mlsanityData to 14 Oct 2026

Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs

arXiv 2601.15698 ↗First posted 22 Jan 2026cs.CV cs.AIcited by 2

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

The rapid advancement of Multimodal Large Language Models (MLLMs) has introduced complex security challenges, particularly at the intersection of textual and visual safety. While existing schemes have explored the security vulnerabilities of MLLMs, the investigation into their visual safety boundaries remains insufficient. In this paper, we propose Beyond Visual Safety (BVS), a novel image-text pair jailbreaking framework specifically designed to probe the visual safety boundaries of MLLMs. BVS employs a "reconstruction-then-generation" strategy, leveraging neutralized visual splicing and inductive recomposition to decouple malicious intent from raw inputs, thereby leading MLLMs to be induced into generating harmful images. Experimental results demonstrate that BVS achieves a remarkable jailbreak success rate of 98.21% against GPT-5 (12 January 2026 release). Our findings expose critical vulnerabilities in the visual safety alignment of current MLLMs.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 28 of its 35 references that are in the map. First posted on arXiv 22 Jan 2026.

Builds on

28 of 35 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Survey of Adversarial Robustness in Multimodal Large Language Models18 Mar
  2. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreaking15 Feb
  3. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency9 Jan

Other references · 25

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2024GPT-4o System Cardcited by 4,588
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  5. 2023Tree of Attacks: Jailbreaking Black-Box LLMs Automaticallycited by 672
  6. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  7. 2023Jailbreaking ChatGPT via Prompt Engineering: An Empirical Studycited by 498
  8. 2023GPT-4 Is Too Smart To Be Safe: Stealthy Chat with LLMs via Ciphercited by 423
  9. 2023DeepInception: Hypnotize Large Language Model to Be Jailbreakercited by 367
  10. 2023Multi-step Jailbreaking Privacy Attacks on ChatGPTcited by 333
  11. 2023A Wolf in Sheep's Clothing: Generalized Nested Jailbreak Prompts can Fool Large Language Models Easilycited by 259
  12. 2023Multilingual Jailbreak Challenges in Large Language Modelscited by 240
13 more
  1. 2023SneakyPrompt: Jailbreaking Text-to-image Generative Modelscited by 189
  2. 2023MasterKey: Automated Jailbreak Across Multiple Large Language Model Chatbotscited by 183
  3. 2024FlipAttack: Jailbreak LLMs via Flippingcited by 80
  4. 2024CogView3: Finer and Faster Text-to-Image Generation via Relay Diffusioncited by 72
  5. 2023Unifying the Perspectives of NLP and Software Engineering: A Survey on Language Models for Codecited by 62
  6. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 44
  7. 2024Perception-guided Jailbreak against Text-to-Image Modelscited by 40
  8. 2024Jailbreaking and Mitigation of Vulnerabilities in Large Language Modelscited by 34
  9. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 33
  10. 2023On the Safety of Open-Sourced Large Language Models: Does Alignment Really Prevent Them From Being Misused?cited by 26
  11. 2024GPT-4 Jailbreaks Itself with Near-Perfect Success Using Self-Explanationcited by 25
  12. 2024Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Stepcited by 11
  13. 2024SQL Injection Jailbreak: A Structural Disaster of Large Language Modelscited by 4

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Benign Inputs, Harmful Outputs: Cross-Modal Jailbreaking via Distributed Semantic Recompositioncited by 0
  2. 2026Multimodal Safety Evaluation Should Measure Controllability Beyond Classificationcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models
  2. 2026MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs
  3. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack
  4. 2025Reimagining Safety Alignment with An Image
  5. 2026Jailbreaking Vision-Language Models Through the Visual Modality
  6. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
  7. 2026COMIC: Reference-Aware Safety Gating for Multimodal Large Language Models
  8. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts