mlsanityData to 14 Oct 2026

DE-FIVE: Detecting Malicious Image Prompts via Fourier Features and Image Vector Embeddings

arXiv 2606.22779 ↗First posted 22 Jun 2026cs.CR cs.CVcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Vision language models (VLMs) employ both visual and textual modalities to enable advanced vision-language inference. However, incorporating visual modalities expands the attack surface of VLMs, making them more susceptible to security threats such as adversarial perturbations and indirect prompt injection, wherein crafted malicious image prompts can elicit unintended model outputs. Existing defense methods against malicious image prompts remain insufficient as they typically demand extensive datasets for retraining or the deployment of additional, complex classifiers. Most critically, there is a profound lack of specialized defense mechanisms specifically targeting indirect prompt injections, a gap that serves as a primary motivation for this work. To address these limitations, we introduce DE-FIVE, a novel training-free framework for detecting malicious image prompts by leveraging Fourier features and the hidden state representations of the visual encoder (image vector embeddings) across perturbations. Specifically, we develop a hybrid detection strategy consisting of a black-box detector that operates on Fourier-domain features and a white-box detector that exploits image vector embeddings derived from only a few-shot malicious set. Extensive experiments demonstrate that the proposed framework consistently outperforms state-of-the-art baselines against malicious image prompts.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 31 of its 40 references that are in the map. First posted on arXiv 22 Jun 2026.

Builds on

31 of 40 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025HiddenDetect: Detecting Jailbreak Attacks against Large Vision-Language Models via Monitoring Hidden States20 Feb
  2. 2024VLMGuard: Bootstrapping Malicious Prompt Detectors from Unlabeled Vision-Language Prompts in the Wild1 Oct
  3. 2024Self-interpreting Adversarial Images12 Jul
  4. 2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models14 Mar
  5. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
  6. 2024MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance5 Jan
  7. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  8. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  9. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul
  10. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun

Other references · 21

  1. 2024The Llama 3 Herd of Modelscited by 14,715
  2. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  3. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  4. 2023Judging LLM-as-a-Judge with MT-Bench and Chatbot Arenacited by 8,626
  5. 2023Visual Instruction Tuningcited by 7,869
  6. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  7. 2024GPT-4o System Cardcited by 4,588
  8. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  9. 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
  10. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  11. 2023XSTest: A Test Suite for Identifying Exaggerated Safety Behaviours in Large Language Modelscited by 505
  12. 2023Detecting Language Model Attacks with Perplexitycited by 431
9 more
  1. 2023Are aligned neural networks adversarially aligned?cited by 315
  2. 2023Towards Generalist Biomedical AIcited by 289
  3. 2023Recommender Systems in the Era of Large Language Models (LLMs)cited by 189
  4. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
  5. 2024Soft Prompt Threats: Attacking Safety Alignment and Unlearning in Open-Source LLMs through the Embedding Spacecited by 91
  6. 2024Gradient Cuff: Detecting Jailbreak Attacks on Large Language Models by Exploring Refusal Loss Landscapescited by 74
  7. 2024Visual Question Answering Instruction: Unlocking Multimodal Large Language Model To Domain-Specific Visual Multitaskscited by 20
  8. 2021Detecting AutoAttack Perturbations in the Frequency Domaincited by 10
  9. 2023Frequency-domain Blind Quality Assessment of Blurred and Blocking-artefact Images using Gaussian Process Regression modelcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2026Detecting Adversarial Images through Response Profiles of Vision-Language Models
  2. 2025Invisible Injections: Exploiting Vision-Language Models Through Steganographic Prompt Embedding
  3. 2026VLMShield: Efficient and Robust Defense of Vision-Language Models against Malicious Prompts
  4. 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors
  5. 2024Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
  6. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  7. 2026Harnessing Hyperbolic Geometry for Harmful Prompt Detection and Sanitization
  8. 2025BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models