Attack Type

Jailbreak Research

Methods for bypassing model safety measures

10 matching entries out of 704 in this category

Jailbreak research results

10 entries

Discrete Token Subversion

Published Feb 20, 2026Analyzed Mar 9, 2026Source: arXiv

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

On the Adversarial Robustness of Discrete Image Tokenizers

Evaluated models: Llama 2 7B

VLM Split-Image Blindspot

Published Feb 8, 2026Analyzed Feb 22, 2026Source: arXiv

Vision Language Models (VLMs) utilizing independent vision encoders (e.g., ViT) and Large Language Model (LLM) decoders are vulnerable to Split-Image Visual Jailbreak Attacks (SIVA). The vulnerability arises from an architectural and alignment discrepancy: while the vision encoder processes image fragments (splits) in isolation via constrained attention or block-diagonal masks, the LLM decoder aggregates these features via cross-attention to reconstruct the semantic content. Current safety…

Robustness of Vision Language Models Against Split-Image Harmful Input Attacks

Evaluated models: Llama 3.2 11B

Semantic Hierarchical VLM Transfer

Published Feb 2, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Evaluated models: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B+4 more

UniDiffuser
BLIP-2 ViT-g/14
InstructBLIP Vicuna 13B
MiniGPT-4 Vicuna 13B
LLaVA 1.5 13B
LLaVA NeXT Qwen 1.5 72B Chat
GPT-4o

Universal MLLM Target Matching

Published Jan 30, 2026Analyzed Feb 22, 2026Source: arXiv

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

Evaluated models: GPT-4o, Claude Sonnet 4.5, GPT-5+2 more

GPT-4o
Claude Sonnet 4.5
GPT-5
GPT-5.2
Claude Opus 4.5

Point Cloud Adversarial Attack

Published Jan 10, 2026Analyzed Feb 22, 2026Source: arXiv

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

On the Adversarial Robustness of 3D Large Vision-Language Models

Evaluated models: Vicuna 7B

Latent Space Discontinuity Exploitation

Published Nov 1, 2025Analyzed Dec 5, 2025Source: arXiv

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Evaluated models: Not reported

Pretraining Modality Gap Jailbreak

Published May 30, 2025Analyzed Dec 30, 2025Source: arXiv

Large Vision-Language Models (LVLMs) that utilize a projection layer (adapter) to bridge a vision encoder and a Large Language Model (LLM) contain a vulnerability stemming from the "Modality Gap"—a distributional distance between image and text token embeddings. This gap allows the visual modality to bypass the safety alignment (RLHF/instruction tuning) of the backbone LLM. Attackers can trigger harmful, toxic, or illegal responses to queries that would be refused in text-only contexts by…

Bootstrapping LLM Robustness for VLM Safety via Reducing the Pretraining Modality Gap

Evaluated models: LLaVA 7B, Vicuna 7B

Universal VLLM Visual Bypass

Published May 2, 2025Analyzed Dec 9, 2025Source: arXiv

A vulnerability exists in Vision-Language Models (VLLMs) that allows for transferable, targeted adversarial attacks. Attackers can generate adversarial image perturbations using an ensemble of open-source surrogate models (primarily CLIP-based visual encoders) which effectively transfer to proprietary, black-box VLLMs. The attack leverages a specific optimization framework that combines a Visual Contrastive Loss with multiple positive/negative visual examples, rather than relying solely on…

Transferable Adversarial Attacks on Black-Box Vision-Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 72B Instruct, Llama 3.2 11B Vision Instruct+6 more

Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 72B Instruct
Llama 3.2 11B Vision Instruct
Llama 3.2 90B Vision Instruct
GPT-4o
GPT-4o Mini
Claude 3.5 Sonnet
Claude 3.7 Sonnet
Gemini 1.5 Pro

Adversarial VLM Jailbreak

Published Feb 17, 2025Analyzed Dec 9, 2025Source: arXiv

Vision-Language Models (VLMs), specifically the LLaVA-1.5 and LLaVA-1.6 series, are vulnerable to optimization-based white-box jailbreak attacks despite standard safety alignment measures like Supervised Fine-Tuning (SFT) and Direct Preference Optimization (DPO). Attackers can craft adversarial perturbations in the image space (imperceptible noise) or latent space using Projected Gradient Descent (PGD) to manipulate the model's internal representations. These perturbations maximize the…

Adversary-Aware DPO: Enhancing Safety Alignment in Vision Language Models via Adversarial Training

Evaluated models: LLaVA 1.5 7B, LLaVA 1.6 7B

Single Image Universal Jailbreak

Published Feb 11, 2025Analyzed Dec 9, 2025Source: arXiv

Multimodal Large Language Models (MLLMs) are vulnerable to a universal adversarial attack where a single, optimized image can bypass safety alignment mechanisms across diverse textual queries. By employing gradient-based optimization on the input image pixels while propagating gradients through the vision encoder and language model, an attacker can craft a visual perturbation that coerces the model into a compliant state. When this adversarial image is present in the context, the model’s…

Universal Adversarial Attack on Multimodal Aligned LLMs

Evaluated models: LLaVA 1.5 7B, Llama 3.2 11B Vision Instruct, Phi-3.5 Vision Instruct+1 more

LLaVA 1.5 7B
Llama 3.2 11B Vision Instruct
Phi-3.5 Vision Instruct
Qwen2-VL 2B Instruct

Related research categories