Architecture Components

Multimodal Research

Security research involving multimodal AI systems

176 matching entries

Multimodal research results

176 entries

MLLM Over-Reasoning Safety Risk

Published Jan 20, 2026Analyzed Feb 21, 2026Source: arXiv

Multimodal Large Language Models (MLLMs) exhibit a vulnerability to "Reasoning-based Multi-Image Attacks," where safety guardrails are bypassed by distributing harmful intent across multiple images (2–4 inputs). Unlike single-image jailbreaks that rely on visual obfuscation, this vulnerability exploits the model's reasoning capabilities. By presenting images that share a specific relationship (e.g., Temporal Jump, Spatial Juxtaposition, or Causality), an attacker can compel the model to infer…

The Side Effects of Being Smart: Safety Risks in MLLMs' Multi-Image Reasoning

Evaluated models: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro+11 more

GPT-4o
GPT-4o Mini
Gemini 1.5 Pro
Gemini 1.5 Flash
Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 32B Instruct
LLaVA 1.5 7B
Llama 3 LLaVA-NeXT 8B
InternVL3 8B
InternVL3 38B
InternVL3 78B
MiniCPM-o 2.6
Skywork-R1V3 38B
GLM-4.1V 9B Thinking

Sound Induces Trimodal Collapse

Published Jan 20, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in trimodal audio-video-language models where an attacker can systematically degrade multimodal reasoning through untargeted, audio-only adversarial perturbations. By optimizing a shared perturbation $\delta$ applied to the audio channel, an attacker can manipulate internal representations—specifically targeting audio encoder embeddings and cross-modal attention mechanisms—without modifying visual or textual inputs. The attack exploits the model's reliance on the audio…

SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models

Evaluated models: VideoLLAMA2, Qwen 2 7B Instruct, Whisper Large-v2+1 more

VideoLLAMA2
Qwen 2 7B Instruct
Whisper Large-v2
PANNs

MLLM Chart Deception

Published Jan 19, 2026Analyzed Feb 21, 2026Source: arXiv

Code-generation Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) are vulnerable to directed misuse for the generation of misleading data visualizations. This vulnerability, described as the "ChartAttack" framework, allows an attacker to prompt the model to manipulate chart annotation code (e.g., JSON specifications for Matplotlib or Vega-Lite) to apply specific "misleaders"—design choices that distort data interpretation without altering the underlying data values. By…

ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation

Evaluated models: Qwen 2.5 14B, LLaVA 7B, Phi-3

VLM In-the-Loop Adversary

Published Jan 19, 2026Analyzed Mar 9, 2026Source: arXiv

The VILTA (VLM-in-the-Loop Trajectory Adversary) framework is vulnerable to Prompt Injection and Data Poisoning via un-sanitized scene representation inputs. The system integrates a Vision-Language Model (Gemini-2.5-Flash) into a closed-loop reinforcement learning environment, feeding it Bird’s-Eye-View (BEV) imagery alongside text-based vehicle dynamics data (e.g., position, speed, and risk_category) to generate challenging driving trajectories. An attacker who can manipulate the input…

VILTA: A VLM-in-the-Loop Adversary for Enhancing Driving Policy Robustness

Evaluated models: Gemini 2.5 Flash

Macaronic T2I Jailbreak

Published Jan 12, 2026Analyzed Mar 8, 2026Source: arXiv

Text-to-Image (T2I) models and their associated safety filters are vulnerable to MacPrompt, a black-box jailbreak technique that exploits cross-lingual embedding alignments. Attackers can bypass input text filters, latent representation filters, and model-level concept removal defenses by replacing sensitive keywords with "macaronic" substitutes. These substitutes are constructed by extracting and recombining character-level substrings from translations of the target word across multiple…

MacPrompt: Maraconic-guided Jailbreak against Text-to-Image Models

Evaluated models: DALL-E, Stable Diffusion

LLM Review Paraphrase Attack

Published Jan 11, 2026Analyzed Feb 22, 2026Source: arXiv

LLM-as-a-Reviewer systems, which utilize large language models to automate the peer review process, are vulnerable to the Paraphrasing Adversarial Attack (PAA). PAA is a black-box optimization technique that exploits the model's sensitivity to specific input sequences and self-preference bias. By iteratively paraphrasing specific manuscript sections (such as the abstract) using in-context learning (ICL) guided by previous review scores, an attacker can generate adversarial sequences that…

Paraphrasing Adversarial Attack on LLM-as-a-Reviewer

Evaluated models: GPT-4o, Claude Sonnet 4

Point Cloud Adversarial Attack

Published Jan 10, 2026Analyzed Feb 22, 2026Source: arXiv

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

On the Adversarial Robustness of 3D Large Vision-Language Models

Evaluated models: Vicuna 7B

Distal Translation Jailbreak

Published Jan 8, 2026Analyzed Mar 8, 2026Source: arXiv

A vulnerability in the prompt-side safety filters of GPT-based Text-to-Image (T2I) systems allows attackers to bypass restrictions on Politically Sensitive Content (PSC). By utilizing a technique called Identity-Preserving Descriptive Mapping (IPDM) combined with Geopolitically Distal Translation, an attacker can obfuscate explicit political entities into neutral descriptive phrases translated across multiple low-resource languages. This induces semantic fragmentation, preventing the safety…

: Politically Controversial Content Generation via Jailbreaking Attacks on GPT-based Text-to-Image Models

Evaluated models: GPT-4o, GPT-5, GPT-5.1+2 more

GPT-4o
GPT-5
GPT-5.1
DALL-E
Midjourney

Multi-turn MLLM Jailbreak

Published Jan 8, 2026Analyzed Feb 21, 2026Source: arXiv

Multi-modal Large Language Models (MLLMs) are vulnerable to a multi-turn jailbreaking attack that leverages typographic visual prompts combined with conversational context drifting. The vulnerability exists because MLLMs establish trust and context during initial benign interactions, shifting the model's latent representation toward helpfulness and compromising its ability to detect malicious intent in subsequent turns. The attack vector utilizes an image where a harmful request is…

Multi-turn Jailbreaking Attack in Multi-Modal Large Language Models

Evaluated models: GPT-4o, Gemini 2.0 Flash, Qwen2-VL 7B Instruct+2 more

GPT-4o
Gemini 2.0 Flash
Qwen2-VL 7B Instruct
LLaVA 1.6 Mistral 7B
LLaVA 1.5 13B

Gamified Goal Pursuit Jailbreak

Published Jan 6, 2026Analyzed Feb 20, 2026Source: arXiv

A "Gamified Adversarial Multimodal Breakout via Instructional Traps" (GAMBIT) vulnerability exists in the safety alignment mechanisms of Multimodal Large Language Models (MLLMs), specifically those employing Chain-of-Thought (CoT) reasoning. The vulnerability exploits the finite cognitive resource budget of the model by inducing "cognitive overload" through a high-stakes, gamified context. The attack functions by decomposing a harmful query into a visual puzzle (e.g., a shuffled grid of image…

GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models

Evaluated models: GPT-4o, Grok 2 Vision, GLM-4.1V Thinking+3 more

GPT-4o
Grok 2 Vision
GLM-4.1V Thinking
QVQ-Max
Gemini 2.5 Flash
o4-mini

Related research categories