mlsanityData to 14 Oct 2026

PiCo: Jailbreaking Multimodal Large Language Models via Pictorial Code Contextualization

arXiv 2504.01444 ↗First posted 2 Apr 2025cs.CR cs.AIcited by 8

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Multimodal Large Language Models (MLLMs), which integrate vision and other modalities into Large Language Models (LLMs), significantly enhance AI capabilities but also introduce new security vulnerabilities. By exploiting the vulnerabilities of the visual modality and the long-tail distribution characteristic of code training data, we present PiCo, a novel jailbreaking framework designed to progressively bypass multi-tiered defense mechanisms in advanced MLLMs. PiCo employs a tier-by-tier jailbreak strategy, using token-level typographic attacks to evade input filtering and embedding harmful intent within programming context instructions to bypass runtime monitoring. To comprehensively assess the impact of attacks, a new evaluation metric is further proposed to assess both the toxicity and helpfulness of model outputs post-attack. By embedding harmful intent within code-style visual instructions, PiCo achieves an average Attack Success Rate (ASR) of 84.13% on Gemini-Pro Vision and 52.66% on GPT-4, surpassing previous methods. Experimental results highlight the critical gaps in current defenses, underscoring the need for more robust strategies to secure advanced MLLMs.

Key facts. Cited by 8 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 39 of its 47 references that are in the map. First posted on arXiv 2 Apr 2025.

Builds on

39 of 47 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  2. 2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model29 Feb
  3. 2024Red Teaming Visual Language Models23 Jan
  4. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance5 Jan
  5. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  6. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  7. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 32

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2023Visual Instruction Tuningcited by 7,869
  3. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
  4. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,876
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  8. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  10. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  11. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  12. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,055
20 more
  1. 2023ShareGPT4V: Improving Large Multi-Modal Models with Better Captionscited by 1,005
  2. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
  3. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  4. 2023"Do Anything Now": Characterizing and Evaluating In-The-Wild Jailbreak Prompts on Large Language Modelscited by 489
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  6. 2023Detecting Language Model Attacks with Perplexitycited by 431
  7. 2023Safety-Tuned LLaMAs: Lessons From Improving the Safety of Large Language Models that Follow Instructionscited by 387
  8. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  9. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  10. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  11. 2024AmpleGCG: Learning a Universal and Transferable Generative Model of Adversarial Suffixes for Jailbreaking Both Open and Closed LLMscited by 172
  12. 2024CodeChameleon: Personalized Encryption Framework for Jailbreaking Large Language Modelscited by 76
  13. 2023The Art of Defending: A Systematic Evaluation and Analysis of LLM Defense Strategies on Safety and Over-Defensivenesscited by 67
  14. 2024EasyJailbreak: A Unified Framework for Jailbreaking Large Language Modelscited by 60
  15. 2023Self-Guard: Empower the LLM to Safeguard Itselfcited by 54
  16. 2024Breaking Down the Defenses: A Comparative Survey of Attacks on Large Language Modelscited by 44
  17. 2024Defensive Prompt Patch: A Robust and Interpretable Defense of LLMs against Jailbreak Attackscited by 37
  18. 2024All in How You Ask for It: Simple Black-Box Method for Jailbreak Attackscited by 32
  19. 2024AttackEval: How to Evaluate the Effectiveness of Jailbreak Attacking on Large Language Modelscited by 28
  20. 2024AI Risk Management Should Incorporate Both Safety and Securitycited by 17

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 5; 2026: 3.

8 papers.

  1. 2025Guardians and Offenders: A Survey on Harmful Content Generation and Safety Mitigation of LLMcited by 9
  2. 2025Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensitycited by 4
  3. 2025AntiDote: Bi-level Adversarial Training for Tamper-Resistant LLMscited by 4
  4. 2025Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilitiescited by 3
  5. 2026TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Explorationcited by 3
  6. 2025Multi-Level Safety Continual Projection for Fine-Tuned Large Language Models without Retrainingcited by 2
  7. 2026When Understanding Becomes a Risk: Authenticity and Safety Risks in the Emerging Image Generation Paradigmcited by 2
  8. 2026Paraphrase-Induced Output-Mode Collapse: When LLMs Break Character Under Semantically Equivalent Inputscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses
  2. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection
  3. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  4. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
  5. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs
  6. 2024textitMMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Multimodal Large Language Models
  7. 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
  8. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs