DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs (2026.acl-long)
Copied to clipboard
| Challenge: | Existing jailbreak methods only use a single image, restricting the attack space . Existing frameworks only use single image to distribute harmful requests across multiple images . |
| Approach: | They propose a compositional jailbreak framework that leverages Distributed instruction, Multimodal evidence and a Number chain task to fully enhance the jailbreak performance. |
| Outcome: | The proposed framework achieves attack success rates of over 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4 . |
Similar Papers
From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking (2024.emnlp-main)
Copied to clipboard
| Challenge: | Recent advances in Large Language Models (LLMs) have demonstrated remarkable performance across various tasks, effectively following instructions to meet diverse user needs. |
| Approach: | They propose a framework for evaluation benchmarks and attack techniques for LLMs and MLLMs to enhance their security. |
| Outcome: | The proposed frameworks have been exploited to exploit the weaknesses of LLMs and MLLMs. |
MLLM-Protector: Ensuring MLLM’s Safety without Hurting Performance (2024.emnlp-main)
Copied to clipboard
Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, Tong Zhang
| Challenge: | MLLMs are deployed on limited image-text pairs, which makes them more vulnerable to catastrophic forgetting of their original abilities during safety fine-tuning. |
| Approach: | They propose a plug-and-play strategy that detects harmful visual inputs and transforms harmful ones into harmless ones. |
| Outcome: | The proposed approach mitigates the risks posed by malicious visual inputs without compromising the original performance of MLLMs. |
Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models (2024.findings-emnlp)
Copied to clipboard
| Challenge: | Multimodal Large Language Models (MLLMs) are susceptible to jailbreak attacks, authors say . multimodal information increases the risk of attacks, but also provides additional data . |
| Approach: | They propose a jailbreaking detector that detects maliciously perturbed image inputs . cross-modality information detector is designed to detect cross-modal similarity between harmful queries and adversarial images. |
| Outcome: | a new tool can detect maliciously perturbed image inputs without modification or computation cost. |
Jailbreaking Multimodal Large Language Models using Multi-Clip Video (2026.acl-long)
Copied to clipboard
| Challenge: | Existing studies show that video inputs can bypass safety alignment, yet it remains unclear which properties of video input induce this vulnerability. |
| Approach: | They propose a simple image-based defense that mitigates the vulnerability of MLLMs by analyzing video inputs. |
| Outcome: | The proposed defense leverages the relative robustness of the image modality. |
Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Large Language Models (LLMs) have raised significant safety concerns about generated content, drawing attention from both academia and industry. |
| Approach: | They propose a reference-guided cross-modal jailbreak method that enhances existing prompt-to-image injection attacks by exploiting MLLMs’ semantic reconstruction capabilities. |
| Outcome: | The proposed method achieves an attack success rate of over 93% on leading MLLMs including ChatGPT, Gemini, Claude, and the widely used open-source LLaMA model. |
SafeSteer: A Decoding-level Defense Mechanism for Multimodal Large Language Models (2026.findings-acl)
Copied to clipboard
| Challenge: | Existing defense methods rely on fine-tuning or inefficient post-hoc interventions, limiting their ability to address novel attacks. |
| Approach: | They propose a decoding-level defense mechanism that employs a lightweight discriminator to iteratively steer the decoding process toward safety. |
| Outcome: | The proposed method improves safety performance by up to 33.40% without fine-tuning on multiple MLLMs. |
GAMBIT: A Gamified Jailbreak Framework for Multimodal Large Language Models (2026.acl-long)
Copied to clipboard
| Challenge: | Existing attacks focus on increasing the complexity of the modified visual task and do not explicitly leverage the model’s own reasoning incentives. |
| Approach: | They propose a framework that decomposes and reassembles harmful visual semantics and constructs a gamified scene that drives the model to explore, reconstruct intent and answer as part of winning the game. |
| Outcome: | Experiments on reasoning and non-reasoning MLLMs show that the proposed framework outperforms baseline models on both vision and text. |
FC-Attack: Jailbreaking Multimodal Large Language Models via Auto-Generated Flowcharts (2025.findings-emnlp)
Copied to clipboard
| Challenge: | Recent research shows that multimodal large language models are vulnerable to jailbreak attacks . |
| Approach: | They propose a jailbreak attack method based on auto-generated flowcharts . the flowchartings are then combined with a benign textual prompt to execute the attack . |
| Outcome: | The proposed method achieves an attack success rate of up to 96% via images and 78% via videos across multiple MLLMs. |
Jailbreak Large Vision-Language Models Through Multi-Modal Linkage (2025.acl-long)
Copied to clipboard
| Challenge: | Existing methods to jailbreak large vision-language models fail against cutting-edge models such as GPT-4o, despite having undergone safety alignment training. |
| Approach: | They propose a new framework for jailbreaking large vision-language models that uses an encryption-decryption process to mitigate the over-exposure of harmful information. |
| Outcome: | The proposed framework jailbreaks GPT-4o with 99.40% success rates on SafeBench, 98.81% on MM-SafeBench and 99.07% on HADES-Dataset. |
Exploring Compositional Generalization of Multimodal LLMs for Medical Imaging (2025.acl-long)
Copied to clipboard
Zhenyang Cai, Junying Chen, Rongsheng Wang, Weihong Wang, Yonglin Deng, Dingjie Song, Yize Chen, Zixu Zhang, Benyou Wang
| Challenge: | Current research suggests that multitask training outperforms single-task as different tasks can benefit each other, but they often overlook the internal relationships within these tasks. |
| Approach: | They employ compositional generalization (CG) to examine the generalization of multimodal large language models in medical imaging. |
| Outcome: | The proposed model can understand unseen medical images and is able to perform CG across classification and detection tasks. |