mlsanityData to 7 Oct 2026

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

arXiv 2606.07706 ↗First posted 5 Jun 2026cs.CR cs.AIcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Vision-Language Models (VLMs) have demonstrated strong performance across multimodal tasks, yet their safety robustness remains an open challenge. While prior work has shown that structured visual prompts such as flowcharts can effectively jailbreak VLMs, existing studies are largely limited to English-centric settings. In this paper, we introduce MLingualFC, a multilingual multimodal benchmark designed to evaluate jailbreak vulnerabilities of VLMs across diverse languages using structured flowchart representations. MLingualFC encodes harmful instructions into flowchart images across five languages (Hindi, Punjabi, Spanish, Romanian, and German). We evaluate state-of-the-art multilingual VLMs, including Qwen2.5-VL, Gemma-4, and Pangea, under a black-box threat model. Our results reveal significant multilingual safety gaps. Flowchart-based attacks achieve high attack success rates (ASR) in case of Latin script languages, demonstrating that visual encoding of harmful content effectively bypasses safety alignment across languages. In contrast, non-Latin script languages such as Punjabi exhibit substantially lower ASR, suggesting potential limitations in visual text recognition rather than stronger safety alignment. These findings highlight that current VLM safety mechanisms fail to generalize across languages and modalities. Resources are available at https://github.com/Rishabhpm23/MLingualFC

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 23 of its 36 references that are in the map. First posted on arXiv 5 Jun 2026.

Builds on

23 of 36 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time9 Oct
  2. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking21 Jun
  3. 2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimization7 Dec
  4. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  5. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  6. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  7. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul

Other references · 16

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  2. 2015VQA: Visual Question Answeringcited by 2,489
  3. 2018From Recognition to Cognition: Visual Commonsense Reasoningcited by 553
  4. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  5. 2023Low-Resource Languages Jailbreak GPT-4cited by 290
  6. 2021Scaling Up Vision-Language Pre-training for Image Captioningcited by 196
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  8. 2021VisualMRC: Machine Reading Comprehension on Document Imagescited by 150
  9. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88
  10. 2024Pangea: A Fully Open Multilingual Multimodal LLM for 39 Languagescited by 63
  11. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 53
  12. 2024Code-Switching Red-Teaming: LLM Evaluation for Safety and Multilingual Understandingcited by 34
4 more
  1. 2023EVCap: Retrieval-Augmented Image Captioning with External Visual-Name Memory for Open-World Comprehensioncited by 32
  2. 2024Red Teaming GPT-4V: Are GPT-4V Safe Against Uni/Multi-Modal Jailbreak Attacks?cited by 32
  3. 2023Q: How to Specialize Large Vision-Language Models to Data-Scarce VQA Tasks? A: Self-Train on Unlabeled Images!cited by 19
  4. 2026IndicJR: A Judge-Free Benchmark of Jailbreak Robustness in South Asian Languagescited by 5

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image
  2. 2026Jailbreaking Vision-Language Models Through the Visual Modality
  3. 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
  4. 2026Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs
  5. 2025Visual Contextual Attack: Jailbreaking MLLMs with Image-Driven Context Injection
  6. 2026MMJailBench: A Factorized Benchmark for Disentangling Multimodal Jailbreak Vulnerabilities
  7. 2025FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowcharts
  8. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models