DAM: Dual-DPO Adversarial Multimodal Jailbreak Attacks on MLLMs via Contextual Camouflage
Abstract
DAM: Dual-DPO Adversarial Multimodal Jailbreak Attacks on MLLMs via Contextual Camouflage This artifact accompanies the ACSAC 2026 submission "DAM: Dual-DPO Adversarial Multimodal Jailbreak Attacks on MLLMs via Contextual Camouflage." It contains the research code, benchmark inputs, locked Python environment, model-specific configuration files, and documentation required to train DAM and evaluate the resulting models. The artifact supports the paper targets LLaVA 1.5 7B, Gemma 3 12B, Qwen3-VL 8B, Gemini 2.5 Flash, and Grok 4.1 Fast. It provides the complete workflow for adversarial candidate generation, target-model response collection, preference selection, diffusion and language-model training, end-to-end evaluation, StrongREJECT scoring, HarmBench evaluation, and CLIP measurement. Paper-scale Table 1 configurations and Table 2 ablation configurations are included. Dependencies are managed exclusively with uv using the included pyproject.toml and uv.lock files. The reference environment uses Linux, Python 3.11, CUDA 12.8, and an NVIDIA H100 80GB GPU. The implementation was also tested on an NVIDIA RTX PRO 6000 Blackwell system. At least 300 GB of free storage is recommended for model caches, training outputs, and temporary files. Local target-model experiments require access to the relevant upstream Hugging Face models. Gemini and Grok experiments use Vertex AI and require the evaluator's own Google Cloud project, Application Default Credentials, model access, quota, and billing. StrongREJECT API scoring requires the evaluator's own OpenAI API key and may incur charges. No credentials or API credits are included. The top-level README and artifact/README.md provide installation, training, evaluation, Vertex AI, metric, and verification instructions. SHA256SUMS records the integrity hashes of the distributed files. Original DAM source code and documentation are licensed under Apache-2.0; third-party models, benchmark inputs, prompts, services, and dependencies remain subject to their respective upstream terms.