Translation in progress Some entries still include text in the original language.
Oct 12 · Monday
All papers Found 28 papers Another 232 papers do not have category tags yet and are not included in filtered results.
“
About this collection Collection in progress We are building a large AI safety paper collection to help researchers find work related to their interests. Papers are collected automatically andfiltered only for relevance to AI safety , without judging quality, novelty or reading value. The default “Annotated first” shows papers with tags or published paper analyses first. Each group is ordered by original publication date, newest first, with undated papers last. “Newest first” uses publication dates only. This order is not a quality ranking.
One-line summaries, tags and paper analyses are prepared by AI from the papers. Language models may have systematic biases and produce hallucinations.We plan to carry out human annotation and review to reduce errors in this content.
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
Published Sep 2
Evaluated models LLaDA-V , MMaDA , LLaDA2.0-Uni 提出 MAMJ，在元层面交替优化多模态越狱的策略提示与攻击者权重
Published Aug 27
Evaluated models GPT-4o , Gemini-3-Pro-Preview , Seed 2.0 提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
Published Aug 3
Evaluated models LLaVA-1.6-Mistral-7B , InternVL-3.5-8B , VLGuard (LLaVA-v1.5-7B-Mixed) and others5 提出 INFER+ 信息过载方法，越狱大型视觉语言模型
Published Jul 3
Evaluated models Qwen3-VL-8B , Qwen2-VL-7B , InternVL3.5-8B and others8 Abstract 用图文过载越狱 LVLM。这篇工作用信息过载 越狱 LVLM，而不是靠 OOD 变换隐藏意图。
提出 ASO，用 GRPO 优化视觉风格以放大越狱攻击
Published Jun 1
Evaluated models GPT-4.1-mini , Gemini-2.5-Flash , Qwen3-VL and others6 Abstract 论文揭示了 MLLM 的风格敏感性脆弱面，提出 ASO 框架利用强化学习优化风格触发器，有效放大了现有视觉越狱效果。
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
Published Jun 1
Evaluated models gemini-2.5-flash-image , qwen-image-2.0 , Tongyi Wanx 2.5 Abstract DSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
Published May 18
Evaluated models GPT-4V , GPT-4o , GPT-5 and others10 提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
Published May 8
Evaluated models LLaDA-V , LaViDA Abstract 作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。 。
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
Published May 7
Evaluated models GPT-5.4-nano , GPT-5.4-mini , Gemini-2.5-Flash and others19 提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
Published May 1
Evaluated models GPT-5.2 , Claude-Haiku-4.5 , Gemini-3-Flash and others8 Abstract 四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。 。
提出 VROP，把有害意图拆成良性视觉 gadget 越狱视觉语言模型
Published Mar 10
Evaluated models GPT-4o , Claude 3.7 Sonnet , GLM-4V-Plus and others7 Abstract VROP 以良性视觉 gadget 与控制流提示词做组合越狱。VROP 是 black-box 多模态越狱框架：不在输入中放显式恶意触发，而把有害目标拆成语义正交的良性视觉 gadget，再用控制流提示词把合成留到后期推理。
Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.
Published Mar 8
Evaluated models GPT-4o (1120) , Gemini-2.0-Flash (001) , Gemini-2.5-Flash and others6 Abstract StructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.
提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
Published Feb 28
Evaluated models GPT-4o , GPT-5-Chat , Gemini-2.5-Pro and others7 提出 FERRET 框架，用扩展生成多轮多模态越狱对话
Published Feb 18
Evaluated models Llama Maverick , Claude Haiku , GPT-4o Propose MAPA multi-turn adaptive prompt attack, alternating text and visual actions to jailbreak vision-language models
Published Feb 16
Evaluated models LLaVA-V1.6-Mistral-7B , Qwen2.5-VL-7B-Instruct , Llama-3.2-Vision-11B-Instruct and others4 Propose COMET cross-modal entanglement attack to jailbreak vision-language models
Published Feb 10
Evaluated models GPT-4.1 , GPT-4.1-mini , Gemini-2.5-Flash and others9 Abstract COMET performs black-box cross-modal entanglement jailbreak.COMET is a black-box jailbreak for VLMs with multimodal reasoning, used to red-team cross-modal safety alignment. The gap the authors address is: distributing malicious cues into fixed combinations of image and text cannot detect vulnerabilities that only appear in multi-step reasoning. The attack does not access gradients; it only constructs image and text inputs.
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
Published Feb 5
Evaluated models Llama-3.2-11B , InternVL3-8B , Qwen3-VL-8B and others8 Abstract 作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
Published Jan 31
Evaluated models Qwen/Qwen3-VL-4B-Instruct , Qwen/Qwen3-VL-8B-Instruct , Qwen/Qwen3-VL-30B-A3B-Instruct and others6 提出 ReAct 双策略，按反馈改写提示并扰动图像绕过 VLM 安全过滤
Published Jan 30
Evaluated models Gemini-2.0-Flash 提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像
Published Jan 22
Evaluated models GPT-5 (12 January 2026 release) , Gemini 1.5 Flash (15 January 2026 release) Abstract BVS 以重建后再生成诱导有害图像。BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。