{"id":"242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728","title":"The authors propose connecting visual jailbreaks to test multimodal model safety","argument":"Authors Xu Zhang, Ziqing Hu, Shuo Han and Ren Wang argue that visual jailbreak attacks can be made more diverse and transferable by connecting effective adversarial inputs through low-loss regions in image space. They call their framework Jailbreak Connectivity (JC). Rather than optimize isolated examples, JC samples paths to generate varied jailbreak images, uses lightweight surrogate classifiers to guide cross-model transfer, and applies a distribution-level objective to target multiple harmful queries.\n\nOn MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% across three tested models, exceeding the strongest baselines by as much as 68.36 percentage points. In black-box evaluations, they report improvements over FigStep of 24.69 percentage points on GPT-5.6 and 27.34 on Gemini 3.1 Pro. The authors say these findings reveal structured vulnerabilities and inform more comprehensive security evaluation.\n\nThe reported results are benchmark and black-box evaluation outcomes; the abstract does not establish how well they predict attacks in other settings. It also gives no details on the evaluation protocols or defenses tested. How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is an arXiv abstract and does not include the paper's full methods, evaluation protocols, or defense comparisons. The reported results concern the named benchmarks, models and black-box evaluations; the abstract does not establish performance in other settings.","speaker":{"name":"Zhang, Xu, Hu, Ziqing, Han, Shuo, Wang, Ren","roleAtSource":"Article author"},"source":{"title":"Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38091","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose Jailbreak Connectivity, which uses connected paths through low-loss regions in image space to generate diverse visual jailbreaks, guide transfer across models, and target multiple harmful queries.","excerpt":"JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"On MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% on three named models, exceeding the strongest baselines by up to 68.36 percentage points.","excerpt":"On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"In black-box evaluations, the authors report that JC improves attack success rates over FigStep on GPT-5.6 and Gemini 3.1 Pro.","excerpt":"In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"The authors argue that their findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","excerpt":"These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38091","checkedAt":"2026-11-13T09:08:08.140Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"The authors propose connecting visual jailbreaks to test multimodal model safety","summary":"Authors Xu Zhang, Ziqing Hu, Shuo Han and Ren Wang argue that visual jailbreak attacks can be made more diverse and transferable by connecting effective adversarial inputs through low-loss regions in image space. They call their framework Jailbreak Connectivity (JC). Rather than optimize isolated examples, JC samples paths to generate varied jailbreak images, uses lightweight surrogate classifiers to guide cross-model transfer, and applies a distribution-level objective to target multiple harmful queries.\n\nOn MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% across three tested models, exceeding the strongest baselines by as much as 68.36 percentage points. In black-box evaluations, they report improvements over FigStep of 24.69 percentage points on GPT-5.6 and 27.34 on Gemini 3.1 Pro. The authors say these findings reveal structured vulnerabilities and inform more comprehensive security evaluation.\n\nThe reported results are benchmark and black-box evaluation outcomes; the abstract does not establish how well they predict attacks in other settings. It also gives no details on the evaluation protocols or defenses tested. How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","question":"How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","claims":[{"text":"The authors propose Jailbreak Connectivity, which uses connected paths through low-loss regions in image space to generate diverse visual jailbreaks, guide transfer across models, and target multiple harmful queries.","excerpt":"JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries.","support":"source-stated"},{"text":"On MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% on three named models, exceeding the strongest baselines by up to 68.36 percentage points.","excerpt":"On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points.","support":"source-stated"},{"text":"In black-box evaluations, the authors report that JC improves attack success rates over FigStep on GPT-5.6 and Gemini 3.1 Pro.","excerpt":"In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively.","support":"source-stated"},{"text":"The authors argue that their findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","excerpt":"These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","support":"source-stated"}],"limitations":["The evidence is an arXiv abstract and does not include the paper's full methods, evaluation protocols, or defense comparisons.","The reported results concern the named benchmarks, models and black-box evaluations; the abstract does not establish performance in other settings."],"mediaId":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","correctionReason":null,"id":"242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728","publicationId":"dd478c96-4845-4378-8c8a-3fc1710c4545","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38091","sourceTitle":"Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:41:23.997Z","createdAt":"2026-11-13T07:01:45.892Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","kind":"article","url":"https://arxiv.org/abs/2610.38091","sourceUrl":"https://arxiv.org/abs/2610.38091","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T05:03:45.194Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38091","checkedAt":"2026-11-13T09:08:08.140Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","confidence":0.8300000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e676a1b33598abc0f5e62f96ccfce2f4308b363b2f45131b4b22133a8254f89f","decidedAt":"2026-10-31T05:03:46.773Z"},"provenance":{"textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observationId":"19b1b3c1a876d68b31f575accdb77cd39fd0edb29ec6d70c9124701946be726b","retrievedAt":"2026-10-31T05:03:44.961Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"87a36294-7c1c-48b4-8809-7d49c640cc67"},"reviewer":{"model":"gpt-6-luna","runId":"2af424e3-647f-4e44-864c-57437fd30d33"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T07:01:45.892Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zhang, Xu","url":null,"kind":"unknown"},{"name":"Hu, Ziqing","url":null,"kind":"unknown"},{"name":"Han, Shuo","url":null,"kind":"unknown"},{"name":"Wang, Ren","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zhang, Xu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Xu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Hu, Ziqing","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hu, Ziqing","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Han, Shuo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Han, Shuo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Wang, Ren","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Ren","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38091","snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728/source"}},"canonicalUrl":"https://escapemeridian.com/readings/the-authors-propose-connecting-visual-jailbreaks-to-test-242a1969","formats":{"html":"/readings/the-authors-propose-connecting-visual-jailbreaks-to-test-242a1969","markdown":"/readings/the-authors-propose-connecting-visual-jailbreaks-to-test-242a1969.md","json":"/readings/the-authors-propose-connecting-visual-jailbreaks-to-test-242a1969.json"},"attribution":"Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.","maintainedGuideLinks":[],"readerContext":{"version":"reader-context-v1","attribution":"Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.","terms":[{"id":"term-jailbreak","name":"Jailbreak","explanation":"A prompt written to trick an AI system into ignoring its safety rules.","referenceUrl":"https://arxiv.org/abs/2307.02483"},{"id":"term-multimodal-model","name":"Multimodal model","explanation":"A model that works with more than one kind of input or output, such as text, images and audio.","referenceUrl":"https://developers.google.com/machine-learning/glossary#multimodal-model"},{"id":"term-benchmark","name":"Benchmark","explanation":"A defined set of tests used to compare systems. Results depend on the tasks and measures selected.","referenceUrl":"https://arxiv.org/abs/2211.09110"}],"entities":[{"id":"arxiv","name":"arXiv","kind":"organization","context":"arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.","referenceUrls":["https://arxiv.org/","https://info.arxiv.org/help/api/index.html"],"path":"/entities/arxiv","json":"/entities/arxiv.json","markdown":"/entities/arxiv.md"}]},"researchQuestions":[],"withdrawn":false,"references":{"schemaVersion":1,"target":{"type":"reading","id":"242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728","revision":"dd478c96-4845-4378-8c8a-3fc1710c4545","revisionKind":"publication-id","title":"The authors propose connecting visual jailbreaks to test multimodal model safety","url":"https://escapemeridian.com/readings/the-authors-propose-connecting-visual-jailbreaks-to-test-242a1969"},"source":{"type":"source","id":"https://arxiv.org/abs/2610.38091","revision":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","revisionKind":"sha256-source-text","title":"Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak","url":"https://arxiv.org/abs/2610.38091"},"status":"available","items":[],"next":null,"scope":"Explicit citations in public readings and public file attachments to this reading. Shared topics are not citations. Other artifact types need an explicit reference adapter."},"revisions":[{"id":"242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728","title":"The authors propose connecting visual jailbreaks to test multimodal model safety","argument":"Authors Xu Zhang, Ziqing Hu, Shuo Han and Ren Wang argue that visual jailbreak attacks can be made more diverse and transferable by connecting effective adversarial inputs through low-loss regions in image space. They call their framework Jailbreak Connectivity (JC). Rather than optimize isolated examples, JC samples paths to generate varied jailbreak images, uses lightweight surrogate classifiers to guide cross-model transfer, and applies a distribution-level objective to target multiple harmful queries.\n\nOn MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% across three tested models, exceeding the strongest baselines by as much as 68.36 percentage points. In black-box evaluations, they report improvements over FigStep of 24.69 percentage points on GPT-5.6 and 27.34 on Gemini 3.1 Pro. The authors say these findings reveal structured vulnerabilities and inform more comprehensive security evaluation.\n\nThe reported results are benchmark and black-box evaluation outcomes; the abstract does not establish how well they predict attacks in other settings. It also gives no details on the evaluation protocols or defenses tested. How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","topicIds":["intelligence-and-discovery"],"domain":"science","claimType":"attributed reading","limits":"The evidence is an arXiv abstract and does not include the paper's full methods, evaluation protocols, or defense comparisons. The reported results concern the named benchmarks, models and black-box evaluations; the abstract does not establish performance in other settings.","speaker":{"name":"Zhang, Xu, Hu, Ziqing, Han, Shuo, Wang, Ren","roleAtSource":"Article author"},"source":{"title":"Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak","publisher":"arXiv cs.AI","format":"Article","url":"https://arxiv.org/abs/2610.38091","publishedAt":"2026-10-28","dateBasis":"Date basis not provided."},"evidence":[{"text":"The authors propose Jailbreak Connectivity, which uses connected paths through low-loss regions in image space to generate diverse visual jailbreaks, guide transfer across models, and target multiple harmful queries.","excerpt":"JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"On MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% on three named models, exceeding the strongest baselines by up to 68.36 percentage points.","excerpt":"On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"In black-box evaluations, the authors report that JC improves attack success rates over FigStep on GPT-5.6 and Gemini 3.1 Pro.","excerpt":"In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"},{"text":"The authors argue that their findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","excerpt":"These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","url":"https://arxiv.org/abs/2610.38091","relationship":"Source-stated"}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38091","checkedAt":"2026-11-13T09:08:08.140Z","items":[],"note":"No suitable media was found by the supported page extraction."},"assumptions":[],"openQuestion":{"attribution":"Open question","text":"How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?"},"whatWouldChangeView":{"attribution":"Change condition not recorded","text":""},"editorialComparisons":[],"live":{"title":"The authors propose connecting visual jailbreaks to test multimodal model safety","summary":"Authors Xu Zhang, Ziqing Hu, Shuo Han and Ren Wang argue that visual jailbreak attacks can be made more diverse and transferable by connecting effective adversarial inputs through low-loss regions in image space. They call their framework Jailbreak Connectivity (JC). Rather than optimize isolated examples, JC samples paths to generate varied jailbreak images, uses lightweight surrogate classifiers to guide cross-model transfer, and applies a distribution-level objective to target multiple harmful queries.\n\nOn MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% across three tested models, exceeding the strongest baselines by as much as 68.36 percentage points. In black-box evaluations, they report improvements over FigStep of 24.69 percentage points on GPT-5.6 and 27.34 on Gemini 3.1 Pro. The authors say these findings reveal structured vulnerabilities and inform more comprehensive security evaluation.\n\nThe reported results are benchmark and black-box evaluation outcomes; the abstract does not establish how well they predict attacks in other settings. It also gives no details on the evaluation protocols or defenses tested. How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","question":"How well does Jailbreak Connectivity transfer beyond the models and evaluations reported in the abstract?","claims":[{"text":"The authors propose Jailbreak Connectivity, which uses connected paths through low-loss regions in image space to generate diverse visual jailbreaks, guide transfer across models, and target multiple harmful queries.","excerpt":"JC optimizes continuous adversarial paths: path sampling yields diverse jailbreak images, lightweight surrogate classifiers guide cross-model transfer, and a distribution-level objective enables universal attacks across harmful queries.","support":"source-stated"},{"text":"On MM-SafetyBench, the authors report average attack success rates of 84.01%, 85.77% and 97.95% on three named models, exceeding the strongest baselines by up to 68.36 percentage points.","excerpt":"On MM-SafetyBench, JC achieves average attack success rates of 84.01%, 85.77%, and 97.95% on Qwen3-VL-8B-Instruct, InternVL3.5-8B, and Gemma-3-12B-IT, respectively, exceeding the strongest baselines by up to 68.36 percentage points.","support":"source-stated"},{"text":"In black-box evaluations, the authors report that JC improves attack success rates over FigStep on GPT-5.6 and Gemini 3.1 Pro.","excerpt":"In black-box evaluations, JC improves attack success rates over FigStep by 24.69 and 27.34 percentage points on GPT-5.6 and Gemini 3.1 Pro, respectively.","support":"source-stated"},{"text":"The authors argue that their findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","excerpt":"These findings reveal structured vulnerabilities in MLLM safety alignment and inform more comprehensive security evaluation.","support":"source-stated"}],"limitations":["The evidence is an arXiv abstract and does not include the paper's full methods, evaluation protocols, or defense comparisons.","The reported results concern the named benchmarks, models and black-box evaluations; the abstract does not establish performance in other settings."],"mediaId":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","correctionReason":null,"id":"242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728","publicationId":"dd478c96-4845-4378-8c8a-3fc1710c4545","version":1,"sourceUrl":"https://arxiv.org/abs/2610.38091","sourceTitle":"Jailbreak Connectivity: Towards Diverse, Transferable, and Universal Multimodal Large Language Model Jailbreak","publisher":"arXiv cs.AI","publishedAt":null,"originalPublished":{"value":"2026-10-28","precision":"day","basis":"publisher_citation_date"},"firstObservedAt":"2026-10-30T06:41:23.997Z","createdAt":"2026-11-13T07:01:45.892Z","historical":true,"entityIds":["arxiv"],"topicIds":["intelligence-and-discovery"],"media":[{"id":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","kind":"article","url":"https://arxiv.org/abs/2610.38091","sourceUrl":"https://arxiv.org/abs/2610.38091","label":"Read original","provenance":"source_link","verification":{"status":"verified","checkedAt":"2026-10-31T05:03:45.194Z","method":"acquired_source","contentType":"text/html"},"recommendationReason":"Recommended by Jev for understanding this source; checked by Luna."}],"sourceMedia":{"status":"not_found","sourceUrl":"https://arxiv.org/abs/2610.38091","checkedAt":"2026-11-13T09:08:08.140Z","items":[],"note":"No suitable media was found by the supported page extraction."},"editorialDecision":{"outcome":"accept","reasonCodes":["material_development"],"rubricVersion":"stream-admission-v5","mediaId":"b9f1936ae4f57cdd05a440a40fa7eb023e78bff6084ea81540171bd485db2bcb","confidence":0.8300000000000001,"provider":"typesafe","model":"jev-1.13.0","inputHash":"e676a1b33598abc0f5e62f96ccfce2f4308b363b2f45131b4b22133a8254f89f","decidedAt":"2026-10-31T05:03:46.773Z"},"provenance":{"textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observationId":"19b1b3c1a876d68b31f575accdb77cd39fd0edb29ec6d70c9124701946be726b","retrievedAt":"2026-10-31T05:03:44.961Z","kind":"publisher-page","preparer":{"model":"gpt-6-luna","runId":"87a36294-7c1c-48b4-8809-7d49c640cc67"},"reviewer":{"model":"gpt-6-luna","runId":"2af424e3-647f-4e44-864c-57437fd30d33"}},"audit":{"status":"uncertain","reviewedAt":"2026-11-13T07:01:45.892Z","model":"anthropic/claude-opus-5.5"},"sourceAttribution":{"authors":[{"name":"Zhang, Xu","url":null,"kind":"unknown"},{"name":"Hu, Ziqing","url":null,"kind":"unknown"},{"name":"Han, Shuo","url":null,"kind":"unknown"},{"name":"Wang, Ren","url":null,"kind":"unknown"}],"authorRole":"article-author","hosts":[],"status":"stated","authorRoster":{"truncated":false,"omitted":0,"assertionGroupsOmitted":0},"participation":[{"actor":{"name":"Zhang, Xu","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Zhang, Xu","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:0","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Hu, Ziqing","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Hu, Ziqing","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:1","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Han, Shuo","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Han, Shuo","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:2","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}},{"actor":{"name":"Wang, Ren","url":null,"kind":"unknown","actorId":null},"role":"author","scope":{"kind":"work-credit","locator":null},"literalCredit":"Wang, Ren","status":"stated","provenance":{"basis":"head-meta","sourceUrl":"https://arxiv.org/abs/2610.38091","locator":"head/meta[name=author|citation_author]"},"assertionId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a:participation:3","identity":{"version":"entity-identity-v1","status":"unresolved","actorId":null,"canonicalActorId":null,"candidateActorIds":[],"assertions":[],"sourceObservedAt":"2026-11-13T09:08:08.140Z","knowledgeAsOf":null},"sourceVersion":{"snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","sourceUrl":"https://arxiv.org/abs/2610.38091","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z"}}],"participationCoverage":{"total":4,"returned":4,"complete":true,"fullAssertions":"source-metadata-endpoint"},"distribution":null,"publisher":null,"sourceUrl":"https://arxiv.org/abs/2610.38091","snapshotId":"4bc634ab2e39fa3cf7902685ead4e81e87011f711b7c5e7ed90b5388d0c5386a","contentSha256":"12a7ce3967f7953a43f85b11c8f3dd335259d6bd7edb59dbfff2be114fb516b2","textHash":"e5685289d7db4a58b64e759ed52739dc6966d808f22256f06a426e09432ed0ea","observedAt":"2026-11-13T09:08:08.140Z","basis":"publisher-page-metadata","sourceLinks":45,"linksTruncated":false,"metadataUrl":"/api/pipeline/stream/242a1969b15fea63f0ab2d896b7c71166e1f2d5b3b2209acd3eaaaa40db19728/source"}}}],"audits":[{"publicationId":"dd478c96-4845-4378-8c8a-3fc1710c4545","verdict":"uncertain","findings":[{"dimension":"attribution","status":"pass","explanation":"The reading correctly attributes the work to Xu Zhang, Ziqing Hu, Shuo Han and Ren Wang. It frames the method, results and conclusions as the authors' proposals and reports rather than established facts.","excerpt":"Authors:Xu Zhang, Ziqing Hu, Shuo Han, Ren Wang"},{"dimension":"summary","status":"uncertain","explanation":"The reading is faithful but hard to follow without specialist background. It never says that jailbreaks are attacks that bypass safety safeguards, which is the source's opening stake. Central terms are not explained in plain language or flagged for tooltips: multimodal large language model (an AI that handles images as well as text), low-loss regions, adversarial inputs, surrogate classifiers, black-box, MM-SafetyBench and FigStep. Smallest repair: add the source's framing that MLLMs are vulnerable to visual jailbreaks that bypass safety safeguards, and add term-library tooltips. The title and question are fine.","excerpt":"Multimodal large language models (MLLMs) are vulnerable to visual jailbreak attacks that bypass safety safeguards."},{"dimension":"date","status":"pass","explanation":"The originalPublished value of 2026-10-28 matches the arXiv v1 submission date. The later feed date was not used.","excerpt":"[Submitted on 28 Oct 2026]"},{"dimension":"support","status":"pass","explanation":"All figures match the abstract, including the per-model rates, the 68.36-point maximum margin and the FigStep gains on GPT-5.6 and Gemini 3.1 Pro. The method description and the authors' conclusion are also accurately reported. The limitations correctly note that the abstract lacks protocol details and does not establish performance in other settings. No unsupported benefits or costs are added.","excerpt":"exceeding the strongest baselines by up to 68.36 percentage points"},{"dimension":"media","status":"pass","explanation":"The selected media is the verified arXiv abstract page for this paper. It is the direct original source and the most relevant link available.","excerpt":null}],"createdAt":"2026-11-13T07:01:45.892Z","model":"anthropic/claude-opus-5.5"}],"correctionUrl":"https://escapemeridian.com/corrections/"}