# MLLM jailbreaks and adversarial robustness

Area: [Multimodal LLMs / vision-language models](https://mlsanity.com/mllm/index.md). HTML: https://mlsanity.com/mllm/mllm-jailbreaks-and-adversarial-robustness/

## Key facts

- MLLM jailbreaks and adversarial robustness: 850 papers on arXiv since 2022 (data through 14 Oct 2026).
- 166 of its 850 mapped papers (20%) cite “FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts” (2023, arXiv 2311.05608).
- 132 of its 850 mapped papers (16%) cite “Visual Adversarial Examples Jailbreak Aligned Large Language Models” (2023, arXiv 2306.13213).
- 33 new papers 17 Sep–14 Oct.

## Most cited here

- [FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts](https://mlsanity.com/paper/2311.05608/) (2023), cited by 166 papers here
- [Visual Adversarial Examples Jailbreak Aligned Large Language Models](https://mlsanity.com/paper/2306.13213/) (2023), cited by 132 papers here
- [On Evaluating Adversarial Robustness of Large Vision-Language Models](https://mlsanity.com/paper/2305.16934/) (2023), cited by 128 papers here
- [MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models](https://mlsanity.com/paper/2311.17600/) (2023), cited by 120 papers here
- [Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models](https://mlsanity.com/paper/2307.14539/) (2023), cited by 105 papers here
- [Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models](https://mlsanity.com/paper/2403.09792/) (2024), cited by 77 papers here
- [How Robust is Google's Bard to Adversarial Image Attacks?](https://mlsanity.com/paper/2309.11751/) (2023), cited by 74 papers here
- [Towards Adversarial Attack on Vision-Language Pre-training Models](https://mlsanity.com/paper/2206.09391/) (2022), cited by 69 papers here
- [AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting](https://mlsanity.com/paper/2403.09513/) (2024), cited by 64 papers here
- [JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks](https://mlsanity.com/paper/2404.03027/) (2024), cited by 64 papers here

## New (17 Sep–14 Oct)

- [Counterfactual Neighborhood Risk Fields: Evidence-Grounded Selective Safety for Vision-Language Models](https://mlsanity.com/paper/2610.20679/) (2026-10-14)
- [Beyond Static Cues: Unified Dynamic Detection of MLLM Backdoors via Dual-Flow Trajectory Analysis](https://mlsanity.com/paper/2610.20319/) (2026-10-14)
- [DPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference Optimization](https://mlsanity.com/paper/2610.18609/) (2026-10-13)
- [Answer It or Not? Towards Prompt-Adapted Adversarial Images on Vision Language Models](https://mlsanity.com/paper/2610.16622/) (2026-10-12)
- [Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs](https://mlsanity.com/paper/2610.14094/) (2026-10-08)
- [Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoders](https://mlsanity.com/paper/2610.11938/) (2026-10-08)
- [Detecting Adversarial Images through Response Profiles of Vision-Language Models](https://mlsanity.com/paper/2610.10436/) (2026-10-07)
- [Open-MMUnlearning: Unifying Methods and Evaluation for MLLM Unlearning](https://mlsanity.com/paper/2610.10358/) (2026-10-07)
- [Purifying Backdoored Large Vision-Language Models by Removing Hijacked Directions](https://mlsanity.com/paper/2610.09941/) (2026-10-07)
- [Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs](https://mlsanity.com/paper/2610.09703/) (2026-10-07)
- [It Is Not Seeing the Hazard: A Frozen Vision-Language Safety Score Measures Its Caption Bank](https://mlsanity.com/paper/2610.09517/) (2026-10-07)
- [Transferable Spatial Temporal Coherence Adversarial Attack on Black-Box Vision Language Models for Autonomous Driving](https://mlsanity.com/paper/2610.08331/) (2026-10-06)
- [Reading, Not Manipulating: Leveraging Router Logits for Multimodal Safety in MoE Vision-Language Models](https://mlsanity.com/paper/2610.07774/) (2026-10-06)
- [From Local Evidence to Safety Verdicts: Causal Tracing in Vision-Language Models](https://mlsanity.com/paper/2610.07514/) (2026-10-05)
- [Visual Grounding Safety in Vision-Language Models](https://mlsanity.com/paper/2610.05637/) (2026-10-05)
- [Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs](https://mlsanity.com/paper/2610.06977/) (2026-10-04)
- [MLLMs Fail to Refuse when Using Tools Agentically](https://mlsanity.com/paper/2610.03938/) (2026-10-02)
- [Corrupted but Correct: Why Vision-Language Models Lie to Themselves Internally](https://mlsanity.com/paper/2610.03445/) (2026-10-02)
- [Typographic Attack Against VLM-based AI-generated Image Detection](https://mlsanity.com/paper/2609.39662/) (2026-09-30)
- [SceneJail: Exploiting Video Scenario Context to Jailbreak Multimodal LLMs](https://mlsanity.com/paper/2609.38899/) (2026-09-30)
- [UnifiedAttack: Evaluating the Safety of Large Multimodal Models in Synergistic Harmful Image-Text Generation](https://mlsanity.com/paper/2610.00341/) (2026-09-29)
- [It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at ε≤ 4/255](https://mlsanity.com/paper/2609.38298/) (2026-09-29)
- [Can Vision-Language Models Stay Helpful When Facing Implicit Risks? Intent-Privilege OPSD for Efficient Safety-Helpfulness Alignment](https://mlsanity.com/paper/2609.37837/) (2026-09-29)
- [Selective Channel Restoration for Backdoored Vision-Language Models](https://mlsanity.com/paper/2609.37759/) (2026-09-29)
- [ThinkingGuard: Decoding Implicit Hazards via Step-by-Step Risk Attribution in Multimodal Large Language Models](https://mlsanity.com/paper/2609.36562/) (2026-09-29)
- [Look Before You Judge: Training-Free Region Mining for Grounded and Explainable Deepfake Detection](https://mlsanity.com/paper/2609.35536/) (2026-09-28)
- [Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Models](https://mlsanity.com/paper/2609.35002/) (2026-09-28)
- [VisionPsy-Nano: Improving Accuracy, Efficiency, and Reliability in On-Device Vision-Language Models](https://mlsanity.com/paper/2609.31746/) (2026-09-23)
- [Evaluating the Semantic-to-Geometric Gap in Adversarial Defenses Against Vision-Language Model-Based Plagiarism](https://mlsanity.com/paper/2609.26733/) (2026-09-22)
- [A2Safe: Counterfactual Evidence-Aligned Adaptive Agent Collaboration for Safe and Effective Visual Question Answering](https://mlsanity.com/paper/2609.24098/) (2026-09-21)