mlsanityData to 14 Oct 2026

PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models

arXiv 2606.24388 ↗First posted 23 Jun 2026cs.AI cs.LGcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

We introduce a large-scale, open-source dataset of pre-generated adversarial attacks for vision-language models (VLMs). The dataset is designed to be diverse, representative, and practical, extending existing benchmarks by covering 10 high-level categories and 55 subcategories of harmful intents. Our primary goal is to make adversarial data accessible to the research community, given the computational cost and complexity of generating large numbers of attacks. The dataset comprises 47 524 adversarial samples, generated using state-of-the-art attack strategies from recent literature. Our work complements existing efforts by consolidating and extending prior benchmarks from multiple established sources, resulting in 7 826 intents, and introduce an additional category to broaden coverage. This provides realistic evaluation resources for studying model robustness and alignment. Our dataset intends to enable researchers and practitioners to systematically evaluate the robustness and safety of VLMs, fine-tune attack-generation models, and develop or stress-test defensive guardrails under diverse adversarial conditions. By releasing this resource, we aim to lower the barrier to adversarial research and foster more reproducible, comprehensive, and comparable evaluations of VLM safety.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 45 of its 54 references that are in the map. First posted on arXiv 23 Jun 2026.

Builds on

45 of 54 references.

Closest ancestors · 13

Same direction, newest first

  1. 2026MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs28 Feb
  2. 2025VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models26 May
  3. 2025Distraction is All You Need for Multimodal Large Language Model Jailbreaking15 Feb
  4. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves29 Oct
  5. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  6. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  7. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  8. 2024Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models14 Mar
  9. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions14 Mar
  10. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
  11. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  12. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
1 more
  1. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 32

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  4. 2025Qwen3-VL Technical Reportcited by 2,793
  5. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  6. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  7. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 573
  8. 2024DeepSeek-VL2: Mixture-of-Experts Vision-Language Models for Advanced Multimodal Understandingcited by 572
  9. 2023GPTFUZZER: Red Teaming Large Language Models with Auto-Generated Jailbreak Promptscited by 560
  10. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 536
  11. 2025GLM-4.5V and GLM-4.1V-Thinking: Towards Versatile Multimodal Reasoning with Scalable Reinforcement Learningcited by 466
  12. 2017Decision-Based Adversarial Attacks: Reliable Attacks Against Black-Box Machine Learning Modelscited by 462
20 more
  1. 2024A StrongREJECT for Empty Jailbreakscited by 385
  2. 2023Low-Resource Languages Jailbreak GPT-4cited by 309
  3. 2024SORRY-Bench: Systematically Evaluating Large Language Model Safety Refusalcited by 240
  4. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 199
  5. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 151
  6. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  7. 2024Does Refusal Training in LLMs Generalize to the Past Tense?cited by 79
  8. 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
  9. 2024Jailbreak Large Vision-Language Models Through Multi-Modal Linkagecited by 62
  10. 2020SurFree: a fast surrogate-free black-box attackcited by 60
  11. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 44
  12. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 33
  13. 2026A Coin Flip for Safety: LLM Judges Fail to Reliably Measure Adversarial Robustnesscited by 20
  14. 2021Decision-based Black-box Attack Against Vision Transformers via Patch-wise Adversarial Removalcited by 16
  15. 2025HarmMetric Eval: Benchmarking Metrics and Judges for LLM Harmfulness Assessmentcited by 15
  16. 2026Comparison requires valid measurement: Rethinking attack success rate comparisons in AI red teamingcited by 15
  17. 2025OmniSafeBench-MM: A Unified Benchmark and Toolbox for Multimodal Jailbreak Attack-Defense Evaluationcited by 11
  18. 2026MultiBreak: A Scalable and Diverse Multi-turn Jailbreak Benchmark for Evaluating LLM Safetycited by 8
  19. 2026Adversarial Humanities Benchmark: Results on Stylistic Robustness in Frontier Model Safetycited by 3
  20. 2026Hard to Read, Easy to Jailbreak: How Visual Degradation Bypasses MLLM Safety Alignmentcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  3. 2026Adversarial Diffusion Across Modalities: A Fusion Survey of Attacks, Defenses, and Evaluation for Text, Vision, and Vision-Language Models
  4. 2026Breaking the weakest link to evade vision language models
  5. 2024Multimodal Adversarial Defense for Vision-Language Models by Leveraging One-To-Many Relationships
  6. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  7. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
  8. 2025MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Models