Pith. sign in

REVIEW 21 cited by

Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2405.20773 v2 pith:MJMQSQE5 submitted 2024-05-25 cs.CR cs.AI

Siyuan Ma , Weidi Luo , Yu Wang , Xiaogeng Liu This is my paper
classification cs.CRcs.AI
keywords jailbreakmodelsimagesattacklanguagelargemllmsrole-play
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

With the advent and widespread deployment of Multimodal Large Language Models (MLLMs), ensuring their safety has become increasingly critical. To achieve this objective, it requires us to proactively discover the vulnerability of MLLMs by exploring the attack methods. Thus, structure-based jailbreak attacks, where harmful semantic content is embedded within images, have been proposed to mislead the models. However, previous structure-based jailbreak methods mainly focus on transforming the format of malicious queries, such as converting harmful content into images through typography, which lacks sufficient jailbreak effectiveness and generalizability. To address these limitations, we first introduce the concept of "Role-play" into MLLM jailbreak attacks and propose a novel and effective method called Visual Role-play (VRP). Specifically, VRP leverages Large Language Models to generate detailed descriptions of high-risk characters and create corresponding images based on the descriptions. When paired with benign role-play instruction texts, these high-risk character images effectively mislead MLLMs into generating malicious responses by enacting characters with negative attributes. We further extend our VRP method into a universal setup to demonstrate its generalizability. Extensive experiments on popular benchmarks show that VRP outperforms the strongest baseline, Query relevant and FigStep, by an average Attack Success Rate (ASR) margin of 14.3% across all models.

Discussion (0). Sign in to comment.

Forward citations

Cited by 21 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score.

  1. Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderation

    cs.CV 2026-04 unverdicted novelty 8.0 of 10

    Adversarial smuggling attacks encode harmful content into human-readable visuals that evade MLLM detection, achieving over 90% attack success rates on models like GPT-5 and Qwen3-VL via the new SmuggleBench benchmark.

  2. On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

    cs.LG 2025-08 conditional novelty 7.0 of 10

    Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.

  3. One Anchor for All: Unified Multilingual and Multimodal Safety Alignment for LVLMs

    cs.AI 2026-07 conditional novelty 6.0 of 10

    A small set of model neurons shared across languages and modalities can transfer English-only safety training to multilingual and multimodal refusal behavior.

  4. The Mirage of LLM Guardrails: A Case Study in AI-Assisted Medical Note Manipulation

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Simple prompts bypass commercial LLM guardrails on medical-note edits; refusal is highly modality-dependent, and the best fakes are hard for humans to spot.

  5. V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failure

    cs.AI 2026-07 conditional novelty 6.0 of 10

    Video LLMs understand harmful content but activate weaker refusal signals when the query is benign; prompt realignment reduces attack success from ~48% to ~1%.

  6. Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models

    cs.CR 2026-06 unverdicted novelty 6.0 of 10

    A narrative survey that catalogs fifty papers on diffusion-based adversarial techniques across text, vision, and vision-language models, proposes a six-class taxonomy of diffusion roles plus a unified five-dimension e...

  7. MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

    cs.CR 2026-06 unverdicted novelty 6.0 of 10

    MLingualFC benchmark finds flowchart jailbreaks succeed at high rates for Latin-script languages but much lower rates for Punjabi in multilingual VLMs, pointing to language-dependent safety gaps.

  8. Through the Lens of Character: Resolving Modality-Role Interference in Multimodal Role-Playing Agent

    cs.CV 2026-05 unverdicted novelty 6.0 of 10

    CAVI framework uses character-guided token pruning, orthogonal feature modulation, and modality-adaptive role steering to resolve modality-role interference in multimodal RPAs.

  9. Targeted Interpretable Safety Neuron Enhancement for Multilingual Vision-Language Large Models

    cs.CV 2026-04 unverdicted novelty 6.0 of 10

    Precise Shield identifies safety neurons in VLLMs via activation contrasts and aligns only them with gradient masking, boosting safety, preserving generalization, and enabling zero-shot cross-lingual and cross-modal transfer.

  10. Dictionary-Aligned Concept Control for Safeguarding Multimodal LLMs

    cs.LG 2026-04 unverdicted novelty 6.0 of 10

    DACO curates a 15,000-concept dictionary from 400K image-caption pairs and uses it to initialize an SAE that enables granular, concept-specific steering of MLLM activations, raising safety scores on MM-SafetyBench and...

  11. Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 6.0 of 10

    A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.

  12. VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models

    cs.CR 2025-10 conditional novelty 6.0 of 10

    VERA-V learns a distribution of text-image jailbreak prompts via variational inference, achieving higher attack success rates and lower toxicity detection than prior multimodal red-teaming methods.

  13. SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses

    cs.CR 2025-10 conditional novelty 6.0 of 10

    A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.

  14. The First Differentiable Transfer-Based Algorithm for Discrete MicroLED Repair

    cs.LG 2025-08 reject novelty 6.0 of 10

    The submission's abstract announces a differentiable microLED repair planner, yet its full text is the LoD jailbreak-detection paper (arXiv 2508.09201v4), leaving the claimed result without any derivation.

  15. RedDiffuser: Auditing Multimodal Safety Failures in Vision-Language Models via Reinforced Diffusion

    cs.CV 2025-03 unverdicted novelty 6.0 of 10

    RedDiffuser is a reinforced diffusion framework that generates adversarial visual contexts to audit and expose widespread multimodal safety failures in VLMs, increasing unsafe response rates by up to 10.69% on LLaVA w...

  16. Localization then Neutralization: Gradient-guided Token Suppression against Visual Prompt Injection Attack

    cs.LG 2026-05 unverdicted novelty 5.0 of 10

    Gradient Token Masking localizes critical adversarial image tokens via hidden-state gradient norms and masks them to neutralize prompt injection attacks in multimodal LLMs with one forward-backward pass.

  17. Targeted Interpretable Safety Neuron Enhancement for Multilingual Vision-Language Large Models

    cs.CV 2026-04 conditional novelty 5.0 of 10

    A neuron-targeted safety tuning method for VLLMs reduces attack success rates from ~20-30% to ~4-6% on average across ten languages while using less than 0.03% of parameters.

  18. Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models

    cs.LG 2025-08 unverdicted novelty 4.0 of 10

    The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.

  19. Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM

    cs.CL 2025-08 unverdicted novelty 3.0 of 10

    The submission's abstract promises an LLM safety survey, but the provided body is the opening page of an unrelated arithmetic-dynamics paper, so the artifact is internally inconsistent.

  20. Empowering Multimodal LLMs with External Tools: A Comprehensive Survey

    cs.CV 2025-08 unverdicted novelty 2.0 of 10

    A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.

  21. Safety at Scale: A Comprehensive Survey of Large Model and Agent Safety

    cs.CR 2025-02 unverdicted novelty 2.0 of 10

    A comprehensive survey that taxonomizes safety threats to large models and agents, reviews defenses and benchmarks, and outlines open challenges.

Pith tools