Video context can trick multimodal AI into unsafe replies
SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs
Cryptography and SecurityArtificial IntelligenceMachine Learning
Summary
Video-based AI systems that understand both video and language can be tricked into giving unsafe answers, depending on the video scenes they see. The authors show that putting the same harmful question in different video settings can lead to very different AI responses. They created SceneJail, a method that finds video scenes and wordings that make these AI models reveal unsafe content more often. Their tests show this approach works well against strong AI models, even when existing defenses are applied.
What this means in practice
- •For ai security teams: Assess and improve video multimodal model defenses by testing their sensitivity to video context manipulations that trigger unsafe outputs.
- •For content moderation teams: Identify and block video scenarios that could coax video-capable AI models into producing undesired or harmful content.
Authors
Wenyu Chen, Li Wang, Chuanchao Zang, Xiangtao Meng, Xinyu Gao, Jianing Wang, Zheng Li, Shanqing Guo
Abstract
Video Multimodal Large Language Models (Video-MLLMs) support reasoning over video inputs, yet remain vulnerable to jailbreak attacks that elicit policy-violating responses. Existing video jailbreaks primarily manipulate how harmful queries are visually presented, thereby treating video merely as a carrier. Consequently, the surrounding video scenario remains unexplored as a contextual attack surface. In this paper, we show that the same harmful query can elicit different safety responses when placed in different video scenarios. To systematically exploit this vulnerability, we propose SceneJail, an adaptive black-box jailbreak framework with two coordinated components. Adaptive Scenario Construction dynamically searches for a surrounding scenario that is contextually compatible with the harmful query. Scenario-aware Prompt Search uses black-box response feedback to search for textual guidance tailored to the selected scenario. Extensive evaluations on the HADES and SafeBench datasets across eight Video-MLLMs, including two proprietary models, GPT-4.1 and Gemini3.5-Flash, demonstrate the effectiveness of SceneJail. SceneJail-F, which presents the complete query persistently, achieves average attack success rates (ASR) up to 91.5%, outperforming the strongest baselines by 29.1 percentage points. Furthermore, SceneJail-S, which distributes the query across successive frames, remains highly robust against current defenses, retaining a 72.3% ASR even under strict image filtering.