MSIA: Adaptive Medical Multimodal Multi-turn Semantic Jailbreak

摘要

Medical multimodal large language models are increasingly deployed in high-stakes clinical settings, yet current safety evaluations largely overlook a critical failure mode: covert semantic drift that accumulates across clinically plausible multi-turn interactions. Such drift can lead models to gradually exaggerate or conceal critical medical findings without triggering explicit safety mechanisms. We propose MSIA (Medical Semantic Infiltration Attack), a framework for modeling and inducing multi-turn medical semantic jailbreaks in clinical dialogues. MSIA enables the controlled optimization of cumulative semantic drift under stealth constraints through adaptive strategy selection and closed-loop reward feedback grounded in medical evidence. Experiments on chest X-ray–based multimodal medical dialogues show that MSIA consistently outperforms existing jailbreak methods across GPT-4o, Claude, and Gemini, achieving an average attack success rate of 76.67%. These results expose substantial and previously underestimated vulnerabilities of medical LLMs in realistic multi-turn clinical interactions. Code is available here: https://github.com/HeYamo/MSIA.