mlsanityData to 7 Oct 2026

Phi: Preference Hijacking in Multi-modal Large Language Models at Inference Time

arXiv 2509.12521 ↗First posted 15 Sep 2025cs.LGcited by 1

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Recently, Multimodal Large Language Models (MLLMs) have gained significant attention across various domains. However, their widespread adoption has also raised serious safety concerns. In this paper, we uncover a new safety risk of MLLMs: the output preference of MLLMs can be arbitrarily manipulated by carefully optimized images. Such attacks often generate contextually relevant yet biased responses that are neither overtly harmful nor unethical, making them difficult to detect. Specifically, we introduce a novel method, Preference Hijacking (Phi), for manipulating the MLLM response preferences using a preference hijacked image. Our method works at inference time and requires no model modifications. Additionally, we introduce a universal hijacking perturbation -- a transferable component that can be embedded into different images to hijack MLLM responses toward any attacker-specified preferences. Experimental results across various tasks demonstrate the effectiveness of our approach. The code for Phi is accessible at https://github.com/Yifan-Lan/Phi.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 29 of its 45 references that are in the map. First posted on arXiv 15 Sep 2025.

Builds on

29 of 45 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images20 Jan
  2. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov

Other references · 27

  1. 2024The Llama 3 Herd of Modelscited by 14,192
  2. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  3. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 7,916
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  6. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  8. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  9. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  10. 2023Steering Llama 2 via Contrastive Activation Additioncited by 1,009
  11. 2022Red Teaming Language Models with Language Modelscited by 983
  12. 2017VGGFace2: A dataset for recognising faces across pose and agecited by 911
15 more
  1. 2022Discovering Language Model Behaviors with Model-Written Evaluationscited by 805
  2. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  3. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  4. 2017Countering Adversarial Images using Input Transformationscited by 517
  5. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  6. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  7. 2023Explore, Establish, Exploit: Red Teaming Language Models from Scratchcited by 111
  8. 2023The Earth is Flat because...: Investigating LLMs' Belief towards Misinformation via Persuasive Conversationcited by 107
  9. 2023FLIRT: Feedback Loop In-context Red Teamingcited by 81
  10. 2023From Prompt Injections to SQL Injection Attacks: How Protected is Your LLM-Integrated Web Application?cited by 53
  11. 2017NO Need to Worry about Adversarial Examples in Object Detection in Autonomous Vehiclescited by 48
  12. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40
  13. 2024Adversarial Perturbations Cannot Reliably Protect Artists From Generative AIcited by 38
  14. 2024PICLe: Eliciting Diverse Behaviors from Large Language Models with Persona In-Context Learningcited by 28
  15. 2017Combining Weakly and Webly Supervised Learning for Classifying Food Imagescited by 17

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Forced Deferral: Manipulating Routing Decisions in Multimodal LLM Cascadescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
  2. 2025Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models?
  3. 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models
  4. 2026SafeSteer: A Decoding-level Defense Mechanism for Multimodal Large Language Models
  5. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance
  6. 2026Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection
  7. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security
  8. 2024Modality-Fair Preference Optimization for Trustworthy MLLM Alignment