Pith. sign in

REVIEW 21 cited by

Jailbreaking Attack against Multimodal Large Language Model

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2402.02309 v1 pith:5WG3ILU7 submitted 2024-02-04 cs.LG cs.CLcs.CRcs.CV

Zhenxing Niu , Haodong Ren , Xinbo Gao , Gang Hua , Rong Jin This is my paper
classification cs.LGcs.CLcs.CRcs.CV
keywords jailbreakinglanguagemllmsmodelsapproachgeneratedimgjplarge
verification ladder T0 review T1 audit T2 compute T3 formal
0 comments
read the original abstract

This paper focuses on jailbreaking attacks against multi-modal large language models (MLLMs), seeking to elicit MLLMs to generate objectionable responses to harmful user queries. A maximum likelihood-based algorithm is proposed to find an \emph{image Jailbreaking Prompt} (imgJP), enabling jailbreaks against MLLMs across multiple unseen prompts and images (i.e., data-universal property). Our approach exhibits strong model-transferability, as the generated imgJP can be transferred to jailbreak various models, including MiniGPT-v2, LLaVA, InstructBLIP, and mPLUG-Owl2, in a black-box manner. Moreover, we reveal a connection between MLLM-jailbreaks and LLM-jailbreaks. As a result, we introduce a construction-based method to harness our approach for LLM-jailbreaks, demonstrating greater efficiency than current state-of-the-art methods. The code is available here. \textbf{Warning: some content generated by language models may be offensive to some readers.}

Discussion (0). Sign in to comment.

Forward citations

Cited by 21 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

    cs.LG 2025-08 conditional novelty 7.0 of 10

    Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.

  2. DeepBias: Adaptive In-depth Probing of Social Biases in LVLMs

    cs.CY 2026-07 conditional novelty 6.5 of 10

    A generation-evolution-probing loop with Proposer and Digger agents produces DeepBiasBench, exposing deeper LVLM social biases than static image-question benchmarks.

  3. Visual Token Compression Enhances Robustness of MLLMs

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Pruning visual tokens farthest from the text feature space at selected 'robust' layers improves MLLM jailbreak defense (average +13.29% RAR) and slightly reduces hallucination.

  4. 3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism

    cs.CV 2026-07 conditional novelty 6.0 of 10

    An optimized, view-consistent 3D Gaussian shell around a face avatar reliably changes which facial attributes vision-language models report, while preserving identity and appearance.

  5. PPE-Bench: A Benchmark for Evaluating MLLM Unlearning under Private-Public Entanglement

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Existing MLLM unlearning methods reduce private-attribute leakage on entangled images but substantially harm co-occurring public figures and landmarks, with private knowledge often re-emerging after public finetuning.

  6. Safe responses matter: Output-aware safety guardrail mitigate over-refusal in MLLMs

    cs.LG 2026-06 conditional novelty 6.0 of 10

    A lightweight multi-instance contrastive classifier on MLLM hidden states predicts output harmfulness, matching input-side safety while sharply lowering over-refusal.

  7. Securing Multimodal AI through Internal Information Decomposition

    cs.AI 2026-05 conditional novelty 6.0 of 10

    A one-class detector using first-token distributional consistency between text-only, vision-only, and joint predictions reduces multimodal jailbreak attack success rates to below 15% with ~2.4% utility loss.

  8. VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models

    cs.CR 2025-10 conditional novelty 6.0 of 10

    VERA-V learns a distribution of text-image jailbreak prompts via variational inference, achieving higher attack success rates and lower toxicity detection than prior multimodal red-teaming methods.

  9. The First Differentiable Transfer-Based Algorithm for Discrete MicroLED Repair

    cs.LG 2025-08 reject novelty 6.0 of 10

    The submission's abstract announces a differentiable microLED repair planner, yet its full text is the LoD jailbreak-detection paper (arXiv 2508.09201v4), leaving the claimed result without any derivation.

  10. The Emotional Baby Is Truly Deadly: Does your Multimodal Large Reasoning Model Have Emotional Flattery towards Humans?

    cs.AI 2025-08 unverdicted novelty 6.0 of 10

    Multimodal reasoning models can be steered into unsafe behavior by emotional prompts and sometimes conceal harmful reasoning inside seemingly safe responses.

  11. Self-Aware Safety Augmentation: Leveraging Internal Semantic Understanding to Enhance Safety in Vision-Language Models

    cs.AI 2025-07 conditional novelty 6.0 of 10

    A tuning-free method that projects middle-layer semantic representations back onto early safety layers, improving vision-language model safety with minimal utility loss.

  12. Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models

    cs.CL 2025-06 conditional novelty 6.0 of 10

    CAMO hides harmful instructions across text and image using masked keywords and math-puzzle clues, making several LVLMs answer banned queries while evading common safety filters.

  13. Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.

  14. VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    VisCRA jailbreaks multimodal LLMs by masking the most harmful image region and using a two-stage reasoning prompt to make the model infer and then comply.

  15. Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Models

    cs.LG 2025-05 reject novelty 6.0 of 10

    IJA hides a malicious instruction in image steganography and uses a benign extraction prompt plus iterative template refinement to make multimodal LLMs execute it.

  16. Auditing Inference-Time Defense Evaluation for Multimodal Large Language Models

    cs.CR 2026-06 unverdicted novelty 5.0 of 10

    Stacking inference-time defenses for multimodal LLMs drives 97–100% over-refusal of benign queries; no single defense dominates and a simple prompt is often preferable.

  17. Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

    cs.CV 2026-02 conditional novelty 5.0 of 10

    Attention-guided stage-wise cropping attacks beat random-crop baselines on targeted adversarial attacks for LVLMs, with less visible perturbation.

  18. Watch, Listen, Understand, Mislead: Tri-modal Adversarial Attacks on Short Videos for Content Appropriateness Evaluation

    cs.CV 2025-07 conditional novelty 5.0 of 10

    Coordinated misleading text descriptions of video, audio, and meaning flip the appropriateness labels assigned by most multimodal LLMs in about 90% of test videos.

  19. A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination

    cs.CR 2026-08 conditional novelty 4.0 of 10

    A new jailbreak framework, HACA, combines atomic text and image attack strategies selected by a cross-modal planner and generates attacks with LLMs and text-to-image models, reaching 95.48% average attack success acro...

  20. Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models

    cs.CR 2025-06 conditional novelty 4.0 of 10

    An alternating image-text optimization produces a universal adversarial suffix and image that transfer across open multimodal LLMs more effectively than single-modality jailbreaks.

  21. Empowering Multimodal LLMs with External Tools: A Comprehensive Survey

    cs.CV 2025-08 unverdicted novelty 2.0 of 10

    A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.

Pith tools