mlsanityData to 14 Oct 2026

The Plot Twist: Jailbreaking Unified Multimodal Models with a Three-Act NarrativeAttack

arXiv 2509.26473 ↗First posted 30 Sep 2025cs.AIcited by 1

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Unified Multimodal Understanding and Generation Models (UMMs) increasingly combine visual understanding and image generation within a single interactive workflow, making generated visual content available as later reasoning context. However, existing jailbreak evaluations mostly study text rewriting or isolated visual prompts, leaving the safety risk of narrative cross-turn visual grounding underexplored. We propose NarrativeAttack, a semantic-preserving visual narrative jailbreak framework. NarrativeAttack employs a three-act narrative structure in which the UMM's own generator produces images for the setup (pre-event) and resolution (post-event) stages, making the full attack workflow self-contained while concealing the malicious event as a hidden climax. The attack concludes with an image-based "guessing game" that embeds the original malicious query among benign candidates, compelling the model to select and answer the most relevant one based on the established narrative context. A dynamic difficulty mechanism further enhances attack stability. Experiments show NarrativeAttack consistently surpasses prior approaches, achieving up to 88.25% ASR on Gemini-2.5-Flash. These results uncover an underdeveloped vulnerability and highlight the urgent need for safety alignment in UMMs.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 21 of its 39 references that are in the map. First posted on arXiv 30 Sep 2025.

Builds on

21 of 39 references.

Closest ancestors · 2

Same direction, newest first

  1. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection3 Jul
  2. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov

Other references · 19

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,181
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  6. 2025Emerging Properties in Unified Multimodal Pretrainingcited by 897
  7. 2025Janus-Pro: Unified Multimodal Understanding and Generation with Data and Model Scalingcited by 812
  8. 2025BLIP3-o: A Family of Fully Open Unified Multimodal Models-Architecture, Training and Datasetcited by 376
  9. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  10. 2025Show-o2: Improved Native Unified Multimodal Modelscited by 250
  11. 2024AnyGPT: Unified Multimodal LLM with Discrete Sequence Modelingcited by 217
  12. 2024COLD-Attack: Jailbreaking LLMs with Stealthiness and Controllabilitycited by 175
7 more
  1. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 125
  2. 2024LMFusion: Adapting Pretrained Language Models for Multimodal Generationcited by 120
  3. 2024Mini-Omni2: Towards Open-source GPT-4o with Vision, Speech and Duplex Capabilitiescited by 109
  4. 2025ILLUME+: Illuminating Unified MLLM with Dual Visual Tokenization and Diffusion Refinementcited by 54
  5. 2025T2ISafety: Benchmark for Assessing Fairness, Toxicity, and Privacy in Image Generationcited by 48
  6. 2025UGen: Unified Autoregressive Multimodal Model with Progressive Vocabulary Learningcited by 16
  7. 2025Rewrite to Jailbreak: Discover Learnable and Transferable Implicit Harmfulness Instructioncited by 7

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Unsafe by Reciprocity: How Generation-Understanding Coupling Undermines Safety in Unified Multimodal Modelscited by 2

Similar, not cited

Close in wording, no citation either way

  1. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injection
  2. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey
  3. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation
  4. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack
  5. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  6. 2026Red-teaming the Multimodal Reasoning: Jailbreaking Vision-Language Models via Cross-modal Entanglement Attacks
  7. 2026UnifiedAttack: Evaluating the Safety of Large Multimodal Models in Synergistic Harmful Image-Text Generation
  8. 2025Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models