ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment
Year: 2026
Type: conference-paper
Abstract: Large Visual Language Models (LVLMs) achieve superior multimodal reasoning but inevitably expand the safety attack surface.While recent studies have explored emoji-based vulnerabilities, they predominantly focus on textual tokenization artifacts and neglect the model's intrinsic capability to interpret visual semantics.In this paper, we reveal a critical systemic vulnerability termed the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment.We observe that LVLMs can implicitly synthesize holistic malicious semantics from fragmented visual cues, whereas existing guardrails fail to intercept such latent intent.To exploit this, we propose the Emoji Chain Hinting Attack (ECHA), a visual typography framework that decouples sensitive concepts into semantically related emoji chains and structural text masks.By utilizing benign scenario-based prompts to guide the decoding process, ECHA induces the model to internally reconstruct prohibited intent from abstract visual symbols, effectively bypassing surface-level safety detection.We conduct extensive red-teaming evaluations on seven stateof-the-art (SOTA) LVLMs, comprising proprietary systems such as GPT-4.1-Nano,GPT-4o-Mini, and Gemini-2.5-Flash,alongside opensource models including Qwen2.5-VL,Qwen3-VL, InternVL-3.5, and LLaVA-NeXT.Experimental results demonstrate that ECHA significantly outperforms existing baselines, successfully bypassing safety guardrails in over 81% of instances with a single attempt.Our
Authors: Chenxing Xu, Junyong Jiang, Zehu Zhang, Lu Dong
Institution: Southeast University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: hybrid
Award: G8926559104
OpenAlex ID: W7166814646