mlsanityData to 14 Oct 2026

Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models

arXiv 2506.01307 ↗First posted 2 Jun 2025cs.CR cs.AIcited by 9

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Large Language Models (LLMs) have evolved into Multimodal Large Language Models (MLLMs), significantly enhancing their capabilities by integrating visual information and other types, thus aligning more closely with the nature of human intelligence, which processes a variety of data forms beyond just text. Despite advancements, the undesirable generation of these models remains a critical concern, particularly due to vulnerabilities exposed by text-based jailbreak attacks, which have represented a significant threat by challenging existing safety protocols. Motivated by the unique security risks posed by the integration of new and old modalities for MLLMs, we propose a unified multimodal universal jailbreak attack framework that leverages iterative image-text interactions and transfer-based strategy to generate a universal adversarial suffix and image. Our work not only highlights the interaction of image-text modalities can be used as a critical vulnerability but also validates that multimodal universal jailbreak attacks can bring higher-quality undesirable generations across different MLLMs. We evaluate the undesirable context generation of MLLMs like LLaVA, Yi-VL, MiniGPT4, MiniGPT-v2, and InstructBLIP, and reveal significant multimodal safety alignment issues, highlighting the inadequacy of current safety mechanisms against sophisticated multimodal attacks. This study underscores the urgent need for robust safety measures in MLLMs, advocating for a comprehensive review and enhancement of security protocols to mitigate potential risks associated with multimodal capabilities.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 36 of its 52 references that are in the map. First posted on arXiv 2 Jun 2025.

Builds on

36 of 52 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024MultiTrust: A Comprehensive Benchmark Towards Trustworthy Multimodal Large Language Models11 Jun
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  3. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learning24 Aug
  4. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  6. 2022Towards Adversarial Attack on Vision-Language Pre-training Models19 Jun

Other references · 30

  1. 2019PyTorch: An Imperative Style, High-Performance Deep Learning Librarycited by 20,305
  2. 2023Visual Instruction Tuningcited by 7,869
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  4. 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,234
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  6. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,876
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  8. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  9. 2023LLaVA-Med: Training a Large Language-and-Vision Assistant for Biomedicine in One Daycited by 1,305
  10. 2024MiniCPM-V: A GPT-4V Level MLLM on Your Phonecited by 1,079
  11. 2023A Survey on Multimodal Large Language Modelscited by 909
  12. 2023VideoChat: Chat-Centric Video Understandingcited by 857
18 more
  1. 2024Yi: Open Foundation Models by 01.AIcited by 719
  2. 2023CogVLM: Visual Expert for Pretrained Language Modelscited by 708
  3. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 625
  4. 2023mPLUG-Owl2: Revolutionizing Multi-modal Large Language Model with Modality Collaborationcited by 547
  5. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 469
  6. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 423
  7. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  8. 2023Pengi: An Audio Language Model for Audio Taskscited by 220
  9. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
  10. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  11. 2024Efficient Adversarial Training in LLMs with Continuous Attackscited by 113
  12. 2024Refuse Whenever You Feel Unsafe: Improving Safety in LLMs via Decoupled Refusal Trainingcited by 69
  13. 2023An Unforgeable Publicly Verifiable Watermark for Large Language Modelscited by 65
  14. 2023Self-Guard: Empower the LLM to Safeguard Itselfcited by 54
  15. 2021Towards Robust Neural Image Compression: Adversarial Attack and Model Finetuningcited by 25
  16. 2022Visual Adversarial Attacks and Defenses in the Physical World: A Surveycited by 11
  17. 2022Dynamics-aware Adversarial Attack of Adaptive Neural Networkscited by 5
  18. 2023Iterative Adversarial Attack on Image-guided Story Ending Generationcited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 5.

9 papers.

  1. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 12
  2. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 11
  3. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMscited by 3
  4. 2026One-shot Optimized Steering Vector for Hallucination Mitigation for VLMscited by 1
  5. 2026Robustness of Vision Language Models Against Split-Image Harmful Input Attackscited by 1
  6. 2026On Optimizing Multimodal Jailbreaks for Spoken Language Modelscited by 1
  7. 2025Metaphor-based Jailbreak Attacks on Text-to-Image Modelscited by 0
  8. 2026VERHallu: Evaluating and Mitigating Event Relation Hallucination in Video Large Language Modelscited by 0
  9. 2026Same Model, Different Weakness: How Language and Modality Reshape the Jailbreak Attack Surface in Frontier MLLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
  2. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking
  3. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models
  4. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models
  5. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  6. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
  7. 2024textitMMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Multimodal Large Language Models
  8. 2025E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Models