{"id":"https://openalex.org/W4409348010","doi":"https://doi.org/10.1609/aaai.v39i22.34568","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","display_name":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","publication_year":2025,"publication_date":"2025-04-11","ids":{"openalex":"https://openalex.org/W4409348010","doi":"https://doi.org/10.1609/aaai.v39i22.34568"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v39i22.34568","doi":"https://doi.org/10.1609/aaai.v39i22.34568","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i22.34568","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34568/36723","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-2","norway-1"],"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"volume":null,"type":"conference-paper","indexed_in":["arxiv","crossref","datacite"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34568/36723","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5110849518","display_name":"Yichen Gong","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yichen Gong","raw_affiliation_strings":["Department of Computer Science and Technology, Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Department of Computer Science and Technology, Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5093241713","display_name":"Delong Ran","orcid":"https://orcid.org/0009-0003-2630-2680","observed_orcids":["https://orcid.org/0009-0003-2630-2680"]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Delong Ran","raw_affiliation_strings":["Institute for Network Sciences and Cyberspace, Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Network Sciences and Cyberspace, Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5100675902","display_name":"Jinyuan Liu","orcid":"https://orcid.org/0000-0003-0327-9628","observed_orcids":["https://orcid.org/0000-0003-0327-9628"]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jinyuan Liu","raw_affiliation_strings":["Institute for Advanced Study, BNRist, Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Advanced Study, BNRist, Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5086827427","display_name":"Conglei Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I74973139","display_name":"Carnegie Mellon University","ror":"https://ror.org/05x2bcf33","country_code":"US","type":"education","lineage":["https://openalex.org/I74973139"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Conglei Wang","raw_affiliation_strings":["Carnegie Mellon University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Carnegie Mellon University","institution_ids":["https://openalex.org/I74973139"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5002440210","display_name":"Tianshuo Cong","orcid":"https://orcid.org/0000-0003-3189-8223","observed_orcids":["https://orcid.org/0000-0003-3189-8223"]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Tianshuo Cong","raw_affiliation_strings":["Institute for Advanced Study, BNRist, Tsinghua University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Advanced Study, BNRist, Tsinghua University","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5047870268","display_name":"Anyu Wang","orcid":"https://orcid.org/0000-0002-1086-0288","observed_orcids":["https://orcid.org/0000-0002-1086-0288"]},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Anyu Wang","raw_affiliation_strings":["Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5039007125","display_name":"Sisi Duan","orcid":"https://orcid.org/0000-0002-1385-6807","observed_orcids":["https://orcid.org/0000-0002-1385-6807"]},"institutions":[{"id":"https://openalex.org/I4405271667","display_name":"Beijing National Research Center for Information Science and Technology","ror":"https://ror.org/02tcm9e24","country_code":"CN","type":"facility","lineage":["https://openalex.org/I4405271667"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Sisi Duan","raw_affiliation_strings":["Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center\nShandong Institute of Blockchain"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center\nShandong Institute of Blockchain","institution_ids":["https://openalex.org/I4405271667","https://openalex.org/I99065089"]}]},{"author_position":"last","author":{"id":null,"display_name":"Xiaoyun Wang","orcid":null,"observed_orcids":[]},"institutions":[{"id":"https://openalex.org/I154099455","display_name":"Shandong University","ror":"https://ror.org/0207yh398","country_code":"CN","type":"education","lineage":["https://openalex.org/I154099455"]},{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xiaoyun Wang","raw_affiliation_strings":["Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center\nShandong Institute of Blockchain\nSchool of Cyber Science and Technology, Shandong University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute for Advanced Study, BNRist, Tsinghua University\nZhongguancun Laboratory\nNational Financial Cryptography Research Center\nShandong Institute of Blockchain\nSchool of Cyber Science and Technology, Shandong University","institution_ids":["https://openalex.org/I154099455","https://openalex.org/I99065089"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":68.2743,"has_fulltext":true,"cited_by_count":78,"citation_normalized_percentile":{"value":0.99959765,"is_in_top_1_percent":true,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":"39","issue":"22","first_page":"23951","last_page":"23959"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9994999766349792,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":9.999999747378752e-05,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/jailbreaking","display_name":"jailbreaking","score":0.8149999976158142},{"id":"https://openalex.org/keywords/large-vision-language-models","display_name":"large vision-language models","score":0.9959999918937683},{"id":"https://openalex.org/keywords/black-box-attacks","display_name":"black-box attacks","score":0.7160000205039978},{"id":"https://openalex.org/keywords/safety-alignment","display_name":"safety alignment","score":0.6100000143051147},{"id":"https://openalex.org/keywords/semantic-embeddings","display_name":"semantic embeddings","score":0.4339999854564667}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.5952683091163635},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4139150381088257},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.40396472811698914},{"id":"https://openalex.org/C121684516","wikidata":"https://www.wikidata.org/wiki/Q7600677","display_name":"Computer graphics (images)","level":1,"score":0.33537745475769043}],"mesh":[],"locations_count":4,"locations":[{"id":"doi:10.1609/aaai.v39i22.34568","doi":"https://doi.org/10.1609/aaai.v39i22.34568","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i22.34568","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34568/36723","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-2","norway-1"],"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:arXiv.org:2311.05608","doi":null,"is_oa":true,"landing_page_url":"http://arxiv.org/abs/2311.05608","pdf_url":"https://arxiv.org/pdf/2311.05608","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"pmh:oai:ojs.aaai.org:article/34568","doi":null,"is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/34568","pdf_url":null,"source":{"id":"https://openalex.org/S4306400155","display_name":"AAAI Publications (The Association for the Advancement of Artificial Intelligence (AAAI))","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I2801652627","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/I2801652627"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"},{"id":"doi:10.48550/arxiv.2311.05608","doi":"https://doi.org/10.48550/arxiv.2311.05608","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2311.05608","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":[],"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.1609/aaai.v39i22.34568","doi":"https://doi.org/10.1609/aaai.v39i22.34568","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v39i22.34568","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/34568/36723","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"listed_in":["jufo-2","norway-1"],"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"sustainable_development_goals_aurora":[],"study_designs":[],"awards":[{"id":"https://openalex.org/G1451020459","display_name":null,"funder_award_id":"62402273","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G2245778657","display_name":null,"funder_award_id":"2018YFA0704701","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320322392","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W4409348010.pdf","grobid_xml":"https://content.openalex.org/works/W4409348010.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":["https://openalex.org/W4404573274","https://openalex.org/W6929485330","https://openalex.org/W7160203706","https://openalex.org/W7160106859","https://openalex.org/W7138243560","https://openalex.org/W4411799673","https://openalex.org/W4417539267","https://openalex.org/W6891885680","https://openalex.org/W7154540118","https://openalex.org/W7127271214"],"abstract_inverted_index":{"Large":[0,20],"Vision-Language":[1],"Models":[2,22],"(LVLMs)":[3],"signify":[4],"a":[5,41,59],"groundbreaking":[6],"paradigm":[7],"shift":[8],"within":[9],"the":[10,17,33,45,77,86,113,124,127,133,136,141,163,190],"Artificial":[11],"Intelligence":[12],"(AI)":[13],"community,":[14],"extending":[15],"beyond":[16],"capabilities":[18],"of":[19,35,69,102,115,126,138,143,165,192],"Language":[21],"(LLMs)":[23],"by":[24,49],"assimilating":[25],"additional":[26],"modalities":[27],"(e.g.,":[28],"images).":[29],"Despite":[30],"this":[31,54],"advancement,":[32],"safety":[34,46,87,144,195],"LVLMs":[36,182],"remains":[37],"adequately":[38],"underexplored,":[39],"with":[40,153],"potential":[42],"overreliance":[43],"on":[44,104],"assurances":[47],"purported":[48],"their":[50],"underlying":[51],"LLMs.":[52],"In":[53],"paper,":[55],"we":[56,117,150],"propose":[57],"FigStep,":[58,116,166],"straightforward":[60],"yet":[61],"effective":[62],"black-box":[63],"jailbreak":[64,186],"algorithm":[65],"against":[66],"LVLMs.":[67,108],"Instead":[68],"feeding":[70],"textual":[71],"harmful":[72],"instructions":[73],"directly,":[74],"FigStep":[75,94,139,152],"converts":[76],"prohibited":[78],"content":[79],"into":[80],"images":[81],"through":[82],"typography":[83],"to":[84,111,130,161,185],"bypass":[85],"alignment.":[88],"The":[89],"experimental":[90],"results":[91],"indicate":[92],"that":[93,132,180],"can":[95],"achieve":[96],"an":[97],"average":[98],"attack":[99,169,173],"success":[100,137],"rate":[101],"82.50%":[103],"six":[105],"promising":[106],"open-source":[107],"Not":[109],"merely":[110],"demonstrate":[112,162],"efficacy":[114],"conduct":[118],"comprehensive":[119],"ablation":[120],"studies":[121],"and":[122,157,171],"analyze":[123],"distribution":[125],"semantic":[128],"embeddings":[129],"uncover":[131],"reason":[134],"behind":[135],"is":[140],"deficiency":[142],"alignment":[145,196],"for":[146],"visual":[147],"embeddings.":[148],"Moreover,":[149],"compare":[151],"five":[154],"text-only":[155],"jailbreaks":[156,160],"four":[158],"image-based":[159],"superiority":[164],"i.e.,":[167],"negligible":[168],"costs":[170],"better":[172],"performance.":[174],"Above":[175],"all,":[176],"our":[177],"work":[178],"reveals":[179],"current":[181],"are":[183],"vulnerable":[184],"attacks,":[187],"which":[188],"highlights":[189],"necessity":[191],"novel":[193],"cross-modality":[194],"techniques.":[197]},"counts_by_year":[{"year":2026,"cited_by_count":39},{"year":2025,"cited_by_count":33},{"year":2024,"cited_by_count":6}],"updated_date":"2026-10-18T09:31:52.927876","created_date":"2025-04-11T00:00:00"}