Architecture Components

Multimodal Research

Security research involving multimodal AI systems

173 matching entries

Multimodal research results

173 entries

Assembling Malice From Benign

Published 3/1/2026

Analyzed 4/10/2026

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

Evaluated models: GPT-4o, Gemini 2.0 Flash 001, Gemini 2.5 Flash +3 more

Source: arXiv

Inaudible Ultrasonic LLM Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

Speech-driven Large Language Models (LLMs) and end-to-end Large Audio-Language Models (LALMs) are vulnerable to inaudible near-ultrasonic prompt injections, a framework dubbed Sirens' Whisper (SWhisper). By exploiting the non-linear response of commodity microphones, attackers can encode structured, phonetically optimized adversarial prompts into the 17–22 kHz near-ultrasonic band. Using regularized channel-inversion pre-compensation, the attacker shapes the waveform to account for microphone…

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Evaluated models: GLM-4 Voice, Qwen Omni Turbo, Llama 3.1 8B Instruct +5 more

Source: arXiv

Inter-Turn Modality Jailbreak

Published 3/1/2026

Analyzed 3/8/2026

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Flash Preview, GPT-4o +1 more

Source: arXiv

Invisible Visual Prompt Injection

Published 3/1/2026

Analyzed 4/11/2026

An imperceptible visual prompt injection vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to execute precise command-hijacking via a Covert Triggered dual-Target Attack (CoTTA). By embedding a bounded, learnable textual overlay ($L_\infty$ norm bound $\varepsilon \le 16$) and adversarial noise into an input image, the attack forces the source image's internal feature representation to align with both the textual and visual embeddings of an attacker-specified…

Adversarial Prompt Injection Attack on Multimodal Large Language Models

Evaluated models: GPT-4o, GPT-5

Source: arXiv

Joint Audio-Text Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

Spoken Language Models (SLMs) are vulnerable to Joint Audio-text Multimodal Attacks (JAMA), which bypass safety alignments by simultaneously perturbing both text and audio inputs. The vulnerability exploits the combined optimization of a discrete text suffix via Greedy Coordinate Gradient (GCG) and a continuous audio perturbation via Projected Gradient Descent (PGD). This joint gradient-based attack pushes the model's hidden layer representations into a distinct subspace far from the benign…

On Optimizing Multimodal Jailbreaks for Spoken Language Models

Evaluated models: Qwen2-Audio 7B Instruct, Qwen 2.5 Omni 7B, Audio Flamingo 3 +1 more

Source: arXiv

LLM Universal Graph Subversion

Published 3/1/2026

Analyzed 4/10/2026

An evasion vulnerability in Text-Attributed Graph (TAG) learning models allows attackers to induce targeted misclassifications via LLM-generated, coordinated perturbations to both graph topology and textual semantics. By identifying a semantically distant "influencer" node, an attacker can use a separate LLM to selectively delete highly relevant edges, insert a deceptive edge connecting the target to the influencer, and slightly modify the target node's text to include a keyword aligned with…

Can LLMs Fool Graph Learning? Exploring Universal Adversarial Attacks on Text-Attributed Graphs

Evaluated models: DeepSeek-V3 671B, Llama 4 17B, Mistral 7B +1 more

Source: arXiv

MLLM Multi-Paradigm Collaborative

Published 3/1/2026

Analyzed 3/9/2026

Multi-Modal Large Language Models (MLLMs) are vulnerable to a highly transferable, black-box adversarial image attack known as the Multi-Paradigm Collaborative Attack (MPCAttack). Attackers can craft imperceptible visual perturbations by jointly aggregating and optimizing semantic feature representations extracted from surrogate models across three distinct learning paradigms: cross-modal alignment (e.g., CLIP), multi-modal understanding (e.g., InternVL3), and visual self-supervised learning…

Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, InternVL3 8B, LLaVA 1.5 7B +3 more

Source: arXiv

Multi-Image Semantic Reconstruction

Published 3/1/2026

Analyzed 3/8/2026

A vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to bypass safety alignments via Multi-Image Dispersion and Semantic Reconstruction (MIDAS). Attackers decompose malicious instructions into risk-bearing semantic subunits, fragment them, and distribute them across multiple benign-looking Game-style Visual Reasoning (GVR) puzzles (e.g., Letter Equations, Rank-and-Read, Odd-One-Out). A sanitized, persona-driven textual prompt with sequential placeholders is then used to…

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Evaluated models: Gemini 2.5 Flash Thinking, Gemini 2.5 Pro, GPT-4o +2 more

Source: arXiv

Multi-Modal Expansion Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

Large Vision-Language Models (LVLMs) are vulnerable to multi-turn, multi-modal jailbreak attacks where malicious intent is incrementally introduced and obfuscated through intertwined text and image prompts. Attackers can systematically bypass safety alignments by starting with self-optimized, benign-seeming conversation starters (horizontal expansion) and progressively stacking text and image attack augmentations across multiple conversation turns (vertical expansion). Furthermore, models fail…

FERRET: Framework for Expansion Reliant Red Teaming

Evaluated models: GPT-4o, Claude 3 Haiku, Llama 4 Maverick

Source: arXiv

Reasoning-Oriented Jailbreak

Published 3/1/2026

Analyzed 4/10/2026

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct +4 more

Source: arXiv

Related research categories