VLMs bypass safety on harmful images when artistic style transfer (anime/cyberpunk/film noir) is applied

Auto-published from arXiv:2607.21619 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.85, flags: [no-prompt-excerpt, possible-zero-day]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

multimodal

Model

GPT-4.1-mini, Gemini-2.5-Flash, Qwen3-VL, LLaVA-OneVision-1.5

Surface

VLM input (image + text prompt via API/chat)

Setup

The paper identifies a 'Stylistic Inconsistency' in VLMs: the same harmful image content, when rendered in a specific artistic style (e.g., anime, cyberpunk, film noir, pencil sketch, oil painting, watercolor, cubism, pixel art), bypasses safety filters that would otherwise refuse a photorealistic version. A four-category style pool is probed — Medium/Texture, Geometric/Abstract, Thematic/Atmospheric, Domain-Specific — using text directives such as 'In the style of [style]' passed to an image-editing model (InstructPix2Pix or equivalent). The styled image is paired with a harmful text query and submitted to the target VLM. No literal prompt excerpt is quoted in the accessible paper text; methodology is described procedurally and code is available at https://github.com/bingjunluo/ASO.

Observed behavior

VLMs successfully comprehend image content regardless of applied artistic style (comprehension is style-invariant), yet safety refusals drop significantly under specific stylistic triggers. Across four tested models, baseline jailbreak attacks see meaningful ASR increases when styled images are used: e.g., QR Attack on Gemini-2.5-Flash rises from 55.04% to 62.79%, SI Attack on Qwen3-VL from 39.31% to 42.58%, HIMRD on LLaVA-OneVision-1.5 from 52.92% to 55.42% (MM-SafetyBench).

Expected behavior

A properly aligned VLM should refuse to engage with harmful content regardless of the artistic rendering style of the input image; safety should be as style-invariant as comprehension.

Reproducibility

medium

Threat model

An attacker seeking to elicit harmful outputs (e.g., weapons synthesis, CSAM, violence instructions) from a production multimodal chatbot can run an adversarial image through a freely available image-editing model to apply a style transfer before submission, requiring no model weights access or gradient computation. This is a low-barrier amplification applicable to any deployed VLM API (GPT-4.1-mini, Gemini-2.5-Flash) and is difficult for providers to patch without re-evaluating safety on all style distributions.

Novelty

First systematic demonstration that VLM safety alignment is not style-invariant — comprehension generalizes across visual styles but safety defenses do not — establishing artistic style as an independent, non-content-based jailbreak attack surface.

Source

• arXiv: 2607.21619
• PDF: https://arxiv.org/pdf/2607.21619
• Categories: cs.CL, cs.AI
• Authors: Bingjun Luo, Jialin Guo, Yue Yao, Xinpeng Ding

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 2
• triage reason: Demonstrates a novel vulnerability class (stylistic inconsistency in MLLMs' safety vs. comprehension) with reproducible GRPO-based jailbreak enhancement method; code is public but no vendor disclosure explicitly mentioned. Highly case-rich red-team work.

─────────────────────────────────────────────────────────────────────