---
title: "ECHA — paper by Xu et al. (2026) — summary and ideas"
description: "The authors describe this gap as a misfit: the models implicitly reconstruct meaning, while their safety alignment covers only… 29 references."
authors: ["Chenxing Xu", "Junyong Jiang", "Zehu Zhang", "Lu Dong"]
year: 2026
venue: "Findings of the Association for Computational Linguistics: ACL 2026"
source: "https://aclanthology.org/2026.findings-acl.893/"
doi: "10.18653/v1/2026.findings-acl.893"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/xu-2026-echa-jailbreaking-lvlms-mismatch-between/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/xu-2026-echa-jailbreaking-lvlms-mismatch-between/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/31/) / ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment

# ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment

**Authors:** Chenxing Xu, Junyong Jiang, Zehu Zhang and Lu Dong · **Year:** 2026 · **Venue:** [Findings of the Association for Computational Linguistics: ACL 2026](https://md.research.elamur.ai/free/en/venues/findings/) ([Findings of the Association for Computational Linguistics 2026](https://md.research.elamur.ai/free/en/venues/findings/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.findings-acl.893/) · [PDF](https://aclanthology.org/2026.findings-acl.893.pdf) · [DOI 10.18653/v1/2026.findings-acl.893](https://doi.org/10.18653/v1/2026.findings-acl.893) · [OpenAlex](https://openalex.org/W7166814646)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
The paper examines a safety weakness in Large Vision-Language Models (LVLMs). The models can work out a harmful meaning from scattered, indirect visual hints, but their guardrails mostly react to explicit surface patterns such as forbidden keywords. The authors describe this gap as a misfit: the models implicitly reconstruct meaning, while their safety alignment covers only what is stated explicitly.

To test it, they build ECHA (Emoji Chain Hinting Attack), a black-box method that needs no optimization. It works in three steps:
- An auxiliary LLM replaces sensitive terms with related emoji sequences.
- Partially masked text hints are rendered into an image.
- A harmless-looking scenario prompt with in-context examples steers the model to decode the image.

The model then rebuilds the forbidden request internally, and the filters do not detect it.

Tested on Hades and SafeBench against seven proprietary and open-source LVLMs, ECHA beats prior baselines and succeeds on the first try in over 81% of cases. Hidden-state analysis supports the proposed mechanism. The work matters because it shows that defenses must monitor latent reasoning, not only the explicit input.

## Key points
- Victim models: GPT-4.1-Nano, GPT-4o-Mini, Gemini-2.5-Flash, Qwen2.5-VL, Qwen3-VL, InternVL-3.5 and LLaVA-NeXT. Benchmarks: Hades and SafeBench.
- Single-attempt Attack Success Rate (ASR) exceeds 81% across the tested models. Code is available at github.com/KerryZack/ECHA.
- In the ablations, removing the HTML-style format disguise lowers GPT-4.1-Nano's ASR from 93.2% to 80.2%. Removing the demonstrations or the scenario framing causes smaller drops.
- A 2D PCA of Qwen3-VL hidden states shows two stages:
  - In layers 1–11, ECHA inputs and explicit-text inputs form clearly separate clusters.
  - In layers 21–37, the clusters move closer together, which suggests the harmful meaning is reconstructed only in the deeper layers.
- The authors observe a "Capability-Vulnerability Misalignment": stronger reasoning models are more susceptible. Claude 4.5 Sonnet was not tested because of budget limits.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Southeast University](https://md.research.elamur.ai/free/en/universities/southeast-university-cn/) — University, Nanjing, China · 32 works · 453 citations

📚 Shelves (2): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works

🧭 Topics (1): [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Chenxing Xu, Junyong Jiang, Zehu Zhang and Lu Dong. 2026. ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{xu2026echa,
  title = {{ECHA: Jailbreaking LVLMs via the Mismatch between Implicit Semantic Reconstruction and Explicit Safety Alignment}},
  author = {Chenxing Xu, Junyong Jiang, Zehu Zhang and Lu Dong},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.893},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.893}
}
```

- [← previous Early Fusion with Contrastive Learning: A Lightweight Alternative for Multi-modal Classification](https://md.research.elamur.ai/free/en/papers/wernlein-2026-early-fusion-contrastive-learning-lightweight/)
- [next → Ecological Discourse Modeling in a Low-Resource Setting: A Longitudinal Vietnamese Climate Corpus with Comparative Topic Modeling](https://md.research.elamur.ai/free/en/papers/nguyen-2026-ecological-discourse-modeling-low-resource/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/31/)

## References

29 references, 16 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Shuai Bai, Yuxuan Cai, Ruizhe Chen, Keqin Chen, Xionghui Chen, Zesen Cheng, Lianghao Deng, Wei Ding, Chang Gao, Chunjiang Ge, Wenbin Ge, Zhifang Guo, Qidong Huang, Jie Huang, Fei Huang, Binyuan Hui, Shutong Jiang, Zhaohai Li, Mingsheng Li, and 45 others. 2025a. [Qwen3-vl technical report](https://md.research.elamur.ai/free/en/papers/bai-2025-qwen3-vl-technical-report/). Preprint, a…
2. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, Humen Zhong, Yuanzhi Zhu, Mingkun Yang, Zhaohai Li, Jianqiang Wan, Pengfei Wang, Wei Ding, Zheren Fu, Yiheng Xu, and 8 others. 2025b. [Qwen2.5-vl technical report](https://md.research.elamur.ai/free/en/papers/bai-2025-qwen2-5-vl-technical/). Preprint, arXiv:2502.1…
3. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, and 1 others. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+and+1+others%2E+2022%2E+Training+a+helpful+and+harmless+assistant+wi)
4. Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2024. Image hijacks: Adversarial images can control generative models at runtime. In International Conference on Machine Learning, pages 2443–2455. PMLR. [find](https://scholar.google.com/scholar?q=Luke+Bailey%2C+Euan+Ong%2C+Stuart+Russell%2C+and+Scott+Emmons%2E+2024%2E+Image+hijacks%3A+Adversarial+images+can+control+generative+models+at+runtime%2E+In+International+Conference+on+Machine+Learning%2C+pages+2443%E2%80%932)
5. Federico Bianchi, Mirac Suzgun, Giuseppe Attanasio, Paul Röttger, Dan Jurafsky, Tatsunori Hashimoto, and James Zou. 2023. [Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions](https://md.research.elamur.ai/free/en/papers/bianchi-2023-safety-tuned-llamas-lessons-improving/). arXiv preprint arXiv:2309.07875.
6. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2023. [Are aligned neural networks adversarially aligned?](https://md.research.elamur.ai/free/en/papers/carlini-2023-aligned-neural-networks-adversarially-aligned/) Advances in Neural Information Processing Systems, 36:61478–61500.
7. Renmiao Chen, Shiyao Cui, Xuancheng Huang, Chengwei Pan, Victor Shea-Jay Huang, QingLin Zhang, Xuan Ouyang, Zhexin Zhang, Hongning Wang, and Minlie Huang. 2025. Jps: Jailbreak multimodal large language models with collaborative visual perturbation and textual steering. In Proceedings of the 33rd ACM… [find](https://scholar.google.com/scholar?q=Renmiao+Chen%2C+Shiyao+Cui%2C+Xuancheng+Huang%2C+Chengwei+Pan%2C+Victor+Shea%2DJay+Huang%2C+QingLin+Zhang%2C+Xuan+Ouyang%2C+Zhexin+Zhang%2C+Hongning+Wang%2C+and+Minlie+Huang%2E+2025%2E+Jps%3A+Jailbreak+multimodal+large+languag)
8. Feng Li, Renrui Zhang, Hao Zhang, Yuanhan Zhang, Bo Li, Wei Li, Zejun Ma, and Chunyuan Li. 2024a. [Llava-next-interleave: Tackling multi-image, video, and 3d in large multimodal models](https://md.research.elamur.ai/free/en/papers/li-2024-llava-next-interleave-tackling-multi/). arXiv preprint arXiv:2407.07895.
9. Rochelle Choenni and Ekaterina Shutova. 2024. Self-alignment: Improving alignment of cultural values in llms via in-context learning. arXiv preprint arXiv:2408.16482. — [arXiv:2408.16482](https://arxiv.org/abs/2408.16482) [find](https://scholar.google.com/scholar?q=Rochelle+Choenni+and+Ekaterina+Shutova%2E+2024%2E+Self%2Dalignment%3A+Improving+alignment+of+cultural+values+in+llms+via+in%2Dcontext+learning%2E+arXiv+preprint+arXiv%3A2408%2E16482%2E+%E2%80%94+%5BarXiv%3A2408%2E16482%5D%28https%3A%2F%2Farxi)
10. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024b. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In European Conference on Computer Vision, pages 174–189. Springer. [find](https://scholar.google.com/scholar?q=Yifan+Li%2C+Hangyu+Guo%2C+Kun+Zhou%2C+Wayne+Xin+Zhao%2C+and+Ji%2DRong+Wen%2E+2024b%2E+Images+are+achilles%E2%80%99+heel+of+alignment%3A+Exploiting+visual+vulnerabilities+for+jailbreaking+multimodal+large+language+models%2E+In+)
11. Shiyao Cui, Xijia Feng, Yingkang Wang, Junxiao Yang, Zhexin Zhang, Biplab Sikdar, Hongning Wang, Han Qiu, and Minlie Huang. 2025. When smiley turns hostile: Interpreting how emojis trigger llms’ toxicity. arXiv preprint arXiv:2509.11141. — [arXiv:2509.11141](https://arxiv.org/abs/2509.11141) [find](https://scholar.google.com/scholar?q=Shiyao+Cui%2C+Xijia+Feng%2C+Yingkang+Wang%2C+Junxiao+Yang%2C+Zhexin+Zhang%2C+Biplab+Sikdar%2C+Hongning+Wang%2C+Han+Qiu%2C+and+Minlie+Huang%2E+2025%2E+When+smiley+turns+hostile%3A+Interpreting+how+emojis+trigger+llms%E2%80%99+toxic)
12. Google DeepMind. 2025. Gemini 3. [https://deepmind.google/technologies/gemini/](https://deepmind.google/technologies/gemini/). [↗](https://deepmind.google/technologies/gemini/)
13. Yue Deng, Wenxuan Zhang, Sinno Jialin Pan, and Lidong Bing. 2024. [Multilingual jailbreak challenges in large language models](https://md.research.elamur.ai/free/en/papers/deng-2023-multilingual-jailbreak-challenges-large-language/). In The Twelfth International Conference on Learning Representations.
14. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. [Figstep: Jailbreaking large vision-language models via typographic visual prompts](https://md.research.elamur.ai/free/en/papers/gong-2023-figstep-jailbreaking-large-vision-language/). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959.
15. He-Yan Huang, Yinghao Li, Huashan Sun, Yu Bai, and Yang Gao. 2024a. How far can in-context alignment go? exploring the state of in-context alignment. In Findings of the Association for Computational Linguistics: EMNLP 2024, pages 8623–8644. [find](https://scholar.google.com/scholar?q=He%2DYan+Huang%2C+Yinghao+Li%2C+Huashan+Sun%2C+Yu+Bai%2C+and+Yang+Gao%2E+2024a%2E+How+far+can+in%2Dcontext+alignment+go%3F+exploring+the+state+of+in%2Dcontext+alignment%2E+In+Findings+of+the+Association+for+Computational+L)
16. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Tekin, and Ling Liu. 2024b. Lisa: Lazy safety alignment for large language models against harmful fine-tuning attack. Advances in Neural Information Processing Systems, 37:104521–104555. [find](https://scholar.google.com/scholar?q=Tiansheng+Huang%2C+Sihao+Hu%2C+Fatih+Ilhan%2C+Selim+Tekin%2C+and+Ling+Liu%2E+2024b%2E+Lisa%3A+Lazy+safety+alignment+for+large+language+models+against+harmful+fine%2Dtuning+attack%2E+Advances+in+Neural+Information+Proce)
17. Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, and 1 others. 2024. [Gpt-4o system card](https://md.research.elamur.ai/free/en/papers/openai-2024-gpt-4o-system-card/). arXiv preprint arXiv:2410.21276.
18. Rafid Ishrak Jahan, Heng Fan, Haihua Chen, and Yunhe Feng. 2024. Unlocking cross-lingual sentiment analysis through emoji interpretation: a multimodal generative ai approach. arXiv preprint arXiv:2412.17255. — [arXiv:2412.17255](https://arxiv.org/abs/2412.17255) [find](https://scholar.google.com/scholar?q=Rafid+Ishrak+Jahan%2C+Heng+Fan%2C+Haihua+Chen%2C+and+Yunhe+Feng%2E+2024%2E+Unlocking+cross%2Dlingual+sentiment+analysis+through+emoji+interpretation%3A+a+multimodal+generative+ai+approach%2E+arXiv+preprint+arXiv%3A2412)
19. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. [Artprompt: Ascii art-based jailbreak attacks against aligned llms](https://md.research.elamur.ai/free/en/papers/jiang-2024-artprompt-ascii-art-based-jailbreak/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), page…
20. Jiayi Kuang, Yinghui Li, Chen Wang, Ying Shen, and Wenhao Jiang. 2024. Emoji2idiom: Benchmarking cryptic symbol understanding of multimodal large language models. [find](https://scholar.google.com/scholar?q=Jiayi+Kuang%2C+Yinghui+Li%2C+Chen+Wang%2C+Ying+Shen%2C+and+Wenhao+Jiang%2E+2024%2E+Emoji2idiom%3A+Benchmarking+cryptic+symbol+understanding+of+multimodal+large+language+models%2E)
21. Hao Liu, Carmelo Sferrazza, and Pieter Abbeel. 2024a. [Chain of hindsight aligns language models with feedback](https://md.research.elamur.ai/free/en/papers/liu-2023-chain-hindsight-aligns-language-models/). In The Twelfth International Conference on Learning Representations.
22. Xiaogeng Liu, Nan Xu, Muhao Chen, and Chaowei Xiao. 2024b. [AutoDAN: Generating stealthy jailbreak prompts on aligned large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-autodan-generating-stealthy-jailbreak-prompts/). In The Twelfth International Conference on Learning Representations.
23. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024c. [Mm-safetybench: A benchmark for safety evaluation of multimodal large language models](https://md.research.elamur.ai/free/en/papers/liu-2023-mm-safetybench-benchmark-safety-evaluation/). In European Conference on Computer Vision, pages 386–403. Springer.
24. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, and 1 others. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
25. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. [Visual adversarial examples jailbreak aligned large language models](https://md.research.elamur.ai/free/en/papers/qi-2023-visual-adversarial-examples-jailbreak-aligned/). In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536.
26. Weiyun Wang, Zhangwei Gao, Lixin Gu, Hengjun Pu, Long Cui, Xingguang Wei, Zhaoyang Liu, Linglin Jing, Shenglong Ye, Jie Shao, and 1 others. 2025. [Internvl3](https://md.research.elamur.ai/free/en/papers/wang-2025-internvl3-5-advancing-open/). 5: Advancing open-source multimodal models in versatility, reasoning, and efficiency. arXiv preprint arXiv:2508.18265.
27. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) Advances in Neural Information Processing Systems, 36:80079–80110.
28. Zhipeng Wei, Yuqi Liu, and N. Benjamin Erichson. 2025. Emoji attack: Enhancing jailbreak attacks against judge LLM detection. In Forty-second International Conference on Machine Learning. [find](https://scholar.google.com/scholar?q=Zhipeng+Wei%2C+Yuqi+Liu%2C+and+N%2E+Benjamin+Erichson%2E+2025%2E+Emoji+attack%3A+Enhancing+jailbreak+attacks+against+judge+LLM+detection%2E+In+Forty%2Dsecond+International+Conference+on+Machine+Learning%2E)
29. Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Kanghua Mo, and Changyu Dong. 2025. Distraction is all you need for multimodal large language model jailbreaking. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 9467–9476. [find](https://scholar.google.com/scholar?q=Zuopeng+Yang%2C+Jiluan+Fan%2C+Anli+Yan%2C+Erdun+Gao%2C+Xin+Lin%2C+Tao+Li%2C+Kanghua+Mo%2C+and+Changyu+Dong%2E+2025%2E+Distraction+is+all+you+need+for+multimodal+large+language+model+jailbreaking%2E+In+Proceedings+of+the+)

*Updated 2 November 2026*