mlsanityData to 7 Oct 2026

Failures to Find Transferable Image Jailbreaks Between Vision-Language Models

arXiv 2407.15211 ↗First posted 21 Jul 2024cs.CL cs.AI cs.CRcited by 27

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

The integration of new modalities into frontier AI systems offers exciting capabilities, but also increases the possibility such systems can be adversarially manipulated in undesirable ways. In this work, we focus on a popular class of vision-language models (VLMs) that generate text outputs conditioned on visual and textual inputs. We conducted a large-scale empirical study to assess the transferability of gradient-based universal image ``jailbreaks" using a diverse set of over 40 open-parameter VLMs, including 18 new VLMs that we publicly release. Overall, we find that transferable gradient-based image jailbreaks are extremely difficult to obtain. When an image jailbreak is optimized against a single VLM or against an ensemble of VLMs, the jailbreak successfully jailbreaks the attacked VLM(s), but exhibits little-to-no transfer to any other VLMs; transfer is not affected by whether the attacked and target VLMs possess matching vision backbones or language models, whether the language model underwent instruction-following and/or safety-alignment training, or many other factors. Only two settings display partially successful transfer: between identically-pretrained and identically-initialized VLMs with slightly different VLM training data, and between different training checkpoints of a single VLM. Leveraging these results, we then demonstrate that transfer can be significantly improved against a specific target VLM by attacking larger ensembles of ``highly-similar" VLMs. These results stand in stark contrast to existing evidence of universal and transferable text jailbreaks against language models and transferable adversarial attacks against image classifiers, suggesting that VLMs may be more robust to gradient-based transfer attacks.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 28 of its 115 references that are in the map. First posted on arXiv 21 Jul 2024.

Builds on

28 of 115 references.

Closest ancestors · 3

Same direction, newest first

  1. 2024Self-interpreting Adversarial Images12 Jul
  2. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  3. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep

Other references · 25

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  4. 2024Refusal in Language Models Is Mediated by a Single Directioncited by 960
  5. 2024Gemma: Open Models Based on Gemini Research and Technologycited by 889
  6. 2023Gemini: A Family of Highly Capable Multimodal Modelscited by 810
  7. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  8. 2024Safety Alignment Should Be Made More Than Just a Few Tokens Deepcited by 450
  9. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  10. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  11. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  12. 2024A Mechanistic Understanding of Alignment Algorithms: A Case Study on DPO and Toxicitycited by 179
13 more
  1. 2023Model evaluation for extreme riskscited by 167
  2. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  3. 2024Defending Against Unforeseen Failure Modes with Latent Adversarial Trainingcited by 82
  4. 2024What Makes and Breaks Safety Fine-tuning? A Mechanistic Studycited by 54
  5. 2018Understanding and Enhancing the Transferability of Adversarial Examplescited by 41
  6. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40
  7. 2024Understanding Jailbreak Success: A Study of Latent Space Dynamics in Large Language Modelscited by 34
  8. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 32
  9. 2021Reading Isn't Believing: Adversarial Attacks On Multi-Modal Neuronscited by 29
  10. 2024Exploring the Transferability of Visual Prompting for Multimodal Large Language Modelscited by 15
  11. 2024Investigating Adversarial Trigger Transfer in Large Language Modelscited by 4
  12. 2023Instance-Level Trojan Attacks on Visual Question Answering via Adversarial Learning in Neuron Activation Spacecited by 3
  13. 2023Multi-attacks: Many images + the same adversarial attack → many target labelscited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 4; 2025: 13; 2026: 10.

27 papers.

Sort:

By area:

  1. 2024Best-of-N Jailbreakingcited by 71
  2. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  3. 2025Adversarial Attacks on Robotic Vision Language Action Modelscited by 31
  4. 2025Jailbreak-AudioBench: In-Depth Evaluation and Analysis of Jailbreak Threats for Large Audio Language Modelscited by 17
  5. 2026CaMeLs Can Use Computers Too: System-level Security for Computer Use Agentscited by 15
  6. 2024Gradient-based Jailbreak Images for Multimodal Fusion Modelscited by 13
  7. 2024Ensemble everything everywhere: Multi-scale aggregation for adversarial robustnesscited by 12
  8. 2025MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agentscited by 12
  9. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 11
  10. 2025FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctioncited by 11
  11. 2025Speech-Audio Compositional Attacks on Multimodal LLMs and Their Mitigation with SALMONN-Guardcited by 8
  12. 2025"I am bad": Interpreting Stealthy, Universal and Robust Audio Jailbreaks in Audio-Language Modelscited by 7
15 more
  1. 2024Jailbreak Defense in a Narrow Domain: Limitations of Existing Methods and a New Transcript-Classifier Approachcited by 6
  2. 2025Jailbreak Transferability Emerges from Shared Representationscited by 5
  3. 2025Simulated Ensemble Attack: Transferring Jailbreaks Across Fine-tuned Vision-Language Modelscited by 4
  4. 2026Less Is More -- Until It Breaks: Security Pitfalls of Vision Token Compression in Large Vision-Language Modelscited by 4
  5. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Modelscited by 4
  6. 2025Disrupting Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Modelscited by 2
  7. 2026Visual Token Compression Enhances Robustness of MLLMscited by 2
  8. 2025VISOR++: Universal Visual Inputs based Steering for Large Vision Language Modelscited by 1
  9. 2026Furina: Fragmented Uncertainty-Driven Refusal Instability Attackcited by 1
  10. 2025Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeedcited by 0
  11. 2026Laundering AI Authority with Adversarial Examplescited by 0
  12. 2026Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximizationcited by 0
  13. 2026Overloading Large Vision-Language Models for Jailbreakingcited by 0
  14. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMscited by 0
  15. 2026VEX-Bench: Benchmarking Verification Complexity of LLM-Generated Misinformationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Robustness of Vision Language Models Against Split-Image Harmful Input Attacks
  2. 2025JaiLIP: Jailbreaking Vision-Language Models via Loss Guided Image Perturbation
  3. 2026Mosaic: Multimodal Jailbreak against Closed-Source VLMs via Multi-View Ensemble Optimization
  4. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves
  5. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models
  6. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models
  7. 2026Jailbreaks on Vision Language Model via Multimodal Reasoning
  8. 2024Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models