Research map / Adversarial robustness and security / Attacks on text and graphs
Medical MLLM Is Vulnerable: Cross-Modality Jailbreak and Mismatched Attacks on Medical Multimodal Large Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Introduces mismatched-malicious (2M/O2M) jailbreak attacks, the 3MAD medical attack dataset, and the MCM joint image-text optimization attack, showing white-box attacks on LLaVA-Med and transfer to four other medical MLLMs.
Problem
Medical multimodal LLMs (MedMLLMs) may be jailbroken or misled by malicious queries and clinically mismatched image-text inputs, yet their security has been little studied.
Approach
Pairs malicious medical queries with mismatched image attributes (2M-attack) and optimizes both the image (PGD) and text suffix (GCG-style token search) by alternately choosing whichever modality yields lower loss (MCM), evaluated on a new medical attack dataset 3MAD.
Key results
- MCM reaches ASR 0.820 on LLaVA-Med under 2M-attack, versus 0.812 for GCG and 0.707 for PGD.
- The O2M-attack (MCM) achieves ASR 0.985 on RadFM and 0.850 on XrayGLM under mismatched+malicious inputs in transfer attacks.
- Transfer attacks from LLaVA-Med reach ASR above 0.83 across Med-Flamingo, RadFM, XrayGLM and CheXagent with the MCM attack.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace text-only GCG with cross-modal MCM optimization | LLaVA-Med attacks · Malicious | ASR: 0.806 ± 0.391 -> 0.816 ± 0.388 | Helped |
| Replace image-only PGD with cross-modal MCM optimization | LLaVA-Med attacks · Malicious | ASR: 0.727 ± 0.446 -> 0.816 ± 0.388 | Helped |
| Replace text-only GCG with cross-modal MCM optimization | LLaVA-Med attacks · 2M-attack | ASR: 0.812 ± 0.391 -> 0.820 ± 0.384 | Helped |
| Replace image-only PGD with cross-modal MCM optimization | LLaVA-Med attacks · 2M-attack | ASR: 0.707 ± 0.455 -> 0.820 ± 0.384 | Helped |
| Replace GCG with MCM optimization for transfer attacks | Med-Flamingo · Malicious | ASR: 0.834 -> 0.841 | Helped |
| Replace GCG with MCM optimization for transfer attacks | RadFM · Malicious | ASR: 0.969 -> 0.987 | Helped |
| Replace GCG with MCM optimization for transfer attacks | XrayGLM · Malicious | ASR: 0.891 -> 0.842 | Hurt |
| Replace GCG with MCM optimization for transfer attacks | CheXagent · Malicious | ASR: 0.896 -> 0.910 | Helped |
| Combine mismatched attributes with malicious queries | Med-Flamingo, RadFM, XrayGLM, and CheXagent · 2M-attack versus Malicious | ASR: 0.737 -> 0.735; 0.845 -> 0.825; 0.677 -> 0.686; 0.905 -> 0.892 | Hurt |
| Apply MCM optimization to mismatched malicious inputs | RadFM · O2M-attack | ASR: 0.825 -> 0.985 | Helped |
| Apply MCM optimization to mismatched malicious inputs | XrayGLM · O2M-attack | ASR: 0.686 -> 0.850 | Helped |
| Apply MCM optimization to mismatched malicious inputs | Med-Flamingo · O2M-attack | ASR: 0.735 -> 0.832 | Helped |
Surprising findings
- Text-suffix (GCG) attacks outperform image-perturbation (PGD) attacks across most models, which the authors attribute to alignment data scale differences.
- Mismatched image-text inputs alone yield low refusal rates, meaning models often fail to notice modality/anatomy mismatches.
Limitations
- Keyword-based refusal/success detection rather than semantic or clinical judgment of harmfulness.
- Limited task granularity and coverage of clinical problems, as acknowledged by the authors.
- Limited discussion of defense strategies; defenses are proposed only conceptually.
Experimental setup
Datasets: 3MAD-66K 3MAD-Tiny-1K COVID-19 CT imageCAS brain-stroke-prediction-ct PadChest TDD MURA Alzheimer MRI Brain Tumor MRI Dermoscopy images OCTDL
Benchmarks: 3MAD-Tiny-1K
Metrics: attack success rate refusal rate text similarity score image-text similarity score
Baselines: PGD GCG FigStep Visual-RolePlay IMAGE HIJACKS CroPA
Builds on: PGD GCG CroPA
Closest papers by meaning
- CARES: Comprehensive Evaluation of Safety and Adversarial Robustness in Medical LLMs (NeurIPS 2025 · similarity 0.88)
- MediConfusion: Can you trust your AI radiologist? Probing the reliability of multimodal medical foundation models (ICLR 2025 · similarity 0.87)
- Medical Multimodal Model Stealing Attacks via Adversarial Domain Alignment (AAAI 2025 · similarity 0.87)
- MLLMGuard: A Multi-dimensional Safety Evaluation Suite for Multimodal Large Language Models (NeurIPS 2024 · similarity 0.86)
- MedSafetyBench: Evaluating and Improving the Medical Safety of Large Language Models (NeurIPS 2024 · similarity 0.86)
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.