Multimodal Jailbreak Attacks

Follow this topic Ask about this topic

The field studies how harmful requests can evade safeguards when models interpret text together with images, audio, video, or tool outputs. Attack methods include adversarial prompt optimization, distributing instructions across multiple inputs, using visual or video context, and adapting attacks through black-box feedback. Researchers evaluate these attacks with safety benchmarks and controlled tests, while exploring defenses such as input filtering, structured safety reasoning, and risk-aware routing. A central challenge is that vulnerabilities vary across models, languages, modalities, and inference pipelines, making broad evaluation difficult while defenses must preserve useful responses.

Latest papers

28 papers3 papers in the last four weeks, down 25% on the four weeks before. 0.0% of all new papers.

Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks
Oct 4, 2026Boyuan Chen, Yehia Dawoud, Hailemariam Mersha +4Multimodal Jailbreak Attacks VLM Robustness
eBRAIN Lab, Division of Engineering, New York University Abu Dhabi, UAE · Tandon School of Engineering, New York University, NY, USA
SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs
Sep 30, 2026Wenyu Chen, Li Wang, Chuanchao Zang +5VLM Robustness Jailbreak Attacks
Shandong University
UnifiedAttack: Evaluating the Safety of Large Multimodal Models in Synergistic Harmful Image-Text Generation
Sep 29, 2026Bingjun Luo, Jialin Guo, Tony Wang +1Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models
Tsinghua University · Harbin Engineering University
TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attacks
Sep 25, 2026Tianmeng Fang, Jiancheng Wang, Chen Wang +4Jailbreak Attacks Multimodal Jailbreak Attacks
School of Computing and Information Systems, Master of IT in Business (MITB), Singapore Management University, Singapore 178903, Singapore · School of Computer Science and Technology, Anhui University, Hefei 230601, China · Department of Electrical and Computer Engineering, University of Miami, Coral Gables, FL 33146, United States +3
Understanding In-Context Multimodal Jailbreaks via Posterior Reweighting
Sep 8, 2026Xu Zhang, Dev Mistry, Xiang Xu +1Multimodal Jailbreak Attacks Adversarial Robustness of Language Models
The Price of Consistency: Exploiting Visual Anchors for Multimodal Jailbreaking in Video Generation
Sep 7, 2026Peng Li, Qianqian Xu, Yangbangyan Jiang +2Image-to-Video Generation Multimodal Jailbreak Attacks
School of Computer Science and Technology, University of Chinese Academy of Sciences, Beijing, China · State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences, Beijing, China · School of Artificial Intelligence and Robotics, Hunan University, Changsha, China +1
Jailbreaking Text-to-Image Models Through Cracks: Navigating Heterogeneous Safety Filters via Multi-Agent Debate
Sep 1, 2026Kaiyan Wen, Shijie Zhang, Lu Yu +1Adversarial Attacks on VLMs Multi-Agent Debate
College of Computer Science and Technology, National University of Defense Technology, Changsha 410073, China · Shenzhen MSU-BIT University, Shenzhen, China · City University of Hong Kong, Hong Kong, China
Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
Aug 27, 2026Benlei Cui, Shen Pang, Yuke Wang +7VLM Robustness Adversarial Attacks on VLMs
1Yuvion Team, Alibaba Group · Laboratory for Statistical Monitoring and Intelligent Governance of Common Prosperity, School of Statistics and Data Science, Zhejiang Gongshang University
MMJailBench: A Factorized Benchmark for Disentangling Multimodal Jailbreak Vulnerabilities
Aug 26, 2026Tianshi Wang, Jingsong Wang, Yafei Huang +3Multimodal Jailbreak Attacks Multimodal Model Evaluation
Tongji University · Mohamed bin Zayed University of Artificial Intelligence · Shanghai Artificial Intelligence Laboratory
Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Models
Aug 23, 2026Wenyun Li, Guiping Cao, Xiangyuan Lan +1Adversarial Attacks on Unified Multimodal Models Multimodal Jailbreak Attacks
Harbin Institute of Technology, Shenzhen, China · Pengcheng Laboratory, Shenzhen, China · Pazhou Laboratory (Huangpu), Guangzhou, China
COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models
Aug 18, 2026Md Abdullahil Oaphy, Anhao Xiang, Zongxing Xie +3MLLM Safety LLM Safety
Kennesaw State University, Kennesaw, GA, USA
Mind the Gap: Zero-Query Jailbreaks via Filter-Generator Discrepancy in Text-to-Image Systems
Aug 2, 2026Wanguang Li, Zhaoxin Wang, Handing WangAdversarial Prompt Generation T2I Generation
School of Artificial Intelligence, Xidian University, Shaanxi, China
PixJail: Self-Evolving Paper-to-Pipeline Reproduction for Text-to-Image Jailbreak Evaluation
Jun 23, 2026Leyi Sheng, Han Sun, Zhen Sun +4AI Safety Evaluation Multimodal Jailbreak Attacks
1The Hong Kong University of Technology and Science (Guangzhou) · 2East China Normal University · 3Shanghai Qi Zhi Institute +4
Jailbreaking Multimodal Large Language Models using Multi-Clip Video
Jun 1, 2026Choongwon Kang, Seungjong Sun, Hyunmin Jun +1Multimodal Robustness Video-Language Models
Department of Applied Artificial Intelligence, Sungkyunkwan University · Department of Human-Artificial Intelligence Interaction, Sungkyunkwan University
When Think-with-Image Meets Safety: What Determines Multimodal Jailbreak Robustness?
May 27, 2026Yuan Tian, Bing Hu, Fang Wu +3VLM Robustness Tool Use in VLMs
Independent Researcher · Stanford University · Harvard University +2
PAST2HARM: A Simple Adaptive Past Tense Attack for Jailbreaking Multimodal AI
May 26, 2026Snehasis MukhopadhyayAdversarial Prompt Generation Multimodal Jailbreak Attacks
Indian Institute of Information Technology, Kalyani
Same Model, Different Weakness: How Language and Modality Reshape the Jailbreak Attack Surface in Frontier MLLMs
May 22, 2026Casey Ford, Madison Van Doren, Sicheng Jin +1Multilingual Language Model Evaluation Adversarial Attacks on VLMs
Appen
DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
May 18, 2026Wenzhuo Xu, Zhipeng Wei, Zonghao Ying +4Multimodal Large Language Models LLM Safety
AI Security Lab, Beijing, China · International Computer Science Institute, CA, USA · UC Berkeley, CA, USA +1
Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximization
May 11, 2026Mengqi He, Xinyu Tian, Xin Shen +6Adversarial Attacks on VLMs Adversarial Attacks
Australian National University, ACT, Australia · The University Of Queensland, Brisbane, Queensland, Australia · GE research, Niskayuna, New York, USA +2
OrchJail: Jailbreaking Tool-Calling Text-to-Image Agents by Orchestration-Guided Fuzzing
May 8, 2026Jianming Chen, Yawen Wang, Junjie Wang +3Adversarial Prompt Generation T2I Generation
Institute of Software, Chinese Academy of Sciences, Beijing, China · Science & Technology on Integrated Information System Laboratory, Beijing, China · State Key Laboratory of Complex System Modeling and Simulation Technology, Beijing, China +1
Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMs
May 7, 2026Md Farhamdur Reza, Richeng Jin, Tianfu Wu +1Multimodal Large Language Models Jailbreak Attacks
1NC State University · 2Zhejiang University
On Optimizing Multimodal Jailbreaks for Spoken Language Models
Mar 19, 2026Aravind Krishnan, Karolina Stańczak, Dietrich KlakowAdversarial Attacks LLM Jailbreak Attacks
Saarland University, Germany · DFKI GmbH, Saarbrücken, Germany · ETH AI Center, Switzerland
SaFeR-ToolKit: Structured Reasoning via Virtual Tool Calling for Multimodal Safety
Mar 3, 2026Zixuan Xu, Tiancheng He, Huahui Yi +7Cultural Safety Evaluation of VLMs VLM Safety
Huazhong University of Science and Technology · Beijing University of Posts and Telecommunications · West China Hospital, Sichuan University +1
MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs
Feb 28, 2026Yilian Liu, Xiaojun Jia, Guoshun Nan +6Multimodal Jailbreak Attacks Adversarial Attacks on Unified Multimodal Models
Beijing University of Posts and Telecommunications, China · Nanyang Technological University, Singapore · Guilin University of Electronic Technology, China
FENCE: A Financial and Multimodal Jailbreak Detection Dataset
Feb 20, 2026Mirae Kim, Seonghun Jeong, Youngjun KwakJailbreak Detection Multimodal Jailbreak Attacks
Kakaobank, South Korea
When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models
Feb 10, 2026Jiacheng Hou, Yining Sun, Ruochong Jin +4Jailbreak Attacks Multimodal Jailbreak Attacks
Tsinghua University, China · Pengcheng Laboratory, Shenzhen, China · Central South University, Changsha, China.
Robustness of Vision Language Models Against Split-Image Harmful Input Attacks
Feb 8, 2026Md Rafi Ur Rashid, MD Sadik Hossain Shanto, Vishnu Asutosh Dasu +1VLM Robustness Adversarial Attacks on VLMs
Pennsylvania State University · Bangladesh University of Engineering and Technology
Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models
Dec 21, 2024Yanxu Mao, Peipei Liu, Tiehan Cui +3Adversarial Attacks on LLMs Multimodal Large Language Models
School of Computer Science and Technology, Shanghai Jiao Tong University, Shanghai, China · Zhongguancun Laboratory, Beijing, China · School of Software, Henan University, Kaifeng, China +1

Oct 4, 2026J/K move · Enter open · S save

Which Image Property Carries the Jailbreak? A Controlled Dissection of Image-to-Text Jailbreaks

Boyuan Chen, Yehia Dawoud, Hailemariam Mersha, Minghao Shao+3

eBRAIN Lab, Division of Engineering, New York University Abu Dhabi, UAE · Tandon School of Engineering, New York University, NY, USA

Multimodal Jailbreak Attacks VLM Robustness

Open paper AskPDF arXiv

Image-to-text jailbreaks place harmful intent in text, image content, or the relationship between them. We examine image-side factors across four published attack families on a 313-prompt StrongREJECT slice, using five multimodal models and an additional appendix evaluation of InternVL3.5-8B. The harmful instruction is held constant across conditions; the baseline matrix uses one draw per prompt, and paired ablations use three draws with an automated rubric judge. A bare harmful query, with or without a benign unrelated image, produces little attack success on most victims, while attack images substantially increase it. First, per-tile entropy and JPEG size do not reliably distinguish attack tiles from size-matched benign distractors, limiting density-only screening. Second, earlier tile-count ladders were confounded by payload visibility. A corrected region-count test found no detectable effect, so the role of tile-count structure remains unresolved. Third, on Qwen3-VL-8B, the E4 manipulation that removes query-specific relatedness lowers ASR by about 0.12. This supports a bounded attribution to the relatedness manipulation, although image-text congruence remains unmeasured. A within-category control reproduces the direction on overlapping stimuli. Five tests survive the global statistical correction, but only E4 supports attribution to one measured descriptor; the within-category result is a robustness check, not a separate attribution. These conclusions remain conditional on the rubric judge.