A research paper submitted to arXiv on October 28 describes a method for creating varied image-based attacks that can get multimodal large language models (MLLMs)—AI systems that process images as well as text—to answer harmful requests. The authors call the method Jailbreak Connectivity. Their tests report high attack success rates on several models, but the results are the paper’s evaluations, not independent confirmation that the attacks work in every setting.
Instead of optimizing one image at a time, Jailbreak Connectivity searches for paths through image space where the attack remains effective. Sampling along those paths produces different images intended to trigger the same unsafe response. The method also uses small “surrogate” classifiers—simpler models that help guide attacks toward other systems—and an objective that aims to work across a range of harmful queries, rather than just one.
What did the tests find?
On MM-SafetyBench, the paper reports average attack success rates of 84.01% against Qwen3-VL-8B-Instruct, 85.77% against InternVL3.5-8B and 97.95% against Gemma-3-12B-IT. The authors say these results exceeded the strongest comparison methods by as much as 68.36 percentage points. That is the largest reported gap, not a claim that every model was beaten by that amount.
The paper also describes black-box evaluations, where the attackers test a model without access to its internals. Compared with an attack method called FigStep, Jailbreak Connectivity reportedly raised success rates by 24.69 percentage points on GPT-5.6 and 27.34 points on Gemini 3.1 Pro. The abstract does not give the starting rates, test settings or details needed to assess how well these results carry over to other versions or real-world use.
What the findings do—and don’t—show
The work adds to research on whether image inputs can undermine safety measures in AI assistants. Its central claim is that effective visual attacks may form connected regions rather than isolated examples, allowing researchers to generate more varied attacks and test transfer across models. The reported success rates make that a useful concern for developers evaluating image-capable systems, but they do not show that ordinary users can reliably bypass safeguards in everyday conversations.
The paper’s abstract presents the results as evidence of structured weaknesses in safety alignment. It does not establish how the method performs outside the named evaluations, or whether model providers have changed their safeguards in response. Those questions matter before treating the benchmark numbers as a measure of risk to users.
Why it matters
For people using AI assistants that accept images, the paper highlights a possible weakness in safeguards: a picture may help elicit a harmful answer even when the system is designed to refuse. The reported tests concern specific benchmarks and model versions, so they do not tell users how likely a bypass is in ordinary use.
