Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 265papers have no tags yet and are not included in filtered results.

Attack technique：Cross-modal payloads Attacker access：Black-box Clear all

Another 265papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.01871Oct 1
研究者提出 IMMRAG 攻击，可从多模态 RAG 数据存储中提取医学与文档图像
提出 imMRAG 攻击，从多模态 RAG 私有图像库提取内容
arXiv
2610.01871
Published
Oct 1
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Lumina-mGPT, Gemini 2.5 Flash Image Preview, CLIP ViT-B/16 and others5
- AttacksExtraction and theft
- TechniqueCross-modal payloads
- ComponentRAG
Paper analysisRead analysis
AttacksarXiv 2609.38899Sep 30
SceneJail: Jailbreaking multimodal large models using video scene context
提出 SceneJail，利用视频情境上下文越狱视频多模态模型
arXiv
2609.38899
Published
Sep 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL-7B-Instruct, Qwen2.5-VL-32B-Instruct, Qwen3-VL-8B-Instruct and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
AttacksarXiv 2608.27531Aug 27
MAMJ：面向视觉语言模型的元自适应多模态越狱攻击
提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
arXiv
2608.27531
Published
Aug 27
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Gemini-3-Pro-Preview, Seed 2.0
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.15578Aug 16
ARENA：面向大型音频语言模型的自动化红队框架
提出 ARENA 音频红队框架，自动构造文本安全且音频接地的越狱输入
arXiv
2608.15578
Published
Aug 16
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Audio Flamingo 3, Qwen2-Audio-7B-Instruct, MiMo-Audio-7B-Instruct and others4
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2607.02961Jul 3
研究者提出信息过载方法越狱大型视觉语言模型
提出 INFER+ 信息过载方法，越狱大型视觉语言模型
arXiv
2607.02961
Published
Jul 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box, Gray-box
Evaluated models
Qwen3-VL-8B, Qwen2-VL-7B, InternVL3.5-8B and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract用图文过载越狱 LVLM。
这篇工作用信息过载越狱 LVLM，而不是靠 OOD 变换隐藏意图。
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.07399May 8
研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型
提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
arXiv
2605.07399
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
LLaDA-V, LaViDA
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。
GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。
Paper analysisRead analysis
AttacksarXiv 2605.05709May 7
研究者提出利用重构与隐藏权衡的多模态大模型越狱方法
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
arXiv
2605.05709
Published
May 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.4-nano, GPT-5.4-mini, Gemini-2.5-Flash and others19
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2603.13847Mar 14
SWhisper 用近超声隐蔽声学通道对语音驱动 LLM 实现黑盒越狱
提出 SWhisper，用近超声波向语音驱动 LLM 隐蔽注入越狱提示
arXiv
2603.13847
Published
Mar 14
Layer
Application layer
Setting
LLM applications
Attacker
Black-box
Evaluated models
Meta-Llama-3.1-8B-Instruct, Gemma-3-4B, Qwen2.5-7B-Instruct and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2603.09246Mar 10
研究者提出 Reasoning-Oriented Programming，通过链式语义片段越狱大型视觉语言模型
提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
arXiv
2603.09246
Published
Mar 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, Claude 3.7 Sonnet, GLM-4V-Plus and others7
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractVROP 以良性视觉 gadget 与控制流提示词做组合越狱。
VROP是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
Paper analysisRead analysis
AttacksarXiv 2603.07590Mar 8
模型作为乐高搭建者：用语义蓝图从无害积木拼装恶意
提出 StructAttack，用结构图把无害语义槽诱导视觉模型拼成恶意内容
arXiv
2603.07590
Published
Mar 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractStructAttack 把有害查询拆成无害槽并画进结构图，在黑盒单次查询下诱导 LVLM 填出有害内容。
StructAttack 是针对 LVLM 的黑盒、单次查询越狱：把有害指令拆成单独看似无害的槽，画进结构图，再让模型把槽拼回有害内容。。
Paper analysisRead analysis
AttacksarXiv 2602.10179Feb 11
研究者提出视觉中心越狱攻击 VJA
提出纯视觉越狱攻击 VJA，把有害编辑指令编码进图像
arXiv
2602.10179
Published
Feb 11
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Nano Banana Pro, GPT Image 1.5, Qwen-Image-Edit and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
Paper analysisRead analysis
AttacksarXiv 2602.10148Feb 10
Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models
提出 COMET 跨模态纠缠攻击，越狱视觉语言模型
arXiv
2602.10148
Published
Feb 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractCOMET 做黑盒跨模态纠缠越狱。
COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。
Paper analysisRead analysis
AttacksarXiv 2602.00420Jan 31
研究者提出 Text-DJ，利用 OCR 能力越狱大型视觉语言模型
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
arXiv
2602.00420
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen/Qwen3-VL-4B-Instruct, Qwen/Qwen3-VL-8B-Instruct, Qwen/Qwen3-VL-30B-A3B-Instruct and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2601.23255Jan 31
研究者提出音频叙事越狱攻击
提出音频叙事越狱，以嗓音投递风格绕过端到端语音模型拒答
arXiv
2601.23255
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o Realtime, Gemini 2.0 Flash, Qwen2.5-Omni-7B
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2601.22398Jan 30
Jailbreaking vision-language models via multimodal reasoning
提出 ReAct 双策略，按反馈改写提示并扰动图像绕过 VLM 安全过滤
arXiv
2601.22398
Published
Jan 30
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Gemini-2.0-Flash
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2601.05339Jan 9
多模态大语言模型的多轮越狱攻击与 FragGuard 防御
提出多轮多模态越狱，并用 FragGuard 拦截有害响应
arXiv
2601.05339
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6 (7B), LLaVa-1.6 (13B), Qwen-2-7B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop