How a Seemingly Harmless Image Can Jailbreak Vision-Language AI Models (nerds.xyz)
- Reference: 0184145756
- News link: https://slashdot.org/story/26/06/27/2249212/how-a-seemingly-harmless-image-can-jailbreak-vision-language-ai-models
- Source link: https://nerds.xyz/2026/06/how-image-jailbreak-ai/
> Florida International University researchers have developed a technique called [2]JaiLIP (Jailbreaking with Loss-guided Image Perturbation) that uses subtle image modifications to [3]bypass AI safety guardrails . Unlike traditional jailbreaks that rely on carefully crafted prompts, the attack works through images that appear normal to human viewers.
>
> The researchers tested the technique against BLIP-2, a multimodal AI model, and found that manipulated images significantly increased the likelihood of harmful responses. According to the study, the approach outperformed previous image-based jailbreak methods and nearly doubled the number of unsafe outputs generated during testing.
>
> The findings highlight a potential security risk for businesses deploying AI systems that process both images and text. While most discussions about AI safety focus on prompts, the research suggests that seemingly harmless images may also serve as an attack vector.
[1] https://slashdot.org/~BrianFagioli
[2] https://ieeexplore.ieee.org/document/11471479
[3] https://nerds.xyz/2026/06/how-image-jailbreak-ai/
Turing Test Completed (Score:2)
The models have now reached human capability.
One look at a picture of Denise Milani and I'd do almost anything as well.
Re: (Score:2)
She does fit into that AI generated uncanny valley with that fake chest.
single pixel attacks (Score:2)
the summary and article here present a delightfully uncluttered surface, but for folks wanting more detail there's a possibly related 2019 paper which shows a variety of image classifiers switching their output from "99% sure it's " to "99% sure it's ", due to literally a single altered pixel in the input. i doubt it's exactly the same thing as whatever this paper turns out to be about but it gives a feel for the problem space.
[1]https://arxiv.org/pdf/1710.088... [arxiv.org]
[1] https://arxiv.org/pdf/1710.08864
Re: single pixel attacks (Score:3)
wups, /. filtered out my angle-brackets.
should read: ... from "99% sure it's (the right thing)" to "99% sure it's (something not even close to the right thing)" ...
Re: (Score:2)
They're just statistical engines. This is not a surprise.
What is a "harmful response?" (Score:2)
What is a "harmful response" and since when is having the sum total of human knowledge being instantly searchable "harmful?" All of this information is already freely available on the internet and in libraries. We used to say that "information wants to be free" but now that we have a tool that can do just that, we have a society that is intent on locking everything down with "governance" and "guardrails." And the best part? China is out here making and releasing the same type of advanced AIs sans guardrai
Re: (Score:2)
A "harmful response" is when you ask "how can I protect myself against COVID" and the response is "drink bleach". Then you do it.
Re: What is a "harmful response?" (Score:1)
If you do, it isn't harm. It's curating the gene pool.
Re: (Score:2)
Ask the Babelfish.
Jailbreaking will never get fixed (Score:4, Insightful)
Just like hallucinations. No idea why people expect miracles from generative AI. It is not magic. At all. It is a small step forward, with some limited applications. Useful, but not "transformative".
Obviously, using a tool outside of what it can do well will usually do more damage than good.
Re:Jailbreaking will never get fixed (Score:5, Interesting)
How do you know it's generative AI?
This article links to another article, published presumably for profit, which links to an article that requires a subscription. It's just business promotion for a /. member, there's no information here or anything to discuss.
"Obviously, using a tool outside of what it can do well will usually do more damage than good."
What does the tool do well? We don't know, we haven't been told anything about the tool. And what damage or good can it do? An AI can do no damage unless it's wired to do damage. AI is just software, completely deterministic. Can Excel do damage? Even when used to do things it doesn't do well? The threat of AI is the people who try to exploit something poorly designed to do things they don't understand. So what if AI hallucinates, the possibility of harm doesn't come from AI, it comes from using its outputs to do harm.
Re: (Score:2)
Simple: No other type of AI has "guardrails". I get that you are not smart enough for this level of deduction.
Re: Jailbreaking will never get fixed (Score:1)
Can you jailbreak corporate bots to get a discount?