Robustness of CAMO against reasoning-optimized LVLMs

Determine the robustness of the Cross-modal Adversarial Multimodal Obfuscation (CAMO) jailbreak attack when applied to large vision-language models explicitly optimized for complex reasoning, such as GPT-o1 and Gemini-2.5, to assess whether these models resist CAMO’s cross-modal obfuscation strategy.

Background

CAMO relies on multi-step cross-modal reasoning to reconstruct harmful instructions from benign-looking textual and visual clues. While it is effective on a range of current LVLMs, models engineered for advanced reasoning may implement internal verification or more stringent alignment mechanisms that could disrupt CAMO’s reconstruction pathway.

Establishing whether CAMO maintains high attack success against models like GPT-o1 and Gemini-2.5 is necessary to understand the limits of cross-modal obfuscation and to inform the design of future defenses.

References

First, although CAMO employs multi-step cross-modal reasoning to obfuscate harmful semantics, its robustness against models explicitly optimized for complex reasoning—such as GPT-o1 and Gemini-2.5—remains to be thoroughly evaluated.

— Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models (2506.16760 - Jiang et al., 20 Jun 2025) in Section: Limitation and Future Work