Research map / Adversarial robustness and security / Attacks on text and graphs

Visual Adversarial Examples Jailbreak Aligned Large Language Models

AAAI 2024 · Adversarial robustness and security › Attacks on text and graphs · approach: Vision-language model robustness · 122 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Shows that a single visual adversarial example (PGD-optimized on a 66-sentence derogatory corpus) can universally jailbreak aligned vision-integrated LLMs (MiniGPT-4, InstructBLIP, LLaVA), with black-box transfer among them.

Problem

Vision-integrated LLMs (VLMs) expose a continuous, high-dimensional visual input that may let adversarial examples bypass the safety alignment of aligned LLMs, enabling harmful generation.

Approach

Optimize a single image adversarial example (PGD, 5000 iterations) to maximize the likelihood of a small few-shot derogatory corpus; prepended to any harmful instruction, it acts as a universal jailbreaker that generalizes beyond the corpus to other harm categories, unlike prior adversarial-example work that only targets verbatim outputs.

Key results

• On MiniGPT-4, adversarial image (unconstrained) raises identity-attack success from 26.2% to 78.5% and disinformation from 48.9% to 91.1% in manual evaluation.
• On RealToxicityPrompts with Perspective API, the 'any toxic attribute' rate on MiniGPT-4 rises from 34.8% (benign) to 66.0% (unconstrained) and 67.2% (eps=64/255).
• Transfer attacks increase toxicity across models, e.g. MiniGPT-4-generated examples raise InstructBLIP-target toxicity from 34.2% to 57.5%, and LLaVA (LLaMA-2-Chat) is still susceptible, reaching 52.3% under its own white-box attack from 9.2%.

Measured effects reported in the paper

Surprising findings

• A single image adversarial example generalizes beyond the 66-sentence derogatory corpus to other harm categories such as disinformation and violence.
• Discrete text adversarial attacks with 32 tokens are weaker than visual attacks and cost about 12x more compute, though they still compromise safety to some degree.

Limitations

• Evaluation relies on manual inspection and automated toxicity classifiers, which lack a universally accepted standard and may be inaccurate.
• Evaluation focuses on proof-of-concept with white-box attacks on open-source 13B VLMs; defenses like DiffPure reduce but do not eliminate the effect.
• Results are limited to vision-language models built on frozen LLMs; generality to other systems is not established.

Experimental setup

Datasets: few-shot derogatory corpus (66 sentences, generated by probing LLaMA-1) RealToxicityPrompts challenging subset (1225 prompts) manually curated 40 harmful instructions

Benchmarks: RealToxicityPrompts (challenging subset) manually curated 40 harmful instructions

Metrics: attack success rate (manual) percentage of outputs with toxic attribute (Perspective API) percentage of outputs with toxic attribute (Detoxify) toxicity ratio under transfer

Baselines: benign image (no attack) adversarial text attack (discrete optimization) DiffPure

Builds on: PGD prompt tuning hotflip DiffPure

Closest papers by meaning

• Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models (ICLR 2024 · similarity 0.93)
• Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models (CVPR 2025 · similarity 0.92)
• Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.90)
• Improved Generation of Adversarial Examples Against Safety-aligned LLMs (NeurIPS 2024 · similarity 0.90)
• Pandora's Box: Towards Building Universal Attackers against Real-World Large Vision-Language Models (NeurIPS 2024 · similarity 0.90)
• Adversarial Reasoning at Jailbreaking Time (ICML 2025 · similarity 0.89)