Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 12 papers
Filter5

Attack type

Jailbreaks11

Attack technique

Gradient and representation optimization20Automated search8Multi-turn escalation5Encoding and obfuscation12Cross-modal payloads39

Impact

Harmful content11

System type

Models and APIs12

Attacker access

Black-box8

Attack surface / entry point

User input12Images, audio and video12

Layer

Prompt layer12Application layer5

System component

Memory0Guardrails and judges14Vision12Image generation7Embeddings0Multimodal19
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.
Attack technique：Encoding and obfuscationLayer：Prompt layerSystem component：MemorySystem component：VisionSystem component：EmbeddingsClear all

Another 215papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  3. AttacksarXiv 2606.01837

    论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出

    提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像

    arXiv
    2606.01837
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
    AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。

    DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。

    Paper analysisRead analysis
  6. AttacksarXiv 2605.00583

    Jailbreaking vision-language models through the visual modality

    提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答

    arXiv
    2605.00583
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.2, Claude-Haiku-4.5, Gemini-3-Flash and others8
    Abstract四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。

    四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。。

    Paper analysisRead analysis
  7. AttacksarXiv 2603.07590

    Model as Lego builder: assembling malicious content from harmless blocks using a semantic blueprint

    Propose StructAttack, which uses structural diagrams to induce visual models to assemble malicious content from harmless semantic slots.

    arXiv
    2603.07590
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
    AbstractStructAttack decomposes a harmful query into harmless slots and draws them into a structure graph, inducing the LVLM to fill in harmful content under a black-box single query.

    StructAttack is a black-box, single-query jailbreak against LVLMs: it decomposes a harmful instruction into separate seemingly harmless slots, draws them into a structural diagram, and then makes the model reassemble the slots into harmful content.

    Paper analysisRead analysis
  9. AttacksarXiv 2602.10148

    Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models

    Propose COMET cross-modal entanglement attack to jailbreak vision-language models

    arXiv
    2602.10148
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
    AbstractCOMET performs black-box cross-modal entanglement jailbreak.

    COMET is a black-box jailbreak for VLMs with multimodal reasoning, used to red-team cross-modal safety alignment. The gap the authors address is: distributing malicious cues into fixed combinations of image and text cannot detect vulnerabilities that only appear in multi-step reasoning. The attack does not access gradients; it only constructs image and text inputs.

    Paper analysisRead analysis
  11. AttacksarXiv 2601.15698

    Beyond Visual Safety: Jailbreaking Multimodal Large Language Models to Generate Harmful Images with Semantically Irrelevant Inputs

    提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像

    arXiv
    2601.15698
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5 (12 January 2026 release), Gemini 1.5 Flash (15 January 2026 release)
    AbstractBVS 以重建后再生成诱导有害图像。

    BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。

    Paper analysisRead analysis
You have reached the end