mlsanityData to 13 Oct 2026

VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Models

arXiv 2510.17759 ↗First posted 20 Oct 2025cs.CR cs.CL cs.CVcited by 1

On the map: LLM reasoning → Reasoning for agents, planning and code

also in 2 more
Abstract (arXiv)

Vision-Language Models (VLMs) extend large language models with visual reasoning, but their multimodal design also introduces new, underexplored vulnerabilities. Existing multimodal red-teaming methods largely rely on brittle templates, focus on single-attack settings, and expose only a narrow subset of vulnerabilities. To address these limitations, we introduce VERA-V, a variational inference framework that recasts multimodal jailbreak discovery as learning a joint posterior distribution over paired text-image prompts. This probabilistic view enables the generation of stealthy, coupled adversarial inputs that bypass model guardrails. We train a lightweight attacker to approximate the posterior, allowing efficient sampling of diverse jailbreaks and providing distributional insights into vulnerabilities. VERA-V further integrates three complementary strategies: (i) typography-based text prompts that embed harmful cues, (ii) diffusion-based image synthesis that introduces adversarial signals, and (iii) structured distractors to fragment VLM attention. Experiments on HarmBench and HADES benchmarks show that VERA-V consistently outperforms state-of-the-art baselines on both open-source and frontier VLMs, achieving up to 53.75% higher attack success rate (ASR) over the best baseline on GPT-4o. We include the code on the project page available here: https://github.com/kxwhiowo/VERA-V

Key facts. Cited by 1 paper in the map (data through 13 Oct 2026). Placed in Reasoning for agents, planning and code, one of 17 directions in LLM reasoning. Builds on 31 of its 36 references that are in the map. First posted on arXiv 20 Oct 2025.

Builds on

31 of 36 references.

References · 31

  1. 2023Visual Instruction Tuningcited by 7,827
  2. 2025Qwen2.5-VL Technical Reportcited by 5,499
  3. 2024Scaling Rectified Flow Transformers for High-Resolution Image Synthesiscited by 4,130
  4. 2025InternVL3: Exploring Advanced Training and Test-Time Recipes for Open-Source Multimodal Modelscited by 1,798
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,405
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,404
  7. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 664
  8. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Promptscited by 394
  9. 2024A StrongREJECT for Empty Jailbreakscited by 379
  10. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 326
  11. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Modelscited by 272
  12. 2024AdvPrompter: Fast Adaptive Adversarial Prompting for LLMscited by 156
19 more
  1. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 134
  2. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Modelscited by 133
  3. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Modelscited by 87
  4. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 66
  5. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 61
  6. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Timecited by 59
  7. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Imagecited by 56
  8. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 45
  9. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 42
  10. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attackscited by 38
  11. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselvescited by 36
  12. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreakingcited by 36
  13. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 32
  14. 2024BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attackscited by 28
  15. 2024RL-JACK: Reinforcement Learning-powered Black-box Jailbreaking Attack against LLMscited by 23
  16. 2024The VLLM Safety Paradox: Dual Ease in Jailbreak Attack and Defensecited by 21
  17. 2024Learning To See But Forgetting To Follow: Visual Instruction Tuning Makes LLMs More Prone To Jailbreak Attackscited by 15
  18. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steeringcited by 10
  19. 2025VERA: Variational Inference Framework for Jailbreaking Large Language Modelscited by 4

Built on by

Cited by year (2026 to 13 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Conceal, Reconstruct, Jailbreak: Exploiting the Reconstruction-Concealment Tradeoff in MLLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Jailbreaks on Vision Language Model via Multimodal Reasoning
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt
  3. 2025TAIJI: Textual Anchoring for Immunizing Jailbreak Images in Vision Language Models
  4. 2025Dynamic Token Reweighting for Robust Vision-Language Models
  5. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models
  6. 2024Failures to Find Transferable Image Jailbreaks Between Vision-Language Models
  7. 2025Cross-Modal Obfuscation for Jailbreak Attacks on Large Vision-Language Models
  8. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Models