Paper on VLM jailbreaks finds encoded prompts exploit a decode gap, then adds recover/decode and reguard to tame the guards.