Image‑to‑text jailbreaks embed harmful intent in the text, the image content, or the relationship between them. This study examines image‑side factors across four published attack families on a 313‑prompt StrongREJECT slice, using five multimodal models and an additional appendix evaluation of InternVL3.5‑8B. The harmful instruction is kept constant; the baseline matrix draws once per prompt, while paired ablations draw three times per prompt and are judged by an automated Rubric Judge.
A bare harmful query, even with an unrelated benign image, yields little attack success on most victim models, whereas adding attack images substantially raises the success rate.
First, per‑tile entropy and JPEG size do not reliably distinguish attack tiles from size‑matched benign distractors, limiting density‑only screening. Second, earlier tile‑count ladders were confounded by payload visibility; a corrected region‑count test found no detectable effect, leaving the role of tile‑count structure unresolved. Third, on Qwen3‑VL‑8B, the E4 manipulation that removes query‑specific relatedness lowers the attack success rate (ASR) by about 0.12, supporting a bounded attribution to the relatedness manipulation, although image‑text congruence remains unmeasured. A within‑category control reproduces the direction on overlapping stimuli. Five tests survive global statistical correction, but only E4 supports attribution to a single measured descriptor; the within‑category result serves as a robustness check rather than a separate attribution. These conclusions remain conditional on the Rubric Judge.
Review