mlsanityData to 14 Oct 2026

Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models

arXiv 2411.18000 ↗First posted 27 Nov 2024cs.CVcited by 12

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 2 more
Abstract (arXiv)

Despite inheriting security measures from underlying language models, Vision-Language Models (VLMs) may still be vulnerable to safety alignment issues. Through empirical analysis, we uncover two critical findings: scenario-matched images can significantly amplify harmful outputs, and contrary to common assumptions in gradient-based attacks, minimal loss values do not guarantee optimal attack effectiveness. Building on these insights, we introduce MLAI (Multi-Loss Adversarial Images), a novel jailbreak framework that leverages scenario-aware image generation for semantic alignment, exploits flat minima theory for robust adversarial image selection, and employs multi-image collaborative attacks for enhanced effectiveness. Extensive experiments demonstrate MLAI's significant impact, achieving attack success rates of 77.75% on MiniGPT-4 and 82.80% on LLaVA-2, substantially outperforming existing methods by margins of 34.37% and 12.77% respectively. Furthermore, MLAI shows considerable transferability to commercial black-box VLMs, achieving up to 60.11% success rate. Our work reveals fundamental visual vulnerabilities in current VLMs safety mechanisms and underscores the need for stronger defenses. Warning: This paper contains potentially harmful example text.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 29 of its 34 references that are in the map. First posted on arXiv 27 Nov 2024.

Builds on

29 of 34 references.

Closest ancestors · 8

Same direction, newest first

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  2. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  3. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  4. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  5. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  6. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  7. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  8. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 21

  1. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  2. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  3. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  4. 2023MMBench: Is Your Multi-modal Model an All-around Player?cited by 2,141
  5. 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,652
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  8. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  9. 2022Red Teaming Language Models with Language Modelscited by 1,026
  10. 2023SEED-Bench: Benchmarking Multimodal LLMs with Generative Comprehensioncited by 940
  11. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  12. 2023Large Language Modelscited by 780
9 more
  1. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 625
  2. 2023Shadow Alignment: The Ease of Subverting Safely-Aligned Language Modelscited by 297
  3. 2023Pretraining Language Models with Human Preferencescited by 247
  4. 2023SafetyBench: Evaluating the Safety of Large Language Modelscited by 199
  5. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 145
  6. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  7. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 108
  8. 2023Jailbreaking GPT-4V via Self-Adversarial Attacks with System Promptscited by 65
  9. 2023Robustness Over Time: Understanding Adversarial Examples' Effectiveness on Longitudinal Versions of Large Language Modelscited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 6; 2026: 6.

12 papers.

  1. 2025A Survey of LLM-Driven AI Agent Communication: Protocols, Security Risks, and Defense Countermeasurescited by 57
  2. 2025Video-SafetyBench: A Benchmark for Safety Evaluation of Video LVLMscited by 28
  3. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  4. 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025cited by 12
  5. 2025FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctioncited by 11
  6. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Modelscited by 4
  7. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
  8. 2025Watch, Listen, Understand, Mislead: Tri-modal Adversarial Attacks on Short Videos for Content Appropriateness Evaluationcited by 2
  9. 2026Robustness of Vision Language Models Against Split-Image Harmful Input Attackscited by 1
  10. 2026STARE: Step-wise Temporal Alignment and Red-teaming Engine for Multi-modal Toxicity Attackcited by 0
  11. 2026New Wide-Net-Casting Jailbreak Attacks Risk Large Modelscited by 0
  12. 2026Overloading Large Vision-Language Models for Jailbreakingcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Tit-for-Tat: Safeguarding Large Vision-Language Models Against Jailbreak Attacks via Adversarial Defense
  2. 2025JaiLIP: Jailbreaking Vision-Language Models via Loss Guided Image Perturbation
  3. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  4. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  5. 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Models
  6. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
  7. 2026Breaking the weakest link to evade vision language models
  8. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models