Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.

Attack technique：Multi-turn escalation Attack technique：Encoding and obfuscation System component：Monitors System component：Vision System component：Embeddings Clear all

Another 247papers do not have category tags yet and are not included in filtered results.

Evaluation and benchmarksarXiv 2609.35912Sep 28
MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作
提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作
arXiv
2609.35912
Published
Sep 28
Layer
Application layer
Setting
coding agent
Evaluated models
GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentMCP and skills
Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.05709May 7
研究者提出利用重构与隐藏权衡的多模态大模型越狱方法
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
arXiv
2605.05709
Published
May 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.4-nano, GPT-5.4-mini, Gemini-2.5-Flash and others19
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.00583May 1
Jailbreaking vision-language models through the visual modality
提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
arXiv
2605.00583
Published
May 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.2, Claude-Haiku-4.5, Gemini-3-Flash and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。
四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。。
Paper analysisRead analysis
AttacksarXiv 2603.07590Mar 8
模型作为乐高搭建者：用语义蓝图从无害积木拼装恶意
提出 StructAttack，用结构图把无害语义槽诱导视觉模型拼成恶意内容
arXiv
2603.07590
Published
Mar 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractStructAttack 把有害查询拆成无害槽并画进结构图，在黑盒单次查询下诱导 LVLM 填出有害内容。
StructAttack 是针对 LVLM 的黑盒、单次查询越狱：把有害指令拆成单独看似无害的槽，画进结构图，再让模型把槽拼回有害内容。。
Paper analysisRead analysis
AttacksarXiv 2603.00565Feb 28
MIDAS：面向 MLLM 越狱的多图分散与语义重建
提出 MIDAS ，把有害语义拆进多张视觉谜题并跨图重构以越狱多模态模型
arXiv
2603.00565
Published
Feb 28
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4o, GPT-5-Chat, Gemini-2.5-Pro and others7
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2603.10010Feb 18
FERRET：基于扩展的多模态自动化红队测试框架
提出 FERRET 框架，用扩展生成多轮多模态越狱对话
arXiv
2603.10010
Published
Feb 18
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Llama Maverick, Claude Haiku, GPT-4o
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2602.14399Feb 16
Multi-turn Adaptive Prompt Attack against Large Vision-Language Models
提出 MAPA 多轮自适应提示攻击，交替文本与视觉动作越狱视觉语言模型
arXiv
2602.14399
Published
Feb 16
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-V1.6-Mistral-7B, Qwen2.5-VL-7B-Instruct, Llama-3.2-Vision-11B-Instruct and others4
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2602.10148Feb 10
Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models
提出 COMET 跨模态纠缠攻击，越狱视觉语言模型
arXiv
2602.10148
Published
Feb 10
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractCOMET 做黑盒跨模态纠缠越狱。
COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。
Paper analysisRead analysis
AttacksarXiv 2603.20198Feb 5
研究者提出 MM-Plan 多模态越狱框架
提出 MM-Plan 多模态越狱框架，自动规划多轮图像编辑以越狱视觉独占目标
arXiv
2603.20198
Published
Feb 5
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Llama-3.2-11B, InternVL3-8B, Qwen3-VL-8B and others8
- AttacksJailbreaks
- TechniqueAutomated search
- ComponentVision
Abstract作者称全局规划能攻破对单轮攻击更稳的前沿 MLLM。
MM-Plan 是面向 Visual Exclusivity 的 black-box 多模态红队方法，并配有人工基准 VE-Safety。
Paper analysisRead analysis
AttacksarXiv 2602.00420Jan 31
研究者提出 Text-DJ，利用 OCR 能力越狱大型视觉语言模型
提出 Text-DJ，用拆分文本图网格越狱视觉语言模型
arXiv
2602.00420
Published
Jan 31
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen/Qwen3-VL-4B-Instruct, Qwen/Qwen3-VL-8B-Instruct, Qwen/Qwen3-VL-30B-A3B-Instruct and others6
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2601.15698Jan 22
Beyond Visual Safety: Jailbreaking Multimodal Large Language Models to Generate Harmful Images with Semantically Irrelevant Inputs
提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像
arXiv
2601.15698
Published
Jan 22
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5 (12 January 2026 release), Gemini 1.5 Flash (15 January 2026 release)
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
AbstractBVS 以重建后再生成诱导有害图像。
BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。
Paper analysisRead analysis
AttacksarXiv 2601.05339Jan 9
多模态大语言模型的多轮越狱攻击与 FragGuard 防御
提出多轮多模态越狱，并用 FragGuard 拦截有害响应
arXiv
2601.05339
Published
Jan 9
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6 (7B), LLaVa-1.6 (13B), Qwen-2-7B and others5
- DefensesDetection and filtering
- AttacksJailbreaks
- TechniqueMulti-turn escalation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2601.03416Jan 7
GAMBIT: a gamified jailbreak framework for multimodal large models
提出 GAMBIT 游戏化越狱框架，用拼图与竞赛场景攻击多模态模型
arXiv
2601.03416
Published
Jan 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Qwen2.5-VL, InternVL 2.5, GPT-4o and others8
- AttacksJailbreaks
- TechniqueRole-play and persuasion
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2512.20168Dec 23, 2025
Odysseus 用双重隐写越狱 GPT-4o、Gemini-2.0 与 Grok-3
提出双重隐写越狱 Odysseus，用图像隐写绕过多模态系统安全过滤器
arXiv
2512.20168
Published
Dec 23, 2025
Layer
Application layer
Setting
AI Agent
Attacker
Black-box
Evaluated models
GPT-4o-2024-08-06, Gemini-2.0-pro, Gemini-2.0-flash and others4
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
Paper analysisRead analysis
AttacksarXiv 2511.13892Nov 18, 2025
论文提出利用图像排版操纵与多轮提示越狱智能交通系统中的 LVLM
提出图像排版操纵与多轮提示越狱，绕过交通场景视觉语言模型安全对齐
arXiv
2511.13892
Published
Nov 18, 2025
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
LLaVa-1.6, Qwen-2, GPT-4o-mini
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis

You have reached the end

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop