mlsanityData to 14 Oct 2026

Beyond Text: Multimodal Jailbreaking of Vision-Language and Audio Models through Perceptually Simple Transformations

arXiv 2510.20223 ↗First posted 23 Oct 2025cs.CR cs.MMcited by 1

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Multimodal large language models (MLLMs) have achieved remarkable progress, yet remain critically vulnerable to adversarial attacks that exploit weaknesses in cross-modal processing. We present a systematic study of multimodal jailbreaks targeting both vision-language and audio-language models, showing that even simple perceptual transformations can reliably bypass state-of-the-art safety filters. Our evaluation spans 1,900 adversarial prompts across three high-risk safety categories harmful content, CBRN (Chemical, Biological, Radiological, Nuclear), and CSEM (Child Sexual Exploitation Material) tested against seven frontier models. We explore the effectiveness of attack techniques on MLLMs, including FigStep-Pro (visual keyword decomposition), Intelligent Masking (semantic obfuscation), and audio perturbations (Wave-Echo, Wave-Pitch, Wave-Speed). The results reveal severe vulnerabilities: models with almost perfect text-only safety (0% ASR) suffer >75% attack success under perceptually modified inputs, with FigStep-Pro achieving up to 89% ASR in Llama-4 variants. Audio-based attacks further uncover provider-specific weaknesses, with even basic modality transfer yielding 25% ASR for technical queries. These findings expose a critical gap between text-centric alignment and multimodal threats, demonstrating that current safeguards fail to generalize across cross-modal attacks. The accessibility of these attacks, which require minimal technical expertise, suggests that robust multimodal AI safety will require a paradigm shift toward broader semantic-level reasoning to mitigate possible risks.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 21 of its 27 references that are in the map. First posted on arXiv 23 Oct 2025.

Builds on

21 of 27 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025Safe RLHF-V: Safe Reinforcement Learning from Multi-modal Human Feedback22 Mar
  2. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreaking15 Feb
  3. 2024UniGuard: Towards Universal Safety Guardrails for Jailbreak Attacks on Multimodal Large Language Models3 Nov
  4. 2024Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models31 Oct
  5. 2024Single Image Unlearning: Efficient Machine Unlearning in Multimodal Large Language Models21 May
  6. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  7. 2024Safety of Multimodal Large Language Models on Images and Texts1 Feb
  8. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov

Other references · 13

  1. 2023Direct Preference Optimization: Your Language Model is Secretly a Reward Modelcited by 8,065
  2. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  3. 2022A Holistic Approach to Undesired Content Detection in the Real Worldcited by 356
  4. 2023StyleTTS 2: Towards Human-Level Text-to-Speech through Style Diffusion and Adversarial Training with Large Speech Language Modelscited by 152
  5. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  6. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 108
  7. 2024ALERT: A Comprehensive Benchmark for Assessing Large Language Models' Safety through Red Teamingcited by 98
  8. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 44
  9. 2024AdvWave: Stealthy Adversarial Jailbreak Attack against Large Audio-Language Modelscited by 38
  10. 2022iSTFTNet: Fast and Lightweight Mel-Spectrogram Vocoder Incorporating Inverse Short-Time Fourier Transformcited by 32
  11. 2025Audio Jailbreak: An Open Comprehensive Benchmark for Jailbreaking Large Audio-Language Modelscited by 21
  12. 2024Enhancing LLM-based Hatred and Toxicity Detection with Meta-Toxic Knowledge Graphcited by 5
1 more
  1. 2025Customize Multi-modal RAI Guardrails with Precedent-based predictionscited by 2

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Audio Jailbreaks in Large Audio-Language Models: Taxonomy, Attack-Defense Analysis, and Cost-Aware Evaluationcited by 1

Similar, not cited

Close in wording, no citation either way

  1. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models
  2. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey
  3. 2025Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities
  4. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models
  5. 2026Jailbreaks on Vision Language Model via Multimodal Reasoning
  6. 2025Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity
  7. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  8. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models