Attack Type

Injection Vulnerabilities

Attacks that inject malicious content into model inputs

9 matching entries out of 323 in this category

Injection research results

9 entries

Visual Memory Multi-Turn Manipulation

Updated 3/8/2026

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Visual Memory Injection Attacks for Multi-Turn Conversations

Affects: Qwen 2.5 VL 7B Instruct, Qwen3-VL 8B Instruct, LLaVA-OneVision 1.5 8B Instruct +2 more

Source: arXiv

Embodied Cross-Modal Misalignment

Updated 1/14/2026

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

When alignment fails: Multimodal adversarial attacks on vision-language-action models

Source: arXiv

JailFlip Implicit Harm

Updated 12/8/2025

A vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs) (including GPT-4, Claude 3, Gemini, and Qwen families) leading to "Implicit Harm." Unlike traditional jailbreaks that use overtly harmful queries, this vulnerability allows remote attackers to coerce the model into providing factually incorrect, plausible, and dangerous responses to benign-looking inputs. By employing "JailFlip" techniques—specifically constructed affirmative-type or denial-type queries…

Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures

Affects: GPT-4.1, GPT-4.1 Mini, GPT-4o +3 more

Source: arXiv

Image-Text Jailbreak

Updated 3/8/2026

Multimodal Large Language Models (MLLMs) are vulnerable to coupled cross-modal jailbreak attacks that combine continuous visual perturbations with discrete textual manipulations. Because standard alignment and single-modality defenses (such as text-only safety tuning or isolated vision-encoder adversarial training) fail to secure the cross-modal interaction, attackers can simultaneously apply gradient-based noise (e.g., PGD) to input images and adversarial suffixes (e.g., GCG) to text prompts…

E2AT: Multimodal Jailbreak Defense via Dynamic Joint Optimization for Multimodal Large Language Models

Affects: LLaVA 1.5 7B, Bunny 1.0 4B, Mplug-owl2

Source: arXiv

Single Image Universal Jailbreak

Updated 12/9/2025

Multimodal Large Language Models (MLLMs) are vulnerable to a universal adversarial attack where a single, optimized image can bypass safety alignment mechanisms across diverse textual queries. By employing gradient-based optimization on the input image pixels while propagating gradients through the vision encoder and language model, an attacker can craft a visual perturbation that coerces the model into a compliant state. When this adversarial image is present in the context, the model’s…

Universal Adversarial Attack on Multimodal Aligned LLMs

Affects: LLaVA 1.5 7B, Llama 3.2 11B Vision Instruct, Phi-3.5 Vision Instruct +1 more

Source: arXiv

Visual Jailbreak via Multi-Loss

Updated 12/29/2024

Vision-Language Models (VLMs) are vulnerable to jailbreak attacks using carefully crafted adversarial images. Attackers can bypass safety mechanisms by generating images semantically aligned with harmful prompts, exploiting the fact that minimal cross-entropy loss during adversarial image optimization does not guarantee optimal attack effectiveness. The attack uses a multi-image collaborative approach, selecting images within a specific loss range to enhance the likelihood of successful…

Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models

Affects: LLaVA 2, MiniGPT-4

Source: arXiv

Visual Adversarial Tool Abuse

Updated 12/28/2024

A vulnerability exists in multimodal Large Language Models (LLMs) integrated with external tools. Adversarial images, visually indistinguishable from benign images, can manipulate the LLM to execute unintended tool commands, compromising the confidentiality and integrity of user resources. The attack is effective across diverse prompts, remaining stealthy both in the image itself and in the generated text response.

Misusing tools in large language models with visual adversarial examples

Source: arXiv

Cross-Modal VLM Jailbreak

Updated 3/4/2025

A vulnerability in multi-modal large language models (LLMs) allows adversaries to bypass safety mechanisms through compositional adversarial attacks. The attack leverages the alignment between vision and language encoders, injecting malicious triggers into benign-looking images. These images, when paired with innocuous prompts, cause the LLM to generate harmful content. The attack requires access only to the vision encoder (e.g., CLIP), not the LLM itself, lowering the barrier to attack.

Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models

Affects: Llama-adapterv2

Source: arXiv

Visual Jailbreak of LLMs

Updated 12/29/2024

A vulnerability in vision-integrated Large Language Models (VLMs) allows an attacker to circumvent safety mechanisms through the use of adversarially crafted visual examples. A single, carefully constructed image can universally "jailbreak" the model, causing it to generate harmful content in response to a wide range of subsequent prompts, even those not included in the adversarial example's training data. This vulnerability extends beyond simple misclassification to encompass the execution of…

Visual adversarial examples jailbreak large language models

Affects: InstructBLIP, MiniGPT-4

Source: arXiv

Related research categories