mlsanityData to 7 Oct 2026

A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends

arXiv 2407.07403 ↗First posted 10 Jul 2024cs.CVcited by 82

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

With the significant development of large models in recent years, Large Vision-Language Models (LVLMs) have demonstrated remarkable capabilities across a wide range of multimodal understanding and reasoning tasks. Compared to traditional Large Language Models (LLMs), LVLMs present great potential and challenges due to its closer proximity to the multi-resource real-world applications and the complexity of multi-modal processing. However, the vulnerability of LVLMs is relatively underexplored, posing potential security risks in daily usage. In this paper, we provide a comprehensive review of the various forms of existing LVLM attacks. Specifically, we first introduce the background of attacks targeting LVLMs, including the attack preliminary, attack challenges, and attack resources. Then, we systematically review the development of LVLM attack methods, such as adversarial attacks that manipulate model outputs, jailbreak attacks that exploit model vulnerabilities for unauthorized actions, prompt injection attacks that engineer the prompt type and pattern, and data poisoning that affects model training. Finally, we discuss promising research directions in the future. We believe that our survey provides insights into the current landscape of LVLM vulnerabilities, inspiring more researchers to explore and mitigate potential safety issues in LVLM developments. The latest papers on LVLM attacks are continuously collected in https://github.com/liudaizong/Awesome-LVLM-Attack.

Key facts. Cited by 82 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 145 of its 213 references that are in the map. First posted on arXiv 10 Jul 2024.

Builds on

145 of 213 references.

Closest ancestors · 38

Same direction, newest first

  1. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift27 Jun
  2. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking21 Jun
  3. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  4. 2024Cross-Modal Safety Alignment: Is textual unlearning all you need?27 May
  5. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models26 May
  6. 2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Models16 May
  7. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Models9 May
  8. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models16 Apr
  9. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security8 Apr
  10. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  11. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  12. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models14 Mar
26 more
  1. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
  2. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  3. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions14 Mar
  4. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  5. 2024One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models4 Mar
  6. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  7. 2024Test-Time Backdoor Attacks on Multimodal Large Language Models13 Feb
  8. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  9. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models5 Feb
  10. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks1 Feb
  11. 2024Safety of Multimodal Large Language Models on Images and Texts1 Feb
  12. 2024Red Teaming Visual Language Models23 Jan
  13. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images20 Jan
  14. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance5 Jan
  15. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  16. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models4 Dec
  17. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
  18. 2023Adversarial Prompt Tuning for Vision-Language Models19 Nov
  19. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  20. 2023Can Language Models be Instructed to Protect Personal Information?3 Oct
  21. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  22. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  23. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  24. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  25. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May
  26. 2023Robust Contrastive Language-Image Pre-training against Data Poisoning and Backdoor Attacks13 Mar

Other references · 107

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
  4. 2023GPT-4 Technical Reportcited by 18,132
  5. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  6. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 13,958
  7. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  8. 2023Visual Instruction Tuningcited by 7,792
  9. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  10. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
  11. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  12. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
38 more
  1. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  2. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  3. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  4. 2021Zero-Shot Text-to-Image Generationcited by 4,276
  5. 2021GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Modelscited by 3,595
  6. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  7. 2023Qwen Technical Reportcited by 3,273
  8. 2022Scaling Instruction-Finetuned Language Modelscited by 2,997
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  10. 2022Training Compute-Optimal Large Language Modelscited by 2,927
  11. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  12. 2019Benchmarking Neural Network Robustness to Common Corruptions and Perturbationscited by 2,857
  13. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  14. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  15. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,498
  16. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,179
  17. 2019A Survey on Bias and Fairness in Machine Learningcited by 1,911
  18. 2024Mixtral of Expertscited by 1,785
  19. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
  20. 2017Towards A Rigorous Science of Interpretable Machine Learningcited by 1,400
  21. 2015Flickr30k Entities: Collecting Region-to-Phrase Correspondences for Richer Image-to-Sentence Modelscited by 1,352
  22. 2016Man is to Computer Programmer as Woman is to Homemaker? Debiasing Word Embeddingscited by 1,304
  23. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  24. 2023ImageBind: One Embedding Space To Bind Them Allcited by 1,162
  25. 2019OK-VQA: A Visual Question Answering Benchmark Requiring External Knowledgecited by 1,114
  26. 2016Adversarial Machine Learning at Scalecited by 934
  27. 2017Ensemble Adversarial Training: Attacks and Defensescited by 833
  28. 2016Universal adversarial perturbationscited by 774
  29. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 685
  30. 2023The Dawn of LMMs: Preliminary Explorations with GPT-4V(ision)cited by 677
  31. 2023Unifying Large Language Models and Knowledge Graphs: A Roadmapcited by 663
  32. 2021Multimodal Few-Shot Learning with Frozen Language Modelscited by 657
  33. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 617
  34. 2023LLaMA-Adapter V2: Parameter-Efficient Visual Instruction Modelcited by 602
  35. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 560
  36. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  37. 2017Men Also Like Shopping: Reducing Gender Bias Amplification using Corpus-level Constraintscited by 420
  38. 2017Wild Patterns: Ten Years After the Rise of Adversarial Machine Learningcited by 411

50 most cited of 107 All 107 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 12; 2025: 41; 2026: 29.

82 papers.

Sort:

By area:

  1. 2025Thinking with Images for Multimodal Reasoning: Foundations, Methods, and Future Frontierscited by 193
  2. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  3. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  4. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  5. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 34
  6. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  7. 2024Look, Compare, Decide: Alleviating Hallucination in Large Vision-Language Models via Multi-View Multi-Path Reasoningcited by 23
  8. 2024The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defensecited by 20
  9. 2025ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agentscited by 19
  10. 2024Cross-Modal Safety Mechanism Transfer in Large Vision-Language Modelscited by 18
  11. 2025VLA-RAIL: A Real-Time Asynchronous Inference Linker for VLA Models and Robotscited by 18
  12. 2025FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowchartscited by 15
38 more
  1. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 14
  2. 2024LeakAgent: RL-based Red-teaming Agent for LLM Privacy Leakagecited by 13
  3. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generationcited by 12
  4. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  5. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  6. 2025Distributed LLMs and Multimodal Large Language Models: A Survey on Advances, Challenges, and Future Directionscited by 10
  7. 2024Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Modelscited by 9
  8. 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
  9. 2025From Head to Tail: Towards Balanced Representation in Large Vision-Language Models through Adaptive Data Calibrationcited by 8
  10. 2025JailBound: Jailbreaking Internal Safety Boundaries of Vision-Language Modelscited by 8
  11. 2025RoboDriveVLM: A Novel Benchmark and Baseline towards Robust Vision-Language Models for Autonomous Drivingcited by 8
  12. 2024Enhancing LLM-based Autonomous Driving Agents to Mitigate Perception Attackscited by 6
  13. 2025Med-VCD: Mitigating Hallucination for Medical Large Vision Language Models through Visual Contrastive Decodingcited by 6
  14. 2026VSearcher: Long-Horizon Multimodal Search Agent via Reinforcement Learningcited by 6
  15. 2025Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Modelscited by 5
  16. 2026Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filterscited by 5
  17. 2025Vision language models are unreliable at trivial spatial cognitioncited by 4
  18. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 4
  19. 2025Simulated Ensemble Attack: Transferring Jailbreaks Across Fine-tuned Vision-Language Modelscited by 4
  20. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 4
  21. 2026Omni-Safety under Cross-Modality Conflict: Vulnerabilities, Dynamics Mechanisms and Efficient Alignmentcited by 4
  22. 2024Mitigating Multilingual Hallucination in Large Vision-Language Modelscited by 3
  23. 2024Joint Top-Down and Bottom-Up Frameworks for 3D Visual Groundingcited by 3
  24. 2025EVADE-Bench: Multimodal Benchmark for Evaluating and Enhancing Evasive Content Detectioncited by 3
  25. 2026PA-Attack: Guiding Gray-Box Attacks on LVLM Vision Encoders with Prototypes and Attentioncited by 3
  26. 2026SlowBA: An efficiency backdoor attack towards VLM-based GUI agentscited by 3
  27. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 3
  28. 2026On the Adversarial Robustness of Multimodal LLM Judgescited by 3
  29. 2025Playing Devil's Advocate: Unmasking Toxicity and Vulnerabilities in Large Vision-Language Modelscited by 2
  30. 2025EigenShield: Causal Subspace Filtering via Random Matrix Theory for Adversarially Robust Vision-Language Modelscited by 2
  31. 2025You've Changed: Detecting Modification of Black-Box Large Language Modelscited by 2
  32. 2025Diffusion-based Cumulative Adversarial Purification for Vision Language Modelscited by 2
  33. 2025JaiLIP: Jailbreaking Vision-Language Models via Loss Guided Image Perturbationcited by 2
  34. 2025Q-MLLM: Vector Quantization for Robust Multimodal Large Language Model Securitycited by 2
  35. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  36. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 2
  37. 2026Jailbreaks on Vision Language Model via Multimodal Reasoningcited by 2
  38. 2026Self-Purification Mitigates Backdoors in Multimodal Diffusion Language Modelscited by 2

50 most cited of 82 All 82 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey
  2. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
  3. 2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models
  4. 2026Breaking the weakest link to evade vision language models
  5. 2025MTAttack: Multi-Target Backdoor Attacks against Large Vision-Language Models
  6. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models
  7. 2026Overloading Large Vision-Language Models for Jailbreaking
  8. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks