Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 16 papers
Filter5

Attack type

Jailbreaks11Prompt injection3

Attack technique

Gradient and representation optimization17Automated search8Multi-turn escalation5Encoding and obfuscation13Cross-modal payloads37Dormant triggers3

Impact

Harmful content12Output manipulation3

System type

Models and APIs15coding agent1

Attacker access

Black-box8

Attack surface / entry point

User input13Images, audio and video16

Layer

Prompt layer13

System component

MCP and skills8Memory3Guardrails and judges14Reasoning chains3Fine-tuning and open weights16Vision16Audio4Image generation9Multimodal27
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Attack technique：Encoding and obfuscationAttack technique：Dormant triggersSystem type：Models and APIsSystem type：coding agentSystem component：VisionClear all

Another 240papers do not have category tags yet and are not included in filtered results.

  1. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  2. Evaluation and benchmarksarXiv 2609.35912

    MMSkillRisk：多模态技能图像中的隐藏指令可诱导 Agent 执行未授权操作

    提出 MMSkillRisk 基准，评测多模态技能图像中的隐藏指令诱导 Agent 越权操作

    arXiv
    2609.35912
    Published
    Layer
    Application layer
    Setting
    coding agent
    Evaluated models
    GPT-5.6-sol, Kimi-K2.6, Kimi-K3 and others6

    Abstract论文提出 MMSkillRisk 基准与 NCVA 攻击，揭示多模态技能中教学图像潜藏指令可引发未授权操作并与良性任务共存。

    Paper analysisRead analysis
  3. AttacksarXiv 2609.07048

    FreqDoor：面向视觉语言模型的频域后门攻击

    提出 FreqDoor，在频域混合振幅并对生成式 VLM 做训练时视觉后门

    arXiv
    2609.07048
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    BLIP-2 (opt-2.7b), InstructBLIP (flan-t5-xl), LLaVA (interleave-qwen)
    AbstractFreqDoor 用频域振幅混合给三款 VLM 植入仅视觉的训练时后门。

    FreqDoor 是针对生成式 VLM 的仅视觉、训练时后门：在频域混合触发源振幅、保留干净图像相位，使触发在空间上分散。

    Paper analysisRead analysis
  4. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  6. AttacksarXiv 2606.01837

    论文提出 DSR 跨模态越狱框架：用良性输入诱导 MLLM 有害输出

    提出 DSR 跨模态越狱，用无害图文诱导 MLLM 生成有害图像

    arXiv
    2606.01837
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    gemini-2.5-flash-image, qwen-image-2.0, Tongyi Wanx 2.5
    AbstractDSR 用无害图文诱导商业 MLLM 输出有害图像，作者称组合能力会反过来扩大攻击面。

    DSR 是一种 black-box 跨模态越狱：输入侧不放显式有害内容，而让商业 MLLM 在推理中把无害图文重组成有害图像。

    Paper analysisRead analysis
  9. AttacksarXiv 2605.00583

    Jailbreaking vision-language models through the visual modality

    提出四类视觉越狱，把有害意图编码进图像以绕过安全拒答

    arXiv
    2605.00583
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.2, Claude-Haiku-4.5, Gemini-3-Flash and others8
    Abstract四类视觉越狱在六个 VLM 上检验文本对齐能否挡住视觉意图，模型与攻击之间差异大。

    四类视觉越狱用来检验前沿 VLM 的文本安全训练能否挡住由图像传达的有害意图。。

    Paper analysisRead analysis
  10. AttacksarXiv 2603.07590

    模型作为乐高搭建者：用语义蓝图从无害积木拼装恶意

    提出 StructAttack，用结构图把无害语义槽诱导视觉模型拼成恶意内容

    arXiv
    2603.07590
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4o (1120), Gemini-2.0-Flash (001), Gemini-2.5-Flash and others6
    AbstractStructAttack 把有害查询拆成无害槽并画进结构图，在黑盒单次查询下诱导 LVLM 填出有害内容。

    StructAttack 是针对 LVLM 的黑盒、单次查询越狱：把有害指令拆成单独看似无害的槽，画进结构图，再让模型把槽拼回有害内容。。

    Paper analysisRead analysis
  12. AttacksarXiv 2602.15927

    研究者提出面向多轮对话的视觉记忆注入攻击 VMI

    提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息

    arXiv
    2602.15927
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, LLaVA-OneVision-1.5-8B-Instruct and others5
    AbstractVMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。

    VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。

    Paper analysisRead analysis
  13. AttacksarXiv 2602.10148

    Red-Teaming Multimodal Reasoning: Cross-Modal Entanglement Attacks Jailbreak Vision-Language Models

    提出 COMET 跨模态纠缠攻击，越狱视觉语言模型

    arXiv
    2602.10148
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-4.1, GPT-4.1-mini, Gemini-2.5-Flash and others9
    AbstractCOMET 做黑盒跨模态纠缠越狱。

    COMET 是面向具备多模态推理的 VLM 的黑盒越狱，用来红队测试跨模态安全对齐。作者要处理的缺口是：把恶意线索分到图文的固定组合，测不到多步推理里才出现的漏洞。攻击不访问梯度，只构造图文输入。

    Paper analysisRead analysis
  15. AttacksarXiv 2601.15698

    Beyond Visual Safety: Jailbreaking Multimodal Large Language Models to Generate Harmful Images with Semantically Irrelevant Inputs

    提出 BVS 图文越狱，用中和拼接图和诱导提示词让模型生成有害图像

    arXiv
    2601.15698
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5 (12 January 2026 release), Gemini 1.5 Flash (15 January 2026 release)
    AbstractBVS 以重建后再生成诱导有害图像。

    BVS 用图文对诱导 MLLM 生成有害图像。作者认为，相对文本越狱和单模态图像诱导，视觉生成的安全审查仍不充分。

    Paper analysisRead analysis
You have reached the end