Reproduce “PAST2HARM: A Simple Adaptive Past Tense Attack for Jailbreaking Multimodal AI” on OpenResearch
Turn your favorite coding agents into research agents that review literature, develop hypotheses, and run experiments.
Universal app for Apple silicon and Intel. Requires macOS 11 or later.
About this paper
Snehasis Mukhopadhyay
Researchers at the Indian Institute of Information Technology, Kalyani, developed PAST2HARM, an adaptive black-box attack that exploits a temporal vulnerability in state-of-the-art multimodal text-to-image models. The attack, which reformulates harmful requests into the past tense, successfully bypassed safety mechanisms in models like SD-XL (88% ASR) and GPT-Image-2 (56% ASR), enabling the generation of policy-violating images.
Key insights
- Current alignment mechanisms in multimodal text-to-image models exhibit a fundamental brittleness to simple temporal shifts in prompt phrasing.
- A 'peak vulnerability window' (around conversation depth 6) was identified, after which sustained adversarial pressure could lead to 'semantic inversion' of harmful content.
- Adversarial prompts generated using this temporal strategy showed high cross-model transferability, indicating generalized weaknesses across diverse architectures.
Summary by alphaXiv.
Tip: change arxiv.org to autoarxiv.org in any arXiv abstract link to open the paper here.