When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models

Recent advances in large image editing models have shifted the paradigm from text-driven instructions to vision-prompt editing, where user intent is inferred directly from visual inputs such as marks, arrows, and visual–text prompts. While this paradigm greatly expands usability, it also introduces a critical and underexplored safety risk: the attack surface itself becomes visual. In this work, we propose Vision-Centric Jailbreak Attack (VJA), the first visual-to-visual jailbreak attack that conveys malicious instructions purely through visual inputs. To systematically study this emerging threat, we introduce IESBench, a safety-oriented benchmark for image editing models. Extensive experiments on IESBench demonstrate that VJA effectively compromises state-of-the-art commercial models, achieving attack success rates of up to 80.9% on Nano Banana Pro and 70.1% on GPT-Image-1.5. To mitigate this vulnerability, we propose a training-free defense based on introspective multimodal reasoning, which substantially improves the safety of poorly aligned models to a level comparable with commercial systems, without auxiliary guard models and with negligible computational overhead. Our findings expose new vulnerabilities, provide both a benchmark and practical defense to advance safe and trustworthy modern image editing systems.

Modern image editing systems can now understand user intent not only from text, but also from visual cues such as arrows, marks, and highlighted regions. This new interaction paradigm improves usability, but also introduces a new security risk: malicious instructions can be hidden directly inside images. In this work, we propose Vision-Centric Jailbreak Attack (VJA), the first attack that jailbreaks image editing models using visual prompts alone. To systematically study this problem, we build IESBench, a benchmark covering diverse harmful editing scenarios and risk categories. Our experiments show that even advanced commercial systems remain highly vulnerable to these attacks. We further introduce a simple training-free defense that activates the model’s internal safety reasoning through multimodal introspection, significantly reducing harmful editing behavior with minimal computational overhead. Overall, our work highlights the need for safety mechanisms that go beyond text and explicitly account for visual instructions in future image editing systems.