Attack Type

Jailbreak Research

Methods for bypassing model safety measures

32 matching entries out of 704 in this category

Jailbreak research results

32 entries

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

Mobile Agent Visual Spoofing

Published Feb 11, 2026Analyzed Feb 22, 2026Source: arXiv

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Image Editing Visual Prompt Jailbreak

Published Feb 10, 2026Analyzed Feb 20, 2026Source: arXiv

Large Image Editing Models (LIEMs) supporting vision-prompt editing are vulnerable to Vision-Centric Jailbreak Attacks (VJA). This vulnerability arises from a modality mismatch in safety alignment: while safeguards primarily analyze textual instructions for policy violations, the underlying models are capable of interpreting and executing instructions embedded directly within the visual input (e.g., typographic text drawn on the image, arrows, symbols, or specific markings). An attacker can…

When the Prompt Becomes Visual: Vision-Centric Jailbreak Attacks for Large Image Editing Models

Evaluated models: GPT Image 1.5, Gemini 3 Pro Image, Seedream 4.5+5 more

GPT Image 1.5
Gemini 3 Pro Image
Seedream 4.5
Qwen-Image-Edit-2512
Qwen-Image-Edit-Safe
BAGEL 14B
Flux 2.0 Dev 32B
LongCat-Image-Edit

Adaptive Web Agent Prompt Injection

Published Feb 9, 2026Analyzed Feb 21, 2026Source: arXiv

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

MUZZLE: Adaptive Agentic Red-Teaming of Web Agents Against Indirect Prompt Injection Attacks

Evaluated models: GPT-4.1, GPT-4o, Qwen3-VL 32B Instruct

Invisible Prompt Phishing Evasion

Published Feb 5, 2026Analyzed Mar 8, 2026Source: arXiv

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection

Evaluated models: GPT-5, Grok 4 Fast Non-Reasoning, Llama 4 Maverick+1 more

GPT-5
Grok 4 Fast Non-Reasoning
Llama 4 Maverick
Gemma 3 27B

Visual Object Injection

Published Jan 24, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4 Turbo+7 more

GPT-4o
GPT-4o Mini
GPT-4 Turbo
Gemini 1.5 Pro Latest
Gemini 1.5 Pro 002
Gemini 1.5 Flash Latest
Claude 3.5 Sonnet Latest
Claude 3.5 Haiku 20241022
Llama 3.2 11B Vision
Llama 3.2 90B Vision Instruct

VLM Moral Persuasion

Published Jan 23, 2026Analyzed Feb 21, 2026Source: arXiv

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 32B Instruct+20 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 32B Instruct
Qwen3-VL 2B Instruct
Qwen3-VL 4B Instruct
Qwen3-VL 8B Instruct
Qwen3-VL 30B-A3B Instruct
InternVL3 2B Instruct
InternVL3 8B Instruct
InternVL3 14B Instruct
InternVL3 38B Instruct
InternVL3.5 4B Instruct
InternVL3.5 8B Instruct
InternVL3.5 14B Instruct
InternVL3.5 38B Instruct
LLaVA 1.5 7B
LLaVA 1.5 13B
LLaVA v1.6 Vicuna 7B
LLaVA v1.6 Vicuna 13B
LLaVA v1.6 34B
Gemma 3 4B IT
Gemma 3 12B IT
Gemma 3 27B IT

Multi-turn MLLM Jailbreak

Published Jan 8, 2026Analyzed Feb 21, 2026Source: arXiv

Multi-modal Large Language Models (MLLMs) are vulnerable to a multi-turn jailbreaking attack that leverages typographic visual prompts combined with conversational context drifting. The vulnerability exists because MLLMs establish trust and context during initial benign interactions, shifting the model's latent representation toward helpfulness and compromising its ability to detect malicious intent in subsequent turns. The attack vector utilizes an image where a harmful request is…

Multi-turn Jailbreaking Attack in Multi-Modal Large Language Models

Evaluated models: GPT-4o, Gemini 2.0 Flash, Qwen2-VL 7B Instruct+2 more

GPT-4o
Gemini 2.0 Flash
Qwen2-VL 7B Instruct
LLaVA 1.6 Mistral 7B
LLaVA 1.5 13B

Dual Stego MLLM Jailbreak

Published Dec 23, 2025Analyzed Dec 30, 2025Source: arXiv

Commercial Multimodal Large Language Model (MLLM) integrated systems are vulnerable to a "Dual Steganography" jailbreak paradigm (referred to as Odysseus). The vulnerability arises from the reliance of safety filters on the assumption that malicious content must be explicitly visible in the input or output modalities (text or image). Attackers can bypass these filters by encoding malicious queries into binary matrices and embedding them into benign-looking images using steganographic encoders…

Odysseus: Jailbreaking Commercial Multimodal LLM-integrated Systems via Dual Steganography

Evaluated models: GPT-4o, Gemini 2.0 Pro, Gemini 2.0 Flash+1 more

GPT-4o
Gemini 2.0 Pro
Gemini 2.0 Flash
Grok 3

Indirect Environmental Jailbreak

Published Nov 20, 2025Analyzed Dec 30, 2025Source: arXiv

Embodied Artificial Intelligence (AI) agents utilizing Vision-Language Models (VLMs) for perception and planning are vulnerable to Indirect Environmental Jailbreak (IEJ). The vulnerability arises from the system's failure to distinguish between user-issued instructions and text embedded in the physical environment (e.g., writing on walls, sticky notes, or projections). The VLM processes visual text detected in the camera feed as authoritative context or direct commands, allowing a black-box…

The Shawshank Redemption of Embodied AI: Understanding and Benchmarking Indirect Environmental Jailbreaks

Evaluated models: GPT-4o, Qwen3-VL Plus, Gemini 2.0 Flash+3 more

GPT-4o
Qwen3-VL Plus
Gemini 2.0 Flash
GLM 4.5
DeepSeek-VL2
Claude 3.5 Sonnet

Related research categories