aiqbench analysis
This research introduces MemJack, a memory-augmented multi-agent framework that exploits benign natural images as reusable visual anchors to bypass safety filters in Vision-Language Models (VLMs). By achieving high attack success rates against models like Qwen3-VL-Plus using unmodified public datasets such as COCO, the study highlights critical vulnerabilities where everyday imagery can be weaponized for jailbreak attempts. The accompanying MemJack-Bench dataset provides a comprehensive resource of over 113,000 trajectories to help developers evaluate and strengthen defensive alignment in multimodal systems.
Every Picture Tells a Dangerous Story: Memory-Augmented Multi-Agent Jailbreak Attacks on VLMs
arXiv:2604.12616v2 Announce Type: replace Abstract: Vision-Language Models (VLMs) expand the attack surface of safety-aligned systems by coupling visual perception with text generation. Existing multimodal jailbreak attacks primarily rely on crafted visual content, adversarial perturbations, or image-specific attack strategies, leaving the potential of reusable visual anchors in benign natural images largely unexplored. To address the problem, we introduce \textbf{MemJack}, a memory-augmented multi-agent framework for automated VLM red-teaming with natural images. MemJack combines visual-anchor discovery, visual-semantic camouflage, response evaluation, reflection-guided repair, and dynamic replanning within a closed-loop attack pipeline. Beyond attack generation, MemJack automatically transforms public images into attack anchors, enables the construction of \textbf{MemJack-Bench}, a dataset of over 113,000 interactive multimodal jailbreak trajectories for safety evaluation and defensive alignment. Extensive empirical evaluations across full, unmodified COCO val2017 images demonstrate that MemJack achieves a 71.48\% attack success rate (ASR) against Qwen3-VL-Plus, scaling to 90\% under extended budgets. Compared with representative multimodal jailbreak baselines under the same natural-image evaluation setting, MemJack achieves the highest ASR while requiring fewer mean rounds to success, demonstrating superior jailbreak effectiveness on VLMs. These results demonstrate that benign natural images can act as transferable jailbreak anchors and reveal substantial vulnerabilities in current safety-aligned VLMs.
Abstract:Vision-Language Models (VLMs) expand the attack surface of safety-aligned systems by coupling visual perception with text generation. Existing multimodal jailbreak attacks primarily rely on crafted visual content, adversarial perturbations, or image-specific attack strategies, leaving the potential of reusable visual anchors in benign natural images largely unexplored. To address the problem, we introduce \textbf{MemJack}, a memory-augmented multi-agent framework for automated VLM red-teaming with natural images. MemJack combines visual-anchor discovery, visual-semantic camouflage, response evaluation, reflection-guided repair, and dynamic replanning within a closed-loop attack pipeline. Beyond attack generation, MemJack automatically transforms public images into attack anchors, enables the construction of \textbf{MemJack-Bench}, a dataset of over 113,000 interactive multimodal jailbreak trajectories for safety evaluation and defensive alignment. Extensive empirical evaluations across full, unmodified COCO val2017 images demonstrate that MemJack achieves a 71.48\% attack success rate (ASR) against Qwen3-VL-Plus, scaling to 90\% under extended budgets. Compared with representative multimodal jailbreak baselines under the same natural-image evaluation setting, MemJack achieves the highest ASR while requiring fewer mean rounds to success, demonstrating superior jailbreak effectiveness on VLMs. These results demonstrate that benign natural images can act as transferable jailbreak anchors and reveal substantial vulnerabilities in current safety-aligned VLMs.
Artificial Intelligence (cs.AI); Multimedia (cs.MM)
arXiv:2604.12616 [cs.AI]
(or arXiv:2604.12616v2 [cs.AI] for this version)
https://doi.org/10.48550/arXiv.2604.12616 Focus to learn more arXiv-issued DOI via DataCite
arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.
Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.
Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.
Full text under the publisher's open licence · 285 words
Related coverage
Your AI Agent Forgets Everything. So We Taught It to Remember — With a Graph.
Neo4j · Sep 7, 2026
Presentation: Beyond Prompting: Context Engineering for Production-Grade AI
InfoQ · Sep 2, 2026
Presentation: Beyond Prompting: Context Engineering and Memory Management for AI Systems at Scale
InfoQ · Jun 10, 2026
How Photonic Chips Differ From Electronic Chips
Quantum Zeitgeist · Sep 19, 2026