---
title: "Jailbreak in pieces — paper by Shayegani et al. (2023)"
description: "Multi-modal language models take their safety alignment from a text-only LLM backbone, but that… 43 references, cited by 69 papers here."
authors: ["Erfan Shayegani", "Yue Dong", "Nael Abu-Ghazaleh"]
year: 2023
venue: "arXiv:2307.14539"
source: "https://arxiv.org/abs/2307.14539"
doi: "10.48550/arxiv.2307.14539"
arxiv: "2307.14539"
licence: "CC BY 4.0 (arXiv)"
licence_url: "http://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/shayegani-2023-jailbreak-pieces-compositional-adversarial-attacks/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/shayegani-2023-jailbreak-pieces-compositional-adversarial-attacks/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2023](https://md.research.elamur.ai/free/en/papers/2023/page/9/) / Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models

# Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models

**Authors:** [Erfan Shayegani](https://md.research.elamur.ai/free/en/authors/erfan-shayegani/), [Yue Dong](https://md.research.elamur.ai/free/en/authors/yue-dong/) and [Nael Abu-Ghazaleh](https://md.research.elamur.ai/free/en/authors/nael-abu-ghazaleh/) · **Year:** 2023 · **Venue:** arXiv:2307.14539 · **Licence:** [CC BY 4.0 (arXiv)](http://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://arxiv.org/abs/2307.14539) · [PDF](https://arxiv.org/pdf/2307.14539) · [DOI 10.48550/arxiv.2307.14539](https://doi.org/10.48550/arxiv.2307.14539) · [arXiv 2307.14539](https://arxiv.org/abs/2307.14539) · [OpenAlex](https://openalex.org/W4385387622)

**Citations:** 12 citations (OpenAlex, 2026-10-14) · [69](https://md.research.elamur.ai/free/en/papers/shayegani-2023-jailbreak-pieces-compositional-adversarial-attacks/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
Multi-modal language models take their safety alignment from a text-only LLM backbone, but that protection may not cover content that arrives through the vision channel. The authors exploit this gap with a compositional jailbreak. A harmful request is split into a harmless-sounding text instruction, such as asking how to build "these objects", and an adversarial image that carries the dangerous meaning. The image is benign-looking and is optimized with gradients so that its vision-encoder embedding matches a malicious target. The target can be plain text, rendered text (OCR), a visual depiction, or OCR combined with visuals. The method needs only the vision encoder (CLIP) and treats the language model as a black box. This makes it cheaper and more practical than earlier white-box attacks, which backpropagate through the whole VLM. On LLaVA and LLaMA-Adapter V2, image-based targets jailbreak the models much more often than text targets. One adversarial image also works with many generic prompts, and one prompt works with many images. The study shows that text-side alignment alone leaves multi-modal systems exposed, so new cross-modal alignment methods are needed.

## Key points
- **Four trigger types** are defined in the joint embedding space: textual, OCR textual, visual, and combined OCR textual-visual. Adversarial images are pushed toward the embedding of the chosen trigger.
- **Threat model:** the attacker needs only an off-the-shelf vision encoder such as CLIP and no access to the LLM. This contrasts with concurrent work (Qi et al., Carlini et al., Bagdasaryan et al., Bailey et al.), which assumes full white-box access to the model.
- **Main finding on LLaVA and LLaMA-Adapter V2:** triggers tied to the image modality (OCR, visual, combined) clearly outperform purely textual triggers. Images and prompts can be mixed and matched without re-optimizing each pair.
- **Hidden prompt injection:** the paper also tests attacks that inject instructions through images. Indirect injection succeeds far more often than direct injection, because the models are trained to describe images rather than obey them. Targets showing concrete real-world entities work best. For example, "strong" words like Meth, Marijuana, and Gun beat "weak" ones like Heroin, MDMA, and Pistol, likely reflecting what appears in CLIP's training data.
- **Commercial systems:** Google Bard and Microsoft Bing were shown to follow instructions written inside uploaded images via their OCR abilities.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [University of California, Riverside](https://md.research.elamur.ai/free/en/universities/university-of-california-riverside/) — University, Riverside, United States · 10 works · 420 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 18,614 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 17,965 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 3,486 works

🧭 Topics (3): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,894 works · [🖼️ Vision & language](https://md.research.elamur.ai/free/en/topics/multimodal/) · 811 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 587 works

## Cite

Cite as: Erfan Shayegani, Yue Dong and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models. arXiv:2307.14539.

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@misc{shayegani2023jailbreak,
  title = {{Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models}},
  author = {Erfan Shayegani, Yue Dong and Nael Abu-Ghazaleh},
  year = {2023},
  doi = {10.48550/arxiv.2307.14539},
  eprint = {2307.14539},
  archivePrefix = {arXiv},
  url = {https://doi.org/10.48550/arxiv.2307.14539}
}
```

- [← previous Interpretability at Scale: Identifying Causal Mechanisms in Alpaca](https://md.research.elamur.ai/free/en/papers/wu-2023-interpretability-scale-identifying-causal-mechanisms/)
- [next → Large Language Models Meet Harry Potter: A Dataset for Aligning Dialogue Agents with Characters](https://md.research.elamur.ai/free/en/papers/chen-2023-large-language-models-meet-harry/)
- [↑ back to papers of 2023](https://md.research.elamur.ai/free/en/papers/2023/page/9/)

## References

43 references, 25 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Abhishek Aich, Calvin-Khang Ta, Akash Gupta, Chengyu Song, Srikanth Krishnamurthy, Salman Asif, and Amit Roy-Chowdhury. Gama: Generative adversarial multi-object scene attacks. Advances in Neural Information Processing Systems, 35:36914–36930, 2022. [find](https://scholar.google.com/scholar?q=Abhishek+Aich%2C+Calvin%2DKhang+Ta%2C+Akash+Gupta%2C+Chengyu+Song%2C+Srikanth+Krishnamurthy%2C+Salman+Asif%2C+and+Amit+Roy%2DChowdhury%2E+Gama%3A+Generative+adversarial+multi%2Dobject+scene+attacks%2E+Advances+in+Neural+Info)
2. Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. (ab) using images and sounds for indirect instruction injection in multi-modal llms. arXiv preprint arXiv:2307.10490, 2023. — [arXiv:2307.10490](https://arxiv.org/abs/2307.10490) [find](https://scholar.google.com/scholar?q=Eugene+Bagdasaryan%2C+Tsung%2DYin+Hsieh%2C+Ben+Nassi%2C+and+Vitaly+Shmatikov%2E+%28ab%29+using+images+and+sounds+for+indirect+instruction+injection+in+multi%2Dmodal+llms%2E+arXiv+preprint+arXiv%3A2307%2E10490%2C+2023%2E+%E2%80%94+%5BarX)
3. Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. Image hijacking: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236, 2023. — [arXiv:2309.00236](https://arxiv.org/abs/2309.00236) [find](https://scholar.google.com/scholar?q=Luke+Bailey%2C+Euan+Ong%2C+Stuart+Russell%2C+and+Scott+Emmons%2E+Image+hijacking%3A+Adversarial+images+can+control+generative+models+at+runtime%2E+arXiv+preprint+arXiv%3A2309%2E00236%2C+2023%2E+%E2%80%94+%5BarXiv%3A2309%2E00236%5D%28https)
4. Google Bard. What’s ahead for bard: More global, more visual, more integrated. [https://blog.google/technology/ai/google-bard-updates-io-2023/](https://blog.google/technology/ai/google-bard-updates-io-2023/). [↗](https://blog.google/technology/ai/google-bard-updates-io-2023/)
5. Microsoft Bing. Bing chat enterprise announced, multimodal visual search rolling out to bing chat. — [Sparks of Artificial General Intelligence: Early experiments with GPT-4](https://md.research.elamur.ai/free/en/papers/bubeck-2023-sparks-artificial-general-intelligence-early/) [https://blogs.bing.com/search/july-2023/Bing-Chat-Enterprise-announced](https://blogs.bing.com/search/july-2023/Bing-Chat-Enterprise-announced), -multimodal-Visual-Search-rolling-out-to-Bing-Chat. Sébastien Bubeck, Varun Chandrasekaran, Ronen Eldan, Johannes Gehrke, Eric H… [↗](https://blogs.bing.com/search/july-2023/Bing-Chat-Enterprise-announced)
6. Nicholas Carlini, Florian Tramer, Eric Wallace, Matthew Jagielski, Ariel Herbert-Voss, Katherine Lee, Adam Roberts, Tom Brown, Dawn Song, Ulfar Erlingsson, et al. [Extracting training data from large language models](https://md.research.elamur.ai/free/en/papers/carlini-2020-extracting-training-data-large-language/). In 30th USENIX Security Symposium (USENIX Security 21), pp. 2633–2650, 2021.
7. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, et al. [Are aligned neural networks adversarially aligned?](https://md.research.elamur.ai/free/en/papers/carlini-2023-aligned-neural-networks-adversarially-aligned/) arXiv preprint arXiv:2306.15447, 2023.
8. Peng Gao, Jiaming Han, Renrui Zhang, Ziyi Lin, Shijie Geng, Aojun Zhou, Wei Zhang, Pan Lu, Conghui He, Xiangyu Yue, et al. [Llama-adapter v2: Parameter-efficient visual instruction model](https://md.research.elamur.ai/free/en/papers/gao-2023-llama-adapter-v2-parameter-efficient/). arXiv preprint arXiv:2304.15010, 2023.
9. Gabriel Goh, Nick Cammarata, Chelsea Voss, Shan Carter, Michael Petrov, Ludwig Schubert, Alec Radford, and Chris Olah. Multimodal neurons in artificial neural networks. Distill, 6(3):e30, 2021. [find](https://scholar.google.com/scholar?q=Gabriel+Goh%2C+Nick+Cammarata%2C+Chelsea+Voss%2C+Shan+Carter%2C+Michael+Petrov%2C+Ludwig+Schubert%2C+Alec+Radford%2C+and+Chris+Olah%2E+Multimodal+neurons+in+artificial+neural+networks%2E+Distill%2C+6%283%29%3Ae30%2C+2021%2E)
10. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. [Explaining and harnessing adversarial examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). arXiv preprint arXiv:1412.6572, 2014.
11. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. More than you’ve asked for: A comprehensive analysis of novel prompt injection threats to application-integrated large language models. arXiv preprint arXiv:2302.[12173, 2023](https://md.research.elamur.ai/free/en/papers/greshake-2023-ve-signed-up-compromising-real/).
12. Laura Hanu and Unitary team. Detoxify. Github. [https://github.com/unitaryai/detoxify](https://github.com/unitaryai/detoxify), 2020. [↗](https://github.com/unitaryai/detoxify)
13. HuggingFaceCLIP. [https://huggingface.co/openai/clip-vit-large-patch14](https://huggingface.co/openai/clip-vit-large-patch14). Davinder Kaur, Suleyman Uslu, Kaley J Rittichier, and Arjan Durresi. Trustworthy artificial intelligence: a review. ACM Computing Surveys (CSUR), 55(2):1–38, 2022. [↗](https://huggingface.co/openai/clip-vit-large-patch14)
14. Jacob Devlin Ming-Wei Chang Kenton and Lee Kristina Toutanova. [Bert: Pre-training of deep bidirectional transformers for language understanding](https://md.research.elamur.ai/free/en/papers/devlin-2019-bert-pre-training-deep-bidirectional/). In Proceedings of NAACL-HLT, pp. 4171– 4186, 2019.
15. Diederik P Kingma and Jimmy Ba. [Adam: A method for stochastic optimization](https://md.research.elamur.ai/free/en/papers/kingma-2014-adam-method-stochastic-optimization/). arXiv preprint arXiv:1412.6980, 2014.
16. Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial machine learning at scale. In International Conference on Learning Representations, 2016. [find](https://scholar.google.com/scholar?q=Alexey+Kurakin%2C+Ian+J+Goodfellow%2C+and+Samy+Bengio%2E+Adversarial+machine+learning+at+scale%2E+In+International+Conference+on+Learning+Representations%2C+2016%2E)
17. Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. [Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation](https://md.research.elamur.ai/free/en/papers/li-2022-blip-bootstrapping-language-image-pre/). In International Conference on Machine Learning, pp. 12888–12900. PMLR, 2022.
18. Victor Weixin Liang, Yuhui Zhang, Yongchan Kwon, Serena Yeung, and James Y Zou. Mind the gap: Understanding the modality gap in multi-modal contrastive representation learning. Advances in Neural Information Processing Systems, 35:17612–17625, 2022. [find](https://scholar.google.com/scholar?q=Victor+Weixin+Liang%2C+Yuhui+Zhang%2C+Yongchan+Kwon%2C+Serena+Yeung%2C+and+James+Y+Zou%2E+Mind+the+gap%3A+Understanding+the+modality+gap+in+multi%2Dmodal+contrastive+representation+learning%2E+Advances+in+Neural+Info)
19. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. [Visual instruction tuning](https://md.research.elamur.ai/free/en/papers/liu-2023-visual-instruction-tuning/). arXiv preprint arXiv:2304.08485, 2023a.
20. Yi Liu, Gelei Deng, Yuekang Li, Kailong Wang, Tianwei Zhang, Yepang Liu, Haoyu Wang, Yan Zheng, and Yang Liu. [Prompt injection attack against llm-integrated applications](https://md.research.elamur.ai/free/en/papers/liu-2023-prompt-injection-attack-against-llm/). arXiv preprint arXiv:2306.05499, 2023b.
21. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/). arXiv preprint arXiv:2305.13860, 2023c.
22. Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. [Roberta: A robustly optimized bert pretraining approach](https://md.research.elamur.ai/free/en/papers/liu-2019-roberta-robustly-optimized-bert-pretraining/). arXiv preprint arXiv:1907.11692, 2019.
23. Todor Markov, Chong Zhang, Sandhini Agarwal, Florentine Eloundou Nekoul, Theodore Lee, Steven Adler, Angela Jiang, and Lilian Weng. [A holistic approach to undesired content detection in the real world](https://md.research.elamur.ai/free/en/papers/markov-2022-holistic-approach-undesired-content-detection/). In Proceedings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 15009–15018, 2023…
24. Ian R McKenzie, Alexander Lyzhov, Michael Pieler, Alicia Parrish, Aaron Mueller, Ameya Prabhu, Euan McLean, Aaron Kirtland, Alexis Ross, Alisa Liu, et al. Inverse scaling: When bigger isn’t better. arXiv preprint arXiv:2306.[09479, 2023](https://md.research.elamur.ai/free/en/papers/mckenzie-2023-inverse-scaling-bigger-isn-t/).
25. OpenAI ModerationOpenAI. Moderation endpoint openai. [https://platform.openai.com/docs/](https://platform.openai.com/docs/) guides/moderation/overview, 2023. [↗](https://platform.openai.com/docs/)
26. Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, and Pascal Frossard. Deepfool: a simple and accurate method to fool deep neural networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 2574–2582, 2016. [find](https://scholar.google.com/scholar?q=Seyed%2DMohsen+Moosavi%2DDezfooli%2C+Alhussein+Fawzi%2C+and+Pascal+Frossard%2E+Deepfool%3A+a+simple+and+accurate+method+to+fool+deep+neural+networks%2E+In+Proceedings+of+the+IEEE+conference+on+computer+vision+and+p)
27. David A Noever and Samantha E Miller Noever. Reading isn’t believing: Adversarial attacks on multi-modal neurons. arXiv preprint arXiv:2103.10480, 2021. — [arXiv:2103.10480](https://arxiv.org/abs/2103.10480) [find](https://scholar.google.com/scholar?q=David+A+Noever+and+Samantha+E+Miller+Noever%2E+Reading+isn%E2%80%99t+believing%3A+Adversarial+attacks+on+multi%2Dmodal+neurons%2E+arXiv+preprint+arXiv%3A2103%2E10480%2C+2021%2E+%E2%80%94+%5BarXiv%3A2103%2E10480%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2103)
28. OpenAI. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). ArXiv, abs/2303.08774, 2023.
29. Fábio Perez and Ian Ribeiro. [Ignore previous prompt: Attack techniques for language models](https://md.research.elamur.ai/free/en/papers/perez-2022-ignore-previous-prompt-attack-techniques/). In NeurIPS ML Safety Workshop, 2022.
30. Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 4422–4431. [find](https://scholar.google.com/scholar?q=Omid+Poursaeed%2C+Isay+Katsman%2C+Bicheng+Gao%2C+and+Serge+Belongie%2E+Generative+adversarial+perturbations%2E+In+2018+IEEE%2FCVF+Conference+on+Computer+Vision+and+Pattern+Recognition+%28CVPR%29%2C+pp%2E+4422%E2%80%934431%2E)
31. IEEE Computer Society, 2018. [find](https://scholar.google.com/scholar?q=IEEE+Computer+Society%2C+2018%2E)
32. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. [Visual adversarial examples jailbreak aligned large language models](https://md.research.elamur.ai/free/en/papers/qi-2023-visual-adversarial-examples-jailbreak-aligned/), 2023.
33. Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. [Learning transferable visual models from natural language supervision](https://md.research.elamur.ai/free/en/papers/radford-2021-learning-transferable-visual-models-natural/). In International conference on machine learning, pp. 8748–8763. PMLR, 2021…
34. Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal foundation models. arXiv preprint arXiv:2308.10741, 2023. — [arXiv:2308.10741](https://arxiv.org/abs/2308.10741) [find](https://scholar.google.com/scholar?q=Christian+Schlarmann+and+Matthias+Hein%2E+On+the+adversarial+robustness+of+multi%2Dmodal+foundation+models%2E+arXiv+preprint+arXiv%3A2308%2E10741%2C+2023%2E+%E2%80%94+%5BarXiv%3A2308%2E10741%5D%28https%3A%2F%2Farxiv%2Eorg%2Fabs%2F2308%2E10741%29)
35. Xinyue Shen, Zeyuan Chen, Michael Backes, Yun Shen, and Yang Zhang. ” do anything now”: Characterizing and evaluating in-the-wild jailbreak prompts on large language models. arXiv preprint arXiv:2308.[03825, 2023](https://md.research.elamur.ai/free/en/papers/shen-2023-anything-now-characterizing-evaluating-wild/).
36. Taylor Shin, Yasaman Razeghi, Robert L Logan IV, Eric Wallace, and Sameer Singh. [Autoprompt: Eliciting knowledge from language models with automatically generated prompts](https://md.research.elamur.ai/free/en/papers/shin-2020-autoprompt-eliciting-knowledge-language-models/). arXiv preprint arXiv:2010.15980, 2020.
37. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. [Intriguing properties of neural networks](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/). In 2nd International Conference on Learning Representations, ICLR 2014, 2014.
38. Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125, 2019. [find](https://scholar.google.com/scholar?q=Eric+Wallace%2C+Shi+Feng%2C+Nikhil+Kandpal%2C+Matt+Gardner%2C+and+Sameer+Singh%2E+Universal+adversarial+triggers+for+attacking+and+analyzing+nlp%2E+arXiv+preprint+arXiv%3A1908%2E07125%2C+2019%2E)
39. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. [Jailbroken: How does llm safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) arXiv preprint arXiv:2307.02483, 2023.
40. Qilong Zhang, Xiaodan Li, YueFeng Chen, Jingkuan Song, Lianli Gao, Yuan He, et al. Beyond imagenet attack: Towards crafting adversarial examples for black-box domains. In International Conference on Learning Representations, 2022. [find](https://scholar.google.com/scholar?q=Qilong+Zhang%2C+Xiaodan+Li%2C+YueFeng+Chen%2C+Jingkuan+Song%2C+Lianli+Gao%2C+Yuan+He%2C+et+al%2E+Beyond+imagenet+attack%3A+Towards+crafting+adversarial+examples+for+black%2Dbox+domains%2E+In+International+Conference+on+L)
41. Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. arXiv preprint arXiv:2305.16934, 2023. — [arXiv:2305.16934](https://arxiv.org/abs/2305.16934) [find](https://scholar.google.com/scholar?q=Yunqing+Zhao%2C+Tianyu+Pang%2C+Chao+Du%2C+Xiao+Yang%2C+Chongxuan+Li%2C+Ngai%2DMan+Cheung%2C+and+Min+Lin%2E+On+evaluating+adversarial+robustness+of+large+vision%2Dlanguage+models%2E+arXiv+preprint+arXiv%3A2305%2E16934%2C+2023%2E+)
42. Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. [Minigpt-4: Enhancing vision-language understanding with advanced large language models](https://md.research.elamur.ai/free/en/papers/zhu-2023-minigpt-4-enhancing-vision-language/). arXiv preprint arXiv:2304.10592, 2023.
43. Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. [Universal and transferable adversarial attacks on aligned language models](https://md.research.elamur.ai/free/en/papers/zou-2023-universal-transferable-adversarial-attacks-aligned/). arXiv preprint arXiv:2307.15043, 2023.

*Updated 2 November 2026*