MML

Multi-Modal Linkage attack encoding harmful prompts into images for VLMs.

Static. Builds its prompts up front and sends them. It drives no model of its own, so it is cheap and repeatable.

One multimodal request with the encoded goal as an image.

Helper models

None. This attack drives no model of its own, so roles can be left out.

Settings for the algorithm itself, written under the attack's parameters. Anything left out keeps its default.

Field	Type	Default	Description
`encoding_mode`	one of `word_replacement`, `mirror`, `rotate`, `base64`, `mixed`	`word_replacement`	How the goal is hidden in the image: word_replacement swaps key words for placeholders shown in the image, mirror and rotate distort the text, base64 encodes it, mixed combines them.
`image_width`	integer (>= 100)	`800`	Width of the generated image, in pixels.
`image_height`	integer (>= 100)	`400`	Height of the generated image, in pixels.
`font_size`	integer (>= 8)	`24`	Font size of the text drawn in the image.
`background_color`	string	`white`	Background color of the image.
`text_color`	string	`black`	Color of the text drawn in the image.
`num_replacements`	integer (>= 1)	`3`	For word_replacement: how many words of the goal are moved into the image.
`prompt_style`	one of `game`, `control`	`game`	How the target is asked to decode the image: game frames it as a puzzle, control asks plainly.

attacks:
- name: mml