mlsanityData to 7 Oct 2026

Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models

arXiv 2307.14539 ↗First posted 26 Jul 2023cs.CR cs.CLcited by 260

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

We introduce new jailbreak attacks on vision language models (VLMs), which use aligned LLMs and are resilient to text-only jailbreak attacks. Specifically, we develop cross-modality attacks on alignment where we pair adversarial images going through the vision encoder with textual prompts to break the alignment of the language model. Our attacks employ a novel compositional strategy that combines an image, adversarially targeted towards toxic embeddings, with generic prompts to accomplish the jailbreak. Thus, the LLM draws the context to answer the generic prompt from the adversarial image. The generation of benign-appearing adversarial images leverages a novel embedding-space-based methodology, operating with no access to the LLM model. Instead, the attacks require access only to the vision encoder and utilize one of our four embedding space targeting strategies. By not requiring access to the LLM, the attacks lower the entry barrier for attackers, particularly when vision encoders such as CLIP are embedded in closed-source LLMs. The attacks achieve a high success rate across different VLMs, highlighting the risk of cross-modality alignment vulnerabilities, and the need for new alignment approaches for multi-modal models.

Key facts. Cited by 260 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 36 of its 52 references that are in the map. First posted on arXiv 26 Jul 2023.

Builds on

36 of 52 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  2. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  3. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 33

  1. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  2. 2014Adam: A Method for Stochastic Optimizationcited by 36,960
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  5. 2023GPT-4 Technical Reportcited by 18,132
  6. 2019RoBERTa: A Robustly Optimized BERT Pretraining Approachcited by 13,266
  7. 2023Visual Instruction Tuningcited by 7,792
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  9. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  10. 2013Intriguing properties of neural networkscited by 5,114
  11. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  12. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
21 more
  1. 2023Sparks of Artificial General Intelligence: Early experiments with GPT-4cited by 2,579
  2. 2020Extracting Training Data from Large Language Modelscited by 2,144
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  4. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  5. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,315
  6. 2016Adversarial Machine Learning at Scalecited by 934
  7. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  8. 2019Universal Adversarial Triggers for Attacking and Analyzing NLPcited by 709
  9. 2023LLaMA-Adapter V2: Parameter-Efficient Visual Instruction Modelcited by 602
  10. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  11. 2022Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Representation Learningcited by 553
  12. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 478
  13. 2022Diffusion Models for Adversarial Purificationcited by 469
  14. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 337
  15. 2023Are aligned neural networks adversarially aligned?cited by 305
  16. 2022Red-Teaming the Stable Diffusion Safety Filtercited by 257
  17. 2023Inverse Scaling: When Bigger Isn't Bettercited by 205
  18. 2017Generative Adversarial Perturbationscited by 153
  19. 2022Beyond ImageNet Attack: Towards Crafting Adversarial Examples for Black-box Domainscited by 42
  20. 2021Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neuronscited by 29
  21. 2022GAMA: Generative Adversarial Multi-Object Scene Attackscited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 5; 2024: 74; 2025: 108; 2026: 73.

260 papers.

Sort:

By area:

  1. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  2. 2024What matters when building vision-language models?cited by 321
  3. 2024Personal LLM Agents: Insights and Survey about the Capability, Efficiency and Securitycited by 257
  4. 2024Building and better understanding vision-language models: insights and future directionscited by 169
  5. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  6. 2024Latent Adversarial Training Improves Robustness to Persistent Harmful Behaviors in LLMscited by 158
  7. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  8. 2024The Emerged Security and Privacy of LLM Agent: A Survey with Case Studiescited by 127
  9. 2024SAFREE: Training-Free and Adaptive Guard for Safe Text-to-Image And Video Generationcited by 125
  10. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Modelscited by 121
  11. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Modelscited by 119
  12. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
38 more
  1. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Promptingcited by 113
  2. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performancecited by 111
  3. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  4. 2023AutoDAN: Interpretable Gradient-Based Adversarial Attacks on Large Language Modelscited by 102
  5. 2024Coercing LLMs to do and reveal (almost) anythingcited by 88
  6. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Modelcited by 82
  7. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  8. 2024Red-Teaming for Generative AI: Silver Bullet or Security Theater?cited by 81
  9. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 73
  10. 2024Safety of Multimodal Large Language Models on Images and Textscited by 70
  11. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  12. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  13. 2024Protecting Privacy in Multimodal Large Language Models with MLLMU-Benchcited by 61
  14. 2024EasyJailbreak: A Unified Framework for Jailbreaking Large Language Modelscited by 57
  15. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflowscited by 57
  16. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  17. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 53
  18. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Imagecited by 50
  19. 2023Privacy in Large Language Models: Attacks, Defenses and Future Directionscited by 48
  20. 2024Bag of Tricks: Benchmarking of Jailbreak Attacks on LLMscited by 47
  21. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreakscited by 44
  22. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 42
  23. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 42
  24. 2025VPI-Bench: Visual Prompt Injection Attacks for Computer-Use Agentscited by 42
  25. 2025AdaSteer: Your Aligned LLM is Inherently an Adaptive Jailbreak Defendercited by 37
  26. 2024CLEAR: Character Unlearning in Textual and Visual Modalitiescited by 36
  27. 2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
  28. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 34
  29. 2024Accelerating Greedy Coordinate Gradient and General Prompt Optimization via Probe Samplingcited by 33
  30. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Modelscited by 33
  31. 2024Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Modelscited by 31
  32. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  33. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreakingcited by 31
  34. 2025SafeEraser: Enhancing Safety in Multimodal Large Language Models through Multimodal Machine Unlearningcited by 31
  35. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  36. 2025HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden Statescited by 29
  37. 2024JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Modelscited by 28
  38. 2026AgentSentry: Mitigating Indirect Prompt Injection in LLM Agents via Temporal Causal Diagnostics and Context Purificationcited by 28

50 most cited of 260 All 260 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models
  2. 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Models
  3. 2025Beyond Text: Multimodal Jailbreaking of Vision-Language and Audio Models through Perceptually Simple Transformations
  4. 2024Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attacks
  5. 2025Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity
  6. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  7. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
  8. 2026Mosaic: Multimodal Jailbreak against Closed-Source VLMs via Multi-View Ensemble Optimization