Architecture Components

Vision Research

Security issues in vision-language models

83 matching entries out of 131 in this category

Vision research results

83 entries

Information-Overloading Jailbreaks in Vision-Language Models

Published Jul 3, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a reproducible black-box multimodal jailbreak evaluation, INFER/INFER+, in which dense image typography, nested cross-modal references, recursive visual layouts, and entropy-guided search increase processing complexity and weaken refusal behavior in large vision-language models. The authors report average ASRs of 88.6% on open-source models and 84.0% on commercial models; these are paper-reported measurements, not independently verified facts. For safe defensive…

Overloading Large Vision-Language Models for Jailbreaking

Evaluated models: Qwen3-VL 8B, Qwen2-VL-7B, InternVL3.5-8B+5 more

Qwen3-VL 8B
Qwen2-VL-7B
InternVL3.5-8B
InternVL 2 8B
Llama 3.2 11B Vision
GPT-4.1 Mini
Gemini 2.5 Flash
Gemini 2.5 Flash-Lite

Multilingual Flowchart Jailbreaks in Vision-Language Models

Published Jun 5, 2026Analyzed Jul 20, 2026Source: arXiv

MLingualFC is a reproducible black-box safety evaluation showing that harmful instructions rendered as multilingual flowchart images can bypass vision-language model safeguards more often than equivalent text-only inputs. The paper evaluates horizontal, vertical, and tortuous layouts across English, Hindi, Punjabi, Spanish, Romanian, and German. Reported results vary substantially by language, script, layout, and model; these are paper-reported measurements, not independently verified…

MLingualFC: Evaluating Jailbreak Vulnerabilities in Multilingual Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Gemma-4-E4B-it, Pangea-7B

Visual-Modality Jailbreaks Bypass VLM Safety Alignment

Published May 1, 2026Analyzed Jul 20, 2026Source: arXiv

The paper reports a reproducible black-box evaluation showing that vision-language models can recover prohibited intent encoded or implied through ostensibly benign visual inputs. Four tested families—visual ciphers, object replacement, text replacement, and analogy riddles—expose a cross-modality alignment gap: safeguards effective for explicit text may not reliably apply after harmful semantics are reconstructed from images. These are paper-reported results, not independently verified…

Jailbreaking Vision-Language Models Through the Visual Modality

Evaluated models: GPT-5.2, Claude Haiku 4.5, Gemini 3 Flash+3 more

GPT-5.2
Claude Haiku 4.5
Gemini 3 Flash
Gemini 3.1 Pro
Qwen3-VL-235B
Qwen3-VL-32B

Semantic Masking Image Jailbreak

Published Apr 2, 2026Analyzed Apr 10, 2026Source: arXiv

Multiple Text-to-Image (T2I) generation systems and their associated multi-stage moderation pipelines are vulnerable to low-effort semantic obfuscation attacks. Attackers can systematically bypass Input Compliance Checks (ICC), Semantic Safety Checks (SSC), and Post-Generation Moderation (PGM) by embedding restricted concepts into benign natural language contexts. By utilizing techniques such as Material Substitution, Artistic Reframing, Pseudo-Educational Framing, and Ambiguous Action…

Low-Effort Jailbreak Attacks Against Text-to-Image Safety Filters

Evaluated models: Sora, Stable Diffusion v1.4

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

VLM Image-Shift Jailbreak

Published Mar 18, 2026Analyzed Apr 10, 2026Source: arXiv

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Evaluated models: LLaVA 1.5 7B, ShareGPT4V 7B, InternVL-Chat 19B

Reasoning-Oriented Jailbreak

Published Mar 10, 2026Analyzed Apr 10, 2026Source: arXiv

A vulnerability in the compositional reasoning architecture of Large Vision-Language Models (LVLMs) allows attackers to bypass multimodal safety alignments using a technique known as Reasoning-Oriented Programming (ROP). Current safety mechanisms primarily target explicit malicious patterns at the perception level (early layers). This vulnerability exploits late-stage reasoning by decomposing a harmful objective into a set of spatially isolated, semantically benign visual "gadgets". Because…

Reasoning-Oriented Programming: Chaining Semantic Gadgets to Jailbreak Large Vision Language Models

Evaluated models: Qwen2-VL 7B Instruct, LLaVA v1.6 Mistral 7B, Llama 3.2 11B Vision Instruct+4 more

Qwen2-VL 7B Instruct
LLaVA v1.6 Mistral 7B
Llama 3.2 11B Vision Instruct
GPT-4o
Claude 3.7 Sonnet
GLM-4V Plus
Qwen-VL Plus

Assembling Malice From Benign

Published Mar 8, 2026Analyzed Apr 10, 2026Source: arXiv

A semantic slot filling vulnerability in Large Vision-Language Models (LVLMs) allows attackers to bypass safety filters and elicit prohibited content via a single query. The attack, known as StructAttack, decomposes a harmful instruction into a central topic and locally benign-appearing semantic slot types (e.g., "Raw Materials", "Making Process"). These individual slots are embedded into structured visual prompts (such as mind maps, tables, or sunburst diagrams) alongside harmless distractor…

Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints

Evaluated models: GPT-4o, Gemini 2.0 Flash 001, Gemini 2.5 Flash+3 more

GPT-4o
Gemini 2.0 Flash 001
Gemini 2.5 Flash
Qwen3-VL Flash
Qwen 2.5 VL 7B Instruct
InternVL3 9B

Two-Frame Infilling Jailbreak

Published Mar 7, 2026Analyzed Apr 10, 2026Source: arXiv

A temporal trajectory infilling vulnerability in Text-to-Video (T2V) generative models allows attackers to bypass input and output safety filters to generate policy-violating content. The vulnerability is exploited using a fragmented prompting technique known as Two Frames Matter (TFM). An attacker submits a prompt that specifies only sparse boundary conditions (the start and end frames) using semantically suggestive but lexically benign alternatives, entirely omitting the intermediate action…

Two Frames Matter: A Temporal Attack for Text-to-Video Model Jailbreaking

Evaluated models: Not reported

Inter-Turn Modality Jailbreak

Published Mar 3, 2026Analyzed Mar 8, 2026Source: arXiv

Multimodal Large Language Models (LLMs) are vulnerable to alignment bypass via Inter-Turn Modality Switching (ITMS). By systematically rotating the input modality (e.g., alternating between text, audio, and image) across successive turns in a multi-turn adversarial conversation, an attacker can destabilize the model's safety defenses. The cross-modal transition mechanism exploits alignment gaps between differing input processing pipelines, accelerating the erosion of safety guardrails and…

MUSE: A Run-Centric Platform for Multimodal Unified Safety Evaluation of Large Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Flash Preview, GPT-4o+1 more

Gemini 2.5 Flash
Gemini 3 Flash Preview
GPT-4o
Claude Sonnet 4

Related research categories