Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 24 papers
Filter5

Attack type

Jailbreaks24Detection evasion3

Attack technique

Automated search6Multi-turn escalation3Encoding and obfuscation9Cross-modal payloads19

Impact

Harmful content22

System type

Models and APIs21AI Agent3

Attacker access

Black-box24White-box3

Attack surface / entry point

User input22Images, audio and video22

Layer

Prompt layer20Application layer3

System component

Memory0Guardrails and judges27Monitors2Reasoning chains5Vision22Audio6Image generation12Multimodal40
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 232papers have no tags yet and are not included in filtered results.
Attack type：JailbreaksAttacker access：Black-boxSystem component：MemorySystem component：MonitorsSystem component：VisionClear all

Another 232papers do not have category tags yet and are not included in filtered results.

  1. DefensesarXiv 2610.09703

    研究揭示 Token-Pruning 对 VLM 安全性的影响并提出 SAP 缓解机制

    提出 Safety-Aware Pruning，缓解视觉 token 剪枝放大的多模态越狱

    arXiv
    2610.09703
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    LLaVA-1.5-7B
    Abstract剪枝去掉背景 token 后注意力塌向恶意前景。

    这篇工作评估视觉 token 剪枝如何改变 VLM 在多模态越狱下的行为，并给出推理时防御 SAP。

    Paper analysisRead analysis
  4. AttacksarXiv 2607.02961

    研究者提出信息过载方法越狱大型视觉语言模型

    提出 INFER+ 信息过载方法，越狱大型视觉语言模型

    arXiv
    2607.02961
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box, Gray-box
    Evaluated models
    Qwen3-VL-8B, Qwen2-VL-7B, InternVL3.5-8B and others8
    Abstract用图文过载越狱 LVLM。

    这篇工作用信息过载越狱 LVLM，而不是靠 OOD 变换隐藏意图。

    Paper analysisRead analysis
  5. AttacksarXiv 2606.01837

    论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出

    提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像

    arXiv
    2606.01837
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
    AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。

    DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。

    Paper analysisRead analysis
  7. AttacksarXiv 2605.07399

    研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型

    提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型

    arXiv
    2605.07399
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    LLaDA-V, LaViDA
    Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。

    GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。

    Paper analysisRead analysis
  9. AttacksarXiv 2603.09246

    研究者提出 Reasoning-Oriented Programming，通过链式语义片段越狱大型视觉语言模型

    提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型

    arXiv
    2603.09246
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o, Claude 3.7 Sonnet, GLM-4V-Plus and others7
    AbstractVROP 以良性视觉 gadget 与控制流提示词做组合越狱。

    VROP是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。

    Paper analysisRead analysis
  10. AttacksarXiv 2603.07590

    Model as Lego builder: assembling malicious content from harmless blocks using a semantic blueprint

    Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.

    arXiv
    2603.07590
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
    AbstractStructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.

    StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.

    Paper analysisRead analysis
  12. AttacksarXiv 2602.10148

    Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models

    提出 COMET 跨模态纠缠攻击，越狱视觉语言模型

    arXiv
    2602.10148
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
    AbstractCOMET performs black-box cross-modal entanglement jailbreak.

    COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。

    Paper analysisRead analysis
  13. AttacksarXiv 2603.20198

    研究者提出 MM-Plan 多模态越狱框架

    提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标

    arXiv
    2603.20198
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
    Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。

    MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。

    Paper analysisRead analysis
Load more