{"id":"https://openalex.org/W7162656091","doi":"https://doi.org/10.48550/arxiv.2605.27932","title":"When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?","display_name":"When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?","publication_year":2026,"publication_date":"2026-05-27","ids":{"openalex":"https://openalex.org/W7162656091","doi":"https://doi.org/10.48550/arxiv.2605.27932"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.27932","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27932","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.27932","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5137272594","display_name":"Yuan Tian","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Tian, Yuan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137241434","display_name":"Bing Hu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hu, Bing","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137277090","display_name":"Fang Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Fang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137267625","display_name":"Xiaomin Li","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Li, Xiaomin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5025474821","display_name":"Binghang Lu","orcid":"https://orcid.org/0009-0001-6001-6632"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Lu, Binghang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137280277","display_name":"Neil Zhenqiang Gong","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Gong, Neil Zhenqiang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.2409999966621399,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T10028","display_name":"Topic Modeling","score":0.2409999966621399,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.16979999840259552,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.15850000083446503,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/semantics","display_name":"Semantics (computer science)","score":0.5788999795913696},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5636000037193298},{"id":"https://openalex.org/keywords/inference","display_name":"Inference","score":0.5171999931335449},{"id":"https://openalex.org/keywords/trace","display_name":"TRACE (psycholinguistics)","score":0.5026000142097473},{"id":"https://openalex.org/keywords/ask-price","display_name":"Ask price","score":0.4514000117778778},{"id":"https://openalex.org/keywords/causal-inference","display_name":"Causal inference","score":0.4255000054836273},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.39989998936653137}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.678600013256073},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.5788999795913696},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5636000037193298},{"id":"https://openalex.org/C2776214188","wikidata":"https://www.wikidata.org/wiki/Q408386","display_name":"Inference","level":2,"score":0.5171999931335449},{"id":"https://openalex.org/C75291252","wikidata":"https://www.wikidata.org/wiki/Q1315756","display_name":"TRACE (psycholinguistics)","level":2,"score":0.5026000142097473},{"id":"https://openalex.org/C90329073","wikidata":"https://www.wikidata.org/wiki/Q914232","display_name":"Ask price","level":2,"score":0.4514000117778778},{"id":"https://openalex.org/C158600405","wikidata":"https://www.wikidata.org/wiki/Q5054566","display_name":"Causal inference","level":2,"score":0.4255000054836273},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4043999910354614},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.39989998936653137},{"id":"https://openalex.org/C2776527387","wikidata":"https://www.wikidata.org/wiki/Q1671839","display_name":"Invocation","level":2,"score":0.3837999999523163},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.35190001130104065},{"id":"https://openalex.org/C2780910867","wikidata":"https://www.wikidata.org/wiki/Q1952416","display_name":"Multimodality","level":2,"score":0.31130000948905945},{"id":"https://openalex.org/C155512373","wikidata":"https://www.wikidata.org/wiki/Q287450","display_name":"Residual","level":2,"score":0.2992999851703644},{"id":"https://openalex.org/C194995250","wikidata":"https://www.wikidata.org/wiki/Q531136","display_name":"Affordance","level":2,"score":0.27649998664855957},{"id":"https://openalex.org/C61797465","wikidata":"https://www.wikidata.org/wiki/Q1188986","display_name":"Term (time)","level":2,"score":0.26660001277923584},{"id":"https://openalex.org/C2780226545","wikidata":"https://www.wikidata.org/wiki/Q6888030","display_name":"Modality (human\u2013computer interaction)","level":2,"score":0.26260000467300415},{"id":"https://openalex.org/C2780871342","wikidata":"https://www.wikidata.org/wiki/Q7883752","display_name":"Underpinning","level":2,"score":0.26260000467300415},{"id":"https://openalex.org/C11671645","wikidata":"https://www.wikidata.org/wiki/Q5054567","display_name":"Causal model","level":2,"score":0.25999999046325684},{"id":"https://openalex.org/C204321447","wikidata":"https://www.wikidata.org/wiki/Q30642","display_name":"Natural language processing","level":1,"score":0.2596000134944916}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.27932","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27932","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.27932","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.27932","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"score":0.7062577605247498,"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions"}],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Think-with-image":[0],"reasoning":[1],"is":[2,88,100,123,179],"emerging":[3],"as":[4,152],"a":[5,153,160,180],"new":[6],"inference":[7],"paradigm":[8],"for":[9,184],"large":[10],"vision-language":[11,59],"models,":[12,60],"but":[13,106],"its":[14],"safety":[15,145,192],"implications":[16],"remain":[17],"poorly":[18],"understood.":[19],"Existing":[20],"systems":[21],"already":[22],"span":[23],"multiple":[24,58],"process":[25],"designs,":[26],"including":[27],"direct":[28],"response":[29],"generation,":[30],"text-only":[31,112],"prior":[32,113],"turn,":[33],"visual-state":[34],"manipulation,":[35],"and":[36,55,165],"explicit":[37,61,176],"external":[38],"image-tool":[39,62,98,134,144,150,177],"invocation.":[40],"In":[41],"this":[42,169],"paper,":[43],"we":[44,141],"ask":[45],"which":[46],"of":[47],"these":[48],"evaluated":[49,84],"paradigms":[50],"improves":[51],"multimodal":[52],"jailbreak":[53,74,186],"robustness,":[54,187],"why.":[56],"Across":[57],"interaction":[63,178],"yields":[64],"the":[65,83,96,120,132,139],"lowest":[66],"attack":[67],"success":[68,75],"rates":[69],"in":[70,156],"our":[71,172],"experiments,":[72],"reducing":[73],"by":[76,126,131],"around":[77],"30%":[78],"relative":[79],"on":[80],"average":[81],"across":[82],"models.":[85],"This":[86],"finding":[87],"initially":[89],"surprising:":[90],"ASR":[91,122],"remains":[92],"low":[93],"even":[94],"when":[95],"returned":[97],"output":[99],"manually":[101],"overridden":[102],"or":[103,130],"itself":[104],"unsafe-looking,":[105],"returns":[107],"near":[108],"direct-answering":[109],"levels":[110],"under":[111],"turn":[114],"controls.":[115],"These":[116],"results":[117,173],"indicate":[118],"that":[119,148,175],"lower":[121],"not":[124],"explained":[125],"benign":[127],"returned-image":[128],"semantics":[129],"textual":[133],"trace":[135],"alone.":[136],"To":[137],"explain":[138],"pattern,":[140],"introduce":[142],"an":[143],"vector":[146],"framework":[147],"models":[149],"invocation":[151],"residual":[154],"shift":[155],"hidden":[157],"representations":[158],"toward":[159],"safety-relevant":[161],"direction.":[162],"Representation-level":[163],"analyses":[164],"activation":[166],"interventions":[167],"support":[168],"account.":[170],"Overall,":[171],"suggest":[174],"promising":[181],"design":[182],"pattern":[183],"improving":[185],"while":[188],"also":[189],"motivating":[190],"pipeline-specific":[191],"evaluation.":[193]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-05-29T00:00:00"}