# FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts

**Authors:** Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, Xiaoyun Wang  
**arXiv:** [2311.05608](https://arxiv.org/abs/2311.05608)  
**Date:** 2023-11-09  
**Summary page:** https://www.summarizepaper.com/en/paper/2311.05608v3/

## Key points

- FigStep: A novel black-box jailbreak algorithm for LVLM vulnerabilities
- LVLMs: Advancements in AI through multimodal incorporation of images and text
- Safety Alignment: Addressing risks of overreliance on LLM safety assurances
- SafeBench: Comprehensive benchmark for LVLM safety assessment and improvement

## Summary

, , , , 


In this paper, the authors introduce FigStep, a novel black-box jailbreak algorithm designed to exploit vulnerabilities in Large Vision-Language Models (LVLMs). These models represent a significant advancement in AI by incorporating multiple modalities such as images along with text. However, the safety of LVLMs has not been adequately explored, leading to potential risks associated with overreliance on safety assurances from underlying Large Language Models (LLMs). <kw>FigStep:</kw> A Novel Black-Box Jailbreak Algorithm for LVLM Vulnerabilities

<kw>LVLMs:</kw> Advancements in AI through Multimodal Incorporation of Images and Text

<kw>Safety Alignment:</kw> Addressing Risks of Overreliance on LLM Safety Assurances

<kw>SafeBench:</kw> Comprehensive Benchmark for LVLM Safety Assessment and Improvement 

FigStep operates by converting prohibited textual content into images using typography, effectively bypassing existing safety measures. The experimental results demonstrate that FigStep achieves an impressive average attack success rate of 82.50% across six prominent open-source LVLMs. Through comprehensive ablation studies and analysis of semantic embeddings distribution, the authors reveal that FigStep's success stems from the lack of safety alignment for visual embeddings in current LVLMs. Furthermore, the study compares FigStep against five text-only and four image-based jailbreak techniques, highlighting its superior performance in terms of attack costs and success rates. The findings underscore the vulnerability of LVLMs to jailbreak attacks and emphasize the need for innovative cross-modality safety alignment methods to enhance model security. To facilitate further research and experimentation, the authors introduce SafeBench, a comprehensive safety benchmark comprising 500 harmful questions generated through LLM-based dataset generation techniques. The study focuses on analyzing two promising open-source LVLMs - LLaVA-v1.5 and MiniGPT4 - showcasing how FigStep can effectively exploit weaknesses in these models. Overall, this work sheds light on the critical importance of addressing security concerns in LVLMs and provides valuable insights into developing robust defenses against potential adversarial attacks. The code and datasets associated with FigStep are available for further exploration on GitHub at https://github.com/ThuCCSLab/FigStep.