Writing study: When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models

ICML overviewCorpus atlasBy contribution typeVisual galleryRules & templateWriting patternsPaper studies

← ICML 2026 oral writing corpus

Jiacheng Hou, Yining Sun, Ruochong Jin, Haochen Han, Fangming Liu, Wai Kin Victor Chan, Alex Jinpeng Wang · Official ICML 2026 oral record

Observed writing choices, not acceptance rules. This study examines the inspected manuscript version. It does not establish why the paper was accepted or that its presentation choices should be copied unchanged.

Figure, table and section ledger

Editorial contribution type: Datasets, benchmarks & measurement (primary).

Layout extraction, not a required paper template. Counts are distinct caption labels; a multi-panel figure counts once. Section spans are estimated from heading positions, including floats and whitespace. Method and limitations.

Canonical PDF

27 physical pages

Before references / appendix

≈ 8.31 page-equivalents

Main figures / tables

7 / 3

Attached appendix figures / tables

12 / 5

Attached appendix span

≈ 15.91 page-equivalents

Before references / appendix: ≈ 30.78%References / intervening material: ≈ 10.3%Attached appendix: ≈ 58.93%Estimated layout envelopes, not text/artwork area. Unresolved appendix boundaries remain within the undivided post-body material.

Source-bound correction: Join wrapped printed heading text using adjacent source lines; original heading start coordinates are unchanged.

Section-by-section lengths and source pages

The title/abstract/front matter precede the first numbered heading. A span ends at the next detected top-level heading, not at the last sentence; end-page whitespace is included. References and statements are listed separately. These are not measurements of text-only or artwork area.

Top-level heading	Starts on PDF page	Estimated span	Share of entire PDF
1. Introduction	1	≈ 1.32 pp.	4.89%
2. VJA: Jailbreak Attack in Vision	3	≈ 1.12 pp.	4.15%
3. IESBench: Benchmarking the Safety of Large Image Editing Models	4	≈ 1.65 pp.	6.11%
4. Experiments	5	≈ 2.5 pp.	9.26%
5. Related Work	8	≈ 0.49 pp.	1.81%
6. Conclusion and Limitations	8	≈ 0.23 pp.	0.85%
Impact Statement	9	≈ 0.11 pp.	0.41%
Acknowledgment	9	≈ 0.08 pp.	0.3%
References	9	≈ 2.78 pp.	10.3%
Appendix	12	≈ 6.35 pp.	23.52%
A. Additional Results	18	≈ 4.25 pp.	15.74%
B. More Details about IESBench	22	≈ 3.84 pp.	14.22%
C. Experimental Setup	26	≈ 1.47 pp.	5.44%

All detected figure and table locations

Main text

• Figure 1 · p. 1
• Figure 2 · p. 2
• Figure 3 · p. 3
• Figure 4 · p. 4
• Table 1 · p. 5
• Figure 5 · p. 6
• Figure 6 · p. 7
• Table 2 · p. 7
• Figure 7 · p. 8
• Table 3 · p. 8

Attached appendix

• Table 4 · p. 13
• Figure 8 · p. 14
• Figure 9 · p. 15
• Figure 10 · p. 16
• Figure 11 · p. 17
• Figure 12 · p. 17
• Figure 13 · p. 18
• Figure 14 · p. 19
• Figure 15 · p. 19
• Figure 16 · p. 20
• Figure 17 · p. 20
• Table 5 · p. 21
• Figure 18 · p. 21
• Table 6 · p. 22
• Table 7 · p. 22
• Figure 19 · p. 24
• Table 8 · p. 27

Argument and organization

1. 1 Introduction; 2 Vision-Centric Attack

   Connects a new input interface to its safety threat and a proposed defense.

2. 3 IESBench; 4 Experiments

   Defines data construction and distinct safety/editing metrics before comparisons and judge analysis.

3. 5 Related Work; 6 Conclusion and Limitations

   Places the interface in context and identifies visual-understanding failures that constrain attack efficacy.

Problem, claim and contribution

The threat is framed around a change in interaction modality, with image input and image output distinguished from earlier multimodal text-generation settings.

Abstract, p.1; Section 2, p.3 · Main paper

Argument and section order

Benchmark construction and scoring have their own sections rather than appearing only as experimental setup.

Section 3, pp.4-5 · Main paper

Figures, captions and visual explanation

The defense diagram marks cache reuse and a stop decision; the main table separately groups deployment types and four metrics, with caption-defined risk colors.

Figure 3, p.3; Table 1, p.5 · Main paper

Tables, comparisons and evidence

Safeguard bypass, valid editing and severe harmful output are different measurements; the text explains that a returned but invalid edit can count as attack success.

Section 3.2, p.5; Appendix B.5 and C.1, p.26 · Main paper

Appendix and reproducibility

Runtime overhead, human-judge agreement and transfer are documented separately, allowing the negligible-overhead and judge-quality claims to be inspected independently.

Appendices A.4-A.6, pp.21-22 · Main paper

Clarity and writing conventions

The conclusion acknowledges that weak visual understanding can reduce attack effectiveness, but some prose/table details need consistency checks, including the abstract versus Table 1 GPT Image score.

Abstract, p.1; Table 1, p.5; Conclusion, pp.8-9 · Main paper

What to reuse—and what not to infer

Transferable lesson: Define the measurement chain from accepted request to valid output to harmful output, then audit every headline against the corresponding table.

Boundary: ASR here is not a rate of valid harmful images; model/version and judge choices matter, and the paper contains numerical/prose inconsistencies that should not be copied.

Apply this lesson using the argument and evidence worksheet.

Inspection record and sources

Checked

2026-10-07

Reading status

Writing-focused manuscript scan + selected visuals inspected

Main text

Writing-oriented scan of the main argument through physical p.9, with focused physical-page text inspection on 1, 3, 4, 5, 7, 8, 9. Framing, section progression, mechanism/proof explanation, displays, comparison conditions and conclusions were inspected. This is not exhaustive technical reading, proof verification or reproduction.

Appendix / supplement

Appendix organization and main-text pointers were checked; focused text inspection of physical pages 14, 21, 22, 26. Remaining appendix proofs and details were not exhaustively read. No separately linked supplement inspected.

Visually inspected PDF pages

3, 5

This is a writing-focused scan of the manuscript and the stated supplementary scope: framing, organization, visual explanation, evidence presentation and wording. It is not a line-by-line proof audit, reproduction of results or exhaustive scientific review.

• Published proceedings PDF, PMLR volume 306, retrieved 2026-10-07 · 27 pages