# Vision-language and text-to-image safety

Area: [LLM safety and security](https://mlsanity.com/safety/index.md). HTML: https://mlsanity.com/safety/vision-language-and-text-to-image-safety/

## Key facts

- Vision-language and text-to-image safety: 507 papers on arXiv since 2022 (data through 14 Oct 2026).
- 183 of its 507 mapped papers (36%) cite “FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts” (2023, arXiv 2311.05608).
- 117 of its 507 mapped papers (23%) cite “Visual Adversarial Examples Jailbreak Aligned Large Language Models” (2023, arXiv 2306.13213).
- 18 new papers 24 Sep–14 Oct.

## Most cited here

- [FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts](https://mlsanity.com/paper/2311.05608/) (2023), cited by 183 papers here
- [Visual Adversarial Examples Jailbreak Aligned Large Language Models](https://mlsanity.com/paper/2306.13213/) (2023), cited by 117 papers here
- [Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models](https://mlsanity.com/paper/2307.14539/) (2023), cited by 110 papers here
- [Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?](https://mlsanity.com/paper/2310.10012/) (2023), cited by 106 papers here
- [Forget-Me-Not: Learning to Forget in Text-to-Image Diffusion Models](https://mlsanity.com/paper/2303.17591/) (2023), cited by 93 papers here
- [Red-Teaming the Stable Diffusion Safety Filter](https://mlsanity.com/paper/2210.04610/) (2022), cited by 89 papers here
- [Images are Achilles' Heel of Alignment: Exploiting Visual Vulnerabilities for Jailbreaking Multimodal Large Language Models](https://mlsanity.com/paper/2403.09792/) (2024), cited by 81 papers here
- [SneakyPrompt: Jailbreaking Text-to-image Generative Models](https://mlsanity.com/paper/2305.12082/) (2023), cited by 79 papers here
- [To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now](https://mlsanity.com/paper/2310.11868/) (2023), cited by 79 papers here
- [AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting](https://mlsanity.com/paper/2403.09513/) (2024), cited by 70 papers here

## New (24 Sep–14 Oct)

- [DecisionRobust: Benchmarking Robustness for JEV Style Decision Models Across Text and Vision](https://mlsanity.com/paper/2610.19118/) (2026-10-13)
- [Answer It or Not? Towards Prompt-Adapted Adversarial Images on Vision Language Models](https://mlsanity.com/paper/2610.16622/) (2026-10-12)
- [Hidden in Plain Sight: Advancing Harmful Content Understanding via Perception-Aware Adversarial Self-Play](https://mlsanity.com/paper/2610.15449/) (2026-10-11)
- [Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs](https://mlsanity.com/paper/2610.14094/) (2026-10-08)
- [False Claims, Credible Images: A Red-Teaming Benchmark for Commercial Image Generators](https://mlsanity.com/paper/2610.11112/) (2026-10-08)
- [Sparse Feature Policy Unlearning Mitigates State Hallucination in Vision-Language-Action Models](https://mlsanity.com/paper/2610.09496/) (2026-10-07)
- [Harmful Content Generation in Text-to-Image Models: Capabilities and Moderation Limitations](https://mlsanity.com/paper/2610.06503/) (2026-10-05)
- [FADE: Frame-Aware Diffusion-Transformer-based Multi-Concept Erasure for Video Unlearning](https://mlsanity.com/paper/2610.03980/) (2026-10-02)
- [Walking the Embedding Space: Datastore Extraction from Multimodal RAG](https://mlsanity.com/paper/2610.01871/) (2026-10-01)
- [ShieldCLIP: Selective Safety Alignment for Harmful Content Mitigation in Multimodal Foundation Models](https://mlsanity.com/paper/2609.39688/) (2026-09-30)
- [FOMO: Forget the Concept, Don't Miss Out on the Scene in Selective Video Unlearning](https://mlsanity.com/paper/2609.39605/) (2026-09-30)
- [Steering Fields: Adaptive Vector Fields for Safe Image Generation and Beyond](https://mlsanity.com/paper/2609.39573/) (2026-09-30)
- [CollageAttack: Exploiting Cross-Modal Alignment Flaws in T2I Models through Spatial Text Composition](https://mlsanity.com/paper/2609.38253/) (2026-09-29)
- [Selective Channel Restoration for Backdoored Vision-Language Models](https://mlsanity.com/paper/2609.37759/) (2026-09-29)
- [Motion Concept Unlearning in Video Diffusion Models](https://mlsanity.com/paper/2609.36832/) (2026-09-29)
- [Render Before Reading: Visual Rendering as a Prompt Injection Defense](https://mlsanity.com/paper/2609.36121/) (2026-09-28)
- [From Latents to Wires: Surgical Post-Editing on Large Language Models](https://mlsanity.com/paper/2609.32434/) (2026-09-26)
- [Region-Level Black-Box Defense Against Stealthy Embedding-Space Backdoors in CLIP](https://mlsanity.com/paper/2609.31558/) (2026-09-25)