Attack Surface

Model layer Research

Security research involving core model architecture and parameters

67 matching entries out of 468 in this category

Model layer research results

67 entries

Information-Overloading Jailbreaks in Vision-Language Models

Published Jul 3, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Evaluated models: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B+5 more

Qwen3-VL 8B
Qwen2-VL-7B
InternVL3.5-8B
InternVL 2 8B
Llama 3.2 11B Vision
GPT-4.1 Mini
Gemini 2.5 Flash
Gemini 2.5 Flash-Lite

Multilingual Flowchart Jailbreaks in Vision-Language Models

Published Jun 5, 2026Analyzed Jul 20, 2026Source: arXiv

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published May 1, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash+3 more

GPT-5.2
Claude Haiku 4.5
Gemini 3 Flash
Gemini 3.1 Pro
Qwen3-VL-235B
Qwen3-VL-32B

VLM Image-Shift Jailbreak

Published Mar 18, 2026Analyzed Apr 10, 2026Source: arXiv

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Evaluated models: LLaVA 1.5 7B, ShareGPT4V 7B, InternVL-Chat 19B

Reasoning-Oriented Jailbreak

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct+4 more

Qwen2-VL 7B Instruct
LLaVA v1.6 Mistral 7B
Llama 3.2 11B Vision Instruct
GPT-4o
Claude 3.7 Sonnet
GLM-4V Plus
Qwen-VL Plus

Two-Frame Infilling Jailbreak

Published Mar 7, 2026Analyzed Apr 10, 2026Source: arXiv

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

Inter-Turn Modality Jailbreak

Published Mar 3, 2026Analyzed Mar 8, 2026Source: arXiv

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Flash Preview, GPT-4o+1 more

Gemini 2.5 Flash
Gemini 3 Flash Preview
GPT-4o
Claude Sonnet 4

Safety Guidance Harm Collision

Published Feb 24, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in multi-category safety-guidance mechanisms (such as Safe Latent Diffusion [SLD] and SAFREE) for Text-to-Image (T2I) diffusion models allows attackers to bypass safety filters and generate restricted content via "Harmful Conflicts." Existing safety methods aggregate multiple harmful keyword categories (e.g., hate, violence, sexual) into a single unified safety direction in the latent or text space. Because distinct harmful categories possess incompatible safety directions…

When Safety Collides: Resolving Multi-Category Harmful Conflicts in Text-to-Image Diffusion via Adaptive Safety Guidance

Evaluated models: GPT-4o, Stable Diffusion

Discrete Token Subversion

Published Feb 20, 2026Analyzed Mar 9, 2026Source: arXiv

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

On the Adversarial Robustness of Discrete Image Tokenizers

Evaluated models: Llama 2 7B

Early Reasoning Safety Degradation

Published Feb 11, 2026Analyzed Mar 8, 2026Source: arXiv

Reinforcement learning (RL) based post-training for explicit chain-of-thought reasoning (e.g., GRPO) in Multimodal Large Reasoning Models (MLRMs) inadvertently degrades safety alignment, rendering the models highly vulnerable to multimodal jailbreak attacks. The vulnerability is caused by "conditional coverage collapse" during the initial phases of chain-of-thought generation. Under adversarial conditioning (text or image), the reasoning policy assigns vanishing probability mass to safe…

Safety Recovery in Reasoning Models Is Only a Few Early Steering Steps Away

Evaluated models: R1-Onevision 7B, OpenVLThinker 7B, VLAA-Thinker 7B+3 more

R1-Onevision 7B
OpenVLThinker 7B
VLAA-Thinker 7B
Vision-R1 7B
LlamaV-o1
LLaVA-CoT

Related research categories