mlsanityData to 7 Oct 2026

Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey

arXiv 2603.27918 ↗First posted 30 Mar 2026cs.CR cs.AIcited by 3

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Multimodal large language models (MLLMs) integrate information from multiple modalities such as text, images, audio, and video, enabling complex capabilities such as visual question answering and audio translation. While powerful, this increased expressiveness introduces new and amplified vulnerabilities to adversarial manipulation. This survey provides a comprehensive and systematic analysis of adversarial threats to MLLMs, moving beyond enumerating attack techniques to explain the underlying causes of model susceptibility. We introduce a taxonomy that organizes adversarial attacks according to attacker objectives, unifying diverse attack surfaces across modalities and deployment settings. Additionally, we also present a vulnerability-centric analysis that links integrity attacks, safety and jailbreak failures, control and instruction hijacking, and training-time poisoning to shared architectural and representational weaknesses in multimodal systems. Together, this framework provides an explanatory foundation for understanding adversarial behavior in MLLMs and informs the development of more robust and secure multimodal language systems.

Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 99 of its 113 references that are in the map. First posted on arXiv 30 Mar 2026.

Builds on

99 of 113 references.

Closest ancestors · 40

Same direction, newest first

  1. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection3 Jul
  2. 2025Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities31 May
  3. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated26 May
  4. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injection19 Apr
  5. 2025QAVA: Query-Agnostic Visual Attack to Large Vision-Language Models15 Apr
  6. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models25 Feb
  7. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreaking15 Feb
  8. 2024PBI-Attack: Prior-Guided Bimodal Interactive Black-Box Jailbreak Attack for Toxicity Maximization8 Dec
  9. 2024SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments28 Nov
  10. 2024Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models27 Nov
  11. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks24 Nov
  12. 2024Audio Is the Achilles' Heel: Red Teaming Audio Large Multimodal Models31 Oct
28 more
  1. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves29 Oct
  2. 2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models9 Oct
  3. 2024Backdooring Vision-Language Models with Out-Of-Distribution Data2 Oct
  4. 2024TrojVLM: Backdoor Attack Against Vision Language Models28 Sep
  5. 2024Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection7 Aug
  6. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Prompts21 Jul
  7. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul
  8. 2024Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift27 Jun
  9. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  10. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  11. 2024Medical MLLM is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models26 May
  12. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  13. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image5 Mar
  14. 2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model29 Feb
  15. 2024VL-Trojan: Multimodal Instruction Backdoor Attacks against Autoregressive Visual Language Models21 Feb
  16. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Models19 Feb
  17. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  18. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models5 Feb
  19. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks1 Feb
  20. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  21. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
  22. 2023Adversarial Prompt Tuning for Vision-Language Models19 Nov
  23. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  24. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  25. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  26. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  27. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  28. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 59

  1. 2017Attention Is All You Needcited by 59,932
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  4. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  6. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  7. 2013Intriguing properties of neural networkscited by 5,114
  8. 2020wav2vec 2.0: A Framework for Self-Supervised Learning of Speech Representationscited by 3,853
  9. 2015VQA: Visual Question Answeringcited by 2,489
  10. 2019ViLBERT: Pretraining Task-Agnostic Visiolinguistic Representations for Vision-and-Language Taskscited by 2,219
  11. 2016Adversarial examples in the physical worldcited by 1,762
  12. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
38 more
  1. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  2. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  3. 2023A Survey on Evaluation of Large Language Modelscited by 1,227
  4. 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
  5. 2017Multimodal Machine Learning: A Survey and Taxonomycited by 1,004
  6. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  7. 2014Show and Tell: A Neural Image Caption Generatorcited by 877
  8. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  9. 2018Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networkscited by 550
  10. 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
  11. 2017Feature Squeezing: Detecting Adversarial Examples in Deep Neural Networkscited by 484
  12. 2018Spectral Signatures in Backdoor Attackscited by 457
  13. 2017Look, Listen and Learncited by 452
  14. 2019STRIP: A Defence Against Trojan Attacks on Deep Neural Networkscited by 437
  15. 2024Agent Security Bench (ASB): Formalizing and Benchmarking Attacks and Defenses in LLM-based Agentscited by 341
  16. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 328
  17. 2018Audio Adversarial Examples: Targeted Attacks on Speech-to-Textcited by 268
  18. 2023Multimodal Foundation Models: From Specialists to General-Purpose Assistantscited by 247
  19. 2023Survey of Vulnerabilities in Large Language Models Revealed by Adversarial Attackscited by 189
  20. 2024SecAlign: Defending Against Prompt Injection with Preference Optimizationcited by 179
  21. 2024EIA: Environmental Injection Attack on Generalist Web Agents for Privacy Leakagecited by 146
  22. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  23. 2024Attacking Vision-Language Computer Agents via Pop-upscited by 112
  24. 2025Words or Vision: Do Vision-Language Models Have Blind Faith in Text?cited by 86
  25. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  26. 2017DolphinAtack: Inaudible Voice Commandscited by 65
  27. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 53
  28. 2025PromptShield: Deployable Detection for Prompt Injection Attackscited by 43
  29. 2023Misusing Tools in Large Language Models With Visual Adversarial Examplescited by 40
  30. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 37
  31. 2024AttnGCG: Enhancing Jailbreaking Attacks on LLMs with Attention Manipulationcited by 31
  32. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  33. 2023Adversarial Illusions in Multi-Modal Embeddingscited by 28
  34. 2025Security Concerns for Large Language Models: A Surveycited by 26
  35. 2025Defending Against Prompt Injection With a Few DefensiveTokenscited by 26
  36. 2025Multilingual and Multi-Accent Jailbreaking of Audio LLMscited by 25
  37. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agentscited by 25
  38. 2024LoRATK: LoRA Once, Backdoor Everywhere in the Share-and-Play Ecosystemcited by 22

50 most cited of 59 All 59 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 3.

3 papers.

  1. 2026Large Language Models in Misinformation Ecosystems: Misuse, Defense, and Vulnerabilitycited by 0
  2. 2026Automatic Hard Example Synthesis with Multi-Level Agentic Data Curationcited by 0
  3. 2026DIVA: Exploiting Cross-Step Conditional Propagation for Visual Jailbreaks in Discrete Diffusion Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Survey of Adversarial Robustness in Multimodal Large Language Models
  2. 2025Investigating Vulnerabilities and Defenses Against Audio-Visual Attacks: A Comprehensive Survey Emphasizing Multimodal Models
  3. 2025Beyond Text: Multimodal Jailbreaking of Vision-Language and Audio Models through Perceptually Simple Transformations
  4. 2025Adversarial Confusion Attack: Disrupting Multimodal Large Language Models
  5. 2026Exploring Adversarial Robustness and Safety Alignment in Multilingual Multi-Modal Large Language Models
  6. 2025Transferability of Adversarial Attacks in Video-based MLLMs: A Cross-modal Image-to-Video Approach
  7. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security
  8. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models