mlsanityData to 7 Oct 2026

Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

arXiv 2602.14399 ↗First posted 16 Feb 2026cs.CVcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 2 more
Abstract (arXiv)

Multi-turn jailbreak attacks have proven effective against text-only large language models (LLMs), where malicious content is gradually introduced to bypass safety alignment. However, effectively extending such attacks to large vision-language models (LVLMs) remains underexplored. In this paper, we find that naively incorporating visual inputs can make multi-turn jailbreaks easier to defend against; for example, overly malicious visual content will easily trigger the defense mechanism in safety-aligned LVLMs, resulting in more conservative responses. Based on this finding, we propose multi-turn adaptive prompting attack (MAPA) that 1) at each turn, alternates text-vision attack actions to elicit the most malicious response; and 2) across turns, adjusts the attack trajectory through iterative back-and-forth refinement to gradually amplify response maliciousness. This two-level design enables MAPA to consistently outperform state-of-the-art methods, improving attack success rates by 15-30% on recent benchmarks against LLaVA-v1.6-Mistral-7B, Qwen2.5-VL-7B-Instruct, Llama-3.2-Vision-11B-Instruct and GPT-4o-mini. Our code is available at: https://github.com/thomaschoi143/MAPA.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 15 of its 37 references that are in the map. First posted on arXiv 16 Feb 2026.

Builds on

15 of 37 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Llama Guard 3 Vision: Safeguarding Human-AI Image Understanding Conversations15 Nov
  2. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr

Other references · 13

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2024The Llama 3 Herd of Modelscited by 14,192
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  4. 2025Qwen2.5-VL Technical Reportcited by 5,418
  5. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  6. 2024LLMs know their vulnerabilities: Uncover Safety Gaps through Natural Distribution Shiftscited by 80
  7. 2024Chain of Attack: a Semantic-Driven Contextual Multi-Turn attacker for LLMcited by 73
  8. 2024Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Charactercited by 61
  9. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 53
  10. 2025Foot-In-The-Door: A Multi-turn Jailbreak for LLMscited by 50
  11. 2025Tempest: Autonomous Multi-Turn Jailbreaking of Large Language Models with Tree Searchcited by 15
  12. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 4
1 more
  1. 2025Effective Black-Box Multi-Faceted Attacks Breach Vision Large Language Model Guardrailscited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
  2. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image
  3. 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
  4. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safety
  5. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt
  6. 2026Jailbreaks on Vision Language Model via Multimodal Reasoning
  7. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  8. 2026MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models