mlsanityData to 7 Oct 2026

Visual Memory Injection Attacks for Multi-Turn Conversations

arXiv 2602.15927 ↗First posted 17 Feb 2026cs.CV cs.LGcited by 2

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Generative large vision-language models (LVLMs) have recently achieved impressive performance gains, and their user base is growing rapidly. However, the security of LVLMs, in particular in a long-context multi-turn setting, is largely underexplored. In this paper, we consider the realistic scenario in which an attacker uploads a manipulated image to the web/social media. A benign user downloads this image and uses it as input to the LVLM. Our novel stealthy Visual Memory Injection (VMI) attack is designed such that on normal prompts the LVLM exhibits nominal behavior, but once the user gives a triggering prompt, the LVLM outputs a specific prescribed target message to manipulate the user, e.g. for adversarial marketing or political persuasion. Compared to previous work that focused on single-turn attacks, VMI is effective even after a long multi-turn conversation with the user. We demonstrate our attack on several recent open-weight LVLMs. This article thereby shows that large-scale manipulation of users is feasible with perturbed images in multi-turn conversation settings, calling for better robustness of LVLMs against these attacks. We release the source code at https://github.com/chs20/visual-memory-injection

Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 38 of its 57 references that are in the map. First posted on arXiv 17 Feb 2026.

Builds on

38 of 57 references.

Closest ancestors · 9

Same direction, newest first

  1. 2025LLaVAShield: Safeguarding Multimodal Multi-Turn Dialogues in Vision-Language Models30 Sep
  2. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection3 Jul
  3. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models25 Feb
  4. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models14 Mar
  5. 2024Test-Time Backdoor Attacks on Multimodal Large Language Models13 Feb
  6. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models5 Feb
  7. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  8. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  9. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 29

  1. 2023GPT-4 Technical Reportcited by 18,132
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  3. 2025Qwen3 Technical Reportcited by 8,195
  4. 2023Visual Instruction Tuningcited by 7,792
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2025Qwen2.5-VL Technical Reportcited by 5,418
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2024Qwen2.5 Technical Reportcited by 4,713
  9. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,337
  10. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  11. 2025Qwen3-VL Technical Reportcited by 2,534
  12. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,442
17 more
  1. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,339
  2. 2025SigLIP 2: Multilingual Vision-Language Encoders with Improved Semantic Understanding, Localization, and Dense Featurescited by 1,127
  3. 2020RobustBench: a standardized adversarial robustness benchmarkcited by 659
  4. 2023OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Modelscited by 560
  5. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  6. 2025LLaVA-OneVision-1.5: Fully Open Framework for Democratized Multimodal Trainingcited by 233
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  8. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  9. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  10. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  11. 2024MMDU: A Multi-Turn Multi-Image Dialog Understanding Benchmark and Instruction-Tuning Dataset for LVLMscited by 89
  12. 2025QoQ-Med: Building Multimodal Clinical Foundation Models with Domain-Aware GRPO Trainingcited by 38
  13. 2025Real AI Agents with Fake Memories: Fatal Context Manipulation Attacks on Web3 Agentscited by 23
  14. 2025SEA-LION: Southeast Asian Languages in One Networkcited by 17
  15. 2025Region-based Cluster Discrimination for Visual Representation Learningcited by 13
  16. 2025REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLMcited by 4
  17. 2026Multi-turn Jailbreaking Attack in Multi-Modal Large Language Modelscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agentscited by 1
  2. 2026Visual Memory Attacks Can Persist Through The KV Cachecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  3. 2026Covert Visual Prompt Injection against Commercial Multimodal Large Language Models
  4. 2026Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection
  5. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated
  6. 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Models
  7. 2026A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation
  8. 2025CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMs