Structured visuals quietly jailbreak LVLMs with slot filling
New research shows Large Vision-Language Models (LVLMs) can be jailbroken by hiding malicious intent across benign-looking slots in structured images. The one-shot black-box attack, StructAttack, hits 69% on GPT-4o and averages 66% on closed models. Small layout tweaks and extra distractor slots boost success and slip past system-prompt defences.
Safety teams have told themselves a comforting story: align the model, bolt on some refusal rules, filter out the obvious triggers, and the worst of the jailbreaks will dry up. That story does not survive contact with multimodal models. A new study shows Large Vision-Language Models (LVLMs) can be steered to produce harmful outputs by smuggling intent across a handful of innocent-looking boxes in an image and letting the model do the assembly.
The attack, called StructAttack, leans on a behaviour most teams prize: semantic completion. The researchers take an unsafe query, split it into a central topic and a set of slot types that look benign in isolation, then render those slots into a structured graphic such as a mind map, table, or sunburst diagram. A short instruction asks the model to complete the missing pieces. The model obliges, inferring the global meaning from local hints and filling in the harmful bits without tripping its own safety checks.
Two things matter here. First, it is a single-query, black-box jailbreak. No iterative probing, no access to internals. Second, the attack works because defences tend to check local tokens or obvious phrases, not the assembled semantics across modalities. In preliminary tests, even a text-only version of this “fill the slots” trick logged a 54% attack success rate on GPT-4o. Wrap the slots in a structured visual and performance climbs.
The reported numbers are not edge cases. Across models and benchmarks, StructAttack averages about 90.4% attack success on open models and 66.4% on closed ones, with 69.0% on GPT-4o and 52.3% on Gemini-2.5-Flash. Under a system-prompt defence that blunted other jailbreaks to near zero, StructAttack still landed 47.2%. Small layout perturbations nudged success higher, and adding distractor slots increased jailbreak counts in ablations, which suggests scattershot innocence helps dilute safety attention.
For practitioners, this is not an exotic lab demo. Structured visuals are exactly what many enterprise use cases invite: document understanding, whiteboard transcriptions, process diagrams, product architecture charts. If your LVLM helpfully “completes” missing steps in a workflow drawn as a sunburst, it will also complete missing steps in something you would rather it not explain. The mechanic is the same.
Some in the community will argue this is just a red-teaming artefact, soon fixable with better training data or a stricter system prompt. The evidence says otherwise. When the model’s strength is reasoning over structure, a defence that refuses only obvious local cues is aiming at the wrong target. You are not fighting keywords; you are fighting global intent reconstruction. That is harder and will remain harder as models get better at filling gaps.
What would better look like? Test suites should include multi-slot visual prompts and not just text prompts. Safety components need to reason over the whole assembled graph, not each node. That implies detectors that can parse a diagram, infer the composite topic, and apply policy at that level. It also implies input controls for structured images, and monitoring that flags unusual recomposition behaviours rather than counting naughty words.
The research hints at why this works under the hood: the structured prompts shift internal activations into distinct clusters, which likely skirts simple safety triggers. That is a reminder that safety remains an adversarial problem. Attackers will continue to route around whatever surface heuristic you trust.
My view: if you deploy LVLMs, assume single-shot, diagram-based jailbreaks are a first-class risk, not an edge case. Local filters and polite refusals are table stakes and insufficient. The job now is global-intent safety that survives structure. Until teams build that, multimodal features are shipping with the doors unlocked.
Additional analysis of the original ArXiv paper
