mlsanityData to 7 Oct 2026

BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks

arXiv 2410.20971 ↗First posted 28 Oct 2024cs.CV cs.AI cs.LGcited by 28

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

In this paper, we focus on black-box defense for VLMs against jailbreak attacks. Existing black-box defense methods are either unimodal or bimodal. Unimodal methods enhance either the vision or language module of the VLM, while bimodal methods robustify the model through text-image representation realignment. However, these methods suffer from two limitations: 1) they fail to fully exploit the cross-modal information, or 2) they degrade the model performance on benign inputs. To address these limitations, we propose a novel blue-team method BlueSuffix that defends target VLMs against jailbreak attacks without compromising its performance under black-box setting. BlueSuffix includes three key components: 1) a visual purifier against jailbreak images, 2) a textual purifier against jailbreak texts, and 3) a blue-team suffix generator using reinforcement fine-tuning for enhancing cross-modal robustness. We empirically show on four VLMs (LLaVA, MiniGPT-4, InstructionBLIP, and Gemini) and four safety benchmarks (Harmful Instruction, AdvBench, MM-SafetyBench, and RedTeam-2K) that BlueSuffix outperforms the baseline defenses by a significant margin. Our BlueSuffix opens up a promising direction for defending VLMs against jailbreak attacks. Code is available at https://github.com/Vinsonzyh/BlueSuffix.

Key facts. Cited by 28 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 40 of its 52 references that are in the map. First posted on arXiv 28 Oct 2024.

Builds on

40 of 52 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models8 Jun
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  3. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  4. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  5. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  6. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul

Other references · 34

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  3. 2023GPT-4 Technical Reportcited by 18,132
  4. 2022Training language models to follow instructions with human feedbackcited by 15,712
  5. 2023Visual Instruction Tuningcited by 7,792
  6. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  7. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,634
  8. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  10. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  11. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 533
  12. 2022Diffusion Models for Adversarial Purificationcited by 469
22 more
  1. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  2. 2023Detecting Language Model Attacks with Perplexitycited by 411
  3. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 401
  4. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 377
  5. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 337
  6. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  7. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 268
  8. 2024SafeDecoding: Defending against Jailbreak Attacks via Safety-Aware Decodingcited by 233
  9. 2023Defending Against Alignment-Breaking Attacks via Robustly Aligned LLMcited by 173
  10. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 172
  11. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  12. 2024Robust Prompt Optimization for Defending Language Models Against Jailbreaking Attackscited by 150
  13. 2024AutoDefense: Multi-Agent LLM Defense against Jailbreak Attackscited by 135
  14. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  15. 2023Distributional Preference Learning: Understanding and Accounting for Hidden Context in RLHFcited by 125
  16. 2024On Prompt-Driven Safeguarding for Large Language Modelscited by 109
  17. 2023Attack Prompt Generation for Red Teaming and Defending Large Language Modelscited by 73
  18. 2024SPML: A DSL for Defending Language Models Against Prompt Attackscited by 33
  19. 2024Protecting Your LLMs with Information Bottleneckcited by 26
  20. 2024Break the Breakout: Reinventing LM Defense Against Jailbreak Attacks with Self-Refinementcited by 25
  21. 2024Tiny Refinements Elicit Resilience: Toward Efficient Prefix-Model Against LLM Red-Teamingcited by 6
  22. 2024Exploring the Adversarial Capabilities of Large Language Modelscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 15; 2026: 12.

28 papers.

Sort:

By area:

  1. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  2. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  3. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 31
  4. 2025Understanding and Rectifying Safety Perception Distortion in VLMscited by 17
  5. 2025E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Modelscited by 12
  6. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  7. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attackcited by 5
  8. 2025SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMscited by 5
  9. 2025CrossGuard: Safeguarding MLLMs against Joint-Modal Implicit Malicious Attackscited by 4
  10. 2025Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gapcited by 3
  11. 2026Concept-Based Dictionary Learning for Inference-Time Safety in Vision Language Action Modelscited by 3
  12. 2025Empowering Multimodal LLMs with External Tools: A Comprehensive Surveycited by 2
16 more
  1. 2025CoDefend: Cross-Modal Collaborative Defense via Diffusion Purification and Prompt Optimizationcited by 2
  2. 2026Risk Awareness Injection: Calibrating Vision-Language Models for Safety without Compromising Utilitycited by 2
  3. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Modelscited by 1
  4. 2025Agentic Moderation: Multi-Agent Design for Safer Vision-Language Modelscited by 1
  5. 2025From Perception to Reasoning: Deep Thinking Empowers Multimodal Large Language Modelscited by 1
  6. 2025SGM: Safety Glasses for Multimodal Large Language Models via Neuron-Level Detoxificationcited by 1
  7. 2026Robustness of Vision Language Models Against Split-Image Harmful Input Attackscited by 1
  8. 2026Interactionless Inverse Reinforcement Learning: A Data-Centric Framework for Durable Alignmentcited by 1
  9. 2026Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Modelscited by 0
  10. 2026FENCE: A Financial and Multimodal Jailbreak Detection Datasetcited by 0
  11. 2026Two Birds, One Projection: Harmonizing Safety and Utility in LVLMs via Inference-time Feature Projectioncited by 0
  12. 2026REALM: A Unified Red-Teaming Benchmark for Physical-World VLMscited by 0
  13. 2026V-DEAL: Diagnosing Video Safety De-Calibration as an Understanding-Refusal Coupling Failurecited by 0
  14. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  15. 2026Text-Anchored Semantic Perturbations for Transferable Jailbreak Attacks on Multimodal Large Language Modelscited by 0
  16. 2026Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Defense-to-Attack: Bypassing Weak Defenses Enables Stronger Jailbreaks in Vision-Language Models
  2. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image
  3. 2026Every Picture Tells a Dangerous Story: Memory-Augmented Multi-Agent Jailbreak Attacks on VLMs
  4. 2026Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift
  5. 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
  6. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  7. 2025TAIJI: Textual Anchoring for Immunizing Jailbreak Images in Vision Language Models
  8. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves