mlsanityData to 14 Oct 2026

Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack

arXiv 2505.21967 ↗First posted 28 May 2025cs.CLcited by 5

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Large Vision-Language Models (LVLMs) have shown remarkable capabilities across a wide range of multimodal tasks. However, their integration of visual inputs introduces expanded attack surfaces, thereby exposing them to novel security vulnerabilities. In this work, we conduct a systematic representational analysis to uncover why conventional adversarial attacks can circumvent the safety mechanisms embedded in LVLMs. We further propose a novel two stage evaluation framework for adversarial attacks on LVLMs. The first stage differentiates among instruction non compliance, outright refusal, and successful adversarial exploitation. The second stage quantifies the degree to which the model's output fulfills the harmful intent of the adversarial prompt, while categorizing refusal behavior into direct refusals, soft refusals, and partial refusals that remain inadvertently helpful. Finally, we introduce a normative schema that defines idealized model behavior when confronted with harmful prompts, offering a principled target for safety alignment in multimodal systems.

Key facts. Cited by 5 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 29 of its 44 references that are in the map. First posted on arXiv 28 May 2025.

Builds on

29 of 44 references.

Closest ancestors · 15

Same direction, newest first

  1. 2025ELITE: Enhanced Language-Image Toxicity Evaluation for Safety7 Feb
  2. 2025Rethinking Bottlenecks in Safety Fine-Tuning of Vision Language Models30 Jan
  3. 2024BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks28 Oct
  4. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time9 Oct
  5. 2024Multimodal Situational Safety8 Oct
  6. 2024Safe Inputs but Unsafe Output: Benchmarking Cross-modality Safety Alignment of Large Vision-Language Model21 Jun
  7. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors17 May
  8. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  9. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  10. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
  11. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  12. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
3 more
  1. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  2. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  3. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 14

  1. 2022Training language models to follow instructions with human feedbackcited by 15,971
  2. 2017Proximal Policy Optimization Algorithmscited by 15,215
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  4. 2023Visual Instruction Tuningcited by 7,869
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2023InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Taskscited by 2,565
  7. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  8. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  9. 2023Catastrophic Jailbreak of Open-source LLMs via Exploiting Generationcited by 451
  10. 2024A StrongREJECT for Empty Jailbreakscited by 385
  11. 2023Are aligned neural networks adversarially aligned?cited by 315
  12. 2024Towards Interpreting Visual Information Processing in Vision-Language Modelscited by 122
2 more
  1. 2024Interpreting and Editing Vision-Language Representations to Mitigate Hallucinationscited by 104
  2. 2024The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defensecited by 21

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 3; 2026: 2.

5 papers.

  1. 2025SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMscited by 5
  2. 2025Agentic Moderation: Multi-Agent Design for Safer Vision-Language Modelscited by 2
  3. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  4. 2026Break the Brake, Not the Wheel: Untargeted Jailbreak via Entropy Maximizationcited by 0
  5. 2026The Uncontrolled Variable: Vision-Language Model Refusal Responds to Image Presence in Ways Risk Cannot Explaincited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  2. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey
  3. 2026Breaking the weakest link to evade vision language models
  4. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  5. 2026Exploring Adversarial Robustness and Safety Alignment in Multilingual Multi-Modal Large Language Models
  6. 2025Tit-for-Tat: Safeguarding Large Vision-Language Models Against Jailbreak Attacks via Adversarial Defense
  7. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  8. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey