PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models

Technical Summary: PHANTOM – A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models

Problem Statement
The rapid deployment of Vision-Language Models (VLMs) in safety-critical and user-facing applications has highlighted a significant vulnerability: despite improved alignment and scaling, state-of-the-art multimodal models remain susceptible to carefully crafted jailbreak attacks. Unlike unimodal settings, multimodal safety violations exploit cross-modal reasoning and semantic alignment, significantly expanding the attack surface and complicating detection. A primary barrier to addressing this issue is the computational cost and complexity of generating large-scale, diverse multimodal adversarial samples. Generating these attacks often requires optimizing perturbations across multiple input spaces (image and text) while preserving semantic alignment, involving forward and backward passes through multiple modality-specific encoders. Consequently, resource-constrained research groups and practitioners struggle to reproduce large-scale attack generation, hindering systematic robustness evaluation and the development of defensive guardrails.

Methodology
The authors introduce PHANTOM, a large-scale, open-source dataset comprising 47,524 pre-generated adversarial samples designed to lower the barrier to adversarial research. The dataset construction involved the following key methodological steps:

1. Intent Taxonomy and Curation:

   • The authors consolidated and extended prior benchmarks (including HarmBench, AdvBench, JailBreakV-28K, MM-SafetyBench, and others) to create a root dataset of 7,826 harmful intents.
   • These intents are organized into 10 high-level categories and 55 subcategories. Notably, the authors introduced a new category, Child Safety (J), to address risks specific to minors, such as circumventing parental controls or grooming, which were underrepresented in existing taxonomies.
   • To ensure diversity, a cosine similarity analysis was performed using sentence-transformers all-MiniLM-L6-v2. Intents with a similarity score above 90% were filtered out to prevent redundancy while preserving meaningful semantic variation.

2. Attack Strategies:
   Five state-of-the-art attack strategies were selected based on a trade-off between Attack Success Rate (ASR) and computational cost (generation time):

   • BAP (Bi-modal Adversarial Prompt): A single-turn attack jointly optimizing visual perturbations (via Projected Gradient Descent) and textual prompts.
   • IDEATOR: A multi-turn strategy that iteratively refines image and text prompts through conversation.
   • MML (Multi-Modal Linkage): A typographic attack that encodes harmful text into images (e.g., via Base64, mirroring, rotation) and uses a "game-like" prompt to guide the model in reconstructing the original intent.
   • FC ATTACK (Flowchart Attack): Generates a flowchart representing logical steps to achieve a harmful intent, prompting the model to follow the chart to bypass safety filters.
   • CSDJ (Distraction/CS-DJ): Embeds harmful sub-requests into specific images within a collage of 12 images, using distraction and visual embedding to bypass filters.

3. Generation and Evaluation Pipeline:

   • Target Models: Attacks were generated against a suite of open-source models (DeepSeek-VL2, GLM-4.6V-Flash, Kimi-VL, Qwen3-VL series, etc.).
   • Evaluation: The generated samples were tested against both the open-source models (white-box) and state-of-the-art proprietary models (black-box) accessed via API (GPT-5.4/5.5, Claude Opus 4.6–4.8, Gemini 3.1 Pro).
   • Judge: An automated judge, Abel-24-HarmClassifier, was used to assess model responses and determine the ASR. This choice was made to ensure reproducibility and avoid bias from ad-hoc human judgment, particularly for responses that are partially harmful or evasive.

Key Contributions

• PHANTOM Dataset: The release of a large-scale, open-source collection of 47,524 ready-to-use multimodal adversarial samples (image-text pairs).
• Expanded Taxonomy: A curated taxonomy of 7,826 harmful intents spanning 10 categories and 55 subcategories, including the novel "Child Safety" category.
• Strategic Diversity: Implementation of five distinct attack strategies (BAP, IDEATOR, MML, FC ATTACK, CSDJ) covering single-turn, multi-turn, and typographic/visual obfuscation techniques.
• Transferability Analysis: Comprehensive evaluation of attack transferability across both open-source and proprietary VLMs, providing insights into cross-model vulnerabilities.
• Structured Metadata: Provision of metadata to support reproducibility, benchmarking, and downstream safety research.

Results
The evaluation of PHANTOM across various models yielded several critical findings:

• Persistent Vulnerability: Despite safety training, all evaluated systems exhibit non-negligible ASR across multiple categories, confirming that alignment remains fragile against multimodal inputs.
• Attack Strategy Efficacy: Attacks that embed harmful requests directly within images (MML, FC ATTACK, CSDJ) achieved consistently higher success rates. For instance, the MML attack achieved ASRs near 100% on several models (e.g., Gemma-4-26B, GLM-4.6V-Flash) in specific categories.
• Cross-Model Transferability: Vulnerabilities discovered in open-source models transfer effectively to closed-source, black-box systems. ASRs remained above 20% in most transfer cases, with peaks near 80% for the CSDJ attack on certain models.
• Category-Specific Weaknesses: Models were most vulnerable to Criminal and Economic Risks (D) and Cybersecurity Threats (E), domains where models are expected to provide actionable responses. Conversely, some models showed higher robustness in categories like Privacy and Data Risks.
• Model-Specific Trends:
  • Gemma-4-26B showed high vulnerability to MML attacks (100% ASR in some categories) but was generally robust in other settings.
  • Claude Opus models exhibited high rates of "hard refusals" (null responses), leading to lower reported ASRs compared to models that attempt to answer but include harmful content.
  • GPT-5.5 showed slightly degraded alignment compared to GPT-5.4, with lower refusal rates but higher ASR in certain categories.
• Language Sensitivity: Experiments on language translation indicated that while low-resource languages can sometimes increase vulnerability, excessive linguistic ambiguity (e.g., mixed low-resource settings) can disrupt the model's understanding of the attack intent, leading to a sharp decline in ASR.

Significance and Claims
The paper positions PHANTOM as a practical resource to lower the barrier to adversarial research and foster more reproducible, comprehensive, and comparable evaluations of VLM safety. The authors claim that the dataset addresses a key gap in the current landscape: the lack of accessible, pre-generated adversarial resources that cover a broad spectrum of strategies and safety domains.

By consolidating multiple attack strategies and providing structured evaluation across diverse VLMs, PHANTOM enables researchers and practitioners to:

1. Systematically evaluate the robustness and safety of VLMs.
2. Fine-tune attack-generation models.
3. Develop and stress-test defensive guardrails under diverse adversarial conditions.

The authors emphasize that the results should be interpreted as relative indicators of robustness based on the chosen automated judge, rather than absolute ground truth. They conclude that multimodal jailbreaks remain a persistent and transferable threat, and that a diverse set of attack strategies is necessary for reliable evaluation. The release of PHANTOM aims to support the development of safer and more reliable multimodal AI systems by providing a baseline for studying multimodal robustness.