Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 215papers have no tags yet and are not included in filtered results.

Attack technique：Gradient and representation optimization Attack technique：Encoding and obfuscation Attack technique：Conversation structure manipulation System type：Models and APIs System component：Multimodal Clear all

Another 215papers do not have category tags yet and are not included in filtered results.

AttacksarXiv 2610.09027Oct 7
P-VMI：对抗图像经 KV cache 持续影响多轮对话
提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出
arXiv
2610.09027
Published
Oct 7
Layer
Infrastructure layer
Setting
Models and APIs
Evaluated models
Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B
- AttacksPrompt injection
- TechniqueDormant triggers
- ComponentVision
Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。
Paper analysisRead analysis
AttacksarXiv 2610.08331Oct 6
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
arXiv
2610.08331
Published
Oct 6
Layer
Prompt layer
Setting
Models and APIs
Attacker
No-box (offline transfer)
Evaluated models
Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
Paper analysisRead analysis
AttacksarXiv 2610.06977Oct 4
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
arXiv
2610.06977
Published
Oct 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2609.38253Sep 29
CollageAttack: Exploiting cross-modal alignment defects for spatial text composition jailbreaks against T2I models.
提出 CollageAttack，用空间文本碎片重组越狱文生图模型
arXiv
2609.38253
Published
Sep 29
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-Image-2, Doubao-Seedream-5.0-Lite, Wan2.7-Image-Pro and others5
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentImage generation
Abstract系统揭示 T2I 跨模态空间合成安全漏洞，证实离散无害元素可在图像层面重构有害意图并放大传播强度。
Paper analysisRead analysis
AttacksarXiv 2609.07216Sep 7
DIVA：利用视觉锚点对视频生成模型实施多模态越狱
提出 DIVA，将有害意图拆成视觉锚点与运动文本以越狱视频生成模型
arXiv
2609.07216
Published
Sep 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
Wan, CogVideoX, LTX-Video and others9
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDIVA 用视觉锚点抑制语义漂移做视频越狱，并给出多条件安全基准 TI2VSafetyBench。
DIVA 是针对带参考图的视频生成模型的免训练 black-box 越狱：用一致性机制本身堵住语义漂移这条安全逃逸路径。。
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2609.05843Sep 5
SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准
提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性
arXiv
2609.05843
Published
Sep 5
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
- AttacksDetection evasion
- TechniqueEncoding and obfuscation
- ComponentGuardrails and judges
AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。
SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。
Paper analysisRead analysis
AttacksarXiv 2609.05525Sep 2
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
arXiv
2609.05525
Published
Sep 2
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2608.04034Aug 3
HACA：原子越狱策略解耦组合的多模态自动红队方法
提出 HACA，将图文越狱拆为原子策略并自动组合以诱导有害输出
arXiv
2608.04034
Published
Aug 3
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
LLaVA-1.6-Mistral-7B, InternVL-3.5-8B, VLGuard (LLaVA-v1.5-7B-Mixed) and others5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
Evaluation and benchmarksarXiv 2606.06037Jun 4
SpeechJBB：语码转换语音下大型音频语言模型的越狱基准
提出 SpeechJBB，评测语码转换语音下音频语言模型的越狱稳健性
arXiv
2606.06037
Published
Jun 4
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
Qwen2.5-Omni-7B, Qwen3-Omni-30B-A3B-Instruct, Voxtral-Small-24B and others9
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentAudio
AbstractSpeechJBB 用五语语码转换语音和伪词探针评测九个 LALM，作者将越狱归为对齐失败而非听不懂。
SpeechJBB 用合成语音测量 LALM 在五语、语码转换和局部伪词混淆下的安全对齐，并另设口语理解对照。
Paper analysisRead analysis
AttacksarXiv 2606.01837Jun 1
论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出
提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像
arXiv
2606.01837
Published
Jun 1
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentImage generation
AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。
DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。
Paper analysisRead analysis
AttacksarXiv 2605.21541May 20
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
arXiv
2605.21541
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
Paper analysisRead analysis
AttacksarXiv 2605.20519May 20
CodecAttack：在音频编解码器潜空间构造对抗扰动，绕过有损压缩防御
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
arXiv
2605.20519
Published
May 20
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box
Evaluated models
Qwen2-Audio-7B-Instruct, Audio Flamingo 3, Qwen2.5-Omni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentAudio
Paper analysisRead analysis
AttacksarXiv 2605.18915May 18
DMN：面向多图输入的多模态大模型组合式越狱框架
提出多图越狱框架 DMN，把有害意图拆进图像序列绕过安全护栏
arXiv
2605.18915
Published
May 18
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-4V, GPT-4o, GPT-5 and others10
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.16090May 15
研究者提出 CrossMPI：仅用图像扰动实现跨模态提示注入
提出 CrossMPI，仅用图像扰动实现跨模态提示注入
arXiv
2605.16090
Published
May 15
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
MiniGPT4-llama2, MiniGPT4-vicuna, InstructBLIP and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.07399May 8
研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型
提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
arXiv
2605.07399
Published
May 8
Layer
Prompt layer
Setting
Models and APIs
Attacker
White-box, Black-box
Evaluated models
LLaDA-V, LaViDA
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。
GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。
Paper analysisRead analysis
AttacksarXiv 2605.05709May 7
研究者提出利用重构与隐藏权衡的多模态大模型越狱方法
提出删字变体越狱方法，利用重构与隐藏权衡绕过多模态模型安全过滤
arXiv
2605.05709
Published
May 7
Layer
Prompt layer
Setting
Models and APIs
Attacker
Black-box
Evaluated models
GPT-5.4-nano, GPT-5.4-mini, Gemini-2.5-Flash and others19
- AttacksJailbreaks
- TechniqueEncoding and obfuscation
- ComponentVision
Paper analysisRead analysis
AttacksarXiv 2605.00583May 1
Jailbreaking vision-language models through the visual modality
提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答
arXiv
2605.00583
Published
May 1
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-5.2, Claude-Haiku-4.5, Gemini-3-Flash and others8
- AttacksJailbreaks
- TechniqueCross-modal payloads
- ComponentVision
Abstract四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。
四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。。
Paper analysisRead analysis
AttacksarXiv 2604.14604Apr 16
The AudioHijack framework achieves covert audio prompt injection against 13 speech large models
提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入
arXiv
2604.14604
Published
Apr 16
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
SpeechGPT, GLM-4-Voice, VITA-Audio and others15
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentAudio
Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。
Paper analysisRead analysis
AttacksarXiv 2604.03117Apr 3
Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
arXiv
2604.03117
Published
Apr 3
Layer
Prompt layer
Setting
Models and APIs
Attacker
Gray-box
Evaluated models
OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.
UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
Paper analysisRead analysis
AttacksarXiv 2603.29418Mar 31
研究者提出针对商用多模态大模型的隐蔽视觉提示注入方法
提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令
arXiv
2603.29418
Published
Mar 31
Layer
Prompt layer
Setting
Models and APIs
Evaluated models
GPT-4o, GPT-5, Claude-4.5 and others4
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractCoTTA 以隐蔽触发和双目标对齐诱导指定句子。
Paper analysisRead analysis

AI Safety Daily

Read the latest issueOne issue per day, updated as events develop