mlsanityData to 7 Oct 2026

Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character

arXiv 2405.20773 ↗First posted 25 May 2024cs.CR cs.AIcited by 61

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

With the advent and widespread deployment of Multimodal Large Language Models (MLLMs), ensuring their safety has become increasingly critical. To achieve this objective, it requires us to proactively discover the vulnerability of MLLMs by exploring the attack methods. Thus, structure-based jailbreak attacks, where harmful semantic content is embedded within images, have been proposed to mislead the models. However, previous structure-based jailbreak methods mainly focus on transforming the format of malicious queries, such as converting harmful content into images through typography, which lacks sufficient jailbreak effectiveness and generalizability. To address these limitations, we first introduce the concept of "Role-play" into MLLM jailbreak attacks and propose a novel and effective method called Visual Role-play (VRP). Specifically, VRP leverages Large Language Models to generate detailed descriptions of high-risk characters and create corresponding images based on the descriptions. When paired with benign role-play instruction texts, these high-risk character images effectively mislead MLLMs into generating malicious responses by enacting characters with negative attributes. We further extend our VRP method into a universal setup to demonstrate its generalizability. Extensive experiments on popular benchmarks show that VRP outperforms the strongest baseline, Query relevant and FigStep, by an average Attack Success Rate (ASR) margin of 14.3% across all models.

Key facts. Cited by 61 papers in the map (data through 7 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 57 of its 71 references that are in the map. First posted on arXiv 25 May 2024.

Builds on

57 of 71 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  2. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  3. 2024Jailbreaking Attack against Multimodal Large Language Model4 Feb
  4. 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models3 Feb
  5. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  6. 2023On the Adversarial Robustness of Multi-Modal Foundation Models21 Aug
  7. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul

Other references · 50

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  3. 2022Large Language Models are Zero-Shot Reasonerscited by 4,323
  4. 2023Reflexion: Language Agents with Verbal Reinforcement Learningcited by 4,064
  5. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,179
  8. 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,624
  9. 2023Video-LLaVA: Learning United Visual Representation by Alignment Before Projectioncited by 1,385
  10. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  11. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  12. 2016Adversarial Machine Learning at Scalecited by 934
38 more
  1. 2023A Survey on Multimodal Large Language Modelscited by 898
  2. 2023Shikra: Unleashing Multimodal LLM's Referential Dialogue Magiccited by 891
  3. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  4. 2023Aligning Large Multimodal Models with Factually Augmented RLHFcited by 703
  5. 2023A Comprehensive Overview of Large Language Modelscited by 639
  6. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  7. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
  8. 2022Diffusion Models for Adversarial Purificationcited by 469
  9. 2023RLHF-V: Towards Trustworthy MLLMs via Behavior Alignment from Fine-grained Correctional Human Feedbackcited by 404
  10. 2023LanguageBind: Extending Video-Language Pretraining to N-modality by Language-based Semantic Alignmentcited by 366
  11. 2024A Survey on Hallucination in Large Vision-Language Modelscited by 352
  12. 2024InternLM-XComposer2: Mastering Free-form Text-Image Composition and Comprehension in Vision-Language Large Modelcited by 326
  13. 2023Set-of-Mark Prompting Unleashes Extraordinary Visual Grounding in GPT-4Vcited by 291
  14. 2023Role-Play with Large Language Modelscited by 290
  15. 2024MM-LLMs: Recent Advances in MultiModal Large Language Modelscited by 277
  16. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 255
  17. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 208
  18. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  19. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  20. 2022Multi-modal Molecule Structure-text Model for Text-based Retrieval and Editingcited by 165
  21. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
  22. 2023Silkie: Preference Distillation for Large Visual Language Modelscited by 128
  23. 2023DDCoT: Duty-Distinct Chain-of-Thought Prompting for Multimodal Reasoning in Language Modelscited by 124
  24. 2023Skywork: A More Open Bilingual Foundation Modelcited by 110
  25. 2023DRESS: Instructing Large Vision-Language Models to Align and Interact with Humans via Natural Language Feedbackcited by 99
  26. 2023Context-faithful Prompting for Large Language Modelscited by 76
  27. 2024LLM Discussion: Enhancing the Creativity of Large Language Models via Discussion Framework and Role-Playcited by 65
  28. 2024Red Teaming Visual Language Modelscited by 62
  29. 2023Multi-Party Chat: Conversational Agents in Group Settings with Humans and Modelscited by 53
  30. 2023A Challenger to GPT-4V? Early Explorations of Gemini in Visual Expertisecited by 49
  31. 2021Adversarial Attacks are Reversible with Natural Supervisioncited by 47
  32. 2023JailGuard: A Universal Detection Framework for LLM Prompt-based Attackscited by 46
  33. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
  34. 2023Chain of Thought Prompt Tuning in Vision Language Modelscited by 34
  35. 2024Democratizing Fine-grained Visual Recognition with Large Language Modelscited by 25
  36. 2023Large Language Models as Automated Aligners for benchmarking Vision-Language Modelscited by 10
  37. 2024Exploring the Limits of Zero Shot Vision Language Models for Hate Meme Detection: The Vulnerabilities and their Interpretationscited by 10
  38. 2024PuriDefense: Randomized Local Implicit Adversarial Purification for Defending Black-box Query-based Attackscited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 11; 2025: 32; 2026: 18.

61 papers.

Sort:

By area:

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  2. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
  3. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  4. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  5. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 54
  6. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreakscited by 44
  7. 2024AutoTrust: Benchmarking Trustworthiness in Large Vision Language Models for Autonomous Drivingcited by 35
  8. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 34
  9. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 34
  10. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  11. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  12. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreakingcited by 31
38 more
  1. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  2. 2025Mirage in the Eyes: Hallucination Attack on Multi-modal Large Language Models with Only Attention Sinkcited by 15
  3. 2025Doxing via the Lens: Revealing Location-related Privacy Leakage on Multi-modal Large Reasoning Modelscited by 14
  4. 2024You Know What I'm Saying: Jailbreak Attack via Implicit Referencecited by 13
  5. 2025Chain-of-Thought Hijackingcited by 13
  6. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 11
  7. 2025SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimizationcited by 11
  8. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steeringcited by 10
  9. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 10
  10. 2025CHAI: Command Hijacking against embodied AIcited by 9
  11. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Modelscited by 8
  12. 2025MIRAGE: Multimodal Immersive Reasoning and Guided Exploration for Red-Team Jailbreak Attackscited by 8
  13. 2025Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLMcited by 8
  14. 2024Zer0-Jack: A Memory-efficient Gradient-based Jailbreaking Method for Black-box Multi-modal Large Language Modelscited by 6
  15. 2025Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganographycited by 6
  16. 2025Mind the Web: The Security of Web Use Agentscited by 5
  17. 2025Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalizationcited by 4
  18. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 4
  19. 2025Simulated Ensemble Attack: Transferring Jailbreaks Across Fine-tuned Vision-Language Modelscited by 4
  20. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4
  21. 2025SoK: Systematizing LLM Prompt Security: Taxonomies, Datasets, and Unified Evaluation of Attacks and Defensescited by 4
  22. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Modelscited by 4
  23. 2026Making MLLMs Blind: Adversarial Smuggling Attacks in MLLM Content Moderationcited by 3
  24. 2025Empowering Multimodal LLMs with External Tools: A Comprehensive Surveycited by 2
  25. 2025JaiLIP: Jailbreaking Vision-Language Models via Loss Guided Image Perturbationcited by 2
  26. 2025Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilitiescited by 2
  27. 2026Red-teaming the Multimodal Reasoning: Jailbreaking Vision-Language Models via Cross-modal Entanglement Attackscited by 2
  28. 2024Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Modelscited by 1
  29. 2025Learning to Detect Unseen Jailbreak Attacks in Large Vision-Language Modelscited by 1
  30. 2025Cowpox: Towards the Immunity of VLM-based Multi-Agent Systemscited by 1
  31. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Modelscited by 1
  32. 2025From Perception to Reasoning: Deep Thinking Empowers Multimodal Large Language Modelscited by 1
  33. 2026GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Modelscited by 1
  34. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Modelscited by 1
  35. 2025Towards medical AI misalignment: a preliminary studycited by 0
  36. 2025Text2VLM: Adapting Text-Only Datasets to Evaluate Alignment Training in Visual Language Modelscited by 0
  37. 2026Text is All You Need for Vision-Language Model Jailbreakingcited by 0
  38. 2026Multi-Turn Adaptive Prompting Attack on Large Vision-Language Modelscited by 0

50 most cited of 61 All 61 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  2. 2025Sequential Comics for Jailbreaking Multimodal Large Language Models via Structured Visual Storytelling
  3. 2026Structured Visual Narratives Undermine Safety Alignment in Multimodal Large Language Models
  4. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image
  5. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection
  6. 2026MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models
  7. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs
  8. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs