Hard to Read Is Not Hard to Audit: Why Degrading a Text Image Raises Jailbreak Success in One 2026 Study and Lowers It in Another, Four Accounts That Fit the Same Curve, and the Ablations That Would Separate Them

@misc{mahendrakar2026hard,
  author       = {Mahendrakar, Pranay},
  title        = {{Hard to Read Is Not Hard to Audit: Why Degrading a Text Image Raises Jailbreak Success in One 2026 Study and Lowers It in Another, Four Accounts That Fit the Same Curve, and the Ablations That Would Separate Them}},
  year         = {2026},
  month        = oct,
  date         = {2026-10-17},
  publisher    = {Life of Research},
  doi          = {10.5281/zenodo.23427759},
  url          = {https://lifeofresearch.com/articles/112},
  abstract     = {(c) 2026 Pranay Mahendrakar. Licensed under CC BY 4.0. Rendering text as an image is now proposed as a way to compress long contexts for multimodal language models, and a 2026 study reports that the same move opens a safety hole: when a harmful request is rendered at a resolution low enough to be hard but not impossible to read, attack success rises sharply and then falls again as the image sharpens. Its authors explain this as cognitive overload - the effort of reading diverts the model from checking - and propose a prompt that makes the model transcribe first and audit second. A second 2026 study, which tested one of the same models, finds the opposite sign: smaller fonts and heavier blur lower attack success, and for two frontier models clean renders are less dangerous than plain text. In this analysis the author reviews and synthesises published results to show that the two studies are not in contradiction once the prompt framing, the dose of degradation and the scoring rule are held apart, and that the inverted-U curve the first study reports is consistent with at least four accounts: resource contention, delayed emergence of harmful features in depth, and a gap in what safety training covered each produce it, and the way success is scored changes its height. Re-reading the first study's own per-model sweeps, the author shows that seven of its ten models show the inverted U, one rises without returning, two are flat, and three of them refuse clean renders more often than plain text. None of the study's ablations, including its defence, discriminates among the four accounts. The paper states the predictions on which the accounts differ, gives a decision procedure for what a degradation result licenses, and specifies five measurements that would settle which account holds.},
  keywords     = {multimodal large language models, jailbreak, typographic attacks, visual degradation, safety alignment, mismatched generalization, visual-text compression, attack success rate},
  language     = {en},
  copyright    = {Creative Commons Attribution 4.0}
}