LingoLoop Attack: Trapping MLLMs via Linguistic Context and State Entrapment into Endless Loops

arXiv 2506.14493 ↗First posted 17 Jun 2025cs.CL cs.CRcited by 9

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Multimodal Large Language Models (MLLMs) have shown great promise but require substantial computational resources during inference. Attackers can exploit this by inducing excessive output, leading to resource exhaustion and service degradation. Prior energy-latency attacks aim to increase generation time by broadly shifting the output token distribution away from the EOS token, but they neglect the influence of token-level Part-of-Speech (POS) characteristics on EOS and sentence-level structural patterns on output counts, limiting their efficacy. To address this, we propose LingoLoop, an attack designed to induce MLLMs to generate excessively verbose and repetitive sequences. First, we find that the POS tag of a token strongly affects the likelihood of generating an EOS token. Based on this insight, we propose a POS-Aware Delay Mechanism to postpone EOS token generation by adjusting attention weights guided by POS information. Second, we identify that constraining output diversity to induce repetitive loops is effective for sustained generation. We introduce a Generative Path Pruning Mechanism that limits the magnitude of hidden states, encouraging the model to produce persistent loops. Extensive experiments on models like Qwen2.5-VL-3B demonstrate LingoLoop's powerful ability to trap them in generative loops; it consistently drives them to their generation limits and, when those limits are relaxed, can induce outputs with up to 367x more tokens than clean inputs, triggering a commensurate surge in energy consumption. These findings expose significant MLLMs' vulnerabilities, posing challenges for their reliable deployment.

Key facts. Cited by 9 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 30 of its 39 references that are in the map. First posted on arXiv 17 Jun 2025.

Builds on

30 of 39 references.

Closest ancestors · 2

Same direction, newest first

Other references · 28

2014Microsoft COCO: Common Objects in Contextcited by 17,608
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
2025Qwen2.5-VL Technical Reportcited by 5,587
2024Qwen2.5 Technical Reportcited by 4,942
2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,876
2024Expanding Performance Boundaries of Open-Source Multimodal Models with Model, Data, and Test-Time Scalingcited by 1,599
2024Enhancing the Reasoning Ability of Multimodal Large Language Models via Mixed Preference Optimizationcited by 239
2023OneLLM: One Framework to Align All Modalities with Languagecited by 187
2020Sponge Examples: Energy-Latency Attacks on Neural Networkscited by 111
2024Coercing LLMs to do and reveal (almost) anythingcited by 89
2020A Panda? No, It's a Sloth: Slowdown Attacks on Adaptive Multi-Exit Neural Network Inferencecited by 61

16 more

2024Multimodal Needle in a Haystack: Benchmarking Long-Context Capability of Multimodal Large Language Modelscited by 55
2022NICGSlowDown: Evaluating the Efficiency Robustness of Neural Image Caption Generation Modelscited by 50
2025GuardReasoner-VL: Safeguarding VLMs via Reinforced Reasoningcited by 42
2024Denial-of-Service Poisoning Attacks against Large Language Modelscited by 35
2024Crabs: Consuming Resource via Auto-generation for LLM-DoS Attack under Black-box Settingscited by 35
2024MMIE: Massive Multimodal Interleaved Comprehension Benchmark for Large Vision-Language Modelscited by 33
2025MicroVQA: A Multimodal Reasoning Benchmark for Microscopy-Based Scientific Researchcited by 32
2024An Engorgio Prompt Makes Large Language Model Babble oncited by 30
2022Energy-Latency Attacks via Sponge Poisoningcited by 29
2022Phantom Sponges: Exploiting Non-Maximum Suppression to Attack Deep Object Detectorscited by 28
2024V2PE: Improving Multimodal Long-Context Capability of Vision-Language Models with Variable Visual Position Encodingcited by 28
2024MM-Soc: Benchmarking Multimodal Large Language Models in Social Media Platformscited by 26
2023Dynamic Transformers Provide a False Sense of Efficiencycited by 14
2024Energy-Latency Manipulation of Multi-modal Large Language Models via Verbose Samplescited by 14
2024Multimodal Commonsense Knowledge Distillation for Visual Question Answeringcited by 11
2023Energy-Latency Attacks to On-Device Neural Networks via Sponge Poisoningcited by 10

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 1; 2026: 8.

9 papers.

2026ReasoningBomb: A Stealthy Denial-of-Service Attack by Inducing Pathologically Long Reasoning in Large Reasoning Modelscited by 5
2026VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijackingcited by 4
2026BenchOverflow: Measuring Overflow in Large Language Models via Plain-Text Promptscited by 3
2026Decoding by Perturbation: Mitigating MLLM Hallucinations via Dynamic Textual Perturbationcited by 3
2025Resource Consumption Red-Teaming for Large Vision-Language Modelscited by 2
2026Rethinking Latency Denial-of-Service: Attacking the LLM Serving Framework, Not the Modelcited by 2
2026Resource Consumption Threats in Large Language Modelscited by 2
2026Structure-Guided Visual Perturbation Neutralization for LVLMscited by 0
2026Uncovering Uncontrolled Repetition through Residual Stream Dynamicscited by 0

Similar, not cited

Close in wording, no citation either way