Attack Surface

Model layer Vulnerabilities

Vulnerabilities targeting the core model architecture and parameters

21 matching entries out of 465 in this category

Model layer research results

21 entries

Invisible Visual Prompt Injection

Updated 4/11/2026

An imperceptible visual prompt injection vulnerability in Multimodal Large Language Models (MLLMs) allows attackers to execute precise command-hijacking via a Covert Triggered dual-Target Attack (CoTTA). By embedding a bounded, learnable textual overlay ($L_\infty$ norm bound $\varepsilon \le 16$) and adversarial noise into an input image, the attack forces the source image's internal feature representation to align with both the textual and visual embeddings of an attacker-specified…

Adversarial Prompt Injection Attack on Multimodal Large Language Models

Affects: GPT-4o, GPT-5

Source: arXiv

Progressive Attention LVLM Attack

Updated 2/22/2026

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Affects: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1 +7 more

Source: arXiv

Visual Memory Multi-Turn Manipulation

Updated 3/8/2026

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Visual Memory Injection Attacks for Multi-Turn Conversations

Affects: Qwen 2.5 VL 7B Instruct, Qwen3-VL 8B Instruct, LLaVA-OneVision 1.5 8B Instruct +2 more

Source: arXiv

Multi-turn MLLM Jailbreak

Updated 2/21/2026

Multi-modal Large Language Models (MLLMs) are vulnerable to a multi-turn jailbreaking attack that leverages typographic visual prompts combined with conversational context drifting. The vulnerability exists because MLLMs establish trust and context during initial benign interactions, shifting the model's latent representation toward helpfulness and compromising its ability to detect malicious intent in subsequent turns. The attack vector utilizes an image where a harmful request is…

Multi-turn Jailbreaking Attack in Multi-Modal Large Language Models

Affects: GPT-4o, Gemini 2.0 Flash, Qwen2-VL 7B Instruct +2 more

Source: arXiv

VLM Moral Persuasion

Updated 2/21/2026

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Models

Affects: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 32B Instruct +20 more

Source: arXiv

Embodied Cross-Modal Misalignment

Updated 1/14/2026

OpenVLA, a Vision-Language-Action (VLA) model, contains a vulnerability regarding multimodal adversarial robustness. The model lacks sufficient cross-modal alignment stability, allowing attackers to disrupt the grounding between visual perception and linguistic instructions. By utilizing the "VLA-Fool" framework, adversaries can inject perturbations via three vectors: (1) Semantically Greedy Coordinate Gradient (SGCG), which alters specific linguistic tokens (referential cues, attributes…

When alignment fails: Multimodal adversarial attacks on vision-language-action models

Source: arXiv

Latent Space Discontinuity Exploitation

Updated 12/5/2025

A vulnerability exists in certain Large Language Models and diffusion models due to discontinuities in their latent space, which arise from data sparsity during training. An attacker can craft inputs containing lexically rare or semantically ambiguous constructs to guide the model's inference process toward these unstable, poorly-conditioned regions. This technique, termed "Alignment Degradation Induction," can degrade or bypass safety alignment mechanisms. Through iterative, multi-turn…

Exploiting Latent Space Discontinuities for Building Universal LLM Jailbreaks and Data Extraction Attacks

Source: arXiv

Adaptive Typographic Image Injection

Updated 12/30/2025

Multimodal agents built on Large Vision-Language Models (LVLMs) are vulnerable to adaptive typographic prompt injection attacks (AgentTypo). This vulnerability allows an attacker to execute indirect prompt injection by embedding adversarial text prompts directly into images (e.g., webpage screenshots, product photos) processed by the agent. Unlike standard visual adversarial attacks that rely on noise perturbation, this method utilizes the AgentTypo framework to perform black-box Bayesian…

AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agents

Affects: GPT-4o, GPT-4V, GPT-4o Mini +2 more

Source: arXiv

Black-Box Confidence Exploit

Updated 12/8/2025

A vulnerability exists in the self-reflection and introspection capabilities of Large Language Models (LLMs) and Vision-LLMs that allows attackers to perform black-box adversarial optimization using only textual model responses. This technique, termed "Asking for Directions" (AfD), bypasses the need for access to gradients, logits, or continuous confidence scores. The attacker employs a hill-climbing optimization strategy where they present the target model with two candidate inputs (an…

Black-box Optimization of LLM Outputs by Asking for Directions

Affects: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 72B Instruct +8 more

Source: arXiv

Physical Patch Driving Hijack

Updated 12/9/2025

Multimodal Large Language Models (MLLMs) employed in autonomous driving (AD) systems are vulnerable to a physically realizable adversarial patch attack dubbed "PhysPatch." This vulnerability exists because MLLMs inherit susceptibility to visual adversarial perturbations from their vision backbones. The attack utilizes a semantic-aware mask initialization strategy combined with a potential field algorithm to identify physically plausible regions for patch placement within a driving scene (e.g…

PhysPatch: A Physically Realizable and Transferable Adversarial Patch Attack for Multimodal Large Language Models-based Autonomous Driving Systems

Affects: LLaVA v1.6 13B, Qwen 2.5 VL 72B Instruct, Llama 3.2 90B Vision Instruct +8 more

Source: arXiv

Related research categories