mlsanityData to 14 Oct 2026

Enhanced MLLM Black-Box Jailbreaking Attacks and Defenses

arXiv 2510.21214 ↗First posted 24 Oct 2025cs.CRcited by 0

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Multimodal large language models (MLLMs) comprise of both visual and textual modalities to process vision language tasks. However, MLLMs are vulnerable to security-related issues, such as jailbreak attacks that alter the model's input to induce unauthorized or harmful responses. The incorporation of the additional visual modality introduces new dimensions to security threats. In this paper, we proposed a black-box jailbreak method via both text and image prompts to evaluate MLLMs. In particular, we designed text prompts with provocative instructions, along with image prompts that introduced mutation and multi-image capabilities. To strengthen the evaluation, we also designed a Re-attack strategy. Empirical results show that our proposed work can improve capabilities to assess the security of both open-source and closed-source MLLMs. With that, we identified gaps in existing defense methods to propose new strategies for both training-time and inference-time defense methods, and evaluated them across the new jailbreak methods. The experiment results showed that the re-designed defense methods improved protections against the jailbreak attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 40 of its 49 references that are in the map. First posted on arXiv 24 Oct 2025.

Builds on

40 of 49 references.

Closest ancestors · 10

Same direction, newest first

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul
  2. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  3. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character25 May
  4. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  5. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  6. 2024Jailbreaking Attack against Multimodal Large Language Model4 Feb
  7. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  8. 2023On the Adversarial Robustness of Multi-Modal Foundation Models21 Aug
  9. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  10. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 30

  1. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  2. 2023Visual Instruction Tuningcited by 7,869
  3. 2019Momentum Contrast for Unsupervised Visual Representation Learningcited by 7,513
  4. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  5. 2024GPT-4o System Cardcited by 4,588
  6. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  7. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,876
  8. 2023MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilitiescited by 1,239
  9. 2023BeaverTails: Towards Improved Safety Alignment of LLM via a Human-Preference Datasetcited by 860
  10. 2024DeepSeek-VL: Towards Real-World Vision-Language Understandingcited by 733
  11. 2023Unifying Large Language Models and Knowledge Graphs: A Roadmapcited by 668
  12. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 625
18 more
  1. 2023PandaGPT: One Model To Instruction-Follow Them Allcited by 334
  2. 2023Are aligned neural networks adversarially aligned?cited by 315
  3. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Modelscited by 274
  4. 2021Image Retrieval on Real-life Images with Pre-trained Vision-and-Language Modelscited by 251
  5. 2023Recommender Systems in the Era of Large Language Models (LLMs)cited by 189
  6. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 183
  7. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformationcited by 124
  8. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performancecited by 117
  9. 2023DRESS: Instructing Large Vision-Language Models to Align and Interact with Humans via Natural Language Feedbackcited by 103
  10. 2023Empowering Molecule Discovery for Molecule-Caption Translation with Large Language Models: A ChatGPT Perspectivecited by 92
  11. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attackscited by 92
  12. 2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 70
  13. 2025On the Emergence of Position Bias in Transformerscited by 59
  14. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 45
  15. 2024Unveiling the Safety of GPT-4o: An Empirical Study using Jailbreak Attackscited by 38
  16. 2023Defending Pre-trained Language Models as Few-shot Learners against Backdoor Attackscited by 33
  17. 2024Visual Question Answering Instruction: Unlocking Multimodal Large Language Model To Domain-Specific Visual Multitaskscited by 20
  18. 2021Directional Self-supervised Learning for Heavy Image Augmentationscited by 11

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency
  2. 2024textitMMJ-Bench: A Comprehensive Study on Jailbreak Attacks and Defenses for Multimodal Large Language Models
  3. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks
  4. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  5. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking
  6. 2025Towards Effective MLLM Jailbreaking Through Balanced On-Topicness and OOD-Intensity
  7. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
  8. 2026Overloading Large Vision-Language Models for Jailbreaking