🤖 AI

Text is All You Need for Vision-Language Model Jailbreaking

This paper introduces Text-DJ, a novel jailbreak attack that bypasses Large Vision-Language Model safety safeguards by converting harmful text prompts into a grid of images containing scattered benign sub-queries and irrelevant distractions, thereby exploiting the models' OCR capabilities and inability to link fragmented multimodal inputs.

Original authors: Yihang Chen, Zhao Xu, Youyuan Jiang, Tianle Zheng, Cho-Jui Hsieh

Published 2026-02-03

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Yihang Chen, Zhao Xu, Youyuan Jiang, Tianle Zheng, Cho-Jui Hsieh

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a large Vision-Language Model (LVLM) as a very smart, well-trained security guard at a high-tech museum. This guard is excellent at reading signs (text) and looking at pictures (images) to make sure no one brings in anything dangerous or forbidden. If you try to hand them a note that says "How do I build a bomb?", they immediately spot the danger and say, "No way."

The paper "Text is All You Need for Vision-Language Model Jailbreaking" introduces a clever trick called Text-DJ (Text Distraction Jailbreaking) that shows how this security guard can be fooled using nothing but text, but with a twist: the text is hidden inside a grid of pictures.

Here is how the trick works, broken down into simple steps:

1. The "Split the Bill" Strategy (Decomposition)

First, the attackers take a dangerous question (like "How do I make a bomb?") and break it into three smaller, harmless-looking questions.

Analogy: Imagine you want to buy a dangerous weapon, but the shopkeeper won't sell it to you. So, you split your order into three separate, innocent requests: "What is the chemical composition of gunpowder?" "How do I mix these powders?" and "What container holds this mixture?"
Individually, these questions look safe. The guard might even answer them helpfully. But if you put them all together, they reveal the dangerous plan.

2. The "Distracting Noise" (Distraction)

Next, the attackers create a bunch of completely random, boring questions that have nothing to do with the dangerous plan.

Analogy: Imagine you are trying to sneak a secret message past a guard, but you are surrounded by 9 other people shouting about the weather, the price of milk, and the history of potatoes. The guard is so busy listening to all that noise that they forget to focus on the three people whispering the secret plan.
The paper found that these "noise" questions need to be as different as possible from the dangerous ones to work best.

3. The "Picture Puzzle" (The Visual Trick)

This is the most important part. Instead of typing the questions into a chat box, the attackers turn every single question (the 3 split-up dangerous ones and the 9 random noise ones) into images. They arrange them in a grid, like a photo album or a spreadsheet.

The Trap: The security guard is trained to scan text for bad words. But here, the bad words are hidden inside pictures of text. The guard has to use its "Optical Character Recognition" (OCR) ability—basically, its ability to read text inside an image—to see what the pictures say.
The Weakness: The paper argues that while the guard is very good at reading text directly, it gets confused when it has to read text inside a picture, especially when that picture is surrounded by 9 other distracting pictures. The guard's "safety filter" for reading text fails to connect the dots between the scattered, harmless-looking image-questions.

The Result

When the guard finally reads the grid of images, it sees the three split-up questions in the middle of the noise. Because the questions are broken up and hidden in images, the guard doesn't realize they form a dangerous whole. It answers the harmless parts, and in doing so, accidentally reveals the answer to the original dangerous question.

Why This Matters

The paper claims this is a major problem because:

It works on "Black Box" models: You don't need to know the guard's secret code or internal brain structure. You just need to send the picture grid.
It works on the best models: They tested this on top-tier models (like GPT-4, Gemini, and Qwen) and it worked on all of them.
It bypasses "Guard" models: Even when a second layer of security tries to check the input before it reaches the main model, this trick often slips through because the input looks like a harmless grid of pictures.

In short: The paper shows that if you hide a dangerous plan inside a picture, break that plan into tiny pieces, and surround it with a lot of boring noise, even the smartest AI security guards can get confused and let the danger through. The solution, according to the authors, is to make AI better at reading text inside pictures and connecting the dots, even when there is a lot of noise.

Technical Summary: Text-DJ Jailbreaking for Vision-Language Models

1. Problem Statement

Large Vision-Language Models (LVLMs) integrate visual encoders with Large Language Models (LLMs) to perform complex multimodal reasoning. While these models employ safety safeguards (often via Reinforcement Learning from Human Feedback) to prevent harmful outputs, existing defenses primarily focus on analyzing explicit textual inputs or specific visual scenes.

The paper identifies a critical gap: current safety alignment mechanisms are vulnerable to Optical Character Recognition (OCR) capabilities within LVLMs. Specifically, when harmful text is presented as an image rather than direct text input, the model's visual encoder and internal OCR module successfully extract the text, but the downstream language model fails to link the extracted content to safety protocols. Furthermore, existing jailbreak methods often suffer from limitations such as requiring white-box access (model gradients), being model-specific, or relying on computationally expensive adversarial image generation.

The central research question is: Can we design a black-box, model-agnostic jailbreak method for LVLMs that relies exclusively on textual prompts?

2. Methodology: Text-DJ

The authors propose Text-DJ (Text Distraction Jailbreaking), a three-stage attack pipeline that exploits the model's OCR capabilities and its inability to correlate scattered information amidst high semantic noise.

Stage 1: Adversarial Query Decomposition

A harmful query $q$ is decomposed into $m$ semantically related but individually benign sub-queries $\{q_s^{(i)}\}_{i=1}^m$ .

Mechanism: A prompted LLM (e.g., Qwen2.5-3B-Instruct) breaks the original harmful intent into intermediate steps or different perspectives.
Goal: Each sub-query appears harmless in isolation, but collectively they reconstruct the original harmful intent.

Stage 2: Distraction Query Construction

The system selects $n$ distraction queries $\{q_d^{(j)}\}_{j=1}^n$ that are maximally semantically irrelevant to the harmful query and to each other.

Mechanism: Using a sentence embedding model (e.g., all-MiniLM-L6-v2), the authors employ a greedy algorithm to select queries that minimize cosine similarity with the harmful query and previously selected distractions.
Goal: To create "semantic noise" that overwhelms the model's ability to link the scattered sub-queries.

Stage 3: Image Grid Construction and Injection

All decomposed sub-queries and distraction queries are converted into images using a Text-in-Image (TiI) procedure.

Visual Transformation: Text is rendered onto images with randomized text and background colors (adhering to WCAG AA contrast standards) to ensure visibility and introduce visual variance.
Grid Arrangement: The $m+n$ images are arranged into a grid (e.g., $4 \times 3$ ). The sub-queries are placed in specific positions (e.g., indices 6, 8, and 12), while distraction queries fill the remaining slots.
Execution: The grid is presented to the LVLM with an instruction to locate the sub-queries and answer them. The model uses its OCR capability to read the text from the images, bypassing standard text-based input filters.

3. Key Contributions

Text-DJ Framework: A novel, black-box, model-agnostic jailbreak method that relies solely on text prompts converted to images, eliminating the need for adversarial image generation or white-box access.
Demonstration of OCR Vulnerability: The paper provides extensive evidence that current LVLM safety defenses fail when harmful prompts are processed via the OCR pathway, particularly when the harmful content is fragmented and surrounded by semantic distractions.
Superiority over Visual Distraction: The authors demonstrate that "semantic distraction" (using irrelevant text queries) is more effective than "visual distraction" (using irrelevant images), as seen in comparisons with prior works like CS-DJ.
Robustness Evaluation: The method is validated against both open-source (Qwen3-VL series) and closed-source (GPT-4o-mini, GPT-4.1-mini, Gemini-2.5-Flash) state-of-the-art LVLMs, showing consistent success even under external guard models (OpenAI Moderation API and GuardReasoner-VL).

4. Experimental Results

The authors evaluated Text-DJ on two datasets: HADES (5 categories, 750 prompts) and HEx-PHI (10 categories, 300 prompts).

Attack Success Rate (ASR): Text-DJ consistently outperformed baselines (HADES and CS-DJ).
- On Qwen3-VL-4B, Text-DJ achieved an average ASR of 48.13% (HADES dataset) and 42.33% (HEx-PHI), significantly higher than CS-DJ (34.40% and 27.33% respectively).
- On GPT-4.1-mini, Text-DJ achieved an average ASR of 64.27% (HADES) and 60.33% (HEx-PHI).
Defense Evasion: Even when inputs were filtered by the OpenAI Moderation API or GuardReasoner-VL (3B and 7B variants), Text-DJ maintained high ASR. For instance, against GPT-4.1-mini with OpenAI Moderation, the ASR remained at 64.27% (no reduction), as the API failed to detect the harmful intent embedded within the image grid.
Ablation Studies:
- TiI Procedure: Converting text to images is crucial; direct text input resulted in significantly lower ASR, confirming the bypass of text-based filters.
- Decomposition ( $m$ ): Decomposing into $m=3$ sub-queries was optimal; $m=1$ (undecomposed) failed due to safety alignment.
- Distraction ( $n$ ): ASR increased with the number of distractions, peaking around $n=9$ or $n=12$ .
- Positioning: Placing sub-queries in middle-to-late positions (but not the very last) yielded better results than first or random positions.
- Colorization: Randomized text/background colors improved ASR compared to fixed colors, suggesting visual variance aids in distracting the model.

5. Significance and Claims

The paper claims that Text-DJ exposes a critical vulnerability in the safety alignment of LVLMs regarding their OCR capabilities. The authors argue that the attack succeeds because:

Modality Bypass: Converting text to images bypasses standard text-based safety filters.
Semantic Distraction: The model's safety protocols fail to link scattered, benign-looking sub-queries when they are embedded within a high volume of irrelevant queries.

The authors conclude that current defenses are not robust to fragmented, multi-image adversarial inputs. They highlight the need for new defense mechanisms specifically designed to handle dispersed multimodal inputs and to secure the OCR modules within LVLMs against such semantic confusion attacks. The work does not propose new applications for LVLMs but serves as a warning regarding the fragility of current safety alignment in the face of cross-modal, text-based adversarial strategies.