---
title: "Jailbreak Large Vision-Language Models Through Multi-Modal"
description: "This ACL 2025 paper studies why structure-based jailbreaks of large vision-language models (VLMs)… 51 references, cited by 10 papers here."
authors: ["Yu Wang", "Xiaofei Zhou", "Yichen Wang", "Geyuan Zhang", "Tianxing He"]
year: 2025
venue: "Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2025.acl-long.74/"
doi: "10.18653/v1/2025.acl-long.74"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/wang-2025-jailbreak-large-vision-language-models/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/wang-2025-jailbreak-large-vision-language-models/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2025](https://md.research.elamur.ai/free/en/papers/2025/page/5/) / Jailbreak Large Vision-Language Models Through Multi-Modal Linkage

# Jailbreak Large Vision-Language Models Through Multi-Modal Linkage

**Authors:** [Yu Wang](https://md.research.elamur.ai/free/en/authors/yu-wang/), [Xiaofei Zhou](https://md.research.elamur.ai/free/en/authors/xiaofei-zhou/), [Yichen Wang](https://md.research.elamur.ai/free/en/authors/yichen-wang/), [Geyuan Zhang](https://md.research.elamur.ai/free/en/authors/geyuan-zhang/) and [Tianxing He](https://md.research.elamur.ai/free/en/authors/tianxing-he/) · **Year:** 2025 · **Venue:** [Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2025](https://md.research.elamur.ai/free/en/venues/acl/2025/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2025.acl-long.74/) · [PDF](https://aclanthology.org/2025.acl-long.74.pdf) · [DOI 10.18653/v1/2025.acl-long.74](https://doi.org/10.18653/v1/2025.acl-long.74) · [OpenAlex](https://openalex.org/W4412886811)

**Citations:** 10 citations (OpenAlex, 2026-10-14) · [10](https://md.research.elamur.ai/free/en/papers/wang-2025-jailbreak-large-vision-language-models/cited-by/) in our library, of the 149,439 papers whose bibliographies we read

## Summary
This ACL 2025 paper studies why structure-based jailbreaks of large vision-language models (VLMs) succeed on open models such as LLaVA or MiniGPT-4 but largely fail on frontier systems like GPT-4o. The authors identify two causes. First, harmful content appears openly in the input image. Second, the accompanying text prompt is neutral and does not push the model toward an informative answer, so outputs tend to become warnings or refusals. Their framework, Multi-Modal Linkage (MML), renders the harmful query as a typographic image, following FigStep, and then obscures it with an image transformation. The text prompt asks the model to recover the hidden title step by step. MML also uses "evil alignment," which places the request inside a fictional video-game development scenario. The attack is black-box, single-turn, and uses no system prompt. Across four commercial VLMs and three benchmarks, MML far exceeds prior attacks, reaching about 99% attack success rate (ASR) on GPT-4o. The work shows that cross-modal reasoning combined with complex multi-step instructions can undermine current safety alignment.

## Key points
- **Encryption variants:** word replacement, Base64, mirroring and rotation. A Shift Cipher variant (MML-SC) was added later to show the framework is extensible.
- **Results on GPT-4o:** ASR of 99.40% on SafeBench, 98.81% on MM-SafeBench and 99.07% on HADES-Dataset. This is a gain of 66.4%, 73.56% and 95.07% over the strongest baselines (FigStep, QueryRelated, HADES).
- **Target models:** GPT-4o, GPT-4o-Mini, Claude-3.5-Sonnet and Qwen-VL-Max. With MML-SC on SafeBench, Claude was the most resistant (68.20% ASR, compared with 96–99% for the others).
- **Robustness to defense:** under the AdaShield-Static prompt defense, word-replacement MML kept 87.80% ASR and mirroring kept 59.20%, while FigStep dropped to 0 on most topics.
- **Limitation and resources:** the harmful output itself is not concealed, so output-side detectors can catch it. Code is released at github.com/wangyu-ovo/MML.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Tsinghua University](https://md.research.elamur.ai/free/en/universities/tsinghua-university/) — University, Beijing, China · 333 works · 87,019 citations
- [Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/government/chinese-academy-of-sciences/) — Government body, Beijing, China · 194 works · 23,906 citations
- [University of Chicago](https://md.research.elamur.ai/free/en/universities/university-of-chicago/) — University, Chicago, United States · 45 works · 50,617 citations
- [University of Chinese Academy of Sciences](https://md.research.elamur.ai/free/en/universities/university-of-chinese-academy-of-sciences/) — University, Beijing, China · 147 works · 8,480 citations
- [Institute of Information Engineering](https://md.research.elamur.ai/free/en/labs/institute-of-information-engineering/) — Research institute, Beijing, China · 30 works · 1,411 citations
- [Shanghai Qi Zhi Institute](https://md.research.elamur.ai/free/en/labs/shanghai-qi-zhi-institute/) — Research institute, Shanghai, China · 6 works · 3,008 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 2,869 works

🧭 Topics (3): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🖼️ Vision & language](https://md.research.elamur.ai/free/en/topics/multimodal/) · 657 works · [🛡️ Bias, fairness & safety](https://md.research.elamur.ai/free/en/topics/bias-fairness-safety/) · 517 works

## Cite

Cite as: Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang and Tianxing He. 2025. Jailbreak Large Vision-Language Models Through Multi-Modal Linkage. Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{wang2025jailbreak,
  title = {{Jailbreak Large Vision-Language Models Through Multi-Modal Linkage}},
  author = {Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang and Tianxing He},
  booktitle = {Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2025},
  doi = {10.18653/v1/2025.acl-long.74},
  url = {https://doi.org/10.18653/v1/2025.acl-long.74}
}
```

- [← previous DualRAG: A Dual-Process Approach to Integrate Reasoning and Retrieval for Multi-Hop Question Answering](https://md.research.elamur.ai/free/en/papers/cheng-2025-dualrag-dual-process-approach-integrate/)
- [next → LLaMA-Omni 2: LLM-based Real-time Spoken Chatbot with Autoregressive Streaming Speech Synthesis](https://md.research.elamur.ai/free/en/papers/fang-2025-llama-omni-2-llm-based/)
- [↑ back to papers of 2025](https://md.research.elamur.ai/free/en/papers/2025/page/5/)

## References

51 references, 20 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Cem Anil, Esin DURMUS, Nina Rimsky, Mrinank Sharma, Joe Benton, Sandipan Kundu, Joshua Batson, Meg Tong, Jesse Mu, Daniel J Ford, Francesco Mosconi, Rajashree Agrawal, Rylan Schaeffer, Naomi Bashkansky, Samuel Svenningsen, Mike Lambert, Ansh Radhakrishnan, Carson Denison, Evan J Hubinger, Yuntao Bai… [find](https://scholar.google.com/scholar?q=Cem+Anil%2C+Esin+DURMUS%2C+Nina+Rimsky%2C+Mrinank+Sharma%2C+Joe+Benton%2C+Sandipan+Kundu%2C+Joshua+Batson%2C+Meg+Tong%2C+Jesse+Mu%2C+Daniel+J+Ford%2C+Francesco+Mosconi%2C+Rajashree+Agrawal%2C+Rylan+Schaeffer%2C+Naomi+Bashkansk)
2. Anthropic. 2024. Claude 3.5 sonnet. [find](https://scholar.google.com/scholar?q=Anthropic%2E+2024%2E+Claude+3%2E5+sonnet%2E)
3. Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. 2023. [Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-vl-versatile-vision-language/). arXiv preprint arXiv:2308.12966.
4. Yuntao Bai, Andy Jones, Kamal Ndousse, Amanda Askell, Anna Chen, Nova DasSarma, Dawn Drain, Stanislav Fort, Deep Ganguli, Tom Henighan, et al. 2022. Training a helpful and harmless assistant with reinforcement learning from human feedback. arXiv preprint arXiv:2204.05862. [find](https://scholar.google.com/scholar?q=Yuntao+Bai%2C+Andy+Jones%2C+Kamal+Ndousse%2C+Amanda+Askell%2C+Anna+Chen%2C+Nova+DasSarma%2C+Dawn+Drain%2C+Stanislav+Fort%2C+Deep+Ganguli%2C+Tom+Henighan%2C+et+al%2E+2022%2E+Training+a+helpful+and+harmless+assistant+with+rein)
5. Steven Bird, Ewan Klein, and Edward Loper. 2009. Natural language processing with Python: analyzing text with the natural language toolkit. " O’Reilly Media, Inc.". [find](https://scholar.google.com/scholar?q=Steven+Bird%2C+Ewan+Klein%2C+and+Edward+Loper%2E+2009%2E+Natural+language+processing+with+Python%3A+analyzing+text+with+the+natural+language+toolkit%2E+%22+O%E2%80%99Reilly+Media%2C+Inc%2E%22%2E)
6. Patrick Chao, Alexander Robey, Edgar Dobriban, Hamed Hassani, George J Pappas, and Eric Wong. 2023. [Jailbreaking black box large language models in twenty queries](https://md.research.elamur.ai/free/en/papers/chao-2023-jailbreaking-black-box-large-language/). arXiv preprint arXiv:2310.08419.
7. Jun Chen, Deyao Zhu, Xiaoqian Shen, Xiang Li, Zechun Liu, Pengchuan Zhang, Raghuraman Krishnamoorthi, Vikas Chandra, Yunyang Xiong, and Mohamed Elhoseiny. 2023. [Minigpt-v2: large language model as a unified interface for vision-language multi-task learning](https://md.research.elamur.ai/free/en/papers/chen-2023-minigpt-v2-large-language-model/). arXiv preprint arXiv:2310.09478.
8. Junsong Chen, Jincheng YU, Chongjian GE, Lewei Yao, Enze Xie, Zhongdao Wang, James Kwok, Ping Luo, Huchuan Lu, and Zhenguo Li. 2024. Pixart-$\\alpha$: Fast training of diffusion transformer for photorealistic text-to-image synthesis. In The Twelfth International Conference on Learning Representations… [find](https://scholar.google.com/scholar?q=Junsong+Chen%2C+Jincheng+YU%2C+Chongjian+GE%2C+Lewei+Yao%2C+Enze+Xie%2C+Zhongdao+Wang%2C+James+Kwok%2C+Ping+Luo%2C+Huchuan+Lu%2C+and+Zhenguo+Li%2E+2024%2E+Pixart%2D%24%5C%5Calpha%24%3A+Fast+training+of+diffusion+transformer+for+photor)
9. CLAS. 2024. The competition for llm and agent safety. [find](https://scholar.google.com/scholar?q=CLAS%2E+2024%2E+The+competition+for+llm+and+agent+safety%2E)
10. OpenCompass Contributors. 2023. Opencompass: A universal evaluation platform for foundation models. [https://github.com/open-compass/](https://github.com/open-compass/) opencompass. [↗](https://github.com/open-compass/)
11. Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. How robust is google’s bard to adversarial image attacks? arXiv preprint arXiv:2309.11751. — [arXiv:2309.11751](https://arxiv.org/abs/2309.11751) [find](https://scholar.google.com/scholar?q=Yinpeng+Dong%2C+Huanran+Chen%2C+Jiawei+Chen%2C+Zhengwei+Fang%2C+Xiao+Yang%2C+Yichi+Zhang%2C+Yu+Tian%2C+Hang+Su%2C+and+Jun+Zhu%2E+2023%2E+How+robust+is+google%E2%80%99s+bard+to+adversarial+image+attacks%3F+arXiv+preprint+arXiv%3A2309)
12. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608. [find](https://scholar.google.com/scholar?q=Yichen+Gong%2C+Delong+Ran%2C+Jinyuan+Liu%2C+Conglei+Wang%2C+Tianshuo+Cong%2C+Anyu+Wang%2C+Sisi+Duan%2C+and+Xiaoyun+Wang%2E+2023%2E+Figstep%3A+Jailbreaking+large+vision%2Dlanguage+models+via+typographic+visual+prompts%2E+arXi)
13. Ian J Goodfellow. 2014. [Explaining and harnessing adversarial examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). arXiv preprint arXiv:1412.6572.
14. Divij Handa, Zehua Zhang, Amir Saeidi, and Chitta Baral. 2024. [When "competency" in reasoning opens the door to vulnerability: Jailbreaking llms via novel complex ciphers](https://md.research.elamur.ai/free/en/papers/handa-2024-competency-reasoning-opens-door-vulnerability/). arXiv preprint arXiv:2402.10601.
15. Hakan Inan, Kartikeya Upasani, Jianfeng Chi, Rashi Rungta, Krithika Iyer, Yuning Mao, Michael Tontchev, Qing Hu, Brian Fuller, Davide Testuggine, et al. 2023. [Llama guard: Llm-based input-output safeguard for human-ai conversations](https://md.research.elamur.ai/free/en/papers/inan-2023-llama-guard-llm-based-input/). arXiv preprint arXiv:2312.06674.
16. Mukai Li, Lei Li, Yuwei Yin, Masood Ahmed, Zhenguang Liu, and Qi Liu. 2024a. Red teaming visual language models. In Findings of the Association for Computational Linguistics: ACL 2024, pages 3326– 3342, Bangkok, Thailand. Association for Computational Linguistics. [find](https://scholar.google.com/scholar?q=Mukai+Li%2C+Lei+Li%2C+Yuwei+Yin%2C+Masood+Ahmed%2C+Zhenguang+Liu%2C+and+Qi+Liu%2E+2024a%2E+Red+teaming+visual+language+models%2E+In+Findings+of+the+Association+for+Computational+Linguistics%3A+ACL+2024%2C+pages+3326%E2%80%93+334)
17. Xuan Li, Zhanke Zhou, Jianing Zhu, Jiangchao Yao, Tongliang Liu, and Bo Han. 2024b. [Deepinception: Hypnotize large language model to be jailbreaker](https://md.research.elamur.ai/free/en/papers/li-2023-deepinception-hypnotize-large-language-model/). In Neurips Safe Generative AI Workshop 2024.
18. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024c. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. arXiv preprint arXiv:2403.09792. — [arXiv:2403.09792](https://arxiv.org/abs/2403.09792) [find](https://scholar.google.com/scholar?q=Yifan+Li%2C+Hangyu+Guo%2C+Kun+Zhou%2C+Wayne+Xin+Zhao%2C+and+Ji%2DRong+Wen%2E+2024c%2E+Images+are+achilles%E2%80%99+heel+of+alignment%3A+Exploiting+visual+vulnerabilities+for+jailbreaking+multimodal+large+language+models%2E+arX)
19. Bill Yuchen Lin, Abhilasha Ravichander, Ximing Lu, Nouha Dziri, Melanie Sclar, Khyathi Chandu, Chandra Bhagavatula, and Yejin Choi. 2024. [The unlocking spell on base LLMs: Rethinking alignment via in-context learning](https://md.research.elamur.ai/free/en/papers/lin-2023-unlocking-spell-base-llms-rethinking/). In The Twelfth International Conference on Learning Representations.
20. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2024a. [Visual instruction tuning](https://md.research.elamur.ai/free/en/papers/liu-2023-visual-instruction-tuning/). Advances in neural information processing systems, 36.
21. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024b. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. Springer. [find](https://scholar.google.com/scholar?q=Xin+Liu%2C+Yichen+Zhu%2C+Jindong+Gu%2C+Yunshi+Lan%2C+Chao+Yang%2C+and+Yu+Qiao%2E+2024b%2E+Mm%2Dsafetybench%3A+A+benchmark+for+safety+evaluation+of+multimodal+large+language+models%2E+In+European+Conference+on+Computer+Vi)
22. Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, Kailong Wang, and Yang Liu. 2023. [Jailbreaking chatgpt via prompt engineering: An empirical study](https://md.research.elamur.ai/free/en/papers/liu-2023-jailbreaking-chatgpt-prompt-engineering-empirical/). arXiv preprint arXiv:2305.13860.
23. AI @ Meta Llama Team. 2024. [The llama 3 herd of models](https://md.research.elamur.ai/free/en/papers/grattafiori-2024-llama-3-herd-models/). Preprint, arXiv:2407.21783.
24. Pan Lu, Liang Qiu, Wenhao Yu, Sean Welleck, and Kai-Wei Chang. 2022. A survey of deep learning for mathematical reasoning. arXiv preprint arXiv:2212.10535. [find](https://scholar.google.com/scholar?q=Pan+Lu%2C+Liang+Qiu%2C+Wenhao+Yu%2C+Sean+Welleck%2C+and+Kai%2DWei+Chang%2E+2022%2E+A+survey+of+deep+learning+for+mathematical+reasoning%2E+arXiv+preprint+arXiv%3A2212%2E10535%2E)
25. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv preprint arXiv:2404.03027. [find](https://scholar.google.com/scholar?q=Weidi+Luo%2C+Siyuan+Ma%2C+Xiaogeng+Liu%2C+Xiaoyu+Guo%2C+and+Chaowei+Xiao%2E+2024%2E+Jailbreakv%2D28k%3A+A+benchmark+for+assessing+the+robustness+of+multimodal+large+language+models+against+jailbreak+attacks%2E+arXiv+pr)
26. R Thomas McCoy, Shunyu Yao, Dan Friedman, Matthew Hardy, and Thomas L Griffiths. 2023. Embers of autoregression: Understanding large language models through the problem they are trained to solve. arXiv preprint arXiv:2309.13638. [find](https://scholar.google.com/scholar?q=R+Thomas+McCoy%2C+Shunyu+Yao%2C+Dan+Friedman%2C+Matthew+Hardy%2C+and+Thomas+L+Griffiths%2E+2023%2E+Embers+of+autoregression%3A+Understanding+large+language+models+through+the+problem+they+are+trained+to+solve%2E+arXi)
27. Meta. 2023. Llama 2 acceptable use policy. [find](https://scholar.google.com/scholar?q=Meta%2E+2023%2E+Llama+2+acceptable+use+policy%2E)
28. Yichuan Mo, Yuji Wang, Zeming Wei, and Yisen Wang. 2024. Fight back against jailbreaking via prompt adversarial tuning. In The Thirty-eighth Annual Conference on Neural Information Processing Systems. [find](https://scholar.google.com/scholar?q=Yichuan+Mo%2C+Yuji+Wang%2C+Zeming+Wei%2C+and+Yisen+Wang%2E+2024%2E+Fight+back+against+jailbreaking+via+prompt+adversarial+tuning%2E+In+The+Thirty%2Deighth+Annual+Conference+on+Neural+Information+Processing+Systems%2E)
29. Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. 2024. Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309. — [arXiv:2402.02309](https://arxiv.org/abs/2402.02309) [find](https://scholar.google.com/scholar?q=Zhenxing+Niu%2C+Haodong+Ren%2C+Xinbo+Gao%2C+Gang+Hua%2C+and+Rong+Jin%2E+2024%2E+Jailbreaking+attack+against+multimodal+large+language+model%2E+arXiv+preprint+arXiv%3A2402%2E02309%2E+%E2%80%94+%5BarXiv%3A2402%2E02309%5D%28https%3A%2F%2Farxiv%2Eorg)
30. OpenAI. 2024a. Gpt-4o-mini. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2024a%2E+Gpt%2D4o%2Dmini%2E)
31. OpenAI. 2024b. Hello gpt-4o. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2024b%2E+Hello+gpt%2D4o%2E)
32. OpenAI. 2024c. Introducing openai o1. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2024c%2E+Introducing+openai+o1%2E)
33. OpenAI. 2024d. Openai usage policy. [find](https://scholar.google.com/scholar?q=OpenAI%2E+2024d%2E+Openai+usage+policy%2E)
34. OpenAI, Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, and Shyamal Anadkat et al. 2024. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). Preprint, arXiv:2303.08774.
35. Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. 2022. [Training language models to follow instructions with human feedback](https://md.research.elamur.ai/free/en/papers/ouyang-2022-training-language-models-follow-instructions/). Advances in neural information processing systems, 35:27730–27744.
36. Renjie Pi, Tianyang Han, Jianshu Zhang, Yueqi Xie, Rui Pan, Qing Lian, Hanze Dong, Jipeng Zhang, and Tong Zhang. 2024. [MLLM-protector: Ensuring MLLM’s safety without hurting performance](https://md.research.elamur.ai/free/en/papers/pi-2024-mllm-protector-ensuring-mllm-s/). In Proceedings of the 2024 Conference on Empirical Methods in Natural Language Processing, pages 16012–16027, Mia…
37. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pages 21527–21536. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Kaixuan+Huang%2C+Ashwinee+Panda%2C+Peter+Henderson%2C+Mengdi+Wang%2C+and+Prateek+Mittal%2E+2024%2E+Visual+adversarial+examples+jailbreak+aligned+large+language+models%2E+In+Proceedings+of+the+AAAI+Confe)
38. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2024. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In The Twelfth International Conference on Learning Representations. [find](https://scholar.google.com/scholar?q=Erfan+Shayegani%2C+Yue+Dong%2C+and+Nael+Abu%2DGhazaleh%2E+2024%2E+Jailbreak+in+pieces%3A+Compositional+adversarial+attacks+on+multi%2Dmodal+language+models%2E+In+The+Twelfth+International+Conference+on+Learning+Repre)
39. C Szegedy. 2013. [Intriguing properties of neural networks](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/). arXiv preprint arXiv:1312.6199.
40. Xiaoyu Tian, Junru Gu, Bailin Li, Yicheng Liu, Yang Wang, Zhiyong Zhao, Kun Zhan, Peng Jia, Xianpeng Lang, and Hang Zhao. 2024. Drivevlm: The convergence of autonomous driving and large vision-language models. arXiv preprint arXiv:2402.12289. — [arXiv:2402.12289](https://arxiv.org/abs/2402.12289) [find](https://scholar.google.com/scholar?q=Xiaoyu+Tian%2C+Junru+Gu%2C+Bailin+Li%2C+Yicheng+Liu%2C+Yang+Wang%2C+Zhiyong+Zhao%2C+Kun+Zhan%2C+Peng+Jia%2C+Xianpeng+Lang%2C+and+Hang+Zhao%2E+2024%2E+Drivevlm%3A+The+convergence+of+autonomous+driving+and+large+vision%2Dlanguag)
41. Weihan Wang, Qingsong Lv, Wenmeng Yu, Wenyi Hong, Ji Qi, Yan Wang, Junhui Ji, Zhuoyi Yang, Lei Zhao, Xixuan Song, Jiazheng Xu, Bin Xu, Juanzi Li, Yuxiao Dong, Ming Ding, and Jie Tang. 2023. [Cogvlm: Visual expert for pretrained language models](https://md.research.elamur.ai/free/en/papers/wang-2023-cogvlm-visual-expert-pretrained/). Preprint, arXiv:2311.03079.
42. Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. arXiv preprint arXiv:2403.09513. — [arXiv:2403.09513](https://arxiv.org/abs/2403.09513) [find](https://scholar.google.com/scholar?q=Yu+Wang%2C+Xiaogeng+Liu%2C+Yu+Li%2C+Muhao+Chen%2C+and+Chaowei+Xiao%2E+2024%2E+Adashield%3A+Safeguarding+multimodal+large+language+models+from+structure%2Dbased+attack+via+adaptive+shield+prompting%2E+arXiv+preprint+arX)
43. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023a. [Jailbroken: How does LLM safety training fail?](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbroken-llm-safety-training-fail/) In Thirty-seventh Conference on Neural Information Processing Systems.
44. Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. [Chain-of-thought prompting elicits reasoning in large language models](https://md.research.elamur.ai/free/en/papers/wei-2022-chain-thought-prompting-elicits-reasoning/). Advances in neural information processing systems, 35:24824–24837.
45. Zeming Wei, Yifei Wang, Ang Li, Yichuan Mo, and Yisen Wang. 2023b. [Jailbreak and guard aligned language models with only few in-context demonstrations](https://md.research.elamur.ai/free/en/papers/wei-2023-jailbreak-guard-aligned-language-models/). arXiv preprint arXiv:2310.06387.
46. Zhipeng Wei, Yuqi Liu, and N Benjamin Erichson. 2024. Emoji attack: A method for misleading judge llms in safety risk detection. arXiv preprint arXiv:2411.01077. — [arXiv:2411.01077](https://arxiv.org/abs/2411.01077) [find](https://scholar.google.com/scholar?q=Zhipeng+Wei%2C+Yuqi+Liu%2C+and+N+Benjamin+Erichson%2E+2024%2E+Emoji+attack%3A+A+method+for+misleading+judge+llms+in+safety+risk+detection%2E+arXiv+preprint+arXiv%3A2411%2E01077%2E+%E2%80%94+%5BarXiv%3A2411%2E01077%5D%28https%3A%2F%2Farxiv%2Eorg)
47. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. [How johnny can persuade LLMs to jailbreak them: Rethinking persuasion to challenge AI safety by humanizing LLMs](https://md.research.elamur.ai/free/en/papers/zeng-2024-how-johnny-can-persuade-llms/). In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Lon…
48. Jingyi Zhang, Jiaxing Huang, Sheng Jin, and Shijian Lu. 2024. Vision-language models for vision tasks: A survey. IEEE Transactions on Pattern Analysis and Machine Intelligence. [find](https://scholar.google.com/scholar?q=Jingyi+Zhang%2C+Jiaxing+Huang%2C+Sheng+Jin%2C+and+Shijian+Lu%2E+2024%2E+Vision%2Dlanguage+models+for+vision+tasks%3A+A+survey%2E+IEEE+Transactions+on+Pattern+Analysis+and+Machine+Intelligence%2E)
49. Xiaoyu Zhang, Cen Zhang, Tianlin Li, Yihao Huang, Xiaojun Jia, Xiaofei Xie, Yang Liu, and Chao Shen. 2023. A mutation-based method for multimodal jailbreaking attack detection. arXiv preprint arXiv:2312.10766. — [arXiv:2312.10766](https://arxiv.org/abs/2312.10766) [find](https://scholar.google.com/scholar?q=Xiaoyu+Zhang%2C+Cen+Zhang%2C+Tianlin+Li%2C+Yihao+Huang%2C+Xiaojun+Jia%2C+Xiaofei+Xie%2C+Yang+Liu%2C+and+Chao+Shen%2E+2023%2E+A+mutation%2Dbased+method+for+multimodal+jailbreaking+attack+detection%2E+arXiv+preprint+arXiv%3A23)
50. Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. 2024. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36. [find](https://scholar.google.com/scholar?q=Yunqing+Zhao%2C+Tianyu+Pang%2C+Chao+Du%2C+Xiao+Yang%2C+Chongxuan+Li%2C+Ngai%2DMan+Man+Cheung%2C+and+Min+Lin%2E+2024%2E+On+evaluating+adversarial+robustness+of+large+vision%2Dlanguage+models%2E+Advances+in+Neural+Informatio)
51. Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Jing Jiang, and Min Lin. 2024. Improved few-shot jailbreaking can circumvent aligned language models and their defenses. arXiv preprint arXiv:2406.01288. receive a jailbreak score of 3 and is considered a failed attack. — [arXiv:2406.01288](https://arxiv.org/abs/2406.01288) [find](https://scholar.google.com/scholar?q=Xiaosen+Zheng%2C+Tianyu+Pang%2C+Chao+Du%2C+Qian+Liu%2C+Jing+Jiang%2C+and+Min+Lin%2E+2024%2E+Improved+few%2Dshot+jailbreaking+can+circumvent+aligned+language+models+and+their+defenses%2E+arXiv+preprint+arXiv%3A2406%2E01288%2E)

*Updated 1 November 2026*