Abstract
Image-to-text jailbreaks place harmful intent in text, image content, or the relationship between them. We examine image-side factors across four published attack families on a 313-prompt StrongREJECT slice, using five multimodal models and an additional appendix evaluation of InternVL3.5-8B. The harmful instruction is held constant across conditions; the baseline matrix uses one draw per prompt, and paired ablations use three draws with an automated rubric judge. A bare harmful query, with or without a benign unrelated image, produces little attack success on most victims, while attack images substantially increase it. First, per-tile entropy and JPEG size do not reliably distinguish attack tiles from size-matched benign distractors, limiting density-only screening. Second, earlier tile-count ladders were confounded by payload visibility. A corrected region-count test found no detectable effect, so the role of tile-count structure remains unresolved. Third, on Qwen3-VL-8B, the E4 manipulation that removes query-specific relatedness lowers ASR by about 0.12. This supports a bounded attribution to the relatedness manipulation, although image-text congruence remains unmeasured. A within-category control reproduces the direction on overlapping stimuli. Five tests survive the global statistical correction, but only E4 supports attribution to one measured descriptor; the within-category result is a robustness check, not a separate attribution. These conclusions remain conditional on the rubric judge.
Keywords
Subject
Publication details
- Journal
- Not available
- Open access
- Green open access
Cite this article
APA 7
Chen, B., Dawoud, Y., Mersha, H., Shao, M., Garg, S., Karri, R., & Shafique, M. (2026). Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks. https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks
MLA 9
Chen, Boyuan, et al. "Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks." https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks.
Chicago (author–date)
Chen, Boyuan, Yehia Dawoud, Hailemariam Mersha, Minghao Shao, Siddharth Garg, Ramesh Karri, and Muhammad Shafique. 2026. "Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks." https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks.
Harvard
Chen, B., Dawoud, Y., Mersha, H., Shao, M., Garg, S., Karri, R. and Shafique, M. (2026) 'Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks', Available at: https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks.
Vancouver
Chen B, Dawoud Y, Mersha H, Shao M, Garg S, Karri R, et al. Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks. https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks
IEEE
B. Chen, Y. Dawoud, H. Mersha, M. Shao, S. Garg, R. Karri, and M. Shafique, "Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks," https://omanscience.com/en/articles/which-image-property-carries-the-jailbreak-a-controlled-dissection-of-image-to-text-jailbreaks.