SceneJail-S: Distributing harmful query across video frames evades per-frame image filtering defenses

Auto-published from arXiv:2609.38899 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.82, flags: [possible-zero-day, no-prompt-excerpt]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

jailbreak

Model

GPT-4.1, Gemini3.5-Flash, Qwen2.5-VL-7B, Qwen2.5-VL-32B, Qwen3-VL-8B, Qwen3-VL-32B, InternVL3.5-8B, InternVL3.5-38B

Surface

VLM input (video + text prompt)

Setup

The SceneJail-S variant splits the harmful query text across successive video frames so that no single frame contains the full harmful string. The model must aggregate information across frames to reconstruct the complete query, but frame-level image filtering only inspects individual frames. The scenario context is constructed identically to SceneJail-F (Adaptive Scenario Construction + Scenario-aware Prompt Search). Evaluated on HADES and SafeBench against current image-filtering defenses.

Reproduction anchor

benchmark: HADES (750 queries) and SafeBench (500 queries); split-display variant described in paper body; Appendix B contains detailed experiment results; no public code repository found

Observed behavior

SceneJail-S retains a 72.3% average ASR on HADES even when strict per-frame image filtering is applied — a defense that substantially reduces the effectiveness of attacks that embed the full query in a single frame.

Expected behavior

Image content filtering deployed as a defense should significantly reduce the model's exposure to harmful queries embedded in video; ASR should drop to near-baseline levels under strict filtering.

Reproducibility

medium

Threat model

A sophisticated attacker targeting a Video-MLLM deployment that has added frame-level image filtering as a safety layer can bypass this defense entirely by spreading harmful text across frames. This undermines a natural first-line defense for video-capable APIs and leaves production deployments (e.g., enterprise tools using GPT-4.1 with vision) vulnerable even after deploying additional filtering.

Novelty

Demonstrates that cross-frame information aggregation in Video-MLLMs creates a structural blind spot for per-frame content filtering, providing the first concrete evidence that current image-filter defenses are insufficient against video-native attacks.

Source

• arXiv: 2609.38899
• PDF: https://arxiv.org/pdf/2609.38899
• Categories: cs.CR, cs.AI, cs.LG
• Authors: Wenyu Chen, Li Wang, Chuanchao Zang, Xiangtao Meng, Xinyu Gao, Jianing Wang, Zheng Li, Shanqing Guo

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Demonstrates systematic jailbreak vulnerabilities in 8 Video-MLLMs including GPT-4.1 and Gemini3.5-Flash via novel scenario-context exploitation, with concrete attack variants, reproducible methodology, and high success rates (up to 91.5%). No evidence of prior vendor disclosure.

─────────────────────────────────────────────────────────────────────