DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness
also in 1 more
Abstract (arXiv)
Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, DMN, which leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms.
Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 14 of its 28 references that are in the map. First posted on arXiv 18 May 2026.
Builds on
14 of 28 references.
Closest ancestors · 5
Same direction, newest first
- 2025Distraction is All You Need for Multimodal Large Language Model Jailbreaking15 Feb
- 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
- 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
- 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
- 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
Other references · 9
- 2023MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilitiescited by 1,239
- 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
- 2023Cognitive Overload: Jailbreaking Large Language Models with Overloaded Logical Thinkingcited by 81
- 2024MIA-Bench: Towards Better Instruction Following Evaluation of Multimodal LLMscited by 62
- 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 62
- 2024LlavaGuard: An Open VLM-based Framework for Safeguarding Vision Datasets and Modelscited by 52
- 2025MM-IFEngine: Towards Multimodal Instruction Followingcited by 42
- 2025Adjacent Words, Divergent Intents: Jailbreaking Large Language Models via Task Concurrencycited by 17
- 2025From Easy to Hard: The MIR Benchmark for Progressive Interleaved Multi-Image Reasoningcited by 8
Built on by
Citing papers per year: 2026: 1.
1 paper.
Similar, not cited
Close in wording, no citation either way
- 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
- 2026MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs
- 2024Efficient LLM-Jailbreaking via Multimodal-LLM Jailbreak
- 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
- 2025JPS: Jailbreak Multimodal Large Language Models with Collaborative Visual Perturbation and Textual Steering
- 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models
- 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs
- 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency