mlsanityData to 14 Oct 2026

Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Models

arXiv 2412.05934 ↗First posted 8 Dec 2024cs.CR cs.AIcited by 33

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

With the rapid advancement of multimodal large language models (MLLMs), concerns regarding their security have increasingly captured the attention of both academia and industry. Although MLLMs are vulnerable to jailbreak attacks, designing effective jailbreak attacks poses unique challenges, especially given the highly constrained adversarial capabilities in real-world deployment scenarios. Previous works concentrate risks into a single modality, resulting in limited jailbreak performance. In this paper, we propose a heuristic-induced multimodal risk distribution jailbreak attack method, called HIMRD, which is black-box and consists of two elements: multimodal risk distribution strategy and heuristic-induced search strategy. The multimodal risk distribution strategy is used to distribute harmful semantics into multiple modalities to effectively circumvent the single-modality protection mechanisms of MLLMs. The heuristic-induced search strategy identifies two types of prompts: the understanding-enhancing prompt, which helps MLLMs reconstruct the malicious prompt, and the inducing prompt, which increases the likelihood of affirmative outputs over refusals, enabling a successful jailbreak attack. HIMRD achieves an average attack success rate (ASR) of 90% across seven open-source MLLMs and an average ASR of around 68% in three closed-source MLLMs. HIMRD reveals cross-modal security vulnerabilities in current MLLMs and underscores the imperative for developing defensive strategies to mitigate such emerging risks. Code is available at https://github.com/MaTengSYSU/HIMRD-jailbreak.

Key facts. Cited by 33 papers in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 52 of its 67 references that are in the map. First posted on arXiv 8 Dec 2024.

Builds on

52 of 67 references.

Closest ancestors · 9

Same direction, newest first

  1. 2024Perception-guided Jailbreak against Text-to-Image Models20 Aug
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  3. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  4. 2024SafeGen: Mitigating Sexually Explicit Content Generation in Text-to-Image Models10 Apr
  5. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  6. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  7. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  8. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  9. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 43

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2024GPT-4o System Cardcited by 4,588
  5. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  6. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
  7. 2023Qwen Technical Reportcited by 3,344
  8. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  9. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  10. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,224
  11. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  12. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
31 more
  1. 2024ChatGLM: A Family of Large Language Models from GLM-130B to GLM-4 All Toolscited by 1,121
  2. 2023A Survey on Multimodal Large Language Modelscited by 909
  3. 2024Yi: Open Foundation Models by 01.AIcited by 719
  4. 2017Evasion Attacks against Machine Learning at Test Timecited by 689
  5. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  6. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  7. 2024Large Language Models: A Surveycited by 525
  8. 2020Overfitting in adversarially robust deep learningcited by 506
  9. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
  10. 2024A Systematic Survey of Prompt Engineering in Large Language Models: Techniques and Applicationscited by 431
  11. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 274
  12. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 240
  13. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attackscited by 230
  14. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  15. 2024Improved Techniques for Optimization-Based Jailbreaking on Large Language Modelscited by 110
  16. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 108
  17. 2024Making Them Ask and Answer: Jailbreaking Large Language Models in Few Queries via Disguise and Reconstructioncited by 107
  18. 2024A Comprehensive Survey on Process-Oriented Automatic Text Summarization with Exploration of LLM-Based Methodscited by 102
  19. 2024Red Teaming Visual Language Modelscited by 65
  20. 2024Towards Understanding Jailbreak Attacks in LLMs: A Representation Space Analysiscited by 64
  21. 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
  22. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  23. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attackscited by 38
  24. 2020Large-Scale Object Detection in the Wild from Imbalanced Multi-Labelscited by 35
  25. 2023Improving Fast Adversarial Training with Prior-Guided Knowledgecited by 35
  26. 2021GAIA: A Transfer Learning System of Object Detection that Fits Your Needscited by 27
  27. 2024Surveying the MLLM Landscape: A Meta-Review of Current Surveyscited by 20
  28. 2024Gibberish is All You Need for Membership Inference Detection in Contrastive Language-Audio Pretrainingcited by 10
  29. 2024Texture Re-scalable Universal Adversarial Perturbationcited by 9
  30. 2024Global Challenge for Safe and Secure LLMs Track 1cited by 4
  31. 2024Enhancing LLM-Based Human-Robot Interaction with Nuances for Diversity Awarenesscited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 22; 2026: 11.

33 papers.

Sort:

By area:

  1. 2025Advances and Challenges in Foundation Agents: From Brain-Inspired Intelligence to Evolutionary, Collaborative, and Safe Systemscited by 126
  2. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  3. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 67
  4. 2025One Shot Dominance: Knowledge Poisoning Attack on Retrieval-Augmented Generation Systemscited by 28
  5. 2025Oyster-I: Beyond Refusal -- Constructive Safety Alignment for Responsible Language Modelscited by 19
  6. 2025Strata-Sword: A Hierarchical Safety Evaluation towards LLMs based on Reasoning Complexity of Jailbreak Instructionscited by 11
  7. 2025FORCE: Transferable Visual Jailbreaking Attacks via Feature Over-Reliance CorrEctioncited by 11
  8. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 11
  9. 2025DynamicID: Zero-Shot Multi-ID Image Personalization with Flexible Facial Editabilitycited by 10
  10. 2025Cannot See the Forest for the Trees: Invoking Heuristics and Biases to Elicit Irrational Choices of LLMscited by 9
  11. 2025Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganographycited by 8
  12. 2025Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Modelscited by 6
21 more
  1. 2025EcoAlign: An Economically Rational Framework for Efficient LVLM Alignmentcited by 5
  2. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attackcited by 5
  3. 2026Evolving Contextual Safety in Multi-Modal Large Language Models via Inference-Time Self-Reflective Memorycited by 5
  4. 2025Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalizationcited by 4
  5. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4
  6. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
  7. 2025Effective Black-Box Multi-Faceted Attacks Breach Vision Large Language Model Guardrailscited by 3
  8. 2025PRISM: Programmatic Reasoning with Image Sequence Manipulation for LVLM Jailbreakingcited by 3
  9. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMscited by 3
  10. 2026The Side Effects of Being Smart: Safety Risks in MLLMs' Multi-Image Reasoningcited by 3
  11. 2025Empowering Multimodal LLMs with External Tools: A Comprehensive Surveycited by 2
  12. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputscited by 2
  13. 2026MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMscited by 1
  14. 2026Improving Safety Alignment via Balanced Direct Preference Optimizationcited by 1
  15. 2026Adversarial Style Optimization: Enhancing VLM Jailbreaks by GRPO-based Stylistic Triggers Optimizationcited by 1
  16. 2025VisuoAlign: Safety Alignment of LVLMs with Multimodal Tree Searchcited by 0
  17. 2025Information-Dense Reasoning for Efficient and Auditable Security Alert Triagecited by 0
  18. 2026Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Modelscited by 0
  19. 2026Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMscited by 0
  20. 2026PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Modelscited by 0
  21. 2026Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Probabilistic Modeling of Jailbreak on Multimodal LLMs: From Quantification to Application
  2. 2024textitMMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Multimodal Large Language Models
  3. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Models
  4. 2025Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses
  5. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking
  6. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency
  7. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Survey
  8. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Models