Red Teaming Multimodal Language Models: Evaluating Harm Across Prompt Modalities and Models
On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness
also in 1 more
Abstract (arXiv)
Multimodal large language models (MLLMs) are increasingly used in real world applications, yet their safety under adversarial conditions remains underexplored. This study evaluates the harmlessness of four leading MLLMs (GPT-4o, Claude Sonnet 3.5, Pixtral 12B, and Qwen VL Plus) when exposed to adversarial prompts across text-only and multimodal formats. A team of 26 red teamers generated 726 prompts targeting three harm categories: illegal activity, disinformation, and unethical behaviour. These prompts were submitted to each model, and 17 annotators rated 2,904 model outputs for harmfulness using a 5-point scale. Results show significant differences in vulnerability across models and modalities. Pixtral 12B exhibited the highest rate of harmful responses (~62%), while Claude Sonnet 3.5 was the most resistant (~10%). Contrary to expectations, text-only prompts were slightly more effective at bypassing safety mechanisms than multimodal ones. Statistical analysis confirmed that both model type and input modality were significant predictors of harmfulness. These findings underscore the urgent need for robust, multimodal safety benchmarks as MLLMs are deployed more widely.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 14 of its 30 references that are in the map. First posted on arXiv 18 Sep 2025.
Builds on
14 of 30 references.
Closest ancestors · 1
Same direction, newest first
Other references · 13
- 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
- 2021Ethical and social risks of harm from Language Modelscited by 966
- 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
- 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 194
- 2021The Values Encoded in Machine Learning Researchcited by 172
- 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
- 2023Generative Language Models Exhibit Social Identity Biasescited by 111
- 2024Query-Based Adversarial Prompt Generationcited by 62
- 2025Trading Inference-Time Compute for Adversarial Robustnesscited by 61
- 2023Adversarial Attacks and Defenses in Large Language Models: Old and New Threatscited by 49
- 2024Realistic Evaluation of Toxicity in Large Language Modelscited by 15
- 2022A Prompting-based Approach for Adversarial Example Generation and Robustness Enhancementcited by 12
1 more
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2026Alignment Drift in Multimodal LLMs: A Two-Phase, Longitudinal Evaluation of Harm Across Eight Model Releases
- 2024Safety of Multimodal Large Language Models on Images and Texts
- 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 2025
- 2025Survey of Adversarial Robustness in Multimodal Large Language Models
- 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models
- 2023Language Model Unalignment: Parametric Red-Teaming to Expose Hidden Harms and Biases
- 2024MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models
- 2024ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teaming