Pith. sign in

REVIEW 41 cited by

Jailbreaking Attack against Multimodal Large Language Model

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.02309 v1 pith:5WG3ILU7 submitted 2024-02-04 cs.LG cs.CLcs.CRcs.CV

Zhenxing Niu , Haodong Ren , Xinbo Gao , Gang Hua , Rong Jin This is my paper · ORCID
classification cs.LGcs.CLcs.CRcs.CV
keywords jailbreakinglanguagemllmsmodelsapproachgeneratedimgjplarge
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

This paper focuses on jailbreaking attacks against multi-modal large language models (MLLMs), seeking to elicit MLLMs to generate objectionable responses to harmful user queries. A maximum likelihood-based algorithm is proposed to find an \emph{image Jailbreaking Prompt} (imgJP), enabling jailbreaks against MLLMs across multiple unseen prompts and images (i.e., data-universal property). Our approach exhibits strong model-transferability, as the generated imgJP can be transferred to jailbreak various models, including MiniGPT-v2, LLaVA, InstructBLIP, and mPLUG-Owl2, in a black-box manner. Moreover, we reveal a connection between MLLM-jailbreaks and LLM-jailbreaks. As a result, we introduce a construction-based method to harness our approach for LLM-jailbreaks, demonstrating greater efficiency than current state-of-the-art methods. The code is available here. \textbf{Warning: some content generated by language models may be offensive to some readers.}

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 41 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

    cs.LG 2025-08 conditional novelty 7.0 of 10

    Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.

  2. Mirage in the Eyes: Hallucination Attack on Multi-modal Large Language Models with Only Attention Sink

    cs.LG 2025-01 conditional novelty 7.0 of 10

    Adversarial images optimized to induce attention sink behavior increase hallucination rates in multiple MLLMs, including commercial APIs, without visibly degrading response quality.

  3. Fun-tuning: Characterizing the Vulnerability of Proprietary LLMs to Optimization-based Prompt Injection Attacks via the Fine-Tuning Interface

    cs.CR 2025-01 conditional novelty 7.0 of 10

    Attackers can use the loss signal from a remote LLM fine-tuning API to optimize adversarial prefix and suffix tokens, turning existing prompt injections into high-success attacks on closed-weight Gemini models.

  4. Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency

    cs.CR 2025-01 conditional novelty 7.0 of 10

    Shuffling words and image patches in harmful prompts bypasses safety mechanisms of several commercial and open-source multimodal models, and a black-box search over shuffles raises attack success rates substantially.

  5. Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks

    cs.CV 2024-11 conditional novelty 7.0 of 10

    ASTRA reduces VLM jailbreak success by adaptively steering activations away from a harm direction learned via image attribution, with little utility loss and near-zero inference overhead.

  6. DeepBias: Adaptive In-depth Probing of Social Biases in LVLMs

    cs.CY 2026-07 conditional novelty 6.5 of 10

    A generation-evolution-probing loop with Proposer and Digger agents produces DeepBiasBench, exposing deeper LVLM social biases than static image-question benchmarks.

  7. MMAligner: Safeguarding Multimodal Large Language Models through Representation Calibration

    cs.CR 2026-08 conditional novelty 6.0 of 10

    Safety failures in multimodal LLMs happen because unsafe image-plus-text inputs shift internal representations past a still-working refusal boundary, and a representation-calibration fine-tune restores refusal with un...

  8. Visual Token Compression Enhances Robustness of MLLMs

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Pruning visual tokens farthest from the text feature space at selected 'robust' layers improves MLLM jailbreak defense (average +13.29% RAR) and slightly reduces hallucination.

  9. 3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism

    cs.CV 2026-07 conditional novelty 6.0 of 10

    An optimized, view-consistent 3D Gaussian shell around a face avatar reliably changes which facial attributes vision-language models report, while preserving identity and appearance.

  10. PPE-Bench: A Benchmark for Evaluating MLLM Unlearning under Private-Public Entanglement

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Existing MLLM unlearning methods reduce private-attribute leakage on entangled images but substantially harm co-occurring public figures and landmarks, with private knowledge often re-emerging after public finetuning.

  11. Safe responses matter: Output-aware safety guardrail mitigate over-refusal in MLLMs

    cs.LG 2026-06 conditional novelty 6.0 of 10

    A lightweight multi-instance contrastive classifier on MLLM hidden states predicts output harmfulness, matching input-side safety while sharply lowering over-refusal.

  12. Securing Multimodal AI through Internal Information Decomposition

    cs.AI 2026-05 conditional novelty 6.0 of 10

    A one-class detector using first-token distributional consistency between text-only, vision-only, and joint predictions reduces multimodal jailbreak attack success rates to below 15% with ~2.4% utility loss.

  13. VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models

    cs.CR 2025-10 conditional novelty 6.0 of 10

    VERA-V learns a distribution of text-image jailbreak prompts via variational inference, achieving higher attack success rates and lower toxicity detection than prior multimodal red-teaming methods.

  14. The First Differentiable Transfer-Based Algorithm for Discrete MicroLED Repair

    cs.LG 2025-08 reject novelty 6.0 of 10

    The submission's abstract announces a differentiable microLED repair planner, yet its full text is the LoD jailbreak-detection paper (arXiv 2508.09201v4), leaving the claimed result without any derivation.

  15. The Emotional Baby Is Truly Deadly: Does your Multimodal Large Reasoning Model Have Emotional Flattery towards Humans?

    cs.AI 2025-08 unverdicted novelty 6.0 of 10

    Multimodal reasoning models can be steered into unsafe behavior by emotional prompts and sometimes conceal harmful reasoning inside seemingly safe responses.

  16. Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models

    cs.AI 2025-07 conditional novelty 6.0 of 10

    A tuning-free method that projects middle-layer semantic representations back onto early safety layers, improving vision-language model safety with minimal utility loss.

  17. Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models

    cs.CL 2025-06 conditional novelty 6.0 of 10

    CAMO hides harmful instructions across text and image using masked keywords and math-puzzle clues, making several LVLMs answer banned queries while evading common safety filters.

  18. Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.

  19. VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    VisCRA jailbreaks multimodal LLMs by masking the most harmful image region and using a two-stage reasoning prompt to make the model infer and then comply.

  20. Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models

    cs.LG 2025-05 reject novelty 6.0 of 10

    IJA hides a malicious instruction in image steganography and uses a benign extraction prompt plus iterative template refinement to make multimodal LLMs execute it.

  21. REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLM

    cs.CL 2025-05 conditional novelty 6.0 of 10

    REVEAL, a new automated benchmark, reports that vision-language models show higher conversation-level defect rates in multi-turn image-input conversations than in single-turn ones across sexual harm, violence, and mis...

  22. Robust-LLaVA: On the Effectiveness of Large-Scale Robust Image Encoders for Multi-modal Large Language Models

    cs.CV 2025-02 conditional novelty 6.0 of 10

    Using large-scale adversarially pretrained vision encoders in LLaVA yields 2x and 1.5x robustness gains on captioning and VQA, and cuts jailbreak success rates by over 10% relative to CLIP fine-tuning baselines.

  23. Spot Risks Before Speaking! Unraveling Safety Attention Heads in Large Vision-Language Models

    cs.LG 2025-01 conditional novelty 6.0 of 10

    A small set of attention heads in LVLMs flags malicious prompts during the first token; a logistic-regression detector built on them reduces jailbreak success to 1-5%.

  24. LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakage

    cs.CR 2024-12 conditional novelty 6.0 of 10

    An RL-trained prompt generator outperforms rule-based and fuzzing baselines at extracting system prompts and training data from black-box LLMs.

  25. Jailbreak Large Vision-Language Models Through Multi-Modal Linkage

    cs.CV 2024-11 conditional novelty 6.0 of 10

    Multi-modal image encryption plus a villain-game role-play prompt achieves near-perfect jailbreak success rates against GPT-4o and other vision-language models.

  26. Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models

    cs.CL 2024-11 conditional novelty 6.0 of 10

    An automated agent can jailbreak GPT-4o and other vision-language models using only individually safe images and benign-sounding prompts, escalating responses to harmful content.

  27. When the Defense Writes the Refusal: Auditing Keyword-Scored Evaluation of Inference-Time Defenses for Multimodal Large Language Models

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    Stacking inference-time defenses for multimodal LLMs drives 97–100% over-refusal of benign queries; no single defense dominates and a simple prompt is often preferable.

  28. Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 5.0 of 10

    Attention-guided stage-wise cropping attacks beat random-crop baselines on targeted adversarial attacks for LVLMs, with less visible perturbation.

  29. Watch, Listen, Understand, Mislead: Tri-modal Adversarial Attacks on Short Videos for Content Appropriateness Evaluation

    cs.CV 2025-07 conditional novelty 5.0 of 10

    Coordinated misleading text descriptions of video, audio, and meaning flip the appropriateness labels assigned by most multimodal LLMs in about 90% of test videos.

  30. T2VShield: Model-Agnostic Jailbreak Defense for Text-to-Video Models

    cs.CR 2025-04 conditional novelty 5.0 of 10

    T2VShield combines LLM-based prompt rewriting with multi-scale video risk detection and reports large reductions in jailbreak success across five text-to-video platforms.

  31. Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models

    cs.CL 2024-12 conditional novelty 5.0 of 10

    JMLLM, a hybrid obfuscation framework, raises jailbreak success rates across text, image, and speech inputs of multimodal LLMs while using fewer queries than prior methods.

  32. Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment

    cs.CR 2024-11 conditional novelty 5.0 of 10

    An inference-time alignment method using a safety reward model and controlled decoding that reduces jailbreak success rates in multimodal LLMs while preserving utility.

  33. Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey

    cs.CV 2024-11 conditional novelty 5.0 of 10

    A survey that taxonomizes multimodal jailbreak attacks and defenses into four lifecycle levels (input, encoder, generator, output) across Any-to-Text, Any-to-Vision, and Any-to-Any generative models.

  34. A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination

    cs.CR 2026-08 conditional novelty 4.0 of 10

    A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...

  35. From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem

    cs.CR 2025-06 conditional novelty 4.0 of 10

    A structured survey of recent jailbreak attacks and defenses across LLMs, multimodal LLMs, and agents, with taxonomies for methods, datasets, metrics, and defenses.

  36. Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    An alternating image-text optimization produces a universal adversarial suffix and image that transfer across open multimodal LLMs more effectively than single-modality jailbreaks.

  37. A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations

    cs.CR 2025-02 conditional novelty 4.0 of 10

    A survey of LVLM safety that adds a lifecycle taxonomy and new benchmark results showing Janus-Pro-7B has weaker safety than several open-source LVLMs.

  38. LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds

    cs.CL 2024-12 reject novelty 4.0 of 10

    LIAR shows that best-of-N sampling of suffixes from a GPT-2 model jailbreaks several aligned LLMs with low-perplexity prompts and far faster time-to-attack than training-based attacks.

  39. Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agents

    cs.AI 2024-11 conditional novelty 4.0 of 10

    A survey proposing a source-and-impact taxonomy (input, model, combined; security, privacy, ethics) for threats to LLM-based agents, with feature analysis and four case studies.

  40. Empowering Multimodal LLMs with External Tools: A Comprehensive Survey

    cs.CV 2025-08 unverdicted novelty 2.0 of 10

    A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.

  41. A Survey of State of the Art Large Vision Language Models: Alignment, Benchmark, Evaluations and Challenges

    cs.CV 2025-01 reject novelty 2.0 of 10

    A survey that catalogs large vision-language models, their alignment methods, benchmarks, and challenges, but is compromised by inconsistent counts and misclassified entries.

Pith tools