[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"branding":3,"analytics":7,"article-study-tries-to-isolate-what-makes-image-jailbreaks-work":10,"sections":35},{"siteName":4,"siteTagline":5,"publisherName":4,"contactEmail":6},"The Revision","Tech news, decoded.","editor@therevision.news",{"gaMeasurementId":8,"adsenseClientId":9},"G-ZW2MV82GYR","ca-pub-8533917693782264",{"article":11},{"id":12,"slug":13,"title":14,"dek":15,"body_md":16,"tags_json":17,"published_at":18,"created_at":19,"updated_at":20,"status":21,"review_note":22,"review_notes":23,"image_url":22,"persona_id":22,"persona_name":22,"section":24,"tags":25,"sources":30,"feedback":34,"feedback_at":22,"cost_usd":34,"total_tokens":34},10628,"study-tries-to-isolate-what-makes-image-jailbreaks-work","Study Tries to Isolate What Makes Image Jailbreaks Work","A new study finds that most theories for why jailbreak images trick AI models, like entropy or tile count, mostly fail to explain the effect.","A new paper pokes holes in the leading theories for why certain images can jailbreak AI chatbots.\n\nResearchers tested four published image-to-text jailbreak methods against five multimodal AI models, plus a sixth in an appendix check, using a 313-prompt slice of the StrongREJECT safety benchmark. A harmful text request alone, or paired with an unrelated benign image, rarely got the models to comply, while dedicated attack images pushed compliance up substantially. But when the team tried to isolate which image property does the work, two popular explanations, image complexity and file size, failed to reliably separate attack images from benign ones, and a corrected test of how many tiles an image gets split into found no measurable effect.\n\nOnly one manipulation reliably moved the needle: stripping an image of its relevance to the harmful request cut one model's attack success rate by about 0.12. That is a narrow, partial answer in a field that has leaned on tidy explanations like pixel noise or chopped-up grids. Anyone building defenses around entropy scores or tile-count limits is guarding against a mechanism nobody has actually proven.\n\nThe paper's own caveat is the honest one: its conclusions rest on an automated judge scoring the jailbreak attempts, not a human double-checking the results.","[\"ai-safety\",\"jailbreaks\",\"multimodal-models\",\"security-research\"]","2026-10-07T04:00:00.000Z","2026-10-08T23:52:06.334Z","2026-10-08T23:52:10.009Z","published",null,[],"security",[26,27,28,29],"ai-safety","jailbreaks","multimodal-models","security-research",[31],{"name":32,"url":33},"arXiv cs.AI","https:\u002F\u002Farxiv.org\u002Fabs\u002F2610.07009",0,{"sections":36},[37,42,46,51,56,61,66,71,76,80,85,90,95,100],{"name":38,"slug":39,"count":40,"latest_published_at":41},"AI","ai",6486,"2026-10-07T18:45:00.000Z",{"name":43,"slug":24,"count":44,"latest_published_at":45},"Security",910,"2026-10-07T19:53:42.000Z",{"name":47,"slug":48,"count":49,"latest_published_at":50},"Policy","policy",474,"2026-10-07T18:23:21.000Z",{"name":52,"slug":53,"count":54,"latest_published_at":55},"Deals","deals",453,"2026-10-07T23:58:31.000Z",{"name":57,"slug":58,"count":59,"latest_published_at":60},"Hardware","hardware",222,"2026-10-07T21:19:54.000Z",{"name":62,"slug":63,"count":64,"latest_published_at":65},"Science","science",186,"2026-10-06T21:20:39.000Z",{"name":67,"slug":68,"count":69,"latest_published_at":70},"Consumer Tech","consumer-tech",174,"2026-10-07T17:41:41.000Z",{"name":72,"slug":73,"count":74,"latest_published_at":75},"Software","software",113,"2026-10-07T18:10:00.000Z",{"name":77,"slug":78,"count":74,"latest_published_at":79},"Startups","startups","2026-10-07T23:36:57.000Z",{"name":81,"slug":82,"count":83,"latest_published_at":84},"Dev Tools","dev-tools",105,"2026-10-07T16:59:11.000Z",{"name":86,"slug":87,"count":88,"latest_published_at":89},"General","general",61,"2026-10-07T22:00:24.000Z",{"name":91,"slug":92,"count":93,"latest_published_at":94},"Gaming","gaming",56,"2026-10-07T12:00:00.000Z",{"name":96,"slug":97,"count":98,"latest_published_at":99},"Reviews","reviews",33,"2026-10-05T11:57:17.000Z",{"name":101,"slug":102,"count":103,"latest_published_at":104},"How-To","how-to",8,"2026-10-05T09:00:00.000Z"]