Architecture Components

Multimodal Research

Security research involving multimodal AI systems

176 matching entries

Multimodal research results

176 entries

Cross-Modal Entanglement Jailbreak

Published Feb 9, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in advanced Vision-Language Models (VLMs) allows attackers to bypass safety alignment mechanisms via a Cross-Modal Entanglement Attack (COMET). By reframing malicious queries into multi-hop reasoning tasks, attackers can migrate visualizable key entities into a paired image and replace the textual entities with ambiguous spatial pointers. This forces the VLM to reconstruct the harmful intent through its own self-induced cross-modal reasoning, effectively bypassing filters that…

Red-teaming the Multimodal Reasoning: Jailbreaking Vision-Language Models via Cross-modal Entanglement Attacks

Evaluated models: GPT-4.1, GPT-4.1 Mini, Gemini 2.5 Flash+6 more

GPT-4.1
GPT-4.1 Mini
Gemini 2.5 Flash
Qwen3-VL 235B-A22B Instruct
Qwen 2.5 VL 72B Instruct
GLM-4.5V
Gemini 2.5 Pro
Llama 4 Maverick
Claude Haiku 4.5

VLM Split-Image Blindspot

Published Feb 8, 2026Analyzed Feb 22, 2026Source: arXiv

Vision Language Models (VLMs) utilizing independent vision encoders (e.g., ViT) and Large Language Model (LLM) decoders are vulnerable to Split-Image Visual Jailbreak Attacks (SIVA). The vulnerability arises from an architectural and alignment discrepancy: while the vision encoder processes image fragments (splits) in isolation via constrained attention or block-diagonal masks, the LLM decoder aggregates these features via cross-attention to reconstruct the semantic content. Current safety…

Robustness of Vision Language Models Against Split-Image Harmful Input Attacks

Evaluated models: Llama 3.2 11B

Voice Agent Behavioral Bypass

Published Feb 7, 2026Analyzed Feb 21, 2026Source: arXiv

Audio Large Language Models (ALLMs) integrated into voice agent systems for high-stakes domains (banking, IT support, logistics) are vulnerable to multimodal adversarial attacks via spoken interaction. Adversaries can exploit the model's inherent compliance and contextual awareness through multi-turn dialogue to bypass authentication safeguards, escalate privileges (e.g., unauthorized credit limit increases), exfiltrate sensitive Personally Identifiable Information (PII), and poison…

Aegis: Towards Governance, Integrity, and Security of AI Voice Agents

Evaluated models: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro+4 more

GPT-4o
GPT-4o Mini
Gemini 1.5 Pro
Gemini 2.5 Flash
Gemini 2.5 Pro
Qwen2-Audio 7B
Qwen 2.5 Omni 7B

Synchronized Multimodal Steering

Published Feb 6, 2026Analyzed Mar 9, 2026Source: arXiv

Multimodal Large Language Model-based Recommender Systems (MLLM-RecSys) are vulnerable to Cross-Modal Interactive Data Poisoning. Attackers can manipulate the system by injecting compromised user-generated content (UGC) that contains synchronized, coupled perturbations across both textual and visual modalities. While MLLMs naturally filter out single-modality noise via cross-modal consensus, this vulnerability exploits the consensus mechanism itself. By leveraging cross-modal attention to…

VENOMREC: Cross-Modal Interactive Poisoning for Targeted Promotion in Multimodal LLM Recommender Systems

Evaluated models: Not reported

Invisible Prompt Phishing Evasion

Published Feb 5, 2026Analyzed Mar 8, 2026Source: arXiv

Multimodal LLM-based phishing detection systems are vulnerable to indirect prompt injection via "perceptual asymmetry." Attackers can embed hidden instructions within a phishing site's HTML, CSS, URLs, or rendered images that remain imperceptible to human victims but are parsed and executed by the evaluating LLM. This vulnerability allows threat actors to manipulate the LLM's contextual understanding, forcing it to misclassify malicious sites as benign (Legitimate Pretexting), trigger safety…

Clouding the Mirror: Stealthy Prompt Injection Attacks Targeting LLM-based Phishing Detection

Evaluated models: GPT-5, Grok 4 Fast Non-Reasoning, Llama 4 Maverick+1 more

GPT-5
Grok 4 Fast Non-Reasoning
Llama 4 Maverick
Gemma 3 27B

Visual Exclusivity Agentic Jailbreak

Published Feb 5, 2026Analyzed Apr 10, 2026Source: arXiv

Frontier Multimodal Large Language Models (MLLMs) are vulnerable to Visual Exclusivity (VE) attacks, an "Image-as-Basis" threat where malicious intent is achieved through joint reasoning over benign text and complex technical visual content (e.g., blueprints, schematics, network diagrams). Unlike wrapper-based attacks that conceal malicious text via typography or adversarial noise, VE exploits the model's core visual reasoning capabilities. Attackers can bypass safety filters by combining…

Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planning

Evaluated models: Llama 3.2 11B Vision, InternVL3 8B, Qwen3-VL 8B+5 more

Llama 3.2 11B Vision
InternVL3 8B
Qwen3-VL 8B
GPT-4o
GPT-5
Claude 3.7 Sonnet
Claude Sonnet 4.5
Gemini 2.5 Pro

Progressive Attention LVLM Attack

Published Feb 4, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1+7 more

Gemini 2.5 Flash
Gemini 3 Pro Preview
GPT-4.1
GPT-5 Mini
Grok 4 Fast
LLaVA 1.5 7B
Llama 4 Maverick
Gemma 3 4B IT
Qwen3-VL 30B-A3B Instruct
Qwen3-VL 235B-A22B Instruct

Semantic Hierarchical VLM Transfer

Published Feb 2, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Evaluated models: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B+4 more

UniDiffuser
BLIP-2 ViT-g/14
InstructBLIP Vicuna 13B
MiniGPT-4 Vicuna 13B
LLaVA 1.5 13B
LLaVA NeXT Qwen 1.5 72B Chat
GPT-4o

UltraBreak Universal VLM Jailbreak

Published Feb 1, 2026Analyzed Feb 20, 2026Source: arXiv

Vision-Language Models (VLMs) are vulnerable to a universal and transferable adversarial attack dubbed "UltraBreak." This vulnerability allows remote attackers to bypass safety alignment filters and elicit harmful responses (e.g., hate speech, dangerous instructions) by supplying a single, specifically crafted adversarial image alongside a text query. Unlike traditional gradient-based attacks that optimize for specific token sequences (cross-entropy loss) and result in brittle…

Toward Universal and Transferable Jailbreak Attacks on Vision-Language Models

Evaluated models: Qwen VL Chat, Qwen2-VL 7B Instruct, Qwen 2.5 VL 7B Instruct+6 more

Qwen VL Chat
Qwen2-VL 7B Instruct
Qwen 2.5 VL 7B Instruct
LLaVA v1.6 Mistral 7B
Kimi VL A3B Instruct
GLM-4.1V 9B Thinking
GPT-4.1 Nano
Gemini 2.5 Flash-Lite
Claude 3 Haiku

OCR Image Distraction Jailbreak

Published Jan 31, 2026Analyzed Feb 20, 2026Source: arXiv

Large Vision-Language Models (LVLMs) possessing Optical Character Recognition (OCR) capabilities are vulnerable to a "Text Distraction Jailbreaking" (Text-DJ) attack. The vulnerability exploits a gap between the model's visual text extraction and its safety alignment mechanisms. By converting a decomposed harmful textual query into images and embedding these images within a grid of semantically irrelevant "distraction" text images, an attacker can bypass safety filters. The model's OCR…

Text is All You Need for Vision-Language Model Jailbreaking

Evaluated models: GPT-4o Mini, GPT-4.1 Mini, Gemini 2.5 Flash+3 more

GPT-4o Mini
GPT-4.1 Mini
Gemini 2.5 Flash
Qwen3-VL 4B Instruct
Qwen3-VL 8B Instruct
Qwen3-VL 30B-A3B Instruct

Related research categories