mlsanityData to 7 Oct 2026

Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models

arXiv 2403.09792 ↗First posted 14 Mar 2024cs.CV cs.CLcited by 121

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 2 more
Abstract (arXiv)

In this paper, we study the harmlessness alignment problem of multimodal large language models (MLLMs). We conduct a systematic empirical analysis of the harmlessness performance of representative MLLMs and reveal that the image input poses the alignment vulnerability of MLLMs. Inspired by this, we propose a novel jailbreak method named HADES, which hides and amplifies the harmfulness of the malicious intent within the text input, using meticulously crafted images. Experimental results show that HADES can effectively jailbreak existing MLLMs, which achieves an average Attack Success Rate (ASR) of 90.26% for LLaVA-1.5 and 71.60% for Gemini Pro Vision. Our code and data are available at https://github.com/RUCAIBox/HADES.

Key facts. Cited by 121 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 33 of its 41 references that are in the map. First posted on arXiv 14 Mar 2024.

Builds on

33 of 41 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  2. 2024Red Teaming Visual Language Models23 Jan
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  4. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  5. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  6. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 27

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2023Visual Instruction Tuningcited by 7,792
  5. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  8. 2023A Survey of Large Language Modelscited by 2,537
  9. 2023MMBench: Is Your Multi-modal Model an All-around Player?cited by 2,105
  10. 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,624
  11. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
15 more
  1. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,023
  2. 2023SEED-Bench: Benchmarking Multimodal LLMs with Generative Comprehensioncited by 929
  3. 2023A Survey on Multimodal Large Language Modelscited by 898
  4. 2023PixArt-α: Fast Training of Diffusion Transformer for Photorealistic Text-to-Image Synthesiscited by 854
  5. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 828
  6. 2022Red Teaming Language Models to Reduce Harms: Methods, Scaling Behaviors, and Lessons Learnedcited by 702
  7. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 617
  8. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 457
  9. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  10. 2023Are aligned neural networks adversarially aligned?cited by 305
  11. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  12. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  13. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 103
  14. 2023Jailbreaking GPT-4V via Self-Adversarial Attacks with System Promptscited by 62
  15. 2023Why do universal adversarial attacks work on large language models?: Geometry might be the answercited by 13

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 22; 2025: 54; 2026: 45.

121 papers.

Sort:

By area:

  1. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  2. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Modelcited by 82
  3. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  4. 2024Best-of-N Jailbreakingcited by 71
  5. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  6. 2024Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM-Based Agentscited by 63
  7. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  8. 2025A Survey of State of the Art Large Vision Language Models: Alignment, Benchmark, Evaluations and Challengescited by 46
  9. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreakscited by 44
  10. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistencycited by 42
  11. 2024Core Knowledge Deficits in Multi-Modal Language Modelscited by 38
  12. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 38
38 more
  1. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  2. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Modelscited by 33
  3. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  4. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  5. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreakingcited by 31
  6. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  7. 2025HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden Statescited by 29
  8. 2024JailbreakEval: An Integrated Toolkit for Evaluating Jailbreak Attempts Against Large Language Modelscited by 28
  9. 2025Video-SafetyBench: A Benchmark for Safety Evaluation of Video LVLMscited by 25
  10. 2024Unraveling and Mitigating Safety Alignment Degradation of Vision-Language Modelscited by 23
  11. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  12. 2024PBI-Attack: Prior-Guided Bimodal Interactive Black-Box Jailbreak Attack for Toxicity Maximizationcited by 17
  13. 2025Understanding and Rectifying Safety Perception Distortion in VLMscited by 17
  14. 2025FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowchartscited by 15
  15. 2024Energy-Latency Manipulation of Multi-modal Large Language Models via Verbose Samplescited by 14
  16. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 14
  17. 2024Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attackscited by 13
  18. 2025Siren: A Learning-Based Multi-Turn Attack Framework for Simulating Real-World Human Jailbreak Behaviorscited by 12
  19. 2025SCAM: A Real-World Typographic Robustness Evaluation for Multimodal Foundation Modelscited by 12
  20. 2024Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Modelscited by 11
  21. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  22. 2025FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctioncited by 11
  23. 2025SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimizationcited by 11
  24. 2025USB: A Comprehensive and Unified Safety Evaluation Benchmark for Multimodal Large Language Modelscited by 10
  25. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 10
  26. 2025MSTS: A Multimodal Safety Test Suite for Vision-Language Modelscited by 9
  27. 2025Robust-LLaVA: On the Effectiveness of Large-Scale Robust Image Encoders for Multi-modal Large Language Modelscited by 9
  28. 2025Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models?cited by 9
  29. 2025AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Deliverycited by 9
  30. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Modelscited by 8
  31. 2025PiCo: Jailbreaking Multimodal Large Language Models via Pictorial Code Contextualizationcited by 8
  32. 2025JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Modelscited by 8
  33. 2026SafeNeuron: Neuron-Level Safety Alignment for Large Language Modelscited by 8
  34. 2024Defending LVLMs Against Vision Attacks through Partial-Perception Supervisioncited by 7
  35. 2025"I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Modelscited by 7
  36. 2025Steering Multimodal Large Language Models Decoding for Context-Aware Safetycited by 6
  37. 2025Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Modelscited by 5
  38. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attackcited by 5

50 most cited of 121 All 121 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  2. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs
  3. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  4. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
  5. 2026Visual Token Compression Enhances Robustness of MLLMs
  6. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
  7. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
  8. 2025Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography