REVIEW 19 cited by
Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
With the advent and widespread deployment of Multimodal Large Language Models (MLLMs), ensuring their safety has become increasingly critical. To achieve this objective, it requires us to proactively discover the vulnerability of MLLMs by exploring the attack methods. Thus, structure-based jailbreak attacks, where harmful semantic content is embedded within images, have been proposed to mislead the models. However, previous structure-based jailbreak methods mainly focus on transforming the format of malicious queries, such as converting harmful content into images through typography, which lacks sufficient jailbreak effectiveness and generalizability. To address these limitations, we first introduce the concept of "Role-play" into MLLM jailbreak attacks and propose a novel and effective method called Visual Role-play (VRP). Specifically, VRP leverages Large Language Models to generate detailed descriptions of high-risk characters and create corresponding images based on the descriptions. When paired with benign role-play instruction texts, these high-risk character images effectively mislead MLLMs into generating malicious responses by enacting characters with negative attributes. We further extend our VRP method into a universal setup to demonstrate its generalizability. Extensive experiments on popular benchmarks show that VRP outperforms the strongest baseline, Query relevant and FigStep, by an average Attack Success Rate (ASR) margin of 14.3% across all models.
Forward citations
Cited by 19 Pith papers
-
On Surjectivity of Neural Networks: Can you elicit any behavior from your model?
Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.
-
One Anchor for All: Unified Multilingual and Multimodal Safety Alignment for LVLMs
A small set of model neurons shared across languages and modalities can transfer English-only safety training to multilingual and multimodal refusal behavior.
-
The Mirage of LLM Guardrails: A Case Study in AI-Assisted Medical Note Manipulation
Simple prompts bypass commercial LLM guardrails on medical-note edits; refusal is highly modality-dependent, and the best fakes are hard for humans to spot.
-
V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failure
Video LLMs understand harmful content but activate weaker refusal signals when the query is benign; prompt realignment reduces attack success from ~48% to ~1%.
-
Targeted Interpretable Safety Neuron Enhancement for Multilingual Vision-Language Large Models
Precise Shield identifies safety neurons in VLLMs via activation contrasts and aligns only them with gradient masking, boosting safety, preserving generalization, and enabling zero-shot cross-lingual and cross-modal transfer.
-
Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models
A multi-turn attack that alternates text and image prompts and adapts its trajectory outperforms existing jailbreak methods on four vision-language models, reaching up to 100% attack success rate.
-
VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models
VERA-V learns a distribution of text-image jailbreak prompts via variational inference, achieving higher attack success rates and lower toxicity detection than prior multimodal red-teaming methods.
-
SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defenses
A systemization of LLM jailbreak security that adds linked taxonomies, an evaluation platform, and JailbreakDB, while its main attack–defense comparison results remain deferred.
-
The First Differentiable Transfer-Based Algorithm for Discrete MicroLED Repair
The submission's abstract announces a differentiable microLED repair planner, yet its full text is the LoD jailbreak-detection paper (arXiv 2508.09201v4), leaving the claimed result without any derivation.
-
Backdoor Cleaning without External Guidance in MLLM Fine-tuning
BYE filters backdoored training images from MLLM fine-tuning by clustering low attention entropy across selected layers.
-
Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
A two-stage evaluation framework and token-projection analysis show that LVLMs encode harmful semantic cues from images even without OCR, while remaining vulnerable to cross-modal attacks.
-
Towards medical AI misalignment: a preliminary study
A custom role-playing prompt called the Goofy Game made four major LLMs produce plausible but incorrect medical recommendations.
-
Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models
The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.
-
A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations
A survey of LVLM safety that adds a lifecycle taxonomy and new benchmark results showing Janus-Pro-7B has weaker safety than several open-source LVLMs.
-
Universal Adversarial Attack on Aligned Multimodal LLMs
A single optimized image, trained through the vision and language modules, makes aligned multimodal LLMs produce dangerous responses across diverse prompts and some models.
-
Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLM
The submission's abstract promises an LLM safety survey, but the provided body is the opening page of an unrelated arithmetic-dynamics paper, so the artifact is internally inconsistent.
-
Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025
The ATLAS 2025 competition demonstrates that vision-language models remain highly vulnerable to flowchart-based and cross-modal jailbreak attacks, with top scores exceeding 93%.
-
When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs
A survey that classifies VLM attacks by goal and data manipulation strategy, and reviews defenses and metrics.
-
Empowering Multimodal LLMs with External Tools: A Comprehensive Survey
A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.
Discussion (0). Continue with ORCID to comment.