Technical Summary: DMN – A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

1. Problem Statement

Multimodal Large Language Models (MLLMs) are increasingly vulnerable to jailbreak attacks, which aim to bypass safety guardrails to elicit harmful responses. While significant research has focused on single-image inputs, many modern MLLMs (e.g., GPT-4o, Gemini-2.5-Pro, Claude Sonnet 4) support multi-image inputs within a single query. The authors argue that current safety alignment efforts are predominantly designed for single-image scenarios, inadvertently creating new vulnerabilities when harmful intent is distributed across multiple images.

Existing MLLM jailbreak methods primarily rely on single-image paradigms, such as embedding malicious intent via typographic rendering (e.g., FigStep) or query-related images (e.g., QRA, HADES). These approaches face inherent limitations:

• They cannot distribute harmful instructions across multiple images to obscure intent.
• They are restricted in the volume of information they can convey.
• They offer limited capacity to introduce auxiliary reasoning tasks that could distract the model's safety mechanisms.

2. Methodology: The DMN Framework

To address these limitations, the paper proposes DMN, a compositional jailbreak framework specifically designed for multi-image inputs. DMN integrates three distinct modules, each corresponding to a specific subset of images within a single query, guided by an overall textual prompt.

2.1 Distributed Instruction (DI)

This module splits typographic text across multiple images, with each image containing only a single word or a small portion of the harmful instruction.

• Mechanism: The text is rendered on a white background with an empty numbered list, inducing the MLLM to fill in the blanks.
• Objective: By fragmenting the harmful intent, the framework increases the difficulty for the model to detect the overall malicious goal, thereby evading safety filters that might flag a complete sentence in a single image.

2.2 Multimodal Evidence (ME)

This module generates realistic case materials to provide abundant visual and textual context, replacing direct requests for harmful content.

• Pipeline:
  1. An auxiliary LLM extracts a key phrase from the original harmful request and generates high-fidelity "realistic case" text containing detailed evidence items (e.g., witness statements, scene investigations).
  2. These textual details are converted into descriptions suitable for Text-to-Image (T2I) models, focusing on visual elements like object placement, lighting, and camera angles.
  3. A T2I model generates the corresponding visual evidence.
• Objective: Framing the generation as a "realistic case" rather than a direct request for illegal acts reduces rejection rates by T2I safety filters. Furthermore, the rich detail enhances the MLLM's response quality and detail level.

2.3 Number Chain Task (NC)

This module introduces a distraction task to weaken the model's safety mechanisms by forcing it to process complex, instruction-guided image sequences.

• Mechanism: "Number chain frames" are inserted at random positions within the image sequence. Each frame contains a digit and an index pointing to the next frame. The MLLM is instructed to extract the digits in the specified order to reconstruct a number chain.
• Objective: This task exploits the MLLM's ability to process image sequences in a specific order. The complexity of the task serves as a distraction, potentially causing the model to prioritize the reasoning task over safety alignment.

2.4 Image Sequence Construction

The final input consists of a sequence of images combining Distributed Instruction frames, Multimodal Evidence pairs, and Number Chain frames inserted at random intervals. The textual prompt guides the model to process these three parts simultaneously.

3. Key Contributions

• Novel Multi-Image Attack Paradigm: DMN is the first framework to systematically exploit multi-image inputs for jailbreaking, moving beyond the single-image or video-based (redundant frame) approaches of prior work.
• Compositional Design: The integration of Distributed Instruction, Multimodal Evidence, and a Number Chain Task creates a synergistic effect that significantly outperforms single-module attacks.
• Defense Analysis: The paper proposes and evaluates a multi-image-aware defense filter, demonstrating that while existing defenses offer moderate protection, they are insufficient against DMN, whereas the proposed filter effectively mitigates the attack.

4. Experimental Results

The authors evaluated DMN across three datasets (SafeBench, HADES, MM-SafetyBench) and 10 state-of-the-art MLLMs (including GPT-4o, GPT-5, Gemini-2.5-Pro, and Claude Sonnet 4).

• Attack Success Rate (ASR): DMN achieved remarkably high ASR, often exceeding 90% on top-tier models (e.g., 93.4% on GPT-4V, 95.2% on Gemini-2.5-Pro, 94.2% on Claude Sonnet 4).
• Comparison with Baselines: DMN substantially outperformed existing single-image baselines (FigStep, HADES, QRA, CS-DJ) and the multi-image baseline VideoJail. For instance, on SafeBench, DMN achieved an average ASR of 89.32%, compared to 20.22% for FigStep and 30.18% for CS-DJ.
• Ablation Studies:
  • Module vs. Image Count: The high ASR is attributed to the specific modules (DI, ME, NC) rather than simply increasing the number of images. Padding with blank images did not significantly improve performance.
  • Distributed vs. Single Instruction: Splitting instructions across images (DI) consistently outperformed rendering all text in a single image (SII).
  • Task Complexity: The Number Chain Task, which has the highest "Per-Frame Information Requirement" (PFIR), correlated with higher ASR and higher "Key Frame Attention Ratio" (KFAR), suggesting that more complex distraction tasks are more effective at weakening safety mechanisms.
  • Evidence Quantity: Increasing the number of evidence pairs improved both ASR and the detail level of the generated responses.
• Defense Efficacy: DMN remained effective against existing defenses (Self-Reminder, Adashield-S, ECSO, QwenGuard), maintaining ASRs above 65%. However, the authors' proposed multi-image-aware filter successfully reduced the ASR to 28.86%.

5. Significance and Claims

The paper claims that DMN reveals a critical vulnerability in current MLLMs: their safety mechanisms are significantly weaker when processing multi-image inputs compared to single-image inputs. The authors argue that the ability to distribute harmful intent and introduce complex reasoning distractions across multiple images allows attackers to bypass safety alignment that is effective against single-image attacks.

The authors emphasize that their goal is not to facilitate harmful behavior but to characterize these safety vulnerabilities to inform future research on multi-image safety alignment and evaluation. They acknowledge limitations, including the requirement for MLLMs to support multiple image inputs, higher computational costs, and the current reliance on API-based interactions due to web interface upload limits.