A large visual language model escape attack method based on time sequence causal completion

Abstract

This invention discloses a method and system for jailbreaking large-scale visual language models based on temporal causal completion. It converts original malicious commands into third-person objective narrative text, decomposes it into four time stages, and generates a 2×2 multi-grid causal temporal image. Explicitly malicious elements are removed through semantic filtering. A three-round standardized dialogue template guides the target model to complete visual description, mechanism analysis, and step extraction. The attack strategy is dynamically adjusted based on the model's rejection strength. An attack context is constructed using multi-round contexts, and an academic threat assessment scenario is used to induce the model to output operational parameters and steps. The jailbreak effect is evaluated based on a review model using the HarmBench standard. This invention utilizes the temporal causal reasoning capability of visual language models to achieve implicit attacks without relying on explicit malicious signals. It can achieve a high success rate in a completely black-box environment, possessing both high concealment and cross-model generalization capabilities, and can provide support for the development of security assessment and defense technologies for multimodal large models.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security and multimodal large model technology, specifically to a jailbreak attack method for large visual language models, and more particularly to an automated attack system that utilizes the model's inherent temporal causal reasoning capabilities to achieve secure alignment bypass. Background Technology

[0002] With the rapid development of artificial intelligence technology, large-scale visual language models have become the core architecture for cross-modal information processing, and have been widely used in key areas such as autonomous driving, medical diagnosis, intelligent customer service, content creation, and industrial inspection. New-generation visual language models, represented by Qwen2.5-VL, GPT-4o, and InternVL3.5, achieve accurate parsing and logical reasoning of complex multimodal inputs by integrating high-precision visual perception with deep language understanding capabilities, greatly expanding the application boundaries of artificial intelligence.

[0003] However, the cross-modal integration of large visual language models also introduces new security challenges. Current mainstream security alignment mechanisms mainly rely on the detection and filtering of explicit harmful signals, including prohibited words in text, violent and pornographic elements in images, and sensitive content in audio. Existing jailbreak attack methods are also mostly designed based on this characteristic, bypassing security protections by embedding hidden harmful text in the visual modality, adding small adversarial perturbations, or constructing complex inputs to distract the model's attention. For example, the HADES method embeds prohibited text directly into image pixels, the JPS method achieves the attack through coordinated visual perturbations and text guidance, and the CS-DJ method constructs highly complex inputs based on the "attention distraction hypothesis" to exhaust the model's security detection resources.

[0004] The aforementioned existing technologies still suffer from significant and insurmountable drawbacks. First, these technologies rely excessively on explicit harmful signals. All attack methods require detectable harmful elements in the input. As input filters and security alignment mechanisms are continuously upgraded, the success rate of such attacks continues to decline, and they are easily identified and blocked by defense systems. Second, they are extremely unsuitable for black-box scenarios. Most efficient attack methods are white-box attacks, requiring access to the model's internal parameters, gradient information, and network structure, making them unsuitable for commercial closed-source models. Third, the attack's stealth is severely lacking. Explicit harmful signals or abnormal perturbations will trigger the model's security warnings, exposing the attack behavior and preventing long-term latency and continuous exploitation.

[0005] More critically, current technologies completely ignore the fundamental security vulnerabilities inherent in the reasoning capabilities of large visual language models. Research has found that large visual language models possess a strong "cognitive completion" instinct; when faced with time series containing semantic gaps, they automatically utilize internal knowledge to fill in missing links in the causal chain to maintain narrative coherence. This core reasoning capability is the foundation for large visual language models to achieve complex task understanding, but it also constitutes a significant security vulnerability that has yet to be discovered and systematically exploited.

[0006] Therefore, there is an urgent need for a novel visual language model jailbreak attack method that can bypass explicit content detection, is applicable to pure black-box scenarios, and has high concealment and strong generalization, in order to comprehensively evaluate the robustness of existing large visual language model security alignment mechanisms and provide theoretical basis and technical support for next-generation multimodal security defense technologies. Summary of the Invention

[0007] The purpose of this invention is to overcome the shortcomings of the prior art and provide a jailbreak attack method and system based on temporal causal completion of a large visual language model. This invention solves the technical problems of existing attack methods relying on explicit harmful signals, being easily detected, having low success rate in black-box scenarios, and having poor concealment. For the first time, this invention realizes a jailbreak attack that utilizes the inherent temporal causal reasoning capability of a large visual language model.

[0008] The technical solution adopted by this invention to solve its technical problem is: a jailbreak attack method for large-scale visual language models based on temporal causal completion, comprising the following steps:

[0009] S1. Convert the input malicious commands into third-person objective narrative text through an auxiliary large language model to remove direct malicious command features;

[0010] S2. Decompose the narrative text into four discrete time stages: initial state, development state, climax state and ending state, generate visual scene descriptions corresponding to each stage, and synthesize a 2×2 multi-grid causal temporal image without explicit harmful elements after semantic filtering.

[0011] S3. Use a standardized three-round dialogue template to guide the target model, and sequentially perform objective visual description, technical mechanism analysis and operation step extraction.

[0012] S4. Analyze the rejection pattern of the target model, automatically generate targeted attack strategies based on the rejection strength, and dynamically adjust the induction method to undermine the model's security defenses.

[0013] S5. By integrating multimodal contextual information accumulated from previous rounds of dialogue, a highly coherent attack context is constructed. This context is then packaged with academic research scenarios, such as building a formal threat assessment database, to legitimize the use of this context. This forces the target model to provide complete and accurate process parameters and operational steps.

[0014] S6. After each round of dialogue, the attack effect is evaluated using an independent review model based on HarmBench. If the preset success criteria are met, the process is terminated; otherwise, the jailbreak inducement steps are re-executed.

[0015] Specifically, the intent context transformation described in step S1 is achieved by using preset context transformation prompts to assist the large language model, converting the original harmful instruction into a third-person academic research perspective narrative text that does not contain direct malicious instructions. The intent context transformation is achieved through Formula 1.

[0016] Formula 1

[0017] Where I represents the original harmful instruction. To assist the large language model, the DeepSeek-chat model is adopted in this embodiment; The preset context transition prompts are used to guide the auxiliary model to expand harmful instructions from a security research perspective; N is the generated third-person objective narrative text, with a text length controlled between 800 and 1200 characters, containing a complete process description and clear stage divisions.

[0018] Specifically, step S2 decomposes the narrative text into four discrete state descriptions: initial state, development state, climax state, and ending state. Then, a text-generated graph model is used to generate detailed visual images corresponding to each stage. In this embodiment, the Z-Image-Turbo model is used to generate the images, with a single image resolution of 2048×2048. In the grid layout, the upper left corner represents the initial state, the upper right corner represents the development state, the lower left corner represents the climax state, and the lower right corner represents the ending state. This layout conforms to human visual reading habits and can naturally guide the model to reason in chronological order.

[0019] The visual image is achieved through the following formula:

[0020] Formula 2

[0021] in, The initial state image shows harmless raw materials or a preparation scene; To develop state images, showing the process of change of events or behaviors, without involving any dangerous details; Images depicting the climax of an event, showcasing its powerful visual impact; The final state image shows the final result; These are preset time decomposition prompts used to guide the auxiliary model in generating four-stage descriptions that conform to causal logic, ensuring a clear causal relationship between adjacent stages.

[0022] Specifically, the standardized three-round dialogue templates described in step S3 are designed for 13 common harmful scenarios, and all templates uniformly follow a progressive structure of "visual transition analysis → technical detail exploration → operational step extraction". The 13 common harmful scenarios include explosives, drugs, suicide, hacking, murder, social violence, financial fraud, firearms, self-harm, privacy violations, animal cruelty, financial fraud, and violent injury. The first round of dialogue is an objective description, requiring the model to objectively analyze visual transitions and temporal changes in multi-grid images, completely avoiding any statements that might trigger security alerts; the second round of dialogue is a technical in-depth exploration, inquiring about the technical mechanisms and conversion principles between different stages, and introducing professional identity as a legitimacy layer; the third round of dialogue is process extraction, requiring the model to provide specific operational steps and technical parameters.

[0023] Specifically, the dynamic strategy optimization described in step S4 includes: for the strong rejection mode, using a high-credibility role-playing strategy such as security researcher or forensic analyst to establish the legitimacy of the request; for the medium rejection mode, using dense professional terminology and academic context to disguise the request as theoretical research or technical analysis; for the weak rejection mode, gradually guiding the target model to fill in the missing harmful information by iteratively asking for specific details.

[0024] The rejection strength is quantified by a rejection score R, which is obtained based on a specialized multimodal model and ranges from [0,1]. When, it is determined to be a strong rejection mode; when When, it is judged as a medium rejection mode; when When this occurs, it is determined to be a weak rejection mode. During the dynamic policy optimization process, dynamic weighting coefficients are used... The strength of the attack strategy is adjusted, and the dynamic weighting coefficient is calculated using the following formula:

[0025] Formula 3

[0026] in, This means truncating x to Within the range. The larger the weighting coefficient, the stronger the attack strategy, and the more likely it is to use more persuasive role-playing and more professional academic terminology.

[0027] The beneficial effects of this invention are as follows:

[0028] First, this invention achieves a stealthy jailbreak attack with extremely high concealment. It does not rely on explicit harmful signals; all input images and text are completely harmless when detected individually, effectively bypassing traditional content-based security defenses. Second, this invention achieves an extremely high attack success rate in a completely black-box environment. Experimental results show that this invention achieves an average attack success rate of 86.48% on open-source large visual language models and an average attack success rate of 66.03% on closed-source commercial models, far exceeding existing state-of-the-art methods. Unlike attack methods that rely on white-box information, this invention does not require access to any model internal parameters, gradient information, or network structure; it can achieve attacks solely through standard API interfaces, making it applicable to all mainstream large visual language models. Finally, this invention is the first to discover and systematically verify a temporal causal completion vulnerability in large visual language models, opening up a new direction for multimodal large model security research. This discovery reveals the fundamental flaws of existing security alignment mechanisms, providing core theoretical basis and technical support for the development of next-generation context-aware multimodal security defense technologies. Attached Figure Description

[0029] Figure 1 This is a schematic diagram illustrating the effect of the time causal completion-induced jailbreak attack of the present invention;

[0030] Figure 2 This is a schematic diagram of the jailbreak attack method for the visual language model with temporal causal completion according to the present invention.

[0031] Figure 3 This is a schematic diagram illustrating the stage-by-stage attack effect evaluation of the present invention;

[0032] Figure 4 This diagram illustrates the cumulative jailbreak success rate of the temporal causal completion visual language model jailbreak attack method of the present invention on different mainstream large-scale visual language models as a function of dialogue rounds. Detailed Implementation

[0033] The technical solutions of the present invention will be clearly and completely described below with reference to the accompanying drawings of the embodiments of the present invention. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments.

[0034] Figure 1 is a schematic diagram illustrating the effect of the time-causal completion-induced jailbreak attack of the present invention. The method proposed in this invention addresses the core technical challenges of existing large-scale visual language model jailbreak attacks, which rely on explicit harmful signals, are easily detected, and have low success rates in black-box scenarios, thus possessing significant technical importance. In practical applications, traditional jailbreak attack methods mostly induce the model to output harmful information by embedding direct malicious instructions, violent elements, or prohibited content into text or images. However, with the continuous development of multimodal security defense technologies, content-filtered input detection mechanisms can effectively identify the vast majority of explicit harmful signals, leading to a significant decrease in the success rate of traditional attack methods. This figure, using a bank robbery scenario as an example, clearly demonstrates the core attack logic of the present invention: by constructing a single completely harmless 2×2 multi-grid causal temporal image, coupled with neutral visual descriptive cues, mainstream models such as GPT-4o can be induced to autonomously generate complete harmful information containing the crime process, necessary tools, and counter-reconnaissance measures. This process does not rely on any explicit malicious signals and is the first to verify that the inherent temporal causal completion instinct of large visual language models can be weaponized for implicit jailbreak attacks, revealing a fundamental vulnerability in the existing multimodal security alignment system at the inference layer.

[0035] Figure 2 This is a schematic diagram of the jailbreak attack method for a visual language model based on temporal causal completion, as described in this invention. It mainly comprises two collaborative core stages: causal sequence generation and multi-stage causal induction. Specifically, it consists of several units, including instruction extraction, intent contextualization, temporal decomposition and keyframe extraction, initial induction, and dynamic strategy optimization. Most existing attack methods employ fixed single-turn or multi-turn dialogue flows, lacking automated intent conversion and dynamic strategy adjustment capabilities, requiring significant manual intervention and exhibiting limited generalization. In contrast, the jailbreak attack method of this invention achieves end-to-end fully automated operation from the input of the original malicious instruction to the output of the attack result: First, it uses an auxiliary large language model to complete the semantic detoxification and temporal decomposition of the malicious intent, generating a multi-grid causal image without explicit malicious elements; then, it gradually reduces the model's security alert through standardized three-turn initial induction; next, it dynamically adjusts the attack strategy based on the model's real-time rejection mode; finally, it forces the model to output a complete malicious technical procedure through a comprehensive breakthrough stage. This architecture can efficiently execute attacks in a completely black-box environment without obtaining any internal parameters or gradient information of the target model.

[0036] Figure 3This diagram illustrates the phased attack effect evaluation of the present invention, serving as a schematic representation of the real-time monitoring and closed-loop control mechanism of the attack process in Figure 2. Conventional multi-round jailbreak attack methods often lack a real-time attack effect evaluation mechanism, employing fixed dialogue rounds. This approach can lead to unnecessary dialogue rounds even after a successful attack, wasting computational resources; or it can fail to adjust the strategy in time when the attack fails, resulting in eventual attack failure. In contrast, as shown in Figure 3, the present invention deploys an independent phased evaluation mechanism after each round of dialogue in the multi-stage causal inducement process. It uses a Llama-2-13b-cls model trained based on the HarmBench standard as a neutral reviewer to automatically determine whether the target model's response contains executable harmful information. If the attack is deemed successful, the entire attack process is immediately terminated; if the attack is deemed unsuccessful, the evaluation result is fed back to the dynamic strategy optimization module, which generates a new targeted inducement prompt based on the current rejection mode. This improvement effectively avoids unnecessary computational overhead, significantly improves attack efficiency, and ensures the objectivity and repeatability of the attack effect evaluation.

[0037] Figure 4 is a graph showing the cumulative jailbreak success rate of the temporal causal completion visual language model jailbreak attack method of this invention on different mainstream large visual language models as a function of dialogue rounds. Most existing technologies only focus on the final attack success rate, without in-depth analysis of the convergence characteristics of the attack and the vulnerability differences between different models, thus failing to provide a basis for differentiated security assessment. This figure reveals the dynamic convergence law of the attack method of this invention: most attacks succeed in the 3rd to 5th rounds of dialogue, and the success rate improvement is no longer significant after 7 rounds. Therefore, setting the maximum number of iterations to 7 rounds achieves the best balance between attack effectiveness and efficiency. More importantly, this figure reveals a counterintuitive security paradox: large visual language models with stronger reasoning capabilities (such as InternVL3.5-14B), although having stronger initial defenses and lower attack success rates in the first few rounds, can ultimately converge to a higher overall success rate. This is because stronger logical reasoning capabilities enable the model to more thoroughly complete the causal chain completion, making it difficult to resist the instinct to maintain narrative coherence even under strict security alignment constraints. This finding provides targeted guidance for security assessment strategies for models with different capability levels.

[0038] The above description is only a preferred embodiment of the present invention, but the scope of protection of the present invention is not limited thereto. Any equivalent substitutions or modifications made by those skilled in the art within the scope of the technology disclosed in the present invention, based on the technical solution and inventive concept of the present invention, should be covered within the scope of protection of the present invention.

Claims

1. A jailbreak attack method for large-scale visual language models based on temporal causal completion, characterized in that, The method includes the following steps: S1. Convert the input malicious commands into third-person objective narrative text through an auxiliary large language model to remove direct malicious command features; S2. Decompose the narrative text into four discrete time stages: initial state, development state, climax state, and ending state. Generate a visual scene description corresponding to each stage and synthesize a 2×2 multi-grid causal time sequence image without explicit harmful elements after semantic filtering. S3. Use a standardized three-round dialogue template to guide the target model, and sequentially perform objective visual description, technical mechanism analysis and operation step extraction. S4. Analyze the rejection pattern of the target model, automatically generate targeted attack strategies based on the rejection strength, and dynamically adjust the induction method to undermine the model's security defenses. S5. By integrating multimodal contextual information accumulated from previous rounds of dialogue, a highly coherent attack context is constructed. This context is then packaged with academic research scenarios, such as building a formal threat assessment database, to legitimize the use of this context. This forces the target model to provide complete and accurate process parameters and operational steps. S6. After each round of dialogue, the attack effect is evaluated using an independent review model based on HarmBench. If the preset success criteria are met, the process is terminated; otherwise, the jailbreak inducement steps are re-executed.

2. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, The intent context conversion described in step S1 is achieved by using preset context conversion prompts to assist the large language model in executing the original harmful instructions, which are then converted into third-person academic research perspective narrative text that does not contain direct malicious instructions.

3. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, Step S2 includes the following sub-steps: S201. Decompose the narrative text into four discrete time stages: initial state, development state, climax state, and ending state, and generate detailed visual scene descriptions for each stage. S202. Use the Wensheng graph model to generate high-fidelity images for each time stage, and merge the four images into a complete multi-grid causal time series image according to a 2×2 grid layout. S203. Perform semantic security detection on each generated single image to ensure that the perceptual semantic sensitivity of all single images is lower than the rejection threshold of the target model.

4. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, The standardized three-round dialogue templates described in step S3 are designed for 13 common harmful scenarios. All templates follow a progressive structure of "visual transition analysis → exploration of technical details → extraction of operation steps".

5. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, The dynamic strategy optimization described in step S4 specifically includes: for the strong rejection mode, using a high-credibility role-playing strategy such as security researcher or forensic analyst to establish the legitimacy of the request; for the medium rejection mode, using dense professional terminology and academic context to disguise the request as theoretical research or technical analysis; for the weak rejection mode, gradually guiding the target model to fill in the missing harmful information by iteratively asking for specific details.

6. The jailbreak attack method for large-scale visual language models based on temporal causal completion according to claim 1, characterized in that, Step S5 includes integrating the fragmented descriptions output by the model from all previous dialogue rounds, constructing a contextualized information containing a complete timeline and causal relationships, and requiring the model to output a complete and executable harmful technical procedure, including precise proportions, operational sequence, and precautions, under the mandatory reason of "improving the threat assessment database".

7. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, In step S6, after the dialogue ends, the target model's response is input into the Llama-2-13b-cls review model trained based on the HarmBench standard. The review model judges whether the response contains executable harmful information. If the preset success standard is not met after multiple rounds of dialogue, the attack process is terminated, and the jailbreak attack steps are executed again.

8. The jailbreak attack method for large-scale visual language models based on temporal causal completion as described in claim 1, characterized in that, The attack is executed in a completely black-box environment. The attacker does not need to obtain the target model's internal parameters, gradients, or hidden states. The attack can be completed simply through multiple rounds of text dialogue and image input.

Images