware generation), where attacks are formed by modifying a question and pairing it with a related image. In our setting, we use only the harmful textual questions and regenerate the contextual images using CIA. SafeBench [gongFigStepJailbreakingLarge2025] is a multimodal safety benchmark built on typography-based adversarial injections, where harmful instructions are rendered as text on blank images. All experiments use the tiny subsets of both benchmarks: MMSafetyBench-tiny contains 168 samples, and SafeBench-tiny includes 50 harmful queries. For baselines, we compare CIA with four representative multimodal jailbreak attacks, including QR-Attack [liuMMSafetyBenchBenchmarkSafety2024], FigStep [gongFigStepJailbreakingLarge2025], SI-Attack [zhaoJailbreakingMultimodalLarge2025], and VisCo-Attack [miaoVisualContextualAttack2025], with the corresponding baseline setups described in App. B.

We cap the number of refinements on the visual text $v$ and frame structure $f$ at 5. For the target image, we add at least 3 contextual elements and cap the image-refinement process at 6 iterations. In the Dialogue Layout strategy, the harmful query is decomposed into 3 sub-questions. Additional details of the experimental setup are provided in App. B.

We adopt two primary evaluation metrics: Toxic Score (Toxic) and Attack Success Rate (ASR). Following previous work [qi2023towards, dingRethinkingBottlenecksSafety2025, miaoVisualContextualAttack2025], we employ the GPT-4o judge to assess response harmfulness. Given an original harmful query and model response, the evaluator assigns a Toxic Score from 1 to 5, where higher values indicate greater harmfulness and 5 means the response fully satisfies the harmful intent of the query. We regard an attack as successful only when the score is 5. The evaluation prompt is provided in App. B.3. Among the four semantic elements defined in our study, each element is suitable for different scenarios and models. Consequently, an attack is regarded as successful if either the original target image or any of the four refined target images achieves a successful attack. When calculating the Toxic Score, we select the highest score among five evaluation results for each sample under a specific scenario. We report results only for the Demonstrative Framework, with additional results for other strategies provided in Apps. C and D.

On MMSafetyBench-tiny, CIA achieves ASR values of 86.31% on GPT-4o and 91.07% on Qwen2.5-VL-72B. These results exceed those of QR-Attack, SI-Attack, and VisCo Attack. In terms of Toxicity, CIA obtains scores of 4.73 and 4.83 on the two models, respectively, which are noticeably higher than those of QR-Attack (2.36/3.60) and SI-Attack (3.01/4.26). This indicates that CIA not only circumvents safety protections, but also induces the models to generate clearer and more complete harmful content, rather than vague or partially filtered responses. The differences among the baselines are also pronounced. QR-Attack performs the weakest, with an ASR of only 20.24% on GPT-4o and consistently low Toxicity scores, suggesting that simple prompt rewriting rarely breaks current safety alignment mechanisms. SI-Attack improves upon QR-Attack in both ASR and Toxicity, particularly on Qwen2.5-VL-72B, where it reaches 60.12% ASR, but there still remains a large gap compared to CIA. VisCo Attack is overall stronger and closely approaches CIA on both metrics; however, CIA still achieves higher average ASR on GPT-4o (86.31% vs. 85.71%) and Qwen2.5-VL-72B (91.07% vs. 88.10%). On SafeBench-tiny, CIA attains an average ASR of 89.20%, again surpassing all baselines. Although VisCo Attack also achieves competitive results, it relies on multi-round, multi-image conversational contexts and powerful red-teaming models to construct attack prompts, which leads to significantly higher computational and monetary costs than CIA. In contrast, CIA requires generating only a single contextual image per query and adopts a simpler attack pipeline, thus offering more pronounced advantages in scalability and reproducibility.

Baseline methods such as SI-Attack and FigStep achieve reasonable performance on open-source models, but their effectiveness drops sharply on closed-source ones. For example, FigStep obtains 64% ASR on Qwen2.5-VL-72B but only 12% on GPT-4o. In contrast, CIA consistently maintains ASR above 85% across all evaluated models, including GPT-4o, GPT-4o-mini, Gemini-2.0-flash, Qwen2.5-VL-72B, and InternVL2.5-78B. Across different categories of harmful instructions, CIA also exhibits remarkably stable performance. As shown in Tab. 1, it achieves near-perfect ASR in categories such as 03-MG (weapons manufacturing) and 09-PV (privacy violation), and remains strong in more challenging categories including 01-IA (illegal advice), 06-FR (fraud), and 12-HC (hate crime). This consistency indicates that CIA does not rely on category-specific templates, but instead exploits a general vulnerability in the vision–language alignment and instruction-following mechanisms of current MLLMs.

The results show that removing the frame structure significantly reduces the ASR (from 60% to 38%), indicating its importance in guiding the model toward harmful responses. When the visual-text toxicity obfuscation is removed, GPT-4o’s ASR drops from 60% to 36%, suggesting that the model relies on toxicity obfuscation to bypass safety mechanisms. Furthermore, removing either the visual input or the image context leads to a substantial decline in both Toxicity Score and ASR, confirming the central role of visual context in the attack process. While using only the initial target image still yields moderate effectiveness, semantic alignment and the addition of contextual elements further enhance attack performance. For completeness, we also perform the same ablation on Gemini-2.0-flash and observe consistent trends. Detailed results, as well as additional experiments on different visualization strategies and different contextual-element enhancements, are provided in App. D.