SpeechJBB: Jailbreak Benchmark for Large Audio Language Models under Code-Switched Speech(original, opens in a new tab)

Proposes SpeechJBB, evaluating jailbreak robustness of audio language models under code-switched speech.

The MFA framework achieves a 58.5% attack success rate across 17 vision-language models(original, opens in a new tab)

The Chinese University of Hong Kong, Beijing Institute of Technology, and Huawei Noah's Ark Lab propose the MFA framework, which collaboratively breaks through the alignment, prompt, and moderation layers of vision-language models.

Researchers propose Text-DJ, jailbreaking large vision-language models by exploiting OCR capabilities(original, opens in a new tab)

Proposes Text-DJ, jailbreaking vision-language models with split text-grid images.

ChartHal: A Fine-Grained Benchmark for Evaluating Hallucination in Chart Understanding by Large Vision-Language Models(original, opens in a new tab)

Proposes the benchmark CHART HAL, a fine-grained evaluation of hallucination in chart understanding.

Jailbreak-AudioBench: A Jailbreak Evaluation Benchmark for Large Audio Language Models(original, opens in a new tab)

Propose Jailbreak-AudioBench to evaluate audio-edit jailbreaks of audio language models.

Odysseus jailbreaks GPT-4o, Gemini-2.0, and Grok-3 with dual steganography, with attack success rates up to 99%(original, opens in a new tab)

Propose dual-steganography jailbreak Odysseus, using image steganography to bypass multimodal system safety filters.

Why it was selectedThe paper discloses that commercial multimodal system safety filters rely on the assumption that malicious content is explicitly visible, and provides a complete attack chain for cross-modal hidden payloads along with measured success rates.

Multi-turn jailbreak attacks on multimodal large language models and FragGuard defense(original, opens in a new tab)

Proposes multi-turn multimodal jailbreak and uses FragGuard to intercept harmful responses.

RedDiffuser: Using reinforcement diffusion to generate visual inputs for auditing VLM multimodal safety failures(original, opens in a new tab)

Propose RedDiff, using reinforcement diffusion to generate images for auditing VLM contextual safety failures.

VideoSTF reveals output repetition problems in video large models, with temporal perturbation attack success rates up to 98%(original, opens in a new tab)

Propose VIDEO STF to evaluate output repetition in video LLMs and stress-test temporal perturbations.

The researchers propose the MM-Plan multimodal jailbreak framework, with an attack success rate of 46.3% against Claude 4.5 Sonnet(original, opens in a new tab)

Proposes the MM-Plan multimodal jailbreak framework, automatically planning multi-turn image edits to jailbreak visual exclusivity targets.

EpiReal-Bench：商用图像生成模型虚假声明红队基准，直接提示攻击成功率超 70%(original, opens in a new tab)

构建 EpiReal-Bench，评测图像生成器将虚假主张渲染为可信证据。

Why it was selected论文给出四款商用图像生成模型在虚假声明提示下的攻击成功率，并公开了基准与攻击框架，可对照检查自家模型的生成侧护栏。

FearCaut-Qwen: Activation steering changes the risk judgment criteria of vision-language models(original, opens in a new tab)

用恐惧激活转向检验视觉语言模型的隐患判定准则。

用路由稀疏自编码器解耦语音编码器中的语言学与副语言学信息(original, opens in a new tab)

提出路由 TopK SAE，把语音编码器稀疏码拆成语言与副语言通路。

Artifact-Bench：评估 MLLM 检测与诊断 AI 生成视频伪影(original, opens in a new tab)

提出 Artifact-Bench，评测 MLLM 检测并诊断 AI 生成视频伪影。

Researchers propose the vision-centric jailbreak attack VJA, achieving an attack success rate of 80.9% against Nano Banana Pro(original, opens in a new tab)

清华大学与鹏城实验室等机构的研究者提出纯视觉越狱攻击 VJA，把有害编辑指令编码进图像。

Why it was selected论文给出视觉提示越狱在多个商业图像编辑模型上的成功率，并配套基准与免训练防御，便于评估图像编辑链路的安全缺口。

SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱(original, opens in a new tab)

提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示。

Why it was selected论文给出近超声隐蔽声学通道的完整建模与补偿方法，并报告了跨商用与开源语音模型的攻击成功率，语音接口的部署方可据此评估物理层风险。

Prometheus：针对文生图扩散模型的免训练提示词窃取攻击(original, opens in a new tab)

提出 Prometheus，从展示图反推文生图模型的在售提示词。

ASO：用GRPO优化视觉风格放大MLLM越狱攻击(original, opens in a new tab)

哈尔滨工程大学、山东大学与西安电子科技大学的研究者提出 ASO，用 GRPO 优化视觉风格以放大越狱攻击。

Why it was selected论文提出用强化学习优化图像风格来放大现有多模态越狱攻击，并给出跨模型与跨基线的成功率提升数据。

研究者提出意图伪装多轮越狱方法，可攻破 GPT-5-thinking 与 Claude-Sonnet-4.5(original, opens in a new tab)

提出多轮意图欺骗越狱 iDecep，用良性意图伪装引出有害内容。

研究者提出面向多轮对话的视觉记忆注入攻击 VMI(original, opens in a new tab)

提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息。

VidDoS：针对视频大语言模型的通用拒绝服务攻击(original, opens in a new tab)

研究者提出 VidDoS，一个面向 Video-LLM 的通用能耗延迟攻击（ELA）框架，通过通用优化生成与实例无关的触发器，无需在推理时计算梯度。

FERRET：基于扩展的多模态自动化红队测试框架(original, opens in a new tab)

提出 FERRET 框架，用扩展生成多轮多模态越狱对话。

The AudioHijack framework achieves covert audio prompt injection against 13 speech large models(original, opens in a new tab)

提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入。

研究者提出 SeedSnitch 与 PromptPirate，利用种子漏洞窃取扩散模型提示词(original, opens in a new tab)

提出 SeedSnitch 与 PromptPirate，恢复种子后窃取扩散提示词。

研究者提出利用重构与隐藏权衡的多模态大模型越狱方法(original, opens in a new tab)

提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤。

研究者提出针对商用多模态大模型的隐蔽视觉提示注入方法(original, opens in a new tab)

提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令。

DMN：面向多图输入的多模态大模型组合式越狱框架(original, opens in a new tab)

提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏。

Gut-VLM 基准：九种幻觉检测方法在胃肠道内镜 VLM 上的评测(original, opens in a new tab)

在 Gut-VLM 上评测内镜 VLM 的幻觉检测方法。

研究者提出声学干扰攻击 AIA，可通用越狱 10 个大型音频语言模型(original, opens in a new tab)

提出声学干扰攻击 AIA，用良性音频潜语义越狱音频语言模型。

ARENA：面向大型音频语言模型的自动化红队框架(original, opens in a new tab)

提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入。

研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果(original, opens in a new tab)

提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击。

PaperGuard：针对多模态 AI 同行评审的攻击与防御基准(original, opens in a new tab)

提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令。

研究者提出信息过载方法越狱大型视觉语言模型(original, opens in a new tab)

提出 INFER+ 信息过载方法，越狱大型视觉语言模型。

CCDF dataset: Grok Imagine, Veo 3.1, Sora 2 forge surveillance footage, ten deepfake detectors basically cannot recognize it(original, opens in a new tab)

提出监控深伪基准 CCDF，在统一编码后评测检测器对伪造犯罪事故录像的识别。

Why it was selected十个主流深伪检测器在统一画质后仍无法区分前沿商业模型生成的监控录像，暴露了现有评测集与真实威胁之间的差距。

巴黎公立医院 AP-HP 报案：Facebook 上 AI 克隆寄生虫学教授的脸和声音卖「排虫」产品(original, opens in a new tab)

巴黎公立医院集团（AP-HP）就 Facebook 上三段 AI 深度伪造视频报案并联系 Meta，视频用 Pitié-Salpêtrière 医院寄生虫学专家 Renaud Piarroux 教授的声音和形象推销所谓「排虫」产品，未获其同意，目前已被删除。AP-HP 警告还有其他使用其医院 logo 或白大褂形象的内容在社交平台流传，并强调作为公立医疗机构不在社交媒体上做商业推广，此类内容可能误导网民使用无科学依据的产品，危害患者健康。

Indian court in Chandigarh orders Facebook to suspend access to three pages over AI-faked political videos(original, opens in a new tab)

In a suit filed in a Chandigarh civil court in India, the court ruled to temporarily prohibit three Facebook pages from publishing or disseminating AI-generated content involving Congress party figure Amandeep Kumar (also known as Amandeep Jaintipura), and ordered Facebook to close public access to the pages "Thanedar uncle," "Kachi laan," and "Batale Di Rajneeti" before the next hearing. The court found that the videos deliberately damaged the individual's image without verifying facts, carrying a political purpose that goes beyond normal public criticism. The three pages have 2.2K, 1.1K, and 11K followers respectively, and the related content has approximately 178K, 180K, and 47.8K views. Jaintipura's side said the AI-forged videos portrayed him negatively as a drug dealer, antisocial element, and so on, while glamorizing ruling Aam Aadmi Party legislators. The order came only months before the Punjab assembly elections, is the third such order in the region before the elections, and the ban lasts until the next hearing on October 22.

FAB 攻击：给 HuBERT/WavLM 植入后门，背景警笛声即可让下游语音任务失灵(original, opens in a new tab)

提出FAB攻击，向声学基础模型植入可由环境声触发的后门。

Why it was selected论文给出在无预训练数据、任务未知条件下对声学基础模型植入后门的方法，并量化了其在九项下游任务和物理场景中的影响。

BabelFake：面向多语言音视频 DeepFake 检测的基准数据集(original, opens in a new tab)

构建多语言音视频 DeepFake 基准 BabelFake 并评测检测器。

HazardArena：面向 VLA 模型的语义安全评测基准(original, opens in a new tab)

提出 HazardArena 基准，用孪生场景评测 VLA 的语义安全。

BackdoorVLM：面向视觉语言模型后门攻击与防御的基准(original, opens in a new tab)

提出 BackdoorVLM 基准，评测视觉语言模型微调中的后门攻击与防御。