这篇论文发现，给越狱提示配张无关图片，能让ECSO防御的攻击成功率掉73个百分点。不是新防御，但交互很反直觉。
论文报告了一个反直觉现象：在编码越狱提示旁附加一张无关诱饵图像，能显著降低视觉语言模型的黑盒防御攻击成功率。实验覆盖五个前沿VLM、两种编码攻击和三种黑盒防御，其中ECSO防御在纯文本输入下ASR几乎不变，附加诱饵后最多下降73个百分点。空白画布和自然照片均能复现效果，表明起作用的是图像存在而非内容。但无条件附加诱饵会使良性拒绝率升至20%–79%，需配合轻量检测器使用。
Decoy Images Amplify Caption-Mediated Defenses Against Encoded Jailbreaks
We report a counter-intuitive interaction between image inputs and existing black-box defenses on Vision--Language Models (VLMs): pairing an encoded jailbreak prompt with an unrelated decoy image can sharply lower attack success rate (ASR). The operative change is in the defense pipeline, not in the image. Across five frontier VLMs, two encoded-attack families, and three black-box defenses, a caption-mediated defense (ECSO) that leaves ASR essentially unchanged on text-only encoded input drops it by up to $73$pp once a content-free decoy is attached; every non-saturated contrast is significant under exact McNemar tests. We advance two hypotheses for this pattern, supported by indirect evidence rather than pipeline introspection, since a black-box threat model precludes inspecting vendor internals: caption-mediated defenses branch on image presence, and intrinsic image-side safety engages on image-resident content. Three controls constrain the explanation. Blank-canvas and natural-photograph decoys reproduce the effect on every model, implicating image presence rather than content; the effect replicates on three open-weight VLMs served with no moderation layer, so it is not a vendor-filtering artifact; and a non-symbolic, meaning-based encoder reproduces it, so it is not specific to symbolic obfuscation. Attaching a decoy unconditionally is not deployable --- it raises benign refusal to $20$--$79\%$, an inflation of $+10$ to $+67$pp --- but gating attachment on a lightweight encoded-input detector returns benign refusal to the text baseline while preserving the safety gain wherever the detector fires, making detector recall the binding constraint. Under adaptive attacks that target the caption-mediated re-check, the effect degrades but holds. We frame this as an observation about pipeline interaction, not as a robust defense.