Attack Type

Injection Research

Attacks that inject malicious content into model inputs

9 matching entries out of 337 in this category

Injection research results

9 entries

Visual Memory Multi-Turn Manipulation

Published Feb 17, 2026Analyzed Mar 8, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Visual Memory Injection Attacks for Multi-Turn Conversations

Evaluated models: Qwen 2.5 VL 7B Instruct, Qwen3-VL 8B Instruct, LLaVA-OneVision 1.5 8B Instruct+2 more

Qwen 2.5 VL 7B Instruct
Qwen3-VL 8B Instruct
LLaVA-OneVision 1.5 8B Instruct
Qwen-SEA-LION v4 8B VL
QoQ-Med3-VL 8B

Embodied Cross-Modal Misalignment

Published Nov 20, 2025Analyzed Jan 14, 2026Source: arXiv

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

When alignment fails: Multimodal adversarial attacks on vision-language-action models

Evaluated models: Not reported

JailFlip Implicit Harm

Published Jun 9, 2025Analyzed Dec 8, 2025Source: arXiv

A vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs) (including GPT-4, Claude 3, Gemini, and Qwen families) leading to "Implicit Harm." Unlike traditional jailbreaks that use overtly harmful queries, this vulnerability allows remote attackers to coerce the model into providing factually incorrect, plausible, and dangerous responses to benign-looking inputs. By employing "JailFlip" techniques—specifically constructed affirmative-type or denial-type queries…

Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures

Evaluated models: GPT-4.1, GPT-4.1 Mini, GPT-4o+3 more

GPT-4.1
GPT-4.1 Mini
GPT-4o
GPT-4o Mini
Qwen Plus
Qwen Turbo

Image-Text Jailbreak

Published Mar 5, 2025Analyzed Mar 8, 2026Source: arXiv

Multimodal Large Language Models (MLLMs) are vulnerable to coupled cross-modal jailbreak attacks that combine continuous visual perturbations with discrete textual manipulations. Because standard alignment and single-modality defenses (such as text-only safety tuning or isolated vision-encoder adversarial training) fail to secure the cross-modal interaction, attackers can simultaneously apply gradient-based noise (e.g., PGD) to input images and adversarial suffixes (e.g., GCG) to text prompts…

E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Models

Evaluated models: LLaVA 1.5 7B, Bunny 1.0 4B, Mplug-owl2

Single Image Universal Jailbreak

Published Feb 11, 2025Analyzed Dec 9, 2025Source: arXiv

Multimodal Large Language Models (MLLMs) are vulnerable to a universal adversarial attack where a single, optimized image can bypass safety alignment mechanisms across diverse textual queries. By employing gradient-based optimization on the input image pixels while propagating gradients through the vision encoder and language model, an attacker can craft a visual perturbation that coerces the model into a compliant state. When this adversarial image is present in the context, the model’s…

Universal Adversarial Attack on Multimodal Aligned LLMs

Evaluated models: LLaVA 1.5 7B, Llama 3.2 11B Vision Instruct, Phi-3.5 Vision Instruct+1 more

LLaVA 1.5 7B
Llama 3.2 11B Vision Instruct
Phi-3.5 Vision Instruct
Qwen2-VL 2B Instruct

Visual Jailbreak via Multi-Loss

Published Nov 27, 2024Analyzed Dec 29, 2024Source: arXiv

Vision-Language Models (VLMs) are vulnerable to jailbreak attacks using carefully crafted adversarial images. Attackers can bypass safety mechanisms by generating images semantically aligned with harmful prompts, exploiting the fact that minimal cross-entropy loss during adversarial image optimization does not guarantee optimal attack effectiveness. The attack uses a multi-image collaborative approach, selecting images within a specific loss range to enhance the likelihood of successful…

Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models

Evaluated models: LLaVA 2, MiniGPT-4

Visual Adversarial Tool Abuse

Published Oct 4, 2023Analyzed Dec 28, 2024Source: arXiv

A vulnerability exists in multimodal Large Language Models (LLMs) integrated with external tools. Adversarial images, visually indistinguishable from benign images, can manipulate the LLM to execute unintended tool commands, compromising the confidentiality and integrity of user resources. The attack is effective across diverse prompts, remaining stealthy both in the image itself and in the generated text response.

Misusing tools in large language models with visual adversarial examples

Evaluated models: Not reported

Cross-Modal VLM Jailbreak

Published Jul 26, 2023Analyzed Mar 4, 2025Source: arXiv

A vulnerability in multi-modal large language models (LLMs) allows adversaries to bypass safety mechanisms through compositional adversarial attacks. The attack leverages the alignment between vision and language encoders, injecting malicious triggers into benign-looking images. These images, when paired with innocuous prompts, cause the LLM to generate harmful content. The attack requires access only to the vision encoder (e.g., CLIP), not the LLM itself, lowering the barrier to attack.

Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models

Evaluated models: Llama-adapterv2

Visual Jailbreak of LLMs

Published Jun 22, 2023Analyzed Dec 29, 2024Source: arXiv

A vulnerability in vision-integrated Large Language Models (VLMs) allows an attacker to circumvent safety mechanisms through the use of adversarially crafted visual examples. A single, carefully constructed image can universally "jailbreak" the model, causing it to generate harmful content in response to a wide range of subsequent prompts, even those not included in the adversarial example's training data. This vulnerability extends beyond simple misclassification to encompass the execution of…

Visual adversarial examples jailbreak large language models

Evaluated models: InstructBLIP, MiniGPT-4

Related research categories