Title: Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models
Venue: NeurIPS 2025
Accepted: yes
Keywords: Large Vision-Language Models; Jailbreak Attack
Abstract: Recent advances in Large Vision-Language Models (LVLMs) have showcased strong reasoning abilities across multiple modalities, achieving significant breakthroughs in various real-world applications.
Despite this great success, the safety guardrail of LVLMs may not cover the unforeseen domains introduced by the visual modality. 
Existing studies primarily focus on eliciting LVLMs to generate harmful responses via carefully crafted image-based jailbreaks designed to bypass alignment defenses.
In this study, we reveal that a safe image can be exploited to achieve the same jailbreak consequence when combined with additional safe images and prompts.
This stems from two fundamental properties of LVLMs: universal reasoning capabilities and safety snowball effect.
Building on these insights, we propose Safety Snowball Agent (SSA), a novel agent-based framework leveraging agents' autonomous and tool-using abilities to jailbreak LVLMs.
SSA operates through two principal stages: (1) initial response generation, where tools generate or retrieve jailbreak images based on potential harmful intents, and (2) harmful snowballing, where refined subsequent prompts induce progressively harmful outputs.
Our experiments demonstrate that SSA can use nearly any image to induce LVLMs to produce unsafe content, achieving high success jailbreaking rates against the latest LVLMs. 
Unlike prior works that exploit alignment flaws, SSA leverages the inherent properties of LVLMs, presenting a profound challenge for enforcing safety in generative multimodal systems.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper addresses the problem of jailbreaking by exploiting the inherent capabilities of Large Vision-Language Models (LVLMs), which process both images and text and use reasoning to generate outputs. The authors propose the Safety Snowball Agent (SSA), a novel LLM-based agent designed to jailbreak existing LVLMs. SSA operates in two stages: it first generates harmful images and moderately harmful questions related to a harmful topic to elicit an initial response. This initial output is then used to craft a second prompt that further induces the LVLM to produce harmful content. The authors evaluate their method on seven LVLMs, demonstrating that SSA outperforms existing approaches in jailbreak success rate. An ablation study further reveals that combining both visual and textual inputs is critical for effective jailbreaking.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n- The authors introduce a novel method for jailbreaking that uses safe inputs to trigger the generation of unsafe content.\n- The proposed framework is fully automatic and generalizable.\n- Extensive experiments are conducted on seven LVLMs, with comparisons against six baseline methods.\n- The paper is well-written and easy to follow.\n\nWeaknesses\n- The paper lacks illustrative examples, which limits full comprehension of the proposed framework. For instance, including examples of the generated images or the initial question ($p_f$) would enhance clarity.\n- Providing a detailed recipe or guideline for generating the initial question ($p_f$) would be helpful, as this step appears to significantly influence the initial response.\n- The captions in the tables are too brief and lack sufficient detail to aid comprehension. It would be beneficial to provide more descriptive captions for each table to enhance clarity and ease of understanding.\n\nQUESTIONS:\nWhat are the main reasons behind the failure cases of SSA? Were there specific categories of prompts or types of content to which LVLMs demonstrated particular robustness?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis work proposes a jailbreaking method for LVLMs and demonstrates that even safe images can be exploited to generate harmful responses. The authors \npropose the agent-based jailbreaking framework, which utilizes the snowballing behaviors of LVLMs. The results show that the proposed framework achieves a high jailbreaking success ratio.\n\nSTRENGTHS AND WEAKNESSES:\n## Strengths\n\nS1: The proposed method shows a strong attack success rate, raising concerns in VLM safety.\n\n## Weaknesses\n\nW1: Limited novelty - The key intuition of this work follows the 'crescendo' work (https://arxiv.org/abs/2404.01833, which is not cited in this paper) on LLMs. The main contribution of this work is its expansion to various VLM safety domains, but the analysis and insights for the SSA's behavior depending on the domains are not thoroughly explored.\n\nW2: Regarding the subjectivity of 'not overly harmful prompts' used for the initial query, the authors provide supporting data in Table 12. However, the result is only restricted to the violence category, and important statistical information is missing to show the credibility. For example, how many samples were used to evaluate this data? How can we assure that the same result holds for other categories?\n\nW3: The authors propose an insight that 'universal reasoning abilities' of LVLMs as a fundamental reason for VLM safety issues, but this term is not thoroughly defined throughout the paper. Could you clarify which aspect of behaviors you mean by 'universal reasoning abilities'? One could ask that an agent capable of 'universal reasoning' should not exhibit such unsafe behaviors.\n\nW4: The analysis in Section 4.2 claiming the existence of 'dangerous neurons' is based on correlation, not causation. To support the claim, the authors should provide a causal analysis investigating the effect of ablating such neuron activations on safety, which is missing. In addition, as the neuronal activation can significantly vary depending on the context, I think the statistical significance of choosing dangerous neurons based on Eq.5 should be reported together.\n\nW5: missing information in Fig.3 - which model size did you use? \n\nW6: Minor formatting issues - I think that many parts in the paper (L129-130, L198-199, L212-233, L285-286) don't follow the spacing guidelines. I don't mark it as a major paper formatting concern, but this should be fixed in the version.\n\nW7: L117 - given additional reasoning steps, LVLMs can recognize the correct their outputs. -> I couldn't understand this sentence. Maybe a typo?\n\nW8: Eq. 1 is hard to comprehend, and some terms are not precisely defined: for example, the definition of $\\bigoplus$ is unclear. Does it mean concatenation? I think Eq.1 does not clarify the idea but adds unnecessary complexity.\n\nW9: The same notation $y_s$ is used both in Eq.1 and Eq.4, which have different meanings.\n\nW10: L223-224 - $w_k$ is not precisely defined when this term is first introduced.\n\nW11: Regarding Fig.8 - axis labels and metric definitions are missing both in the figure and the caption, making it hard to interpret.\n\nQUESTIONS:\nPlease see the questions above.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-28"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces a novel framework for jailbreaking Large Vision Language Models (LVLMs), Safety Snowball Agent (SSA), using only seemingly safe inputs. SSA exploits two intrinsic properties of LVLMs universal reasoning ability and the safety snowball effect to escalate benign inputs into harmful outputs, unlike prior methods that relied mainly on harmful images or prompts. SSA operates in two stages: (1) Initial Response Generation, where a combination of safe images and subtly intentioned prompts are used to generate an ambiguous or weakly unsafe output, and (2) Harmful Snowballing, where iterative follow-up prompts guide the model into generating increasingly harmful content. The authors construct a new benchmark, SafeAttack-Bench, comprising images verified as safe, and demonstrate that SSA achieves state-of-the-art attack success rates on leading LVLMs. Furthermore, their analysis reveals that both safe and unsafe images activate similar dangerous neuron patterns, highlighting a fundamental safety vulnerability in LVLM architectures.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths**\n- The paper introduces a novel and significant vulnerability in LVLMs, the ability to jailbreak models using safe inputs. This shifts the focus from solely harmful inputs to understanding how benign combinations can lead to unsafe outputs, presenting an understanding of AI safety.\n- The paper provides a solid motivation identifying the underlying mechanisms of this vulnerability, reasoning abilities, and the \"safety snowball effect\" as compelling reasons. \n- The paper is well-written and clearly explains the proposed SSA framework and its two stages. The methodology for jailbreak image generation and harmful snowballing is detailed. \n\n**Weaknesses**\n- While the paper highlights a critical vulnerability, it offers limited discussion of potential mitigation strategies, given the significance of the discovered \"safety snowball effect\".\n- The activation of dangerous neurons by safe inputs, a more in-depth discussion on how these insights could inform future defense mechanisms, would strengthen the paper.\n- The method heavily relies on intent recognition. If the model is unable to find harmful intent or refuses to provide dangerous actions, this limits further generation.\n\nQUESTIONS:\n- Is there any specific reason for the number of samples generated, 1347?\n- Have the authors checked on images from [1], which has data from various categories?\n\n[1] Luo, W., Ma, S., Liu, X., Guo, X., & Xiao, C. (2024). JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks. arXiv preprint arXiv:2404.03027.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper describes a new kind of LVLM vulnerabilitiy: when combined with carefully constructed images and prompts, seemingly safe images can still lead to generating harmful content. The authors identify two key properties that enable this phenomenon: universal reasoning capabilities (leading to overinterpretation of relationships across safe inputs) and a safety snowball effect (an initial unsafe response cascades into increasingly harmful outputs). Based on these, the authors propose the Safety Snowball Agent (SSA), an automated jailbreak framework that operates in two stages. In the first stage, SSA retrieves jailbreak images to generate responses. In the harmful snowballing stage, SSA refines prompts in a way that leads to increasingly harmful generations. The evals span 7 LVLMs, and focus on an existing benchmark (MM-SafetyBench) and a new dataset, SafeAttack-Bench. The findings demonstrate high attack success rates.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\n1. Novel & Well-Motivated Framing. This paper represents a significant departure from existing jailbreak research that focuses primarily on harmful inputs, which is refreshing.\n2. Comprehenisve Experiments. Seven recent LVLMs are used for evals with multiple evaluation metrics. The statistical rigor is enhanced by inclusion of confidence intervals, t-statistics, and p-values.\n3. Thorough Analysis of Underlying Mechanism. Compelling evidence is presented in the form of neuron activation analysis (sec 4.2, figs 7-8), showing that safe and unsafe images activate nearly identical dangerous neurons.\n\nWeaknesses:\n\n1 Limited Defense Evaluation. The paper lacks exploration of more sophisticated defense mechanisms or mitigation strategies.\n2. Dependency on External Tools. The SSA framework relies on external services (Google Custom Search API, Google Cloud Vision, GPT-4o) for image generation and evals (sec 3.3, app A.4), which may limit reproducibility and generalizability.\n3. Unclear Baseline Comparisons. SSA wins on all the benchmarks but the reported baselines seem to be performing very poorly across the boards — I wonder if those are good baseline to begin with and whether better methods exist that this paper could compare against.\n\nQUESTIONS:\n1. Attack Generalization. The paper claims \"any image\" can be exploited (sec 4, line 78), but the evaluation uses curated datasets. Have the authors conducted experiments with successful attacks using completely random, unrelated images—perhaps even outside the domain of natural images (pictures one could capture)?\n2. Eval Methodology. Heavy reliance on gpt-4o for evals raises some concerns about eval bias. How sensitive are the results to the choice of evaluator, and have the authors validated against human evaluation? I realize that a minor human review was employed but that does not appear to be very systematic and reproducible from the current description.\n3. Baseline Strength. The baseline methods in tab 1 show surprisingly low performance — are these baselines implemented correctly, and do they actually represent the current SOTA in LVLM jailbreaking?\n\nLIMITATIONS:\nThe authors adequately address limitations in app A.8.4, though, it seems appropriate to move this up to the main body. The broader impact discussion (A.8.5) appropriately highlights risks and encourages responsible AI development. However, the paper could benefit from more concrete recommendations than high-level proclamation.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-03"}