Sequential Comics for Jailbreaking Multimodal Large Language Models via Structured Visual Storytelling
On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness
also in 1 more
Abstract (arXiv)
Multimodal large language models (MLLMs) exhibit remarkable capabilities but remain susceptible to jailbreak attacks exploiting cross-modal vulnerabilities. In this work, we introduce a novel method that leverages sequential comic-style visual narratives to circumvent safety alignments in state-of-the-art MLLMs. Our method decomposes malicious queries into visually innocuous storytelling elements using an auxiliary LLM, generates corresponding image sequences through diffusion models, and exploits the models' reliance on narrative coherence to elicit harmful outputs. Extensive experiments on harmful textual queries from established safety benchmarks show that our approach achieves an average attack success rate of 83.5%, surpassing prior state-of-the-art by 46%. Compared with existing visual jailbreak methods, our sequential narrative strategy demonstrates superior effectiveness across diverse categories of harmful content. We further analyze attack patterns, uncover key vulnerability factors in multimodal safety mechanisms, and evaluate the limitations of current defense strategies against narrative-driven attacks, revealing significant gaps in existing protections.
Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 39 of its 43 references that are in the map. First posted on arXiv 16 Oct 2025.
Builds on
39 of 43 references.
Closest ancestors · 9
Same direction, newest first
- 2025PRISM: Programmatic Reasoning with Image Sequence Manipulation for LVLM Jailbreaking29 Jul
- 2025Pushing the Limits of Safety: A Technical Report on the ATLAS Challenge 202514 Jun
- 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models11 Dec
- 2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models8 Jun
- 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
- 2024Learning To See But Forgetting To Follow: Visual Instruction Tuning Makes LLMs More Prone To Jailbreak Attacks7 May
- 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
- 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
- 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
Other references · 30
- 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
- 2024The Llama 3 Herd of Modelscited by 14,715
- 2023Visual Instruction Tuningcited by 7,869
- 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
- 2024GPT-4o System Cardcited by 4,588
- 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
- 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,234
- 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
- 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
- 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
- 2025Gemma 3 Technical Reportcited by 1,824
- 2023Video-LLaMA: An Instruction-tuned Audio-Visual Language Model for Video Understandingcited by 1,471
18 more
- 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
- 2023ImageBind: One Embedding Space To Bind Them Allcited by 1,175
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2023A Survey on Multimodal Large Language Modelscited by 909
- 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 785
- 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
- 2024DeepSeek-VL2: Mixture-of-Experts Vision-Language Models for Advanced Multimodal Understandingcited by 572
- 2024Jailbreak Attacks and Defenses Against Large Language Models: A Surveycited by 230
- 2024ArtPrompt: ASCII Art-based Jailbreak Attacks against Aligned LLMscited by 216
- 2024An Introduction to Vision-Language Modelingcited by 178
- 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
- 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
- 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 64
- 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 38
- 2025AGENTSAFE: Benchmarking the Safety of Embodied Agents on Hazardous Instructionscited by 38
- 2023Adversarial Illusions in Multi-Modal Embeddingscited by 29
- 2025Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findingscited by 27
- 2025Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?cited by 6
Built on by
Citing papers per year: 2026: 2.
2 papers.
Similar, not cited
Close in wording, no citation either way
- 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs
- 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack
- 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character
- 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
- 2025MIRAGE: Multimodal Immersive Reasoning and Guided Exploration for Red-Team Jailbreak Attacks
- 2026COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models
- 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
- 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering