mlsanityData to 13 Oct 2026

A Multimodal Automatic Redteaming Evaluation based on Atomic Jailbreak Strategy Decoupling and Combination

arXiv 2608.04034 ↗First posted 3 Aug 2026cs.CRcited by 0

On the map: LLM safety and security → Vision-language and text-to-image safety

Abstract (arXiv)

Multimodal Large Language Models (MLLMs) have achieved impressive progress in image-text comprehension and generation, yet they remain susceptible to jailbreak attacks that can trigger harmful outputs and pose serious safety concerns. Existing multimodal jailbreak attacks have shown the feasibility of such attacks, but they still face two fundamental challenges: the lack of a atomic multi-modal strategy space, the absence of a concise and efficient executable framework beyond human-craft experience. To address these challenges, we first decompose the text-image jailbreak strategy space into three levels: structural, semantic, and syntactic, constructing a jailbreak strategy set encompassing both text and image modalities to systematically achieve combined coverage of different attack types. Then we propose a multimodal automated red team jailbreak method named Hierarchical Atomic Combination Attack (HACA). Specifically, based on a six-dimensional strategy space, a cross-modal joint planner is used to select and combine the different atomic jailbreak strategy for subsequent jailbreak command generation. Finally, at the implementation level, we explore to apply a unified generate executor to directly generate jailbreak instructions based on the selected multi-modal strategies. A series of experiments show that our automated red team method can achieve an attack success rate of average 95.48% against five mainstream MLLMs.

Key facts. No citing papers in the map yet (data through 13 Oct 2026). Placed in Vision-language and text-to-image safety, one of 12 directions in LLM safety and security. Builds on 28 of its 44 references that are in the map. First posted on arXiv 3 Aug 2026.

Builds on

28 of 44 references.

Closest ancestors · 7

Same direction, newest first

  1. 2026Jailbreaking Vision-Language Models Through the Visual Modality1 May
  2. 2025VRSA: Jailbreaking Multimodal Large Language Models through Visual Reasoning Sequential Attack5 Dec
  3. 2025Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities2 Dec
  4. 2025FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowcharts28 Feb
  5. 2024IDEATOR: Jailbreaking and Benchmarking Large Vision-Language Models Using Themselves29 Oct
  6. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  7. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul

Other references · 21

  1. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,064
  2. 2023InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Taskscited by 2,546
  3. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,637
  4. 2022Red Teaming Language Models with Language Modelscited by 1,014
  5. 2024How Johnny Can Persuade LLMs to Jailbreak Them: Rethinking Persuasion to Challenge AI Safety by Humanizing LLMscited by 565
  6. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 384
  7. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 277
  8. 2024AutoDAN-Turbo: A Lifelong Agent for Strategy Self-Exploration to Jailbreak LLMscited by 196
  9. 2025X-Teaming: Multi-Turn Jailbreaks and Defenses with Adaptive Multi-Agentscited by 122
  10. 2023Tricking LLMs into Disobedience: Formalizing, Analyzing, and Detecting Jailbreakscited by 49
  11. 2025Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategycited by 43
  12. 2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 42
9 more
  1. 2025AutoRedTeamer: Autonomous Red Teaming with Lifelong Attack Integrationcited by 41
  2. 2024MRJ-Agent: An Effective Jailbreak Agent for Multi-Round Dialoguecited by 32
  3. 2025QueryAttack: Jailbreaking Aligned Large Language Models Using Structured Non-natural Query Languagecited by 18
  4. 2025from Benign import Toxic: Jailbreaking the Language Model via Adversarial Metaphorscited by 15
  5. 2024Jailbreaking? One Step Is Enough!cited by 9
  6. 2025Special-Character Adversarial Attacks on Open-Source Language Modelcited by 6
  7. 2025ARMs: Adaptive Red-Teaming Agent against Multimodal Models with Plug-and-Play Attackscited by 4
  8. 2025The Trojan Example: Jailbreaking LLMs through Template Filling and Unsafety Reasoningcited by 3
  9. 2026TreeTeaming: Autonomous Red-Teaming of Vision-Language Models via Hierarchical Strategy Explorationcited by 3

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024Jailbreak Attacks and Defenses against Multimodal Generative Models: A Survey
  2. 2026DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs
  3. 2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Models
  4. 2026Fully Unleashing the Multimodal Attacker: Meta-Adaptive Jailbreaking of Vision-Language Models
  5. 2024Divide and Conquer: A Hybrid Strategy Defeats Multimodal Large Language Models
  6. 2024Distract Large Language Models for Automatic Jailbreak Attack
  7. 2025Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency
  8. 2025PolyJailbreak: Cross-Modal Jailbreaking Attacks on Black-Box Multimodal LLMs