Architecture Components

Multimodal Research

Security research involving multimodal AI systems

176 matching entries

Multimodal research results

176 entries

Alignment Curse Jailbreak Transfer

Published Jan 30, 2026Analyzed Mar 9, 2026Source: arXiv

End-to-end multimodal large language models (omni-models) that utilize a shared representation space for text and audio are vulnerable to cross-modality jailbreak transfer, a phenomenon termed the "alignment curse." Because these models are trained to strongly align audio and text embeddings in their mid-to-late layers, an attacker can reliably bypass audio-specific safety mechanisms by converting mature, text-based jailbreak prompts into audio using standard Text-to-Speech (TTS) tools. When…

The Alignment Curse: Cross-Modality Jailbreak Transfer in Omni-Models

Evaluated models: GPT-4o, Qwen 2.5 3B

Audio Narrative Jailbreak

Published Jan 30, 2026Analyzed Feb 21, 2026Source: arXiv

End-to-end Large Audio-Language Models (LALMs) are vulnerable to paralinguistic jailbreak attacks where the acoustic delivery style of an input—specifically tone, prosody, and emotional framing—overrides safety alignment mechanisms. Unlike adversarial perturbations that inject noise, this vulnerability exploits the model's personification bias by utilizing standard Text-to-Speech (TTS) synthesis to render prohibited instructions in psychologically manipulative vocal styles (e.g…

Now You Hear Me: Audio Narrative Attacks Against Large Audio-Language Models

Evaluated models: GPT-4o Realtime, Gemini 2.0 Flash, Qwen 2.5 Omni 7B

Universal MLLM Target Matching

Published Jan 30, 2026Analyzed Feb 22, 2026Source: arXiv

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

Evaluated models: GPT-4o, Claude Sonnet 4.5, GPT-5+2 more

GPT-4o
Claude Sonnet 4.5
GPT-5
GPT-5.2
Claude Opus 4.5

Adaptive Multimodal Reasoning Jailbreaks

Published Jan 29, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a black-box jailbreak evaluation in which a ReAct-style loop adaptively rewrites unsafe text prompts and selectively applies blur, DCT filtering, or recoloring to image regions identified as safety-sensitive. The combined cross-modal strategy is intended to make harmful image-text requests appear less objectionable to a vision-language model while preserving enough semantics to elicit an answer. This is a specific, security-relevant evaluation, although the reported results…

Jailbreaks on Vision Language Model via Multimodal Reasoning

Evaluated models: Gemini 2.0 Flash

Cross-Image Contagion

Published Jan 29, 2026Analyzed Feb 22, 2026Source: arXiv

Multi-modal Large Language Models (MLLMs) capable of processing interleaved image-text sequences are vulnerable to a universal adversarial perturbation (UAP) attack known as LAMP. This vulnerability allows an attacker to generate a single, noise-based perturbation pattern using a surrogate model (e.g., Mantis-CLIP) that transfers effectively to black-box target models. The attack leverages two novel loss functions during perturbation learning: a "contagious" objective that manipulates…

LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models

Evaluated models: Mantis-CLIP, Mantis-SIGLIP, Mantis-Idefics2+4 more

Mantis-CLIP
Mantis-SIGLIP
Mantis-Idefics2
VILA 1.5
LLaVA 1.6
Qwen VL Chat
MiniGPT-4

Visual Compression Mismatch Attack

Published Jan 29, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).

On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression

Evaluated models: LLaVA 1.5 7B

VLM Text Overrides Image

Published Jan 27, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMs

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, InternVL3 1B+8 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
InternVL3 1B
InternVL3 2B
InternVL3 8B
LLaVA-OneVision 0.5B
LLaVA-OneVision 7B
Gemini 2.5 Flash
Gemini 2.5 Pro
GPT-4o Mini
GPT-4o

Visual Object Injection

Published Jan 24, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4 Turbo+7 more

GPT-4o
GPT-4o Mini
GPT-4 Turbo
Gemini 1.5 Pro Latest
Gemini 1.5 Pro 002
Gemini 1.5 Flash Latest
Claude 3.5 Sonnet Latest
Claude 3.5 Haiku 20241022
Llama 3.2 11B Vision
Llama 3.2 90B Vision Instruct

VLM Moral Persuasion

Published Jan 23, 2026Analyzed Feb 21, 2026Source: arXiv

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 32B Instruct+20 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 32B Instruct
Qwen3-VL 2B Instruct
Qwen3-VL 4B Instruct
Qwen3-VL 8B Instruct
Qwen3-VL 30B-A3B Instruct
InternVL3 2B Instruct
InternVL3 8B Instruct
InternVL3 14B Instruct
InternVL3 38B Instruct
InternVL3.5 4B Instruct
InternVL3.5 8B Instruct
InternVL3.5 14B Instruct
InternVL3.5 38B Instruct
LLaVA 1.5 7B
LLaVA 1.5 13B
LLaVA v1.6 Vicuna 7B
LLaVA v1.6 Vicuna 13B
LLaVA v1.6 34B
Gemma 3 4B IT
Gemma 3 12B IT
Gemma 3 27B IT

Semantic-Agnostic Multimodal Image Jailbreak

Published Jan 22, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are…

Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs

Evaluated models: GPT-5, Gemini 1.5 Flash

Related research categories