mlsanityData to 14 Oct 2026

A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations

arXiv 2502.14881 ↗First posted 14 Feb 2025cs.CR cs.CVcited by 67

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

With the rapid advancement of Large Vision-Language Models (LVLMs), ensuring their safety has emerged as a crucial area of research. This survey provides a comprehensive analysis of LVLM safety, covering key aspects such as attacks, defenses, and evaluation methods. We introduce a unified framework that integrates these interrelated components, offering a holistic perspective on the vulnerabilities of LVLMs and the corresponding mitigation strategies. Through an analysis of the LVLM lifecycle, we introduce a classification framework that distinguishes between inference and training phases, with further subcategories to provide deeper insights. Furthermore, we highlight limitations in existing research and outline future directions aimed at strengthening the robustness of LVLMs. As part of our research, we conduct a set of safety evaluations on the latest LVLM, Deepseek Janus-Pro, and provide a theoretical analysis of the results. Our findings provide strategic recommendations for advancing LVLM safety and ensuring their secure and reliable deployment in high-stakes, real-world applications. This survey aims to serve as a cornerstone for future research, facilitating the development of models that not only push the boundaries of multimodal intelligence but also adhere to the highest standards of security and ethical integrity. Furthermore, to aid the growing research in this field, we have created a public repository to continuously compile and update the latest work on LVLM safety: https://github.com/XuankunRong/Awesome-LVLM-Safety .

Key facts. Cited by 67 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 117 of its 171 references that are in the map. First posted on arXiv 14 Feb 2025.

Builds on

117 of 171 references.

Closest ancestors · 60

Same direction, newest first

  1. 2024Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment27 Nov
  2. 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks23 Nov
  3. 2024Layer-wise Alignment: Examining Safety Alignment Across Image Encoder Layers in Vision Language Models6 Nov
  4. 2024UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Models3 Nov
  5. 2024Replace-then-Perturb: Targeted Adversarial Attacks With Visual Reasoning for Vision-Language Models1 Nov
  6. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey31 Oct
  7. 2024Effective and Efficient Adversarial Detection for Vision-Language Models via A Single Vector30 Oct
  8. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves29 Oct
  9. 2024BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks28 Oct
  10. 2024Cross-Modal Safety Mechanism Transfer in Large Vision-Language Models16 Oct
  11. 2024Unraveling and Mitigating Safety Alignment Degradation of Vision-Language Models11 Oct
  12. 2024How Does Vision-Language Adaptation Impact the Safety of Vision Language Models?10 Oct
38 more
  1. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time9 Oct
  2. 2024Multimodal Situational Safety8 Oct
  3. 2024Backdooring Vision-Language Models with Out-Of-Distribution Data2 Oct
  4. 2024TrojVLM: Backdoor Attack Against Vision Language Models28 Sep
  5. 2024CoCA: Regaining Safety-awareness of Multimodal Large Language Models with Constitutional Calibration17 Sep
  6. 2024Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attacks11 Sep
  7. 2024Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models31 Jul
  8. 2024Sim-CLIP: Unsupervised Siamese Adversarial Fine-Tuning for Robust and Semantically-Rich Vision-Language Models20 Jul
  9. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul
  10. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift27 Jun
  11. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Models26 Jun
  12. 2024MOSSBench: Is Your Multimodal Language Model Oversensitive to Safe Queries?22 Jun
  13. 2024Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Model21 Jun
  14. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking21 Jun
  15. 2024Enhancing Cross-Prompt Transferability in Vision-Language Models through Contextual Injection of Target Tokens19 Jun
  16. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model17 Jun
  17. 2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Models13 Jun
  18. 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models11 Jun
  19. 2024MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Models11 Jun
  20. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  21. 2024Cross-Modal Safety Alignment: Is textual unlearning all you need?27 May
  22. 2024Safety Alignment for Vision Language Models22 May
  23. 2024Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models21 May
  24. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors17 May
  25. 2024Adversarial Robustness for Visual Grounding of Multimodal Large Language Models16 May
  26. 2024Learning To See But Forgetting To Follow: Visual Instruction Tuning Makes LLMs More Prone To Jailbreak Attacks7 May
  27. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security8 Apr
  28. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  29. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  30. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models14 Mar
  31. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  32. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions14 Mar
  33. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  34. 2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model29 Feb
  35. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  36. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Models19 Feb
  37. 2024Test-Time Backdoor Attacks on Multimodal Large Language Models13 Feb
  38. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb

50 newest of 60 All 60 (JSON)

Other references · 57

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2023Qwen Technical Reportcited by 3,344
  6. 2024LLaVA-OneVision: Easy Visual Task Transfercited by 2,719
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  8. 2023A Survey of Large Language Modelscited by 2,576
  9. 2023Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyondcited by 2,224
  10. 2024Mixtral of Expertscited by 1,823
  11. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  12. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
38 more
  1. 2023PaLM 2 Technical Reportcited by 1,162
  2. 2023Kosmos-2: Grounding Multimodal Large Language Models to the Worldcited by 1,089
  3. 2023Gemini: A Family of Highly Capable Multimodal Modelscited by 872
  4. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
  5. 2025Janus-Pro: Unified Multimodal Understanding and Generation with Data and Model Scalingcited by 812
  6. 2023Multimodal Chain-of-Thought Reasoning in Language Modelscited by 752
  7. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 625
  8. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 565
  9. 2024Large Language Models: A Surveycited by 525
  10. 2024DriveVLM: The Convergence of Autonomous Driving and Large Vision-Language Modelscited by 490
  11. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  12. 2023Trustworthy LLMs: a Survey and Guideline for Evaluating Large Language Models' Alignmentcited by 401
  13. 2024InternLM2 Technical Reportcited by 397
  14. 2023PandaGPT: One Model To Instruction-Follow Them Allcited by 334
  15. 2017Adversarial Attacks on Neural Network Policiescited by 320
  16. 2023A Survey of Reinforcement Learning from Human Feedbackcited by 264
  17. 2018Adversarial Attacks and Defences: A Surveycited by 259
  18. 2024StoryDiffusion: Consistent Self-Attention for Long-Range Image and Video Generationcited by 247
  19. 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
  20. 2024Foundational Challenges in Assuring Alignment and Safety of Large Language Modelscited by 199
  21. 2023Navigate through Enigmatic Labyrinth A Survey of Chain of Thought Reasoning: Advances, Frontiers and Futurecited by 184
  22. 2024Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Modelscited by 167
  23. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  24. 2023Instructions as Backdoors: Backdoor Vulnerabilities of Instruction Tuning for Large Language Modelscited by 110
  25. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 108
  26. 2024InferAligner: Inference-Time Alignment for Harmlessness through Cross-Model Guidancecited by 83
  27. 2020Rethinking the Trigger of Backdoor Attackcited by 77
  28. 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
  29. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 68
  30. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 62
  31. 2024LlavaGuard: An Open VLM-based Framework for Safeguarding Vision Datasets and Modelscited by 52
  32. 2023JailGuard: A Universal Detection Framework for LLM Prompt-based Attackscited by 50
  33. 2024Image Textualization: An Automatic Framework for Creating Accurate and Detailed Image Descriptionscited by 43
  34. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 34
  35. 2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Modelscited by 33
  36. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 33
  37. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Surveycited by 32
  38. 2024Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Imagecited by 26

50 most cited of 57 All 57 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 33; 2026: 34.

67 papers.

Sort:

By area:

  1. 2025Safety in Large Reasoning Models: A Surveycited by 64
  2. 2025CoT-Kinetics: A Theoretical Modeling Assessing LRM Reasoning Processcited by 51
  3. 2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 42
  4. 2025Backdoor Cleaning without External Guidance in MLLM Fine-tuningcited by 35
  5. 2025VLM2-Bench: A Closer Look at How Well VLMs Implicitly Link Explicit Matching Visual Cuescited by 33
  6. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injectioncited by 25
  7. 2025Synthetic Data is an Elegant GIFT for Continual Vision-Language Modelscited by 21
  8. 2025MVI-Bench: A Comprehensive Benchmark for Evaluating Robustness to Misleading Visual Inputs in LVLMscited by 15
  9. 2025Are Vision LLMs Road-Ready? A Comprehensive Benchmark for Safety-Critical Driving Video Understandingcited by 13
  10. 2025Are Vision-Language Models Safe in the Wild? A Meme-Based Benchmark Studycited by 12
  11. 2025SafeGRPO: Self-Rewarded Multimodal Safety Alignment via Rule-Governed Policy Optimizationcited by 12
  12. 2025LoRASculpt: Sculpting LoRA for Harmonizing General and Specialized Knowledge in Multimodal Large Language Modelscited by 11
38 more
  1. 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoringcited by 11
  2. 2025Mixed Signals: Decoding VLMs' Reasoning and Underlying Bias in Vision-Language Conflictcited by 10
  3. 2025USB: A Comprehensive and Unified Safety Evaluation Benchmark for Multimodal Large Language Modelscited by 10
  4. 2025SaFeR-VLM: Toward Safety-aware Fine-grained Reasoning in Multimodal Modelscited by 10
  5. 2025EchoBench: Benchmarking Sycophancy in Medical Large Vision-Language Modelscited by 9
  6. 2025V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMscited by 9
  7. 2025DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Promptcited by 8
  8. 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defensescited by 7
  9. 2025Implicit Jailbreak Attacks via Cross-Modal Information Concealment on Vision-Language Modelscited by 6
  10. 2025AMIA: Automatic Masking and Joint Intention Analysis Makes LVLMs Robust Jailbreak Defenderscited by 5
  11. 2025TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Modelscited by 5
  12. 2026EMO-R3: Reflective Reinforcement Learning for Emotional Reasoning in Multimodal Large Language Modelscited by 5
  13. 2026Test-Time Attention Purification for Backdoored Large Vision Language Modelscited by 5
  14. 2025QGuard:Question-based Zero-shot Guard for Multi-modal LLM Safetycited by 4
  15. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4
  16. 2026Tone Matters: The Impact of Linguistic Tone on Hallucination in VLMscited by 4
  17. 2026When Attention Betrays: Erasing Backdoor Attacks in Robotic Policies by Reconstructing Visual Tokenscited by 4
  18. 2026VisualLeakBench: Auditing the Fragility of Large Vision-Language Models against PII Leakage and Social Engineeringcited by 4
  19. 2026WARD: Adversarially Robust Defense of Web Agents Against Prompt Injectionscited by 4
  20. 2025ThanoRA: Task Heterogeneity-Aware Multi-Task Low-Rank Adaptationcited by 3
  21. 2025SIA: Enhancing Safety via Intent Awareness for Vision-Language Modelscited by 3
  22. 2025Harmonious Parameter Adaptation in Continual Visual Instruction Tuning for Safety-Aligned MLLMscited by 3
  23. 2026PA-Attack: Guiding Gray-Box Attacks on LVLM Vision Encoders with Prototypes and Attentioncited by 3
  24. 2026LLM-as-Judge Framework for Evaluating Tone-Induced Hallucination in Vision-Language Modelscited by 3
  25. 2026CBV: Clean-label Backdoor Attacks on Vision Language Models via Diffusion Modelscited by 3
  26. 2026On the Adversarial Robustness of Multimodal LLM Judgescited by 3
  27. 2025TokenFocus-VQA: Enhancing Text-to-Image Alignment with Position-Aware Focus and Multi-Perspective Aggregations on LVLMscited by 2
  28. 2025Learning to Detect Unseen Jailbreak Attacks in Large Vision-Language Modelscited by 2
  29. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  30. 2026Lingua-SafetyBench: A Benchmark for Safety Evaluation of Multilingual Vision-Language Modelscited by 2
  31. 2025VSF-Med:A Vulnerability Scoring Framework for Medical Vision-Language Modelscited by 1
  32. 2025Learning to Detect Unknown Jailbreak Attacks in Large Vision-Language Modelscited by 1
  33. 2025From Perception to Reasoning: Deep Thinking Empowers Multimodal Large Language Modelscited by 1
  34. 2026Automated Safety Benchmarking: A Multi-agent Pipeline for LVLMscited by 1
  35. 2026One-shot Optimized Steering Vector for Hallucination Mitigation for VLMscited by 1
  36. 2026AGMark: Attention-Guided Dynamic Watermarking for Large Vision-Language Modelscited by 1
  37. 2026VALD: Multi-Stage Vision Attack Detection for Efficient LVLM Defensecited by 1
  38. 2026Toward Accountable AI-Generated Content on Social Platforms: Steganographic Attribution and Multimodal Harm Detectioncited by 1

50 most cited of 67 All 67 (JSON)

Similar, not cited

Close in wording, no citation either way

  1. 2025HoliSafe: Holistic Safety Benchmarking and Modeling for Vision-Language Model
  2. 2026A Safety Report on GPT-5.2, Gemini 3 Pro, Qwen3-VL, Grok 4.1 Fast, Nano Banana Pro, and Seedream 4.5
  3. 2025Safe Vision-Language Models via Unsafe Weights Manipulation
  4. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  5. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
  6. 2025VLM-Guard: Safeguarding Vision-Language Models via Fulfilling Safety Alignment Gap
  7. 2025Spot Risks Before Speaking! Unraveling Safety Attention Heads in Large Vision-Language Models
  8. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques