Pith. sign in

REVIEW 4 major objections 5 minor 38 references

Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models

T0 review · 4 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read The paper claims that splitting a harmful prompt into benign-looking text and image pieces makes leading vision-language models reassemble the harmful intent and answer it, with 81.82% success on GPT-4.1-nano and 96.97% on…

desk verdict CAMO is a genuinely new single-query black-box jailbreak construction with strong reported ASR, but the paper overclaims the 100% defense-evasion result and one theoretical bound is wrong. read the letter →

arxiv 2506.16760 v1 pith:OGFIMHX7 submitted 2025-06-20 cs.CL cs.CV

Lei Jiang , Zixun Zhang , Zizhou Wang , Xiaobing Sun , Zhen Li , Liangli Zhen , Xiaohua Xu This is my paper
classification cs.CLcs.CV
keywords jailbreakattackslargevision-languagemodelscross-modalobfuscationblack-boxmultimodalsafetypromptdecompositioncontentmoderationadversarialexamples
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a single-turn, black-box query can make large vision-language models produce restricted content by splitting the harmful instruction into pieces no safety filter sees as dangerous on its own. The method, CAMO, masks the sensitive words in the text and hides the missing characters inside an image as a character-lookup puzzle, then relies on the model's cross-modal reasoning to reassemble the original question and answer it. On GPT-4.1-nano it reports an 81.82% attack success rate, on Qwen2-VL-72B-Instruct 96.97%, and it reports 100% evasion of three defenses: perplexity filtering, OCR keyword detection, and OpenAI's moderation API. The paper argues this exposes a structural blind spot in current safety filters, which check each modality in isolation rather than jointly. If correct, it would mean that current alignment and moderation practices do not handle instructions whose danger emerges only after multimodal composition.

What carries the argument

The carrying mechanism is cross-modal obfuscation with an arithmetic-indexed image lookup: for each masked character, a math question supplies a numeric answer used as a spatial index into an OCR-visible map in the image, so the model must solve the math, read the indexed character, and reassemble the keyword. This forces multi-step reasoning across modalities and makes the harmful intent invisible to unimodal detectors. The model that follows the chain has effectively reconstructed the harmful instruction by itself, so the malicious intent never appears as a single surface token in the input.

What would settle it

Run CAMO on harmful prompts where the sensitive term is replaced by a synonym not present in the paper's dictionary, such as 'explosive device' instead of 'bomb', and measure attack success; the claim predicts a sharp drop in ASR whenever the harmful token is not selected. A second decisive test is to insert a defense that first solves the arithmetic clues, reads the indexed characters, and checks the reconstructed word before answering, which should reduce the reported 100% evasion rate to near zero if the reconstruction mechanism is what carries the attack.

Watch

Extended reading notes

Core claim

The central claim is that a harmful instruction can be decomposed into a set of individually benign multimodal fragments and then reconstructed by the target model itself, without any gradient access, iterative optimization, or multi-turn dialogue. Concretely, each sensitive keyword is partially masked in the text, and the missing characters are placed in an image with positional indices; simple arithmetic questions in the text tell the model which index to read. The model that solves the arithmetic, reads the image, and reassembles the word has effectively performed the jailbreak on its own, while each fragment in isolation passes perplexity-based and OCR-based filters and the moderation API. The paper reports attack success rates up to 81.82% on GPT-4.1-nano and 96.97% on Qwen2-VL-72B-Instruct, with substantially fewer input tokens than earlier black-box attacks.

Load-bearing premise

The entire attack depends on the keyword selection step finding the genuinely sensitive word in the prompt; if the manually built dictionary and part-of-speech tagger miss the harmful term, the masked prompt is either still detected or the model cannot reconstruct the harmful intent, and the reported success rates collapse.

Editorial extensions

If this is right

  • If the claim is correct, safety filters that score text and image independently cannot catch this class of attacks, because each modality is benign when scored alone.
  • Commercial LVLM APIs that expose single-turn image-plus-text queries would be vulnerable without any access to gradients or internal states.
  • Reported success increases with both the fraction of masked words and the fraction of masked characters, suggesting that finer-grained fragmentation produces even harder-to-detect prompts.
  • The attack transfers across model families and deployment settings, so a single crafted prompt may work against unknown future models.
  • The low token count, roughly 179 tokens versus 387 to 1420 for the compared attacks, would make large-scale automated abuse financially feasible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the manual keyword dictionary is the hardest constraint, so the attack could likely be automated further by replacing dictionary-and-POS selection with an LLM that decides which tokens to mask, possibly raising success on unseen harmful domains.
  • Editorial inference: a defense that reconstructs the masked word from the image before moderation, effectively running the same cross-modal reasoning the attack exploits, would likely neutralize this specific scheme at least until the encoding is made harder.
  • Editorial inference: the same decomposition principle might extend beyond jailbreaks to other safety-relevant properties, such as leaking private information or triggering malicious tool calls, because it only requires the model to compose benign fragments.
  • Editorial inference: the reported 100% defense evasion is measured on a fixed set of filters; an adaptive defense allowed to evolve after seeing the attack would be a harder test of the method.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces CAMO, a single-turn, black-box jailbreak attack for large vision-language models (LVLMs). The method masks sensitive keywords in the text prompt and distributes character-level clues into an image via simple arithmetic-indexed lookups; the LVLM must solve the math questions, read the image indices, reconstruct the masked word, and then answer the harmful question. The authors report attack success rates up to 81.82% on GPT-4.1-nano and 96.97% on Qwen2-VL-72B-Instruct, along with fewer input tokens than several baselines. They also claim a 100% evasion rate against three defenses: a perplexity-based filter, an OCR-based toxicity classifier, and OpenAI's moderation API. The paper includes ablations of the keyword set, text template, math encoding, and visual input, as well as hyperparameter sensitivity studies.

Significance. If the empirical claims hold, the paper demonstrates a practical and transferable vulnerability in current LVLMs: a benign-looking multimodal prompt can induce restricted content generation without gradient access or multi-turn interaction. The cross-modal decomposition idea is novel relative to text-suffix and image-OCR attacks, and the paper's ablation study is a strength because it isolates the contribution of each component. The reported token-efficiency advantage over DRA and PAPs is also a useful practical point. However, the load-bearing '100% evasion' claim is not adequately supported by the current experimental write-up, the judge-based ASR metric lacks validation and error bars, and the formal query-complexity bound in Section 3.5 is not mathematically justified as stated. These issues are fixable but require more than editorial polishing.

major comments (4)
  1. [Section 5, Table 3] The central claim of a 100% evasion rate is not supported by the reported experiments. In Section 5.1, the perplexity threshold τ from [12] is never stated; the average log-PPL values (3.07 for attack prompts, 3.47 for harmful questions) cannot be interpreted as a '100% pass rate' without knowing τ and without per-sample counts. In Section 5.2, the paper does not report what text EasyOCR actually extracted; if the extracted text consists only of clue labels such as '3:F' and '6:I', then the OCR-based classifier is not being tested on the reconstructed harmful keyword, and the toxicity threshold for LLaMA-2-Chat-7B is also unspecified. In Section 5.3, the OpenAI Moderation test uses 'text-only inputs that embed semantically harmful visual clues' rather than the actual image+text CAMO input, so it does not establish that the real multimodal attack bypasses system-level moderation. The paper should either report the full defense evaluation with thresholds, sample sizes, and the actual attack inputs, or scale back the '100% evasion' claim accordingly.
  2. [Section 4.1, Tables 1 and 2] The ASR evaluation rests on a single judge model (GPT-4o-2024-08-06) with a fixed rating threshold (>5), but the paper provides no validation of this judge against human labels, no confidence intervals, and no repeated-trial variability. Since each AdvBench-M category contains roughly 30 samples, differences such as 53.33% versus 56.67% in Table 1 correspond to a difference of about one sample; many reported margins are within sampling noise. In addition, the hyperparameters r and k are tuned on the same benchmark (Figures 7 and 8), so the reported ASRs likely overstate the attack's performance on unseen prompts. The authors should report per-category sample sizes, confidence intervals or exact binomial bounds, and a validation protocol that does not select hyperparameters on the test benchmark.
  3. [Section 3.5, Eq. (12)] Equation (12) is not a valid upper bound on the expected number of queries as stated. For example, if every state has success probability p_s = 0.9 and the state space has |S| = 5, the right-hand side equals 0.5, while the expected number of queries to first success is at least 1. Summing (1 - p_s) over states is not equivalent to the expected number of failures before success under any standard sequential-search model without additional assumptions. The paper should either replace this expression with a correct bound (e.g., based on the tail-sum formula for waiting times) or explicitly label it as a heuristic approximation, and should avoid claiming a formal upper bound.
  4. [Section 3.1 and Table 4] The ablation shows that removing the manually curated sensitive keyword set reduces bomb-related ASR from 60.00% to 13.33%, indicating that the attack's success depends critically on this domain-specific dictionary. The paper describes the method as 'automatic keyword extraction' in Section 4.2, but Algorithm 1 requires a manually curated dictionary D (plus optional extra terms) and a fallback policy. The authors should clearly state that the method requires a curated list of sensitive terms for each new domain, and should discuss how such a list would be constructed in practice; the current Limitation section acknowledges the manual tuning of r and k but does not fully own the dictionary dependency.
minor comments (5)
  1. [Section 3.1] There is a typo in 'a a predefined stopword set' and the variable D is used both for the sensitive dictionary and for the tokenized/POS-tagged sequence in Algorithm 1, which is confusing.
  2. [Equations (6) and (8)] Equation (6) uses floor for the character masking length while Equation (8) uses ceiling for the same quantity; the inconsistency should be resolved and stated once.
  3. [Section 4.3] The qualitative examples refer to 'GPT-4.1-mini', but the model list in Section 4.1 includes GPT-4.1-nano; please clarify which model was actually used and why it is not in the model evaluation table.
  4. [Figures 6 and 7 and Tables 1 and 2] The per-category sample sizes are not listed in the tables or figures beyond the statement that each category has roughly 30 samples; exact counts are needed to interpret the percentages and to verify the total across categories.
  5. [General reproducibility] The paper does not provide code or data for the curated dictionary, the exact prompt templates, or the image-rendering procedure; releasing these would be important for reproducing the reported ASR numbers.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: CAMO's attack success is an empirical measurement, not a quantity forced by its own construction.

full rationale

CAMO's central claims are empirical: ASR values in Tables 1-2 are measured from model outputs judged by an external GPT-4o judge against AdvBench/AdvBench-M prompts, and the defense-evasion claims in Table 3 are experimental measurements (PPL scores, EasyOCR/LLaMA-2 toxicity labels, Moderation API responses). The keyword dictionary, math encoding, and masking template are inputs to the attack pipeline, not parameters fitted to the evaluation set; the ablation study measures their causal contribution rather than defining the outcome. Section 3.5 formalizes the difficulty-adjustment search as a constrained optimization and gives an upper bound E[N] <= sum(1-p_s(r,k)); this is a definitional restatement of a search procedure, not a derivation of attack success from assumptions. Equations (18)-(20) restate the design goal that each unimodal component is benign while the joint input is harmful, but the claimed empirical results are not derived from that restatement. No load-bearing self-citation or imported uniqueness theorem appears. The Section 5 defense evaluation has reporting gaps—no PPL threshold, no OCR-extracted text examples, and a text-only surrogate for the Moderation API—but those are evidence-completeness concerns, not circularity. Score 0.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim depends on two hand-chosen masking hyperparameters, a curated dictionary that is not released, and the assumptions that LVLMs can decode the clues and that GPT-4o judge ratings are reliable. No new entities are introduced.

free parameters (3)
  • r (word masking ratio) = 0.6 used in main experiments; varied 0.2-0.6 in ablation
    Controls how many content words are masked; chosen by hand and not tuned on a held-out split.
  • k (character masking depth) = 0.4 used in main experiments; varied 0.2-0.6 in ablation
    Controls the fraction of characters masked within each keyword; hand-tuned on the target models.
  • alpha (keyword augmentation ratio) = not reported
    Threshold for supplementing matched keywords in Algorithm 1; no value is given, so reproduction requires guessing.
assumptions (4)
  • domain assumption Arithmetic and basic OCR indexing are unambiguous and the target LVLM solves the math questions and uses answers as spatial indices into the image map.
    Section 3.2, Eqs. (1)-(3): the entire reconstruction chain assumes these steps are performed reliably.
  • ad hoc to paper The manually curated sensitive dictionary plus POS tagging suffices to identify harmful keywords in AdvBench prompts.
    Algorithm 1, Section 3.1; Table 4 shows removing the dictionary cuts BE ASR from 60% to 13.33%, and the dictionary is not shared.
  • domain assumption GPT-4o judge ratings above 5 correspond to genuinely harmful outputs.
    Section 4.1 evaluation; no human validation or inter-annotator agreement is reported.
  • domain assumption The evaluated defenses, PPL, OCR, and moderation APIs, are standard and representative of deployed safety filters.
    Section 5; no thresholds or sample sizes are reported for the 100% evasion result.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models." pith.science (2026). https://pith.science/paper/OGFIMHX7

@misc{pith2026250616760,
  author       = {Pith},
  title        = {Pith review of: Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/OGFIMHX7}},
  note         = {Machine review of arXiv:2506.16760}
}
read the original abstract

Large Vision-Language Models (LVLMs) demonstrate exceptional performance across multimodal tasks, yet remain vulnerable to jailbreak attacks that bypass built-in safety mechanisms to elicit restricted content generation. Existing black-box jailbreak methods primarily rely on adversarial textual prompts or image perturbations, yet these approaches are highly detectable by standard content filtering systems and exhibit low query and computational efficiency. In this work, we present Cross-modal Adversarial Multimodal Obfuscation (CAMO), a novel black-box jailbreak attack framework that decomposes malicious prompts into semantically benign visual and textual fragments. By leveraging LVLMs' cross-modal reasoning abilities, CAMO covertly reconstructs harmful instructions through multi-step reasoning, evading conventional detection mechanisms. Our approach supports adjustable reasoning complexity and requires significantly fewer queries than prior attacks, enabling both stealth and efficiency. Comprehensive evaluations conducted on leading LVLMs validate CAMO's effectiveness, showcasing robust performance and strong cross-model transferability. These results underscore significant vulnerabilities in current built-in safety mechanisms, emphasizing an urgent need for advanced, alignment-aware security and safety solutions in vision-language systems.

Figures

Figures reproduced from arXiv: 2506.16760 by the authors.

Figure 1
Figure 1. Comparison between CAMO and prior multimodal attack methods. CAMO reformulates a harmful question [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the CAMO pipeline. Given a harmful question (e.g., “How to make a bomb”), CAMO identifies risky [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Comparison of the number of input tokens fed [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Qualitative examples of CAMO input formats and their corresponding model outputs. (a) The entire reasoning [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Interaction with DeepSeek-R1-0528 on the To [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Comparison of average log perplexity (PPL) [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]
Figure 7
Figure 7. Figure 7: Impact of the keyword selection ratio r (pro￾portion of extracted keywords to process) on attack suc￾cess rate (ASR), with fixed character masking ratio k = 0.4, evaluated on GPT-4o-mini. Higher r implies more content-bearing words are altered. The abbreviations of thr…
Figure 8
Figure 8. Figure 8: Effect of character masking ratio k (pro￾portion of masked characters within each keyword) on ASR, with fixed keyword selection ratio r = 0.6, eval￾uated on GPT-4.1-nano. Larger k induces stronger obfuscation and better evasion. The abbreviations of threat categories a…
Figure 9
Figure 9. Figure 9: Visual examples of three image input types used [PITH_FULL_IMAGE:figures/full_fig_p013_9.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

38 extracted references · 16 canonical work pages

  1. [12]

    arXiv preprint arXiv:2309.00614 (2023)

    Jain, N., Schwarzschild, A., Wen, Y ., Somepalli, G., Kirchenbauer, J., Chiang, P.y., Goldblum, M., Saha, A., Geiping, J., Goldstein, T.: Baseline defenses for adversarial attacks against aligned language models. arXiv preprint arXiv:2309.00614 (2023)

    arXiv 2023

  2. [1]

    The Claude 3 Model Family: Opus, Sonnet, Haiku

  3. [2]

    arXiv preprint arXiv:2303.08774 (2023)

    Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: GPT-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023)

    arXiv 2023

  4. [3]

    https://together.ai (2025), accessed: 2025- 06

    AI, T.: Together Inference. https://together.ai (2025), accessed: 2025- 06

    work page 2025

  5. [4]

    arXiv preprint arXiv:2404.02151 (2024)

    Andriushchenko, M., Croce, F., Flammarion, N.: Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks. arXiv preprint arXiv:2404.02151 (2024)

    arXiv 2024

  6. [5]

    Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., Zhou, J.: Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyond (2023), https://arxiv.org/abs/2308.12966

    arXiv 2023

  7. [6]

    Carlini, N., Nasr, M., Choquette-Choo, C.A., Jagielski, M., Gao, I., Koh, P.W.W., Ippolito, D., Tramer, F., Schmidt, L.: Are aligned neu- ral networks adversarially aligned? Advances in Neural Information Processing Systems36, 61478–61500 (2023)

    work page 2023

  8. [7]

    arXiv preprint arXiv:2310.08419 (2023)

    Chao, P., Robey, A., Dobriban, E., Hassani, H., Pappas, G.J., Wong, E.: Jailbreaking Black Box Large Language Models in Twenty Queries. arXiv preprint arXiv:2310.08419 (2023)

    arXiv 2023

Show all 38 references
  1. [8]

    In: Proceedings of the AAAI Confer- ence on Artificial Intelligence

    Gong, Y ., Ran, D., Liu, J., Wang, C., Cong, T., Wang, A., Duan, S., Wang, X.: FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts. In: Proceedings of the AAAI Confer- ence on Artificial Intelligence. vol. 39, pp. 23951–23959 (2025)

    2025

  2. [9]

    arXiv preprint arXiv:2402.10601 (2024)

    Handa, D., Zhang, Z., Saeidi, A., Kumbhar, S., Baral, C.: When ”Competency” in Reasoning Opens the Door to Vulnerability: Jailbreaking LLMs via Novel Complex Ciphers. arXiv preprint arXiv:2402.10601 (2024)

    2024

  3. [10]

    arXiv preprint arXiv:2410.21276 (2024)

    Hurst, A., Lerer, A., Goucher, A.P., Perelman, A., Ramesh, A., Clark, A., Ostrow, A., Welihinda, A., Hayes, A., Radford, A., et al.: GPT-4o System Card. arXiv preprint arXiv:2410.21276 (2024)

    2024 arXiv

  4. [11]

    https://pypi.org/project/easyocr/1.7.1/ (2023), accessed: 2024-02-09

    Jaided AI: EasyOCR 1.7.1. https://pypi.org/project/easyocr/1.7.1/ (2023), accessed: 2024-02-09

    2023

  5. [13]

    In: International conference on machine learning

    Li, J., Li, D., Savarese, S., Hoi, S.: BLIP-2: Bootstrapping Language- Image Pre-training with Frozen Image Encoders and Large Language Models. In: International conference on machine learning. pp. 19730– 19742. PMLR (2023)

    2023

  6. [14]

    In: European Conference on Computer Vision

    Li, Y ., Guo, H., Zhou, K., Zhao, W.X., Wen, J.R.: Images are Achilles’ Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models. In: European Conference on Computer Vision. pp. 174–189. Springer (2024)

    2024

  7. [15]

    arXiv preprint arXiv:2404.07921 (2024)

    Liao, Z., Sun, H.: AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMs. arXiv preprint arXiv:2404.07921 (2024)

    2024 arXiv

  8. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Liu, H., Li, C., Li, Y ., Lee, Y .J.: Improved Baselines with Visual Instruction Tuning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 26296–26306 (2024)

    2024

  9. [17]

    In: 33rd USENIX Security Symposium (USENIX Security 24)

    Liu, T., Zhang, Y ., Zhao, Z., Dong, Y ., Meng, G., Chen, K.: Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstruction. In: 33rd USENIX Security Symposium (USENIX Security 24). pp. 4711–4728 (2024)

    2024

  10. [18]

    arXiv preprint arXiv:2310.04451 (2023)

    Liu, X., Xu, N., Chen, M., Xiao, C.: AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Models. arXiv preprint arXiv:2310.04451 (2023)

    2023 arXiv

  11. [19]

    arXiv preprint arXiv:2404.03027 (2024)

    Luo, W., Ma, S., Liu, X., Guo, X., Xiao, C.: JailBreakV: A Bench- mark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks. arXiv preprint arXiv:2404.03027 (2024)

    2024 arXiv

  12. [20]

    Proceedings of Machine Learning Research235, 35181–35224 (2024)

    Mazeika, M., Phan, L., Yin, X., Zou, A., Wang, Z., Mu, N., Sakhaee, E., Li, N., Basart, S., Li, B., et al.: HarmBench: A Standardized Eval- uation Framework for Automated Red Teaming and Robust Refusal. Proceedings of Machine Learning Research235, 35181–35224 (2024)

    2024

  13. [21]

    arXiv preprint arXiv:2402.02309 (2024)

    Niu, Z., Ren, H., Gao, X., Hua, G., Jin, R.: Jailbreaking Attack against Multimodal Large Language Model. arXiv preprint arXiv:2402.02309 (2024)

    2024 arXiv

  14. [22]

    https://platform.openai.com/ docs/guides/moderation (2024), accessed: 2024-02-09

    OpenAI: Moderation – OpenAI API. https://platform.openai.com/ docs/guides/moderation (2024), accessed: 2024-02-09

    2024

  15. [23]

    https://openai.com/index/ gpt-4-1/ (2025), accessed: 2025-06

    OpenAI: Introducing GPT-4.1 in the API. https://openai.com/index/ gpt-4-1/ (2025), accessed: 2025-06

    2025

  16. [25]

    In: The Twelfth International Conference on Learning Representations (2023)

    Shayegani, E., Dong, Y ., Abu-Ghazaleh, N.: Jailbreak in pieces: Com- positional Adversarial Attacks on Multi-Modal Language Models. In: The Twelfth International Conference on Learning Representations (2023)

    2023

  17. [26]

    arXiv preprint arXiv:2403.05530 (2024)

    Team, G., Georgiev, P., Lei, V .I., Burnell, R., Bai, L., Gulati, A., Tanzer, G., Vincent, D., Pan, Z., Wang, S., et al.: Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530 (2024)

    2024 arXiv

  18. [27]

    Team, Q.: Qwen2.5-VL (January 2025), https://qwenlm.github.io/ blog/qwen2.5-vl/

    2025

  19. [28]

    arXiv preprint arXiv:2307.09288 (2023)

    Touvron, H., Martin, L., Stone, K., Albert, P., Almahairi, A., Babaei, Y ., Bashlykov, N., Batra, S., Bhargava, P., Bhosale, S., et al.: Llama 2: Open Foundation and Fine-Tuned Chat Models. arXiv preprint arXiv:2307.09288 (2023)

    2023 arXiv

  20. [29]

    arXiv preprint arXiv:2409.12191 (2024)

    Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., Fan, Y ., Dang, K., Du, M., Ren, X., Men, R., Liu, D., Zhou, C., Zhou, J., Lin, J.: Qwen2-VL: Enhancing Vision- Language Model’s Perception of the World at Any Resolution. arXiv prepri...

    2024 arXiv

  21. [30]

    In: Proceedings of the 32nd ACM International Conference on Multime- dia

    Wang, R., Ma, X., Zhou, H., Ji, C., Ye, G., Jiang, Y .G.: White-box Multimodal Jailbreaks Against Large Vision-Language Models. In: Proceedings of the 32nd ACM International Conference on Multime- dia. pp. 6920–6928 (2024)

    2024

  22. [31]

    arXiv preprint arXiv:2311.03079 (2023)

    Wang, W., Lv, Q., Yu, W., Hong, W., Qi, J., Wang, Y ., Ji, J., Yang, Z., Zhao, L., Song, X., et al.: CogVLM: Visual Expert for Pretrained Language Models. arXiv preprint arXiv:2311.03079 (2023)

    2023 arXiv

  23. [32]

    arXiv preprint arXiv:2407.10671 (2024)

    Yang, A., Yang, B., Hui, B., Zheng, B., Yu, B., Zhou, C., Li, C., Li, C., Liu, D., Huang, F., Dong, G., Wei, H., Lin, H., Tang, J., Wang, J., Yang, J., Tu, J., Zhang, J., Ma, J., Xu, J., Zhou, J., Bai, J., He, J., Lin, J., Dang, K., Lu, K., Chen, K., Yang, K., Li, M., Xue, M.,...

    2024 arXiv

  24. [33]

    arXiv preprint arXiv:2306.13549 (2023)

    Yin, S., Fu, C., Zhao, S., Li, K., Sun, X., Xu, T., Chen, E.: A Survey on Multimodal Large Language Models. arXiv preprint arXiv:2306.13549 (2023)

    2023 arXiv

  25. [34]

    arXiv preprint arXiv:2310.02446 (2023)

    Yong, Z.X., Menghini, C., Bach, S.H.: Low-Resource Languages Jailbreak GPT-4. arXiv preprint arXiv:2310.02446 (2023)

    2023 arXiv

  26. [35]

    arXiv preprint arXiv:2308.06463 (2023)

    Yuan, Y ., Jiao, W., Wang, W., Huang, J.t., He, P., Shi, S., Tu, Z.: GPT- 4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Cipher. arXiv preprint arXiv:2308.06463 (2023)

    2023 arXiv

  27. [36]

    In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguis- tics (V olume 1: Long Papers)

    Zeng, Y ., Lin, H., Zhang, J., Yang, D., Jia, R., Shi, W.: How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMs. In: Proceedings of the 62nd Annual Meeting of the Association for Computational Linguis- tics (V olume 1:...

    2024

  28. [37]

    arXiv preprint arXiv:2304.10592 (2023)

    Zhu, D., Chen, J., Shen, X., Li, X., Elhoseiny, M.: MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models. arXiv preprint arXiv:2304.10592 (2023)

    2023 arXiv

  29. [38]

    arXiv preprint arXiv:2307.15043 (2023)

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M.: Universal and Transferable Adversarial Attacks on Aligned Language Models. arXiv preprint arXiv:2307.15043 (2023)

    2023 arXiv

  30. [39]

    Zou, A., Wang, Z., Kolter, J.Z., Fredrikson, M.: Universal and Trans- ferable Adversarial Attacks on Aligned Language Models (2023)

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.