Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models

arXiv:2610.30348 · cs.CR · Submitted 2026-10-21 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: Security Radio. Generated commentary on the latest security and cryptography papers.

Nadia: I'm Nadia.

Elias: And I'm Elias, here with Priya.

Nadia: We're looking at the paper: "Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models".

Elias: Here's the gist of the paper. The gist The proposed attack, Mirage, demonstrates that post-generation safety checkers in multimodal diffusion models can be bypassed using targeted jailbreak attacks while preserving fine-grained malicious target semantics.

Nadia: How it works Mirage conceals the adversarial target within a small perturbation applied to a benign input image while leaving the text prompt unchanged <ref:2610.30348#pg2>.

Elias: It exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts <ref:2610.30348#pg3>.

Nadia: This semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details <ref:2610.30348#pg6>.

Paper summary: Nadia: So, we just covered the basics of what this paper claims about Mirage—that it bypasses post-generation safety checkers by using a targeted attack that aligns an image perturbation with a malicious target in the shared encoder space and pushes it away from unsafe concepts.

Elias: It’s important to remember that Mirage doesn't need access to the safety checker’s model details or decision threshold, which is a big deal because usually these checks are designed to be opaque.

Priya: But what about the actual mechanism of encoding that cross-modal target into that small image perturbation? The abstract hints at a challenge there.

Nadia: They address it by exploiting the shared embedding space of multimodal encoders, specifically optimizing a norm-bounded perturbation so that both textual and visual targets can be handled in the same optimization framework. This guides the diffusion model toward generating content aligned with whatever target you chose.

Elias: And then for evading the checker, they use a contrastive learning objective. They formulate it as L contras = - (y adv, y t) + lambda sum j=one (y adv, y j NSFW) which means they are minimizing the distance to the target while maximizing the distance from known NSFW concepts <ref:2610.30348#pg1>.

Priya: That contrastive loss setup is interesting because it’s explicitly trying to create that separation in the unified embedding space where features from different inputs are mapped close together.

Nadia: Right. And they claim this semantic separation can transfer across representation spaces, which is what lets Mirage evade heterogeneous safety checkers without knowing their internal details.

Elias: It means you don't need to know the specific rule that blocks something; you just need to find a representation gap that points somewhere else entirely.

Priya: What does this mean for the real-world data? If the results show strong performance, how confident are we in those claims when it comes to actual content generation?

Nadia: The experimental results show Mirage achieves high attack success rates and strong CLIP similarity between the generated content and the intended targets. Specifically, they found that successful attack images remain highly aligned with the adversarial targets, achieving CLIP similarity scores close to the None setting with only negligible degradation.

Elias: And they’re quite query-efficient too; in most cases, it requires only a few queries to bypass the safety checker. That’s a nice practical result for deployment because it keeps the cost low for running this type of attack.

Conclusion: Nadia: So, wrapping up on "Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models," what we've seen is that these post-generation safety checkers aren't foolproof against targeted attacks.

Elias: It really shows that even when you have these checks running inside a diffusion pipeline, if the attack is clever enough, it can exploit the shared representation space to achieve its goal.

Priya: For someone focused on privacy and measurement, what does this vulnerability mean for how we trust AI-generated content in general?

Nadia: It highlights that relying solely on post-generation safety checks might not be enough against adaptive multimodal jailbreak attacks. The paper suggests we need more robust defense mechanisms, something called defense-in-depth, for these kinds of pipelines.

Elias: And the implication is that the way these models are structured—with those shared encoders and adapters—creates a pathway where semantic manipulation can bypass layered defenses without needing internal model access.

Priya: It sounds like we need to look at how we measure robustness in terms of representation space manipulation, not just final output filtering.

Nadia: Exactly. The work on Mirage demonstrates that post-generation safety checking alone isn't sufficient protection against these adaptive attacks, and it points toward the need for deeper layers of defense within multimodal diffusion pipelines.

Washington University in St. Louis · Virginia Tech

cs.CR

Submitted: 2026-10-21

Updated: 2026-10-21

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 91/100

The gist: The gist The proposed attack, Mirage, demonstrates that post-generation safety checkers in multimodal diffusion models can be bypassed using targeted jailbreak attacks while preserving fine-grained

Key concepts

Multimodal Jailbreak Attack: This attack targets diffusion models that handle both images and text. Instead of just changing the text prompt, Mirage modifies an input image slightly. It uses this small change to carry a hidden malicious meaning, allowing it to bypass safety checks designed for either modality.
Shared Representation Space: Multimodal encoders (like those in diffusion models) use a common mathematical space to understand both images and text simultaneously. Mirage exploits this shared space by aligning the perturbed image representation with the target's representation while simultaneously pushing it away from representations associated with unsafe content like NSFW concepts.
Contrastive Objective: This is a mathematical goal used during attack construction. Mirage uses this objective to create an adversarial perturbation that achieves two things: first, it keeps the meaning of the original benign image close to the target's meaning; second, it ensures this new representation is mathematically distant from representations of unsafe concepts.
Black-box Query Refinement: Since Mirage operates without knowing the safety checker's internal workings, it uses a technique called black-box query refinement. This involves making small adjustments to the attack perturbation based only on the final feedback received from the target diffusion pipeline, helping it navigate unknown safety boundaries more effectively.

Terminology

Diffusion Model — 1× in this paper · explained in 10 episodes
Diffusion Models — 1× in this paper · explained in 9 episodes

Summary

The gist The proposed attack, Mirage, demonstrates that post-generation safety checkers in multimodal diffusion models can be bypassed using targeted jailbreak attacks while preserving fine-grained malicious target semantics.

How it works

Mirage conceals the adversarial target within a small perturbation applied to a benign input image while leaving the text prompt unchanged <ref:2610.30348#pg2>. It exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts <ref:2610.30348#pg3>. This semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details <ref:2610.30348#pg6>.

Detailed Design

The attack consists of two main design components <ref:2610.30348#pg6>. First, Mirage constructs a norm-bounded adversarial perturbation in a surrogate multimodal representation space using a contrastive objective that jointly preserves target semantics and separates the adversarial representation from unsafe concepts <ref:2610.30348#pg6>. The contrastive loss is formulated as Lcontras = − cos(yadv, yt) + λ Σj=1 cos(yadv, yjNSFW) <ref:2610.30348#pg6>. Second, because the transferred perturbation may not perfectly cross the unknown safety boundary, Mirage performs lightweight black-box query refinement using only the final feedback from the target diffusion pipeline <ref:2610.30348#pg6>. This refinement is achieved by adding a second per-query perturbation δ+ in addition to the primary perturbation <ref:2610.30348#pg6>.

Key Components and Targets

The adversary can specify fine-grained malicious targets through either a malicious text description or a reference NSFW image as the adversarial target <ref:2610.30348#pg2>. Mirage operates using only surrogate multimodal models and limited blackbox queries <ref:2610.30348#pg6>. The adversary leverages a surrogate multimodal encoder with encoding functions similar to those used in the target diffusion model <ref:2610.30348#pg6>. The adversary's goal is to bypass the diffusion model’s post-generation safety checkers and cause the model to generate targeted NSFW content <ref:2610.30348#pg6>.

Experimental Results

The results show that Mirage achieves high attack success rates and strong CLIP similarity between the generated NSFW content and the intended targets <ref:2610.30348#pg9>. In Tab. II, Mirage achieves high bypass rates across most models, datasets, and safety checkers <ref:2610.30348#pg10>. The results show that successful attack images remain highly aligned with the adversarial targets, achieving CLIP similarity scores close to the None setting with only negligible degradation <ref:2610.30348#pg10>. Mirage is query-efficient, in most cases, it requires only a few queries to bypass the safety checker <ref:2610.30348#pg10>.

Contributions and Implications

The paper makes several contributions <ref:2610.30348#pg10>. First, it shows that multimodal diffusion models remain vulnerable to targeted jailbreak attacks even when protected by black-box post-generation safety checkers <ref:2610.30348#pg10>. Second, it proposes Mirage, a targeted multimodal jailbreak attack that encodes cross-modal adversarial targets into small image perturbations and evades unknown postgeneration safety checkers <ref:2610.30348#pg10>. Third, it evaluates Mirage across three representative diffusion models, three heterogeneous post-generation safety checkers, and both textual and visual adversarial targets <ref:2610.30348#pg10>. The results demonstrate strong targeted jailbreak performance under limited query budgets and consistent improvements over existing jailbreak baselines <ref:2610.30348#pg10>. Ultimately, this work reveals that postgeneration safety checking alone may be insufficient against adaptive multimodal jailbreak attacks and highlights the need for more robust, defense-in-depth safety mechanisms for multimodal diffusion pipelines <ref:2610.30348#pg14>.

Ethical Considerations

The research studies the security risks of multimodal diffusion models protected by post-generation safety mechanisms <ref:2610.30348#pg15>. The primary risk of this work is dual use, as a malicious actor could adapt the proposed techniques to bypass safety mechanisms and generate restricted content <ref:2610.30348#pg15>. Mitigations include conducting experiments in a controlled research environment using publicly available models and datasets <ref:2610.30348#pg15>. The paper discusses potential countermeasures to help model developers and safety-checker providers improve the robustness of multimodal safety pipelines <ref:2610.30348#pg15>.

Applicability

The underlying attack operates on multimodal encoder representations and is not inherently restricted to image generation <ref:2610.30348#pg13>. The same attack intuition may extend to other modalities, such as text-to-audio diffusion models, although directly extending Mirage to audio generation is non-trivial <ref:2610.30348#pg13>. The paper suggests that adversarial training or fine-tuning and input purification are potential defense mechanisms <ref:2610.30348#pg13>.

Conclusion

In this paper, we present Mirage, a targeted multimodal jailbreak attack against diffusion models protected by postgeneration safety checkers <ref:2610.30348#pg10>. Mirage encodes textual or visual adversarial targets into small image perturbations by jointly aligning the adversarial representation with the intended target and separating it from potentially filtered NSFW concepts <ref:2610.30348#pg10>. By exploiting cross-space transferability together with lightweight black-box query refinement, Mirage can evade heterogeneous post-generation safety checkers without accessing their internal details <ref:2610.30348#pg10>. Extensive experiments across multiple diffusion models, target modalities, and safety checkers demonstrate the effectiveness of the attack <ref:2610.30348#pg10>. Mirage reveals that postgeneration safety checking alone may be insufficient against adaptive multimodal jailbreak attacks and highlights the need for more robust, defense-in-depth safety mechanisms for multimodal diffusion pipelines <ref:2610.30348#pg14>.

--- Page 1 ---

Mirage: Targeted Jailbreaks Against Post-Generation Safety Checkers in Multimodal Diffusion Models Safety Checkers in Multimodal Diffusion Models Shanghao Shi∗, Chaoyu Zhang†, Heng Jin†, Hao Li∗, Ning Zhang∗, Y. Thomas Hou†, and Wenjing Lou† Washington University in St. Louis, †Virginia Tech <ref:2610.30348#pg2>. Abstract—Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users <ref:2610.30348#pg2>. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage <ref:2610.30348#pg2>. Given an adversarial target, which can be either a reference NSFW image or a malicious text description, Mirage conceals the target within an imperceptible perturbation applied to a benign input image <ref:2610.30348#pg2>. Mirage exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts <ref:2610.30348#pg3>. Such semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details <ref:2610.30348#pg6>. We further employ lightweight black-box query refinement to improve evasion near the unknown safety boundary <ref:2610.30348#pg6>.

How it works

The adversary leverages a surrogate model to construct the targeted adversarial input against diffusion models <ref:2610.30348#pg6>. The attack is cross-modal: the adversarial target may be either a reference image or a malicious text description <ref:2610.30348#pg6>.

Detailed Design

Improvements for AI systems

Targeted jailbreak evasion against post-generation safety checkers can be achieved without accessing internal model details or decision thresholds by exploiting cross-space transferability between surrogate and safety checker representations. This allows for bypassing heterogeneous safety mechanisms like CLIP Checker, ViT Checker, and NudeNet simultaneously using only limited black-box queries.
The AI system can generate targeted NSFW content from benign inputs by applying a small image perturbation to align the perturbed image's embedding with the adversarial target while repelling its representation from commonly filtered NSFW concepts in a surrogate embedding space. This semantic separation is shown to transfer across representation spaces, enabling evasion even when the safety checker's architecture differs from the surrogate model.
A lightweight black-box query refinement procedure can be integrated into the attack flow by adding a second per-query perturbation delta plus to compensate for residual mismatches between surrogate and target spaces. This technique improves both bypass rate and Attack Success Rate by allowing targeted, small-norm adjustments sufficient to flip the safety filter's decision with only a few queries.
The system can be adapted for Image-to-Image, Image Inpainting, and Image-to-Video tasks to generate target NSFW content on these modalities by applying the Mirage attack workflow. This demonstrates applicability across diverse diffusion model generation tasks by leveraging the core mechanism of cross-modal target alignment and unsafe concept repulsion.
The system can be used to evaluate potential defense mechanisms such as adversarial training, input purification, and RLHF for multimodal diffusion pipelines. This provides a framework for model developers to understand the limitations of current post-generation safety checking and motivate the development of more robust, defense-in-depth safety mechanisms.

Abstract

Post-generation safety checkers are widely employed in diffusion-model pipelines to prevent unsafe generated content from reaching users. In this paper, we show that these safety checkers can still be bypassed by our proposed multimodal jailbreak attack, Mirage. Given an adversarial target, which can be either a reference NSFW image or a malicious text description, Mirage conceals the target within an imperceptible perturbation applied to a benign input image. Mirage exploits the shared representation space of multimodal encoders to jointly align the perturbed image with the cross-modal adversarial target while repelling its representation from commonly filtered NSFW concepts. Such semantic separation can transfer across representation spaces, enabling Mirage to evade heterogeneous safety checkers without accessing their internal details. We further employ lightweight black-box query refinement to improve evasion near the unknown safety boundary. We implemented Mirage on Stable Diffusion 1.5, Stable Diffusion XL, and Kandinsky 2.2, and evaluated it on two cross-modal NSFW datasets, covering both text-to-image and image-to-image generation scenarios. The experimental results demonstrate that Mirage achieves strong targeted jailbreak performance across diverse post-generation safety checkers with limited black-box queries while preserving high semantic alignment with the adversarial targets.