Architecture Components

Multimodal Research

Security research involving multimodal AI systems

176 matching entries

Multimodal research results

176 entries

Inaudible Ultrasonic LLM Jailbreak

Published Mar 14, 2026Analyzed Apr 10, 2026Source: arXiv

Speech-driven Large Language Models (LLMs) and end-to-end Large Audio-Language Models (LALMs) are vulnerable to inaudible near-ultrasonic prompt injections, a framework dubbed Sirens' Whisper (SWhisper). By exploiting the non-linear response of commodity microphones, attackers can encode structured, phonetically optimized adversarial prompts into the 17–22 kHz near-ultrasonic band. Using regularized channel-inversion pre-compensation, the attacker shapes the waveform to account for microphone…

Sirens' Whisper: Inaudible Near-Ultrasonic Jailbreaks of Speech-Driven LLMs

Evaluated models: GLM-4 Voice, Qwen Omni Turbo, Llama 3.1 8B Instruct+5 more

GLM-4 Voice
Qwen Omni Turbo
Llama 3.1 8B Instruct
Gemma 3 4B
Qwen 2.5 7B Instruct
Mistral 7B Instruct v0.3
GLM-4 Air 250414
Grok 4

Reasoning-Oriented Jailbreak

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct+4 more

Qwen2-VL 7B Instruct
LLaVA v1.6 Mistral 7B
Llama 3.2 11B Vision Instruct
GPT-4o
Claude 3.7 Sonnet
GLM-4V Plus
Qwen-VL Plus

Assembling Malice From Benign

Published Mar 8, 2026Analyzed Apr 10, 2026Source: arXiv

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

Evaluated models: GPT-4o, Gemini 2.0 Flash 001, Gemini 2.5 Flash+3 more

GPT-4o
Gemini 2.0 Flash 001
Gemini 2.5 Flash
Qwen3-VL Flash
Qwen 2.5 VL 7B Instruct
InternVL3 9B

Two-Frame Infilling Jailbreak

Published Mar 7, 2026Analyzed Apr 10, 2026Source: arXiv

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

MLLM Multi-Paradigm Collaborative

Published Mar 5, 2026Analyzed Mar 9, 2026Source: arXiv

Multi-Modal Large Language Models (MLLMs) are vulnerable to a highly transferable, black-box adversarial image attack known as the Multi-Paradigm Collaborative Attack (MPCAttack). Attackers can craft imperceptible visual perturbations by jointly aggregating and optimizing semantic feature representations extracted from surrogate models across three distinct learning paradigms: cross-modal alignment (e.g., CLIP), multi-modal understanding (e.g., InternVL3), and visual self-supervised learning…

Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, InternVL3 8B, LLaVA 1.5 7B+3 more

Qwen 2.5 VL 7B Instruct
InternVL3 8B
LLaVA 1.5 7B
GLM-4.1V 9B Thinking
GPT-4o
GPT-5

Inter-Turn Modality Jailbreak

Published Mar 3, 2026Analyzed Mar 8, 2026Source: arXiv

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Flash Preview, GPT-4o+1 more

Gemini 2.5 Flash
Gemini 3 Flash Preview
GPT-4o
Claude Sonnet 4

Video-LLM Token Flood

Published Mar 2, 2026Analyzed Mar 9, 2026Source: arXiv

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models

Evaluated models: LLaVA-NeXT-Video 7B, Qwen3-VL 4B Instruct, Video-LLaVA 7B

Multi-Image Semantic Reconstruction

Published Feb 28, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to bypass safety alignments via Multi-Image Dispersion and Semantic Reconstruction (MIDAS). Attackers decompose malicious instructions into risk-bearing semantic subunits, fragment them, and distribute them across multiple benign-looking Game-style Visual Reasoning (GVR) puzzles (e.g., Letter Equations, Rank-and-Read, Odd-One-Out). A sanitized, persona-driven textual prompt with sequential placeholders is then used to…

MIDAS: Multi-Image Dispersion and Semantic Reconstruction for Jailbreaking MLLMs

Evaluated models: Gemini 2.5 Flash Thinking, Gemini 2.5 Pro, GPT-4o+2 more

Gemini 2.5 Flash Thinking
Gemini 2.5 Pro
GPT-4o
GPT-5 Chat
QVQ-Max

Indirect Prompt Injection Hijacks Tool-Using Agents

Published Feb 24, 2026Analyzed Jul 20, 2026Source: arXiv

The paper evaluates a reproducible indirect prompt injection issue in ReAct-style LLM agents: untrusted retrieved content can be interpreted as instructions and redirect the agent toward unauthorized tool calls. The authors report that successful attacks correlate with concentrated attention on injected content and evaluate defenses using InjectAgent, AgentDojo, TrojanTools, and a visual prompt-injection benchmark. These are paper-reported findings, not independently verified facts.

ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correction

Evaluated models: Qwen 3 8B, Llama 3.1 8B, Mistral 8B+3 more

Qwen 3 8B
Llama 3.1 8B
Mistral 8B
Qwen3VL
InternVL
MiniCPM

Safety Guidance Harm Collision

Published Feb 24, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in multi-category safety-guidance mechanisms (such as Safe Latent Diffusion [SLD] and SAFREE) for Text-to-Image (T2I) diffusion models allows attackers to bypass safety filters and generate restricted content via "Harmful Conflicts." Existing safety methods aggregate multiple harmful keyword categories (e.g., hate, violence, sexual) into a single unified safety direction in the latent or text space. Because distinct harmful categories possess incompatible safety directions…

When Safety Collides: Resolving Multi-Category Harmful Conflicts in Text-to-Image Diffusion via Adaptive Safety Guidance

Evaluated models: GPT-4o, Stable Diffusion

Related research categories