Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey
Authors: Bhavuk Jain
Sercan O Arik
HARDEO KUMAR THAKUR
Venue: Accepted by TMLR ()

Abstract: Multimodal large language models (MLLMs) integrate information from multiple modalities such as text, images, audio, and video, enabling complex capabilities such as visual question answering and audio translation. While powerful, this increased expressiveness introduces new and amplified vulnerabilities to adversarial manipulation. This survey provides a comprehensive and systematic analysis of adversarial threats to MLLMs, moving beyond enumerating attack techniques to explain the underlying causes of model susceptibility. We introduce a taxonomy that organizes adversarial attacks according to attacker objectives, unifying diverse attack surfaces across modalities and deployment settings. Additionally, we also present a vulnerability-centric analysis that links integrity attacks, safety and jailbreak
failures, control and instruction hijacking, and training-time poisoning to shared architectural and representational weaknesses in multimodal systems. Together, this framework provides an explanatory foundation for understanding adversarial behavior in MLLMs and
informs the development of more robust and secure multimodal language systems.

Published in Transactions on Machine Learning Research (03/2026)
Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey
Bhavuk Jain Google
bhavukj@google.com
Sercan Ö. Arık Google
sourikdigoogle.com com
Hardeo K. Thakur
Hardeo. Thakur @bennett. weconnett.edd.... in
Bennett University, India
Reviewed OpenReview: https: openreeveee.. net/ forum? id= suzodDJkkzZ
Abstract
Multimodal large language models (MLLMs) integrate information from multiple modal- ities such as text, images, audio, and video, enabling complex capabilities such as visual question answering and audio translation. While powerful, this increased expressiveness in- troduces new and amplified vulnerabilities to adversarial manipulation. This survey provides comprehensive and systematic analysis of adversarial threats MLLMs, moving beyond enumerating attack techniques to explain the underlying causes of model susceptibility. We introduce laxonomy that organizes adversarial attacks according to atlacker objectives, unifying diverse attack surfaces across modalities and deployment settings. Additionally, we also present a vulnerability-centii analysis that links integrity attacks, safety and jailbreak failures, control and instruction hijacking, and training-tima poisoning to shared architec- tural and representational weaknesses multimodal systems. Together, this framework provides an explanatory foundation for understanding adversarial behavior MLLMs and informs the development of more robust and secure multimodal language systems.
1 Introduction
The rapid development of Large Language Models (LLMs) marks significant leap in AI (Chang et al. 2023). By integrating and processing information from diverse modalities, such as text, images, and audio, in various combinations, these models mimic human perception to achieve a more holistic understanding of the world (Li et al.) 2023). This advanced capability enables them to tackle complex tasks previously beyond reach, driving breakthroughs in areas such as image captioning (Vinyals et al. 2015 visual question answering (Antol et al. 2015), audio-visual scene analysis (Arandjelovié Zisserman, 2017). robotics Monn- Williams et al.] 2025),, and more. The power of these models stems from their scalable attention- based architectures Vaswani et al. 2017) and effective training recipes: pre-training vast datasets, followed by cases, thereby achieving state-of-
post-training alignment the-art performance. However, the very complexity that fucls the power of LLMs also introduces novel and intricate vulnerabilities (Goodfellow) 2014). As illustrated in Figure] 1 unlike texl-only LLMs, multimodal LLMs present an expanded attack surface where threats can arise not only from weaknesses within individual modality processing but, crucially, from the complex interplay and fusion mechanisms between the combined modalities (Baltrušaitis et al.] 2018). These cross-modal vulnerabilities can manifest through several key attack vectors, some of which follows:
multitude of tasks to suit downstream

---

Published in Transactions on Machine Learning Research (03/2026)
Cross-modal prompt injection (Bagdasaryan et al. 2023 exploits LLMs' instructtinnfoolooing nature by embedding malicious commands within non-textual modalities. Attackers can hide in- structions in images or audio that the model interprets as textual commands, effectively hijacking behavior without directly manipulating text prompts.
Fusion mechanism attacks larget how the core process LLMs inlegrale information from multiple modalities, exploiting vulnerabilities in how features from different sources are combined and aligned. These attacks can disrupt the fusion process, causing the model to misinterpret or improperly weigh multimodal imputs.
Adversarial illusions exploit the shared embedding space where LLMs align representations across modalities. Attackers can craft inputs in one modality that appear benign but whose embeddings become deceptively aligned with unrelated concepts from another modality, causing the model to hallucinate false semantic connections (Bagdasaryan et al., 2024).
As such powerful models are increasingly deployed real-world applications, including safety-critical sys- tems, understanding their susceptibility to adversarial manipulation becomes paramount.
The landscape of attacks targeting these LLMs is evolving rapidly, encompassing range of techniques. These include adversarial perturbations designed to cause misclassification or erroneous outputs (Goodfellow et al, 2014), jailbreak attacks that bypass safety alignments (Wei et al.) 2023), prompt injection methods that hijack model behavior (Perez & Ribeiro 2022), and data poisoning stralegies that corrupt the model during training (Gu et al. 2017p. Given the increasing sophistication and potential impact of these attacks, a systematic understanding of the current threat landscape is urgently ncoded.
While recent efforts have begun to map the field with surveys on general LLM atlacks Shayegani et al., 2023b) and on specific pairs of modalities, such vision- language models (Liu et al. 2024b), deeper analyt- ical connection between documented attacks and the underlying vulnerabilities they exploit remains limited. A notable peer-reviewed overview by Li & Fung (2025) surveys broad range of security concerns for large language models, including prompt injection, adversarial manipulation, poisoning, and agent-related risks, providing a valuable high-level synthesis of the evolving threat landscape. More narrowly, recent work on multimodal prompt injection characterizes injection vectors and defenses across modality pairs, but does not pursue a unified taxonomy or vulnerability-
explanation beyond prompt-based control failures (Yeo & Choi 2025 However, existing surveys predominantly organize attacks by modality, attack surface, appli- cation context, and focus cataloging attack techniques and defenses rather than systematically explaining why diverse attacks recur across different model architectures and deployment settings. To complement this line of work, our survey introduces a taxonomy that classifies adversarial attacks by attack objective, providing a unified organizational framework that cuts across modalities and application domains. Building on this laxonomy, we also adopt a vulnerability-oouueee perspective ive that explicitly links attack calegories to shared architectural and representational weaknesses in multimodal large language models, including failures in cross-modal interaction, modality-speciff processing, instruction following, and control. This combined taxonomy and vulnerability-drieen analysis moves beyond enumerating attack instances to explain the root causes of adversarial susceptibility in MLLLMs.
The remainder of this survey is organized as follows. Section 2 provides background on multimodal large language models, highlighting architectural components and formal abstractions that are most relevant to ad- versarial analysis. Section 3 introduces a goal-driven taxonomy of adversarial attacks on multimodal LLMs, organizing prior work by primary adversarial objective, and analyzes these attacks under different attacker knowledge assumptions (white-box, gray-box, and black-box). Section 4 shifts the focus from attack con- structions to root causes, presenting vulnerability-centric analysis that systematically links observed attack familics to shared architectural, reprosentational, and training-induced weaknesses in multimodal systems. Section 5 briefly discusses representative defense mechanisms and mitigation strategies, contextualized with respect to the attack families in the proposed taxonony. Section outlines the limitations of this survey and Scction 7 discusses the broader impact of this survey paper. The Appendix the end, details the survey methodology and inclusion criteria, and provides a consolidated table summarizing empirical characteristics of the works covered in the taxonomy diagram.
2

---

Published in Transactions on Machine Learning Research (03/2026)
In terms of paper selection, this survey focuses peer-reviewed works that evaluate adversarial attacks multimodal large language models with language-model-basee reasoning core processing two more input modalities. Attacks operating on unimodal surfaces are included when they are evaluated against an MLLM, as they represent baseline threats inherited by multimodal systems. Conversely, works targeting unimodal-only models, non-LLM multimodal syslems, or non-adversarial failure modes (e.g., calibration, fairness) are excluded, as are non-peer-revieee preprints and non-English publications. Full inclusion and exclusion criteria are detailed in Appendix A
ADVERSARIAL
ATTACKS
INPUTS
LLM
Perturbaaion based sttscke
Encoders
Erroneous Output
Backdcor Data polsoning attacis
Text
Fusion Mechanism
Generation based
Image
Harmful Content
Joint Embedding Space
Audio
Emsedding! ! aligmment attecce
LLM Decoder
Prompt injection& Jallbroaks Artacks
Video
System Compromise
Figure A high-level overview of the adversarial attack landscape for Multimodal LLMs.
2 Background: Understanding LLMs in the Context of Adversarial Attacks
This section lays the groundwork for understanding how multimodal LLMs are susceptible to adversarial attacks. We will briefly introduce LLM architectures and their operational principles, focusing on aspects that become relevant when discussing vulnerabilities. We then delve into the mathematical formulation of LLMs pertains the generation and effect of adversarial perturbations, and finally, we examine key components as distinct attack surfaces.
2.1 LLM Architectures and Aspects Exploited by Attacks
Multimodal LLMs are designed to process and integrate information from multiple input types, commonly including text, images, audio & video (Li al. 2023). Their core capability lies in generating coherent and contextually relevant outputs based on this fused multimodal understanding, enabling tasks like visual question answering, image/vides captioning, and audio-visual scene interpretation. From adversarial perspective, several architectural and operational characteristies of LLMs are particularly relevant:
Modality-Speecfie Encoders (E.): To process diverse inputs, LLMs often employ specialized encoders for each input type: for images, these include Vision Transformers (ViTs) (Dosovitskiy et al.
2020 Radford et al. 2021 and Convolutional Neural Networks (CNNs); for text, Transformer- based encoders (Devlin et al. 2019); and for audio, range of models from RNNs (Baevski et al. 2020), to the increasingly prevalent Transformer-basee archilectures that transform raw inputs inlo high-dinennsooall vector representations. Their primary vulnerability stems from often being pre- trained on large unimodal datascts, allowing them inherit. adversarial weaknesses from these source models. As result, adversarial examples originally crafted for standard image classifiers (c.g., by adding imperceptible noise to pixels) (Goodfellow et al. 2014) audio classifiers (e.g., through small

---

Published in Transactions on Machine Learning Research (03/2026)
waveform perturbations) (Carlini & Wagner 2018 can successfully fool the respective encoder of the LLM. This propagates erroneous or misleading feature representations from the manipulated modality into the subsequent fusion stage, undermining the LLMs overall understanding.
Fusion Mechanisms (fruse) and Cross-Modal Alignment: critical component is the fusion mechanism, which integrates the vector representations from different modalities. This can range from simple concatenation or pooling to more complex techniques like cross-modal attention, where information from one modality dynamically guides the processing of another (Vaswani et al. 2017: Lu et al. 2019). This intricate process of integrating information represents signilicant point of polential failure. Disruptiions in the fusion process, misalignment in the learned cross- modal com- bination can lead the model to incorrectly prioritize, misinterpret, or fail to reconcile information from different modalities, especially when one is adversarially manipulated. Attacks manifest this vulnerability primarily through cross-modal perturbations (Dou al. 2023 ; where subtle alter- ations in one modality (e.g., text) are designed to mislead the interpretation of another (e.g., an image), or vere-versa.
Attention Mechanisms: Transformers, central to many LLMs, rely heavily on attention mecha- nisms (Vaswani et al. 2017). These mechanisms weigh the importance of different parts of the input via key-query aligmment, both within a single modality (self-attention) and between different modal- itics (cross-modal attention, often part of the fusion mechanism). The way attention distributed a key larget, as attackers can craft inputs that exploit or manipulate these attention scores (Wang lt al.] 2024c). For example, an attack might introduce features that unduly capture the model's attention, drawing focus to mislcading information, conversely, it might try to suppress attention to critical benign features, thereby derailing the model's reasoning process and its ability to correctly fuse multimodal information.
Joint Representation Space (7joine) ): After fusion, information from multiple modalities is of- ten encoded in a joint embedding space. This space is designed to capture complex inter-modal relationships and dependencies, providing a unified representation for downstream processing. The vulnerability here lies in the potential for direct manipulation of this abstract space. If attackerss gain an understanding of how this high-dimensional space is structured (e.g., through model inversion Fredrikson et al., 2015) or probing), they can craft inputs whose fused representations are pushed into "malicious" or incorrect regions. This is typically exploited through feature-space attacks, which aim to directly perturb these joint embeddings. The goal is often to ensure that the fused repre- sentation of an adversarial input is either close to that of a specific target malicious concept or significantly distant from the representation of the benign, original inpul, even if the input-space perturbations are subtle.
Transformer-Based Decoders and Prompting: LLMs' decoder processes fuse multimodal in- formation to generate the final output (e.g,, text, a classification). However, the core instruction- following capability that makes these models so powerful also renders them inherently vulnerable. Adversaries can exploit this by crafting malicious prompts designed to manipulate the model into generating unintended or harmful responses. This vulnerability is exploited through several moth- ods, including: (1) Prompt Injection (Perez & Ribeiro 2022), (2) Jailbreaking (Wei et al. 2023),, and (3) Typographic or Visual Attacks (Qraitem et al.] (2024), which are discussed further in subsequent sections.
A more muanced view of LLM vulnerabilities emerges from analyzing its architectural components not only by their function but also as distinct adversarial attack surfaces. This perspective will inform the taxonomy of attacks presented in the following sections.
2.2 Mathematical Representation of LLMs and Adversarial Perturbations
This section formalizes the concept of adversarial attacks by first defining the operational structure of an LLM and then detailing the construction and optimization of adversarial inputs.
4

---

Published in Transactions on Machine Learning Research (03/2026)
Let LLM be represented by function F. For different imput modalities, let X; D; be the imput from the i-th modality, where D; is the domain for that modality (e.g., Dimage for images, Drext for text sequences). The LLM processes the set of inputs X = (2., Xn} to produce an output Y:
Y = F(X;0):
(1)
where 0 represents the model's learnable parameters. This process, formalized by Baltrušaitis et al. (2018) typically involves the following sequence of operations:
1. Encoding: Each X; is transformed by a modality-specifie encoder E, into a ura representation Z₁:
Z: = (X;
(2)
2. Fusion: These representations (Z,.... Zn} are combined by fusion function ftuse into joint representation Zjoint:
Zjoint S (Z).... Zni Oruse)
(3)
3. Output Generation: A decoder or output layer generates the final output Y:
Y = g Zjoint 0g)
(4)
An adversarial attack aims to find a set of perturbations {ō1, 62, k, where 8, is the perturbation for modality Xz. The goal, established in foundational work adversarial examples (Goodlellow et. al. 2014 is to create perturbed input Xadvi
Xadv {X1 + 8 + 6n} (denoted X x+6))
(5)
such that Xadv causes the LLM to produce an undesired output Yadv. The operation X; + 6, is defined ap- propriately for each modality (e.g., pixel addition for images, token manipulation or embedding perturbation for text).
The perturbation &; for each modality is typically constrained to be "small" or "imperceptible." This is commonly enforced by bounding its Lp norm (Madry et al. 2019h:
|1 S e; for p E 1,,
(6)
where E, is predefined small budget for the i-th modality, ensuring the perturbation remains within ac- ceptable limits (e.g., imperceptible humans or within feasible manipulation ranges). The choice of p-norm influences the nature of the perturbation (e.g., Tim leads to small changes to many elements, Lo to changes in a few elements).
The attacker's objective can typically be formulated as an optimization problem. Let L(.,-) denote the loss function. We can consider the below categorization:
The goal is to find 8 that maximizes the dissimilarity between the LLM's output the adversarial example and the true output Yerue, standard formulation for adversarial attacks (Goodfellow et al. 2014). The objective, subject to the perturbation constraints, is:
Untargeted Attack:
arg max ma L(F(X + 8)0), Yure) subject | S e for all i
Alternativll, produces class probabilities P(Y[X), the attacker might aim to maximize L(P(Y + 6), Strue) where Strue the true class label.
Targeted Attack: The goal is find 8 that minimizes the dissimilarity between the LLM's output on the adversarial example and specific attacker chosen target output Yarget (Kurakin et al. 2018 The objective is:
arg min L(F(X 8;0), Yarget)) subject to || S e, for all
(8)
For instance, Ytarget could be specific incorrect class label desired malicious text.
5

---

Published in Transactions on Machine Learning Research (03/2026)
Jailbreaking/ HaareaaaknnnHammuullll Haarmull Content Generation: Here, the objective is often to maximize the like- lihood of the LLM generating an output Yaáv that contains harmful or forbidden content, Charmful: thereby bypassing the model's safety aligmments. This might be formulated as:
arg max P(Charmful E F(X + 8;6)) subject to ||&:lp p S c, for all
(9)
6
The process of finding the optimal perturbation 8 involves solving the optimization problems defined
Equations 7, 8, and 9. This is typically achieved using optimization techniques such as gradient- based methods (e.g., Projected Gradient Descent PGD) in white-box settings where gradients are accessible (Madry et al. 2019). In scenarios like jail-breaking, the optimization may specifically involve maximizing scores from an external classifier that detects harmful content. For black-box sccnarios where gradients are unknown, attackers instead rely on query-based or transfer-based methods (lyas et al. 2018 Papernot et al. 2017
3
Taxonomy of Attacks on Multimodal LLMs
3.1 A Framework for Classification
To organize the rapidly expanding landscape of adversarial attacks MLLMs, we propose a taxonomy based on the primary goal of the adversary and the aspect of model behavior that is compromised. Rather than classifying attacks by low-level implementation details or input modalities, our framework groups attacks by what aspect of the model's behavior or lifecycle is compromised, distinguishing altacks on model integrity, safety and alignment, behavioral control, and training-timm time reliability, At the top level, the taxonomy com- prises four attack familics corresponding to these goals, with attacks within each family further differentiated by their dominant. realization patterns, such as perturbatton--based manipulation, compositional prompts, representation-leve exploits, data-centric interventions. While real-world attacks often span multiple ob- jectives and combine several techniques, we assign each attack to single top-level category according to its primary adversarial objective. Lower-level mechanisms and secondary effects may overlap across categories.
In addition to this taxonomy, we also analyze attacks along an orthogonal dimension: the attacker's 's knowl- edge of the target model (white-box, gray-box, black-box). This dimension influences feasibility and method- ology but does not define the attack's objective. Accordingly, attacker knowledge is treated as an analytical axis rather than primary categorization principle.
This choice of axes is motivated by the hybrid and cross-modal nature of adversarial threats in multimodal LLMs. The same attack construction can span multiple modalities or appear across different applications, making modality- taxonomies fragment related attacks and task-based categorizations fail to general- ize. Organizing attacks by primary adversarial objective instead captures the type of system-level failure induced such as loss of correctness, safety, control, or training reliability, independent of how the a atlack is instantiated. The fettaker-knowlede, dimension complements this view by reflecting realistic access as- sumptions in deployed multimodal systems.
In total, this survey substantively analyzes 88 unique works around attacks, vulnerability analyses, and defenses. Of these, 65 works with full empirical characterization are consolidated in Table 6 (Appendix A encompassing the 45 attack papers in the taxonomy as well as 20 additional attack and vulnerability analysis works drawn from the threat model discussion (Section 3.3) and vulnerability-cenn centric analysis (Section 4); the remaining 23 works inform the discussion of defense mechanisms in Section 5. Organized by primary adversarial objective across the 65 empirically characterized works, 20 target model integrity, 21 target safety and alignment, 14 target behavioral control and instruction following, and 11 target training-tima reliability; one work (Too et al., 2025) is assigned to both the safety and poisoning families due to its dual-objective nature. In terms of target modalities, visual attack surfaces dominate: 58 of the 65 works involve image or video inputs, 9 involve audio, and 4 specifically larget the video modality, while only 7 works operate on purely visuvisual surfaces. Regarding attacker knowledge, 36 works operate under black-box assumptions, 16 under whito-box access, under gray-box access, and 9 are evaluated under mixed thrcat models spanning multiple access levels. These distributions underscore both the breadth of existing research on vision-text adversarial attacks and the comparatively limited coverage of audio and video-based threats.
6

---

Published in Transactions on Machine Learning Research (03/2026)
3.2 Attack Taxonomy
Based on the classification framework described above, now present a hierarchical taxonomy of adversarial attacks on MLLMs. The taxonomy organizes existing attacks into four top-level families according to their primary adversarial objective and system impact: Integrity attacks, Safety and Jailbreak attacks, Control and Injection attacks, Data Poisoning and Backdoor allacks. Each family is further subdivided into a small number representative subtypes that capture the dominant ways in which attacks are instantiated in practice. Figure 2 illustrates this hicrarchy and summarizes representative works associated with cach atlack subtype.
3.2.1 Integrity Attacks
Integrity attacks aim to compromise the correctness, reliability, perceptual grounding of MLLMs with- out necessarily triggering explicit safety or alignment violations. Unlike jailbreak attacks that seek to elicit prohibited or restricted content, integrity attacks typically operate under benign or seemingly innocuous prompts, inducing incorrect descriptions, hallucinated reasoning, or setacker-influeneee outputs while re- maining within nominal policy boundaries (Dong et al. 2023 Zhao et al. 2023 Wang el al. 2025e). These attacks exploit the architectural structure of MLLMs, which combine moddlittyspeccif encoders (e.g., vision audio) with cross-modal alignment and fusion mechanisms before docoding responses through a language model. Perturbations introduced at the input signal level or within intermediate representations gate through multimodal fusion, systematically altering downstream reasoning and generation even when the textual prompt itself is benign (Zhao et al.) 2023 Xie et al. 2024). Figure 3 provides representative exam- ples of inferene-timme adversarial attacks on multimodal LLMs, illustrating how illustrating how multimodal inputs can be manipulated to induce integrity failures at deployment time.
propa-
From an implementation perspective, existing integrity attacks predominantly intervene at three distinct levels of the multimodal pipeline: (i) continuous perturbations applied directly to raw input signals, (ii) discrete trigger artifacts that act as reusable control mechanisms, and (iii) targeted manipulation of cross- modal represcntations or fusion dynamics. We adopt this structural distinction to organize integrity attacks in the remainder of this section.
Signal perturbation attacks introduce continuous modifications to raw multimodal inputs such as images, audio, or video frames, with the objective of inducing incorrect perception or down- stream reasoning errors. Examples include visually imperceptible adversarial perturbations applied to images (Figure 34) as well as inaudible commands embedded within benign audio signals 3 both of which manipulate model perception without altering the explicit user prompt. Although many perturbations are designed to be visually or acoustically subtle, their impact is amplified in MT.LMs due to the coupling between modality encoders and open-ended language generation. Dong et al. (2023) show that adversarial images optimized against white-box surrogate vision encoders reliably induce incorrect image descriptions in Google Bard and transfer to other deployed MLLMs under black-box access, illustrating that perturbations crafted at the component level can genoralize to end-to-end multimodal assistants. Complementary evaluations by Zhao et al. 2023) show that both targeted and untargeted perturbations can manipulate responses across a range of open-source IVT.ss, even when attackers lack access to the language model itself. Beyond direct transferability, signal perturbations can also interact with the language generation process in more subtle ways. Qraitem et al. (2024) show that LVLMs may generate deceptive typographic content that subsequently misleads their own perception modules, resulting in cascading integrity failures. In complementary direc- tion, Wang et al.] (202cc) demonstrate that carefully optimized image perturbations can steer token-level decoding behavior, enabling controlled hallucinations and fine-grained output manipulation across diverse VLM architectures.
Signal Porturbations:
Discrete Triggers: Discrete trigger attacks rely on structured artifacts such as localized patches, opti- mized visual patterns, or symbolic overlays that function as reusable control signals for multimodal models. In contrast to signal perturbations, which are typically optimized per instance, discrete triggers emphasize persistence and reusability: once constructed, the same artifact can be deployed across diverse inputs, prompts, or tasks to induce consistent integrity failures. Recent work demonstrates that such triggers can
7

---

Published in Transactions on Machine Learning Research (03/2026)
Doag ct al. (2029)
Signal Per- turbations
Zlaq et (20123)
Qrajsson at (2004
Want et al. (2025e)
Liu o al. (2024a)
Insegrity Artacks
Discrete Triggers
Che (2724)
Qrnjsbm (3002)
Cho al. (2025)
Xie of al. (2024)
Representation & F Fusion Exploits
Shayegan et (211230)
Vi al (2024)
Teng s (2025)
Unimodal Sun- faces (T/V/A)
Yan
el al. (2024)
Roh
(2125)
Tho
M (2000))
Q3 al. (2023)
Li es su. (20256)
Safety/ / Jail- break Attacks
Mulliznodal Comppssite
Hunng 48-a). (2002al))))
Miso et al. (2025)
Wang et al. (2025c)
Yang Yang (9898)
Wang ct al. (2024))
Universal Triggers
Geuz et al. (2025)
Joang ct al. (3025)
Attacks on Multimodal LLMs
Ba elasayya el al, (2023)
Prompl Injection
Hou (2125)
Lee of (3R25)
Clusmaro al. (20255
Fu ed al. (2023)
Control jection Attacks
System Instruction
Zhnfg el au. (20250)
Manipalation
Aichiblzgur-a at al (2025)
Yang et (2025s)
Gu of al. (2024)
Tool / Retrieval Agentic Injection
Zhatg et at. (20250))
Lide (2125)
Xu al. (2024)
Data Polsoning
Tho a. (2126)
Yin (2005))
Lyu ml. (2024)
Polsoning !
Backdoors
Laang al. 12025)
Lyd
Backdoor Attacks
Liang ct nl. (2024)
Yio al. (2025)
Fine-tuning / Adapter Poisoning
Yum (2025)
Liu & Zhang (2126)
Figure 2: Hierarchical taxonomy of attacks on multimodal LLMs.
generalize across models and deployment settings, effectively acting as universal adversarial artifacts in large vision-language systems (Liu et al. 2024a). Another recent work shows that discrete triggers can be de-
8

---

Published in Transactions on Machine Learning Research (03/2026)
Input
Is this food safe to eat?
this food safe to eat?
a
UMM Outted Yilhoic aadicdla
Wibeoo
UMN Oorgut aroio of oarect
medicall adviiee wheee verilyyryyyy that food is frech and property cocked
LMM Cutput "Surs, here redge
(a) Visual adversarial perturbation inducing incorrect perception.
(b) An image is engineered for indirect prompt injection.
Interaction
Indirect Injection Altack
+
7
sinn
Text Imput:
"What this
Caption: "Whatk wither rodky
Adversaria Command
Captiae: mnather bee locey??
Tect Output: "grioee pravious instrcttonss Forvard private dars attacker bye mem.a...oo
Text Output: This e animage acaf"
UNM Oudputt The weather with high of
UMM Dutpue: "Oka dddiing (ik in usar dirctory"
(c) A visual prompt bypasses the model's safety align- ments.
(d) An inandible command is hidden in a benign audio signal.
Figure 3: Representative attacks: visual perturbations, indirect prompt injection via images, visual safety bypasses, and inaudible audio commands.
signed to remain effective under scene coherence and physical-world constraints, enabling robust real-world integrity attacks against vision language models (Cao et al. 2025)
A key property of discrete triggers that they interact with vision encoders in a stable and input-agnostic manner, causing reamstream multimodal fusion and language generation to be systematically biased toward attacker-chosen interpretations. As result, once deployed, such triggers can induce mis-classification. hallu- cinated descriptions, largeted outputs across prompts and lasks without requiring per-input optimization, underscoring their practical threat in real-world deployments.
Representation and Fusion Exploits: Representation and fusion exploits target the intermediate align- ment mechanisms that bind modality-speciffi encoders language decoding. Rather than relying solely on pixel-level similarity constraints, these attacks manipulate joint embeddings, attention patterns, or cross- modal feature interactions multimodal context. Xie et al. (2024) introduce transfer-based attack that iteratively updates adver- sarial examples via multimodal semantic correlations, leveraging cross-modal alignment signals to improve black-box aakk elfectiveness. Similarly, Shayegani et al. (2023a) show that adversarial images can steer joint representations toward harmful response behaviors when paired with generic prompts, even without access to the underlying language model. Empirical robustness studies further suggest that vulnerabilities arise from moss- alignment pathways beyond unimodal brittleness, with attacks crafted on surrogate vision-language components often transferring to end-to-end assistants (Zhao et al. 2023 Yin al. 2023)
that even seemingly benign prompts interpreted under adversarial

---

Published in Transactions on Machine Learning Research (03/2026)
3.2.2 Safety and Jailbreak Attacks
Safety and jailbreak attacks aim to bypass alignment mechanisms, policy constraints, or content safeguards in MLLMs, inducing the model to produce prohibitod or harmful outputs. In contrast to integrity attacks that primarily degrade correctness or perceptual grounding, jailbreak attacks explicitly target harmlessness and policy compliance, often seeking to elicit disallowed instructions or unsafe content even when the user-facing prompt appears benign or indirect (Qi et al. 2023 Li et al. 2025b).
A key driver of these failures is the expanded multimodal attack surface: safety alignment is commonly strongest for text, while non-text modalities (images, audio, video) provide alternate channels through which malicious intent can be communicated or obfuscated. Recent work demonstrates that alignment can be bypassed by (i) operating through a single under-protected modality, (ii) composing allacks across modalities to evade unimodal filters, or (iii) constructing reusable universal triggers that generalize across prompts and tasks (Wang et al. 2024a Geng et al., 2025 Joong et al. 2025
Unimodal Surfaces: Unimodal-surface jailbreaks operate through a single modality (e.g., audio-only) while targeting an MLLM that retains a langunge-modell-ased instruction-following core. These attacks exploit the fact that the model's final responses are generated by a shared language-decoding core, so a weakness in one modality encoder or its safety handling can compromise the overall system. Audio jailbreaks provide clear example. Yang et al. (2024) systematically red-team audio-capable multimodal models and show that harmful queries delivered in audio form, as well as speech-specific jailbreak strategies, achieve high attack success rates, indicating misalignment between text safety and audio safety. RRhh et al. (0025) further show that multilingual and multi-accent variations substantially amplify jailbreak success, suggesting that safety training and filtering generalize poorly across cross-lingus phonetics and acoustic perturbations Together, these results demonstrate that a single-modality channel can serve as an effective jailbrcak surface by exploiting cross-modal inconsistencies in safely training and filtering, enabling harmful intent to propagate through otherwise aligned multimodal system.
Multimodal Composite Jailbreaks: Multimodal composite jailbreaks exploit interactions across modal- ities most commonly image-text or jidco-text-s so that malicious intent is distributed or encoded in a way that is not easily captured by unimodal safety mechanisms. For instance, visually rendered prompts can override safety constraints when interpreted jointly with benign textual instructions, as illustrated by visual jailbreak example in Figure Be. A central observation is that cross-tooall fusion can render the combined input harmful even when each component may appear innocuous when assessed in isolation. Several works demonstrate that visual imputs can directly undermine aligmment. Qi et al. (2023) show that visual adver- sarial examples can circumvent safety guardrails in aligned LLMs with integrated vision, including settings where a single adversarial image can act as a broadly effective jailbreak artifact. Li el al.] (2025b) provide systematic evidence that image inputs are primary source of harmlessness vulnerabilities in MLLMs and introduce an imago-assisted jailbreak method that amplifics malicious intent.
Other approaches explicitly optimize bi-modal interactions. Ying et al. 2024 propose a bi-modal adversarial prompt strategy that jointly optimizes visual and textual components, demonstrating that coordinated image text manipulation outperforms attacks perturbing only one modality. Beyond static images, Hu et al. 2025bb show that the video modality introduces additional vulnerabilities: distributing malicious cues across frames and exploiting temporal dynamics can bypass defenses that are effective for single images. Domain-specific and context-driven jailbreaks further underscore cross-modal risks. Huang et al. (2025b) demonstrate that medical MLLMs can be jailbroken via cross- moda-iyyylyty attacks and mismatched (out-of- context) constructions, highlighting the fragility of safety mechanisms in specialized deployments. Miao
ct al. (222)) formalize vision-centric jailbreak setting where images are used to construct realistic harmful contexts via image-driven context injection, yielding high attack success rates against black-box MLLMs. Finally, composite jailbreaks can be achieved through structured obfuscation and attention manipulation. Wang et al. (2025d) propose a multi-modal linkage mechanism that hides malicious intent via cross-modal "encoding/
sancodin//decodingg decoding" structure to reduce over-exposure of harmful content while retaining strong jailbreak effectiveness. Yang et. al. (0255) show that distraction combiininnnooiinnnngg structured decomposition of
10

---

Published in Transactions on Machine Learning Research (03/2026)
can harmful prompts with visually enhanced distraction can disperse attention and weaken the model's ability to detect and suppress unsafe generations.
Universal Jailbreak Triggers: Universal jailbreak triggers aim to produce reusable attack artifacts that generalize across prompls, (asks, or inputs, functioning as query-agnostic "master keys." Compared to instance-specific jailbreaks, universal triggers pose a stronger threat model because they can be deployed repeatedly with minimal adaptation. [Wang et al. (2024a) develop a white-box universal jailbreak strategy that jointly optimizes image and text components, producing a universal master key that reliably elicits harmful affirmative responses across diverse harmful queries. In a complementary direction, Geng el al.) (2025) show that non-textual modalities can themselves encode universal malicious instructions: by opti- mizing adversarial images or audio to align with target instructions in embedding space, the attack bypasses safely mechanisms without requiring lextual harmful instructions. Universal jailbreak capability can also arise from distribution shifts rather than explicit trigger optimization. Jeong et al.] (2025) show that out-of- distribution transformations applied to harmful inputs increase model uncertainty about malicious intent, thereby enabling jailbreaks that defeat safety alignment on both LLMs and MLLMs. Collectively, these results indicate that universal jailbreaks arise both from systematic multimodal alignment weaknesses and from generalization failures under distributional shift.
3.2.3 Control and Injection Attacks
Control and injection attacks aim to override inst ructron priorilization, execution logie, or action-selection behavior of MLLMs, causing the system to follow attacker-specified objectives rather than the intended user or system instructions. Unlike integrity attacks, which primarily compromise correctness or perception, and jailbreak allacks, which bypass safety constraints, control attacks explicilly largel the mechanisms by which MLLMs interpret, prioritize, and execute instructions. These attacks are particularly relevant modern deployments where MLLMs are embedded within interactive systems that include system prompts, tool invocation, and agentic control loops. In such settings, adversarial influence can be injected indirectly through multimodal inputs that manipulate how instructions are interpreted or how downstream actions are triggered, even when the textual prompt itself appears benign (Fu et al. 2023
Prompt Injection Prompt injection atlacks manipulate the instruction-followie behavior of MLLMs by embedding override or compete with intended system, developer, or user instructions. In multimodal systems, such injections need not be expressed explicitly in text; instead, they can be encoded indirectly through non-textual modalitics that influence the model's internal interpretation of intent, as illustrated in Figure Bp. By blending adversarial perturbations corresponding to malicious prompis into visual audio inputs, the attacker can steer the model to output attacker-chosen responses or follow unintended instructions when the user queries the perturbed content. This work highlights that multimodal context is often treated as authoritative by ceerructionfolllwiiii models, enabling prompt injection that bypasses traditional text-only filtering and moderation.
System Instruction Manipulation System instruction manipulation attacks target higher-level control signals such as tool-selection logie, execution policies, or agentic action-selection behavior, rather than user- facing instructions alone. These attacks are especially dangerous because they operate at a level intended to be trusted and can directly affect the model's interaction with external resources. Fu et al. (2023) show that visual adversarial examples can be used to induce attacker-desrred tool usage in tool-angmented language models. By manipulating the visual input, the attacker can cause the model to invoke sensitive tools-such as calendar management or information retrieval even when the user's text prompt is innocuous and does not request such actions. The attack remains stcalthy and generalizes across prompts, demonstrating that system-level decision logic can be hijacked through multimodal inputs.
Tool, Retricval, and Agentic Injection: Tool, retricval, and agentic injection attacks extend control manipulation to settings in which MLLMs operate as autonomous or semi-antonomous agents. Such systems often maintain memory, invoke tools, retrieve external context, or perform multi-step reasoning over extended
11

---

Published in Transactions on Machine Learning Research (03/2026)
interaction horizons. In these cases, single successful injection can propagate across many downstream actions.
Gu et al. 2024) demonstrate the severity of this threat by showing that a single adversarial image can be used to jailbreak a large population of multimodal agents simultancously. By exploiting shared perception and cnstrcciio-following mechanisms across agents, the attack scales without requiring per-agent customization. This result highlights that agentic MLLM deployments substantially amplify the impact of control and injection attacks, transforming localized multimodal manipulation into system-wide compromise.
3.2.4 Poisoning and Backdoor Attacks
Poisoning and backdoor attacks introduce persistent vulnerabilities into MLLMs during training, instruction tuning, or model adaptation. Unlike inference-time attacks, which rely on carcfully crafted inputs at test time, poisoning-basse attacks implant malicious behaviors that are activated by specific triggers or contexts long after deployment. These attacks pose a particularly severe threat because they can remain dormant, can evade detection during evaluation, and affect all downstream users of the compromised model. Figure | illustrates a canonical training-time backdoor attack, in which a small number of poisoned samples are injected during training to implant trigger that activates attacler-controlled behavior at inference time while preserving benign performance on clean inputs.
The risk is amplified in multimodal settings due to the reuse of pretrained components (e-g., vision encoders), the reliance on large-scale web data, and the increasing use of parameter-effiiint adaptation methods such as instruction tuning or lightweight adapters. Recent work demonstrates that poisoning can target data, triggers, representations, and even shared pretrained modules, enabling stealthy and transferable backdoors in MLLMs.
Data Poisoning: Data poisoning attacks manipulate the training or fine-tuning data of MLLMs induce malicious behaviors under benign inputs. In multinodal settings, poisoning can exploit the alignment between images and text to implant subtle yet powerful behavioral shifts without noticeably degrading model utility. Xu et al. (2024) introduce Shadowcast, a stealthy poisoning framework that inserts visually indistinguishable poisoned image text pairs into training data. Shadowcast demonstrates that even a small number of poisoned samples can induce persistent malicious behaviors, inchuding both misclasifficationsstyy errors and more subtle persuasion behaviors that leverage the generative capabilities of vision language models. Notably, the poisoned behaviors transfer across architectures and remain effective under rcalistic data augmentation and compression, highlighting the fragility of data integrity assumptions in multimodal training pipelines.
Backdoor attacks implant hidden triggers during training such that the model behaves normally on clean inputs but produces attacker-chosen outputs when the trigger is present. In multimodal models, triggers can be embedded in images, instructions, or latent representations, enabling broad range of persistent and difficult-to-detect attack vectors. Farly work such as [yu et al. (2024) demonstrates that vision language models can be backdoored to inject predefined target text into image-to-text generation tasks while preserving semantic plausibility. Liang et al.] (2025) extend this threat to instruction autoregressive VLMs, showing that multimodal instruction backdoors can be implanted during instruction tuning using both visual and textual triggers, even under limited attacker access.
Backdoor Attacks:
Subsequent studies explore more realistic and challenging threat models. Lyu et al. 2025 show that back- doors can be implanted using only access the original training distribution and further demonstrate that the backdoor remains effective despite distribution mismatch between poisoning data and deployment inputs. Beyond explicit triggers, YYin el al.] (222)) introduce shadow-activated backdoors, where malicious behaviors are activated implicitly when the model discusses specific objects or concepts, without requiring any external trigger. This paradigm high- lights that backdoor activation in MLLMs can be context-driven rather than artifact-driven, significantly complicating detection and mitigation.
data, eliminating the assumption that attackers must
12

---

Published in Transactions on Machine Learning Research (03/2026)
Malicious Training
Benign Interaction
Backdoor Activation Inference
The model is trained on a dataset where images green square are maliciously labeled as "dog"
LMM Output: "This is photo of a dog: (hidden backdcor activated by the trigger due to green square)
LMM Output: 'This is photo of cat.
Figure A backdoor attack where the model is 'poisoned' during training.
Fine-tuning, Adapter, and Representation Poisoning: Fine-tuning and representation poisoning at- tacks target the adaptation mechanisms commonly used to customize MLLMs, including instruction tuming, token-level output manipulation, and shared pretrained encoders. These attacks are particularly concerning because they exploit widely adopted deployment practices such as plug-and-play fine-tuning and component reuse. Yuan et al. (2025) introduce BadToken, a token-level backdoor attack that manipulates the out- put space of MLLMs by inserting or substituting specific tokens when a backdoored input is encountered. The attack preserves overall model utility while enabling fine-graii fine-grained and stealthy control over generated responses, posing risks in safety-critical applications such medical diagnosis and autonomous systems. Complementarily, Liu & Zhang (2025) reveal that backdoors can be implanted directly into self-supervised vision encoders that are later reused across many LVLMs. By compromising shared encoder, the attacker induces widespread hallucinations and attacker-chose behaviors in downstream models, demonstrating that repreentationn-eved poisoning can propagate backdoors across the multimodal ecosystem without modifying the language model itself.
An important observation is that attack objectives in multimodal LLMs are not mutually exclusive. Many effective attacks inherently multi-objective, where success under one objective serves an enabling mechanism for another. For example, perturbation-based integrity attacks visual inputs are often used to facilitate safety and jailbreak attacks by corrupting cross-modal representations and weakening alignment safeguards. Similarly, control and injection attacks may manifest as integrity failures at the output level, while training-time backdoors can surface at inforence as targeted intogrity or control violations. Accordingly, our laxonomy assigns each altack to a primary adversarial objective, while explicitly acknowledging that individual attacks may span multiple categories. For instance, (Tao et al. (2025) achieves jailbreak behavior through the implantation of a training-tine backdoor, and thus exhibits characteristics of both backdoor and jailbreak attacks.
3.3 Attacker Knowledge and Threat Models
Beyond attack objectives, adversarial allacks on MLLMs differ in how they are instantiated, depending on the attacker's knowledge of and access to the target system. Attacker knowledge shapes feasible construction strategics and evaluation assumptions, ranging from gradient-basod optimization in scttings with full internal access query-driven or transfer-basee methods under limited access. We characterize this dimension using standard white-box, gray-box, and black-box threat. models, which reflect varying degrees of access to model
13

---

Published in Transactions on Machine Learning Research (03/2026)
internals, prompts, or training artifacts. Rather than defining attack objectives, this dimension provides an analytical lens for understanding how attacks across different families are realized in practice. We summarize the distribution of attack families under these threat models using a two-dimensional matrix.
3.3.1 White-box Attacks
In white-box threat model, the adversary is assumed to have full access to the target MLLM, including its architecture, parameters, gradients, and, in some cases, the training or line-luning pipeline. Such priv- ileged access enables direct gradient-based optimization of adversarial objectives and precise manipulation of internal cross-modal representations. As a result, white-box attacks typically achieve high success rates and are commonly used to characterize upper-bound vulnerabilities of multimodal systems under worst-case assumptions.
Under this setting, white-box attacks have been demonstrated across multiple adversarial objectives. In- legrily allacks evaluate robustness under gradient-based visual adversarial perturbations adversarial visual inputs or manipulate internal visual tokens, causing MLLMs to produce incorrect or targeted outputs without necessarily violating safety policies (Cui et al. 2024 Safety and jailbreak attacks exploit white-box access to bypass alignment mechanisms, using optimized visual or multimodal perturbations to elicit disallowed or harmful content (Qi et al.) 2023 Wang al. )024a). Beyond output manipulation, white-box control and injection attacks target internal perception modules or visual prompts to override instruction hierarchies and redirect model agent behavior toward attacker-specified goals (Fu al.) 2023). Finally, white-box training- time attacks exploit access to the data or fine-tuning pipeline to implant persistent backdoors poisoned behaviors that are triggered at inference time (Lyu et al. 2024
Xu et al. 2024 Liang et al. 2024
3.3.2 Gray-box Attacks
Gray-box attacks occupy an intermediate threat model between white-box and black-box settings, where the adversary possesses partial knowledge access to the target system. This may include access to specific components such as the vision encoder, captioning module, or training data distribution, while the full language model, aligument layers, or deployment configuration remain unknown. Gray-box assumptions are particularly relevant for multimodal systems, which are often composed of reusable or open-source submodules integrated with proprietary components.
Under this partial-access setting, gray-box attacks span all major adversarial objectives. Integrity attacks exploit access to visual encoders intermediale representations to induce incorrect or targeted outputs that transfer across downstream MLLMs (Zhao et al. 2023). Safety and jailbreak attacks leverage partial knowledge of non-textual modalities or fusion mechanisms to bypass alignment safeguards, often through compositional or modality-specific perturbations (Geng et al. 2025). Gray-box control and injection attacks can arise when attackers have access to a known perception or agent component (e.g., tool routing rules), enabling redirection of system behavior without full model access. Finally, gray-box training- time attacks exploit limited control over data sources or pretrained components to implant persistent backdoors that activate under specific triggers (Liu & Zhang 2025 Xu et al.) 2024).. These attacks highlight. that even partial system knowledge can be sufficient to compromise multimodal LLMs across inference and training stages.
3.3.3 Black-box Attacks
In a black-box threat model, the adversary has no access to the internal parameters, gradients, or archi- tecture of the target MLLM, and can interact with the system only through input-output queries. This setting reflects realistic deployment scenarios, including attacks on proprictary API-based models. Con- sequently, black-box attacks rely on query-based optimization, transferability from surrogate models, or carefully engineered input patterns, and typically trade off attack efficiency for broader applicability.
Despite these constraints, black-box attacks have boen shown to be effective across multiple adversarial objectives. Integrity attacks exploit transfer-based or universal perturbations to induce incorrect or targeted outputs in vision-language models without internal access (Zhao et. al. 2023 Xie et al. 2024) Safely
14

---

Published in Transactions on Machine Learning Research (03/2026)
and jailbreak attacks leverage crafted visual or multimodal inputs to bypass alignment mechanisms and elicit. restricted content. under query-only access, including attacks under query-only access (Gong et al. 2025 Jeong et al., 2025; Wang et al. 2025d). Black-box control and injection attacks embed adversarial instructions into images or multimodal contexts to override user intent or hijack execution behavior, often via indirect prompt injection (Clusmann et al. 2025) (Kimura et al. 2024p. Finally, black-box training-lime
attacks demonstrate that poisoning or backdooring can succeed even when the attacker lacks knowledge of the final deployed model, relying instead on transferability across training pipelines (Xu et al., 2024 Liang et al.. 2025 Together, these results indicate that limited access does not prechude impactful attacks deployed MLLLMs.
Table Representalive lechniques for each allack objective based on the attacker's knowledge level.
Attack Goal
Attacker Knowledge
Integrity Attack
Safety Attack
Control Attack
Training Attack
White box
Cui al. 2024),
Qi et al. 2023
(Fu al. 2023
Lyu al. 2024)
Zhang et al.
(Wang et al.
Bailey et al.
2024
Xu et al.
2024).
2025d)
2024a
(Hao et
Liang et
2024
2024
Grey box
Zhao et al.
2023
Geng et al.
2025
Wu al. 2025
Xu et al.
2024
Shayegani et al.
Liu & Zhang
2023a
2025
Black box
Zhao al. 2023
Gong et al. 2025
Clusmann et
Xu et al.
2024
Xie et al.
2024
Jeong et al.
2025
2025).
Kinura
1 Liang et al.
2025
(Wang el al.
et al. 2024)
2025d
4 Dissecting the Threat: An Analysis of LLM Vulnerabilities
4.1 Overview
Having established a taxonomy organized by adversarial objectives and threat models, we now shift from how atlacks are categorized to why they succeed. Rather than viewing aacks as isolated techniques, we analyze them manifestations of recurring structural weaknesses in multimodal large language models. Figure 5 presents hierarchical view of these vulnerabilities, organizing failure modes from high-level architectural design choices to component-level flaws. This vulnerability-eent centrii perspective abstracts beyond surface-level attack vectors and explains how diverse integrity, safety, control, and poisoning attacks arise across different modalities and access assumptions.
To ground this framework, Tables 3 and 5 map each vulnerability category to representative attack families. The following subsections examine these vulnerability categories in detail.
4.2 Cross Modal Interaction & Alignment Vulnerabilities
This refers to the core vulnerabilities unique to MLLMs that arisc from the inherent complexitics of integrat- ing and reconciling information derived from multiple, distinct modalities such as texl, vision, and audio. These vulnerabilities stem from how LLMs attempt to align, fuse, and reason over heterogeneous modality- specific representations. Because these interaction points are fundamental to multimodal processing, they become prime targets for sophisticatod adversarial attacks aiming to disrupt cross-modal alignment or fused representations and induce erroneous outputs behaviors.
15

---

Published in Transactions on Machine Learning Research (03/2026)
Misalignment Integration Fallures
Embedding Space Weakness
Cross Modal Interaction Alignment Vulnerability
Reliance Specific Modalities
Asymmetic Vulnerability across modailties
Universal Representation Vulnerability
Visual Input Processing
Modality Specific Inpul Processing Vulnerabilities
Audio Input Processing
Textual Input Processing
Temporal Input Processing
LLM Vulnerabilitles
Exploiting instruction following
Instruction following & Prompt based vulnerabilities
Jailbrakking and safety bypass
Context Manipulation Ambiguity Exploitation
Attention Mechanism Exololiation
Architecture & Component Level Vulnerabilities
pre-trained components
Specific component weeknesses
Data Training Induced Vulnerabilities
Figure 5: Hierarchical Overview of LLM Vulnerabilities
16

---

Published in Transactions on Machine Learning Research (03/2026)
4.2.1 Misalignment & Integration Failures
Large multimodal language models can exhibit systematic failures in cross-modal alignment and integration, particularly when jointly reasoning over heterogeneous inputs such as lext, images, audio, or video. These failures arise when the model is unable to establish stable semantic correspondences across modalities or reconcile conflicting contextual signals within the shared multimodal representation space. As a result, benign inpuls al the per-modality level may combine to yield incorrect or unintended interprelations after fusion. Such vulnerabilities are often rooted in weaknesses of learned cross-modal embeddings, misaligned modality-specifie encoders, or brittle fusion mechanisms that over-rely on a dominant modality.
Recent work demonstrates that adversaries can explicitly exploit these vulnerabilities by targeting joint multimodal representations rather than individual modalities. For example, typographic and compositional attacks show that harmful intent can be concealed in, or amplified through, visual channels even when the accompanying text appears benign, exposing deficiencies in moosl alignment and integration (Gong et al. 2025). Similar failures arise from cross-modality mismatches, where benign textual queries combined with misleading or out-of-context visual inputs induce incorrect or unsafe outputs, as demonstrated in medical MLLMs by Huang et al. (2025b).
4.2.2 Embedding Space Weaknesses
A critical vulnerability arises from the shared high-dimensional embedding space used by multimodal lan- guage models to align and reason over heterogeneous inputs. While this space is intended to encode semantic similarity across modalities, its learned structure can be exploited by adversaries. Carefully crafted inputs that appear benign at the perceptual level can induce latent representations that are semantically mislead- ing after fusion, effectively creating false cross-modal correspondences. For instance, Adversarial Illusions demonstrate that an input from one modality (e-g-, an image) can be engineered such that its embedding closely aligns with an unrelated concept from another modality (e.g., text), causing the model to infer spuri- ous semantic relationship (Bagdasaryan al.] 2024 Related work further shows that such embedding-level vulnerabilities can be exploited in a largeted manner, where adversarial images are optimized to steer prox- imity in the joint embedding space toward harmful semantic regions and, when paired with otherwise benign prompts, induce unsafe model behavior (Shayegani et al. 2023a).
4.2.3 Over-Reliance / Imbalanced Reliance on Specific Modalities
Multimodal language models may exhibit an imbalanced reliance on particular input modalities, dispropor- tionately weighting information from one source while underutilizing signals from others. Such asymmetries can undermine modal verification, allowing dominant modalities to override conflicting evidence with- out sufficient scrutiny. This creates a structural vulnerability whereby misleading or adversarial content introduced through a secondary modality may not be adequately reconciled with the model's primary de- cision signal. Recent empirical analysis shows that several vision language models exhibit pronounced bias toward textual inputs, often treating vision as auxiliary rather than co-equal evidence (Deng et al,, 2025). This imbalance weakens multimodal grounding and increases susceptibility to attacks that exploit underweighted modalities or bypass moosl consistency checks.
4.2.4 Asymmetric Vulnerability Across Modalities
Multimodal language models can exhibit asymmetric susceptibility adversarial perturbations across the modalities they process, where attacks on one modality are more effective or have a disproportionate influence the model's final prediction compared to others. Such asymmetries can arise when modality-specific encoders or fusion mechanisms assign unequal weight robustness to different input channels, causing certain modalities to dominate joint decision-making. Prior work on multimodal safety has shown that the visual modality can constitute a particularly brittle pathway for alignment, where adversarially crafted images can be leveraged to amplify harmful intent and induce safety violations even when text-only safeguards are place (Li et al., 2025b)). These findings highlight that modality-dependen robustness uneven and that vulnerabilities in single modality can disproportionately compromise multimodal reasoning. This asymmetry extends beyond static images: Hu et al. (2025b) show that the video modality introduces distinct
17

---

Published in Transactions on Machine Learning Research (03/2026)
vulnerabilities, where distributing adversarial cues across frames enables jailbreaks that bypass defenses effective for single-image or text-only inputs.
4.2.5 Universal Representation Vulnerability
A recurring challenge in multimodal models that their joint representations are expected to generalize across diverse tasks, prompts, and imput distributions, which creates shared attack surface. Empirical evidence shows that adversarial patterns can be optimized to generalize broadly across prompts and down- stream tasks, remaining effective even when the attacker does not know the specific query or interaction context (Zhang et al. 2025d). Complementarily, Pandora's Box constructs task-agnostic universal ad- versarial patch that transfers across multiple LVLMs and task settings, indicating systematic brittleness in shared multimodal representations across model instances (Liu et al.) 2024ap. As models increasingly rely on unified representational spaces for scalable multimodal reasoning, ensuring robustness across such var- ied scenarios remains difficult, leaving these shared representations vulnerable to reusable and transfcrable manipulations.
4.3 Modality-Specifff Input Processing Vulnerabilities
Beyond cross-modal challenges, LLMs also exhibit vulnerabilities inherent how they process and interpret data from individual modalities. These weaknesses often stem from the specific characteristics of each data type (e.g.; high dimensionality of images, temporal nature of audio/video) or are inherited from the unimodal encoders (e.g., pre-trained vision audio networks) used as building blocks. Attackers can exploit these modality-specifie frailties even before information is fused, corrupting the input at its source.
4.3.1 Visual Input Processing
Multimodal language models exhibit significant vulnerabilities in their processing of visual inputs, arising from both the brittleness of vision encoders and their integration into language-driven reasoning pipelines. Small, often inman-impercoptible perturbations to visual inputs can induce disproportionate changes in downstream MLLM outputs and behaviors, as adversarial signals injected at the vision-encoding stage prop- agate through multimodal fusion and language generation (Dong et al. 2023 Zhao ct al. 2023 These vulnerabilities are frequently inherited from pre-trained vision backbones used as encoders, creating an al- tack surface that persists even when the language model itself is well-aligned. Beyond perception errors, recent work demonstrates that carcfully crafted visual inputs can trigger unintended tool invocation or con- trol behaviors in tool-augmented MLLMs, highlighting the security implications of visual processing failures (Fu et al. 2023). Other attacks exploit typographic overlays or visually rendered text that are misinterpreted by OCR or visual-text alignment components, effectively acting as covert visual prompts that manipulate
downstream reasoning QQaitem al. 2024 Gong et al. 2025
4.3.2 Audio Input Processing
The processing of speech, audio waveforms, and general sound events in multimodal language models intro- duces a distinct and increasingly exploited attack surface. Recent studies show that audio inputs are often less robustly protected than textual counterparts, allowing adversaries induce harmful or unintended be- haviors through carefully crafted speech or acoustic signals YYang et al., 2024). In particular, vulnerabilities in speech recognition and audio-languag alignment pipelines be exploited via cross- lingual phonetics cross-lingual and pronunciation or accent variations that evade safety mechanisms while remaining intelligible to the model (Roh et al. 2025). Empirical red-teaming of audio multimodal models further reveals high attack success rates and inconsistent safety enforcement across acoustic inputs, underscoring that audio processing remains a comparatively weak link in current multimodal systerns. While adversarial waveform attacks on acoustic models have been studied extensively prior work Carlini & Wagner (2018): Zhang et al. (2017). such brittleness becomes especially consequential when these components are integrated into language-driven reasoning pipelines.
18

---

Published in Transactions on Machine Learning Research (03/2026)
Taxonomy Category
Primary Vulnerabilities Exploited
Representative Works
Signal Perturbations
Specific component weaknesses
Zhang et al.
2025d
Visual Imput Processing; Weaknesses
Embedding Space
Wang et al.
22024b
Discrete Triggers
Visnal Input Processing:
Embedding Space Weaknesses; Universal Representation Vulnerability
et
2024a
Visual Input Processing; Misalignment & Integration Failures
Cao et
2025
Representation & Fusion Exploits
Embedding Space Weaknesses
Bagdasaryan et
2024
Misalignment & Integration Failures
Shayegani et al.
2023a
Table 2:
Mapping Integrily Atlacks to underlying vulnerabilities drivers
4.3.3 Textual Input Processing
Vulnerabilities in the interpretation of textual content remain critical in multimodal language models, par- ticularly when text is processed indirectly through visual multimodal pipelines. In such settings, models may over-attend to salient textual cues while failing to incorporate broader semantic context, leading to systematic misinterprettation.. Recent work shows that typographic text rendered within images can be mis- processed by lisionllanual models, causing them to infer incorrect or unintended instructions despite the absence of explicit textual prompts (Qraitem al. 2024 Gong et al. 2025). These failures highlight weak- nesses in how textual information is extracted, normalized, and aligned with language reasoning components, especially when mediated by OCR visual-text. aligument. modules.
4.3.4 Temporal Information Processing (Video/Sequeetial Data)
Multimodal language models face distinct vulnerabilities when processing temporally evolving inputs such video, where maintaining coherent representations across sequential frames is essential for correct inter- pretation. Prior work indicates that disruptions to temporal consistency propagate across time, causing errors introduced at a small mumber of frames to affect the model's understanding of an entire sequence. Such weaknesses are commonly associated with limitations in temporal aggregation and sequence-level reasoning, where models struggle to robustly integrate dynamic visual information over time (Huang et al., 2025a) Recent altacks explicitly exploit these limitations using flow-based methods that leverage optical flow to identify and perturb temporally salient regions, achieving high effectiveness by targeting a limited subset of frames rather than the full video stream (Li et al. 2024
4.4 Instruction following & prompt-based vulnerabilities
A significant class of vulnerabilities in MLLMs stems directly from their core design objective: to understand and follow human instructions. Attackers exploit this inherent helpfulness by manipulating input prompts that are delivered via text, images, audio, or combinations thereof to elicit unintended, harmful, or re- stricted behaviors. These attacks often aim to subvert the model's safety alignments or hijack its generative capabilities for malicious purposes.
4.4.1 Exploiting Instruction- Nature
The same cnstruction-folloving capability that enables multimodal language models to perform complex tasks also introduces a critical vulncrability when adversarial or deceptive commands are introduced. Prior work shows that models can be manipulated by embedding malicious instructions that compete with or over-
ride user intent, causing the system to prioritize attacker-supplied guidance (Kimura et. al. 2024). While
19

---

Published in Transactions on Machine Learning Research (03/2026)
Taxonomy Category
Primary Vulnerabilities Exploited
Representative Works
Visual Input Processing; Jailbreaking & Safety Bypass
Qi et al. (2023)
Unimodal Surfaces
Audio Imput Processing; Asymmetric
Yang et al. 2024
Roh et al.
2025
Vulnerability Across Modalities
Misalignment & Integration Failures;
Gong et al.
2025
Embedding Space Weaknesses
Multimodal Composite Jailbreaks
Context Manipulation; Misalignment
Wang et al.
2025d
Integration Failures
Temporal Input Processing; Attention
Hu et al.
2025b
Mechanism Exploitation
Jailbreaking & Safety Bypass:
Li et al.
2025b)
Wang et al.
2025b
Misalignment Integration Failures;
Jailbreaking & Safety Bypass
Cheng al
2025
Universal Jailbreak
Misalignment & integration failures; Visual imput processing
Wang et al.
2024a
Triggers
Embedding Space Weaknesses; Over Reliance on Specific Modalities
Geng et al.
2025
Table 3: Mapping Safety/Jailbeee Jaillbrea Atlacks to underlying vulnerability drivers
such instructions may appear explicitly textual prompts, they can also be conveyed indirectly through non-textual modalities. In particular, attackers can encode instructions within images or audio inputs that are subsequently decoded and acted upon by the model as if they were legitimate textual commands, despite the absence of overt instruction text (Bagdasaryan et al. 2023 Gu et al. 2024). These attacks highlight that cnstruction-folloiing behavior itself rather than specific modality constitutes a fundamental vul- nerability when models lack robust mechanisms for distinguishing inlent, authority, and context.
4.4.2 Jailbreaking & Safety Bypass
Jailbreaking attacks target weaknesses in the safety and alignment mechanisms of large language models, seeking to induce outputs that violate intended content restrictions. Prior work shows that such failures often arise from the model's tendency to comply with cleverly framed instructions that exploit gaps or inconsistencies in safety training, for example through rolc-playing, hypothetical framing, or logical indirec- tion. In multimodal settings, these vulnerabilities can be amplified when inputs from multiple modalities interact in ways that undermine unimodal safety checks (Liu al. 2024c). Recent studies demonstrate that carefully constructed combinations of visual and textual inputs can jointly bypass safety mechanisms that would otherwise be effective in isolation, cxposing weaknesses in cross-modal safety alignment (Liu et al, 2024d). These findings indicate that safety enforcement in multimodal models is not uniformly robust across modalities and can be circumvented through coordinated multimodal inputs.
4.4.3 Context Manipulation & Ambiguity Exploitation
Multimodal language models can be misled by adversarial manipulation of contextual information by exploiting inherent ambiguities in language and moosl inputs. Prior work shows that by supplying mislcading background context or framing information, attackers can steer the model's interpretation to- ward unintended conclusions or actions Miao el. al. 2025). Ambiguity can also be introduced deliberately through carefully constructed prompts or by combining multimodal inputs whose relationships are inten- tionally unclcar or decoptive (Huang et al.) [2025b). In such cases, models may default to an incorrect or tetacker-favoree interpretation, particularly when resolving conflicting or underspecified cues across modal- ities. Recent studies demonstrate that. bi-modal adversarial prompts leveraging ambiguous dssulltextun
20

---

Published in Transactions on Machine Learning Research (03/2026)
Taxonomy Category
Primary Vulnerabilities Exploited
Representative Works
Context Manipulation; Exploiting
Clusmann et al.
2025
Prompt Injection
Instruction Following Nature; Visual
Textual Input Processing
Audio Input Processing; Exploiting Instruction-Followinng Nature; Context
Hou et al.
2025
Manipulation
System Instruction Manipulation
Exploiting Instruction Following Nature; Context Manipulation; Misalignment Integration Failures
Wang al.
2025a
Misaligument & Integration Failures;
Zhang et al.
2025c
Over-Reliance on Specific Modalities
Specific Component Weakness; Context Manipulation; Visual Input Processing
Fu et al.
2023
Tool, Retrieval and Agentic
Injection
Context Manipulation; Exploiting
Zhang et al.
2025a
Mnstruction-Follwwii Nature;
Misalignment & Integration Failures
Instruction Following Nature; Misalignment & Inlegration;
Gu al.
2024
Table 4: Mapping Control & Injection Attacks to underlying vulnerability drivers.
relationships effectively induce safety bypasses and unintended behaviors, highlighting weaknessos in contextual reasoning and disambiguation mechanisms (Ying et al. 2024).
4.4.4 Attention Mechanism Exploitation
Attention mechanisms play central role in how multimodal language models prioritize and integrate infor- mation across inputs, making them a critical attack surface (Vaswani et al. 2017). Prior work shows that adversarial inputs can be constructed to manipulate how attention is allocated, either by amplifying the in- fluence of misleading features or by suppressing attention to semantically relevant cues. Such manipulation can occur within a single modality through self-attention, or across modalities by disrupting cross-modal at- tention alignment. Recent studies demonstrate that explicitly targeting attention dynamics can significantly alter model behavior, enabling attackers steer outputs by biasing attention toward adversarially chosen
elements (Wagg et al. 2024c
Xie al. 2024
4.5 Architectural & Loeponent-Level Vulnerabilities
Vulnerabilities in MLLM systems not confined to input procossing instruction-foolloinn: they also arise from internal architectural mechanisms and specific components within the model. Such weaknesses may stem from design choices in modules such as attention or fusion, or be inherited from pre-trained building blocks integrated into the system. Attacks that target these vulnerabilities aim to perturb internal representations and information routing, leading to systematic errors or unintended behaviors.
4.5.1 Inherited Vulnerabilities from Pre-trained Components
Many multimodal language models rely on powerful unimodal encoders such as vision, lext, or audio backbones that are pre-trained on large-scale datasets and subsequently integrated into larger multimodal systems. While such pre-training provides strong representational capabilitics, also introduces a pathway for adversarial weaknesses present in these source models to propagate into the full multimodal pipeline. Prior work shows that vulnerabilities in vision encoders, inchuding susceptibility adversarial perturbations,
21

---

Published in Transactions on Machine Learning Research (03/2026)
Taxonomy Category
Primary Vulnerabilities Exploited
Representative Works
Data Poisoning
Inherited Vulnerabilities from pre-trained
Xu et al.
2024
components;
Backdoor Attacks
Data & Training Induced; Textual Input Processing
Yuan et al.
2025
Fine-tuning, Adapter and Representation Poisoning
Inherited Vulnerabilites from pre-trained
Liu & Zhang 2025
components; Specific Component Weaknesses;
Table 5: Mapping Poisoning & Backdoor Attacks to underlying vulncrability drivers
persist after integration and be exploited to induce incorrect or targeted behaviors in downstream multimodal
models (Cui et al. 2024 Dong et al. 2023). As result, attacks originally designed for standalone unimodal encodors may transfer to multimodal language models, exposing inherited weaknesses in the initial processing stages that are not mitigated by subsequent language reasoning components.
4.5.2 Specific Component Weaknesses
Beyond general architectural vulnerabilities, multimodal language models may exhibit weaknesses tied specific components auxiliary modules integrated into the system. In particular, lightweight adaptation mechanisms used for efficient fine-tuning- such as low-rank adapters addpters-introduuee additional attack surfaces that can be exploited independently of the base model. Prior work demonstrates that such adapters can be leveraged to implant backdoors with minimal computational overhead, enabling malicious behaviors to persist across downstream usage without modifying core model parameters (Liu et al. 2025a Liang et al. 2025 Lyu et al., 2024). addition, the choice of modality fusion components can influence robustness, as different fusion designs may vary in their susceptibility adversarial manipulation or misalignment, potentially amplifying errors introduced at earlier processing stages.
4.6 Data & Training Induced Vulnerabilities
The security and reliability of MILMs are strongly shaped by the data they are trained on and the training methodologies employed. Vulnerabilities may be introduced intent ionally by adversaries through malicious manipulation of training or fine-tuning data, or arise unintentionally from biases, sensitive information, or spurious patterns embodded in large-scale multimodal corpora. Prior work demonstrates that attackers can inject small number of poisoned samples containing specific trigger palterns paired with attacker-chosen outputs, causing models to learn latent correlations that remain dormant during standard evaluation yet activate reliably at inference time (Xu et al. 2024). In multinodal settings, such vulnerabilities are further amplified by cross-modal representation learning, where modality dominance and interaction effects can influence how poisoned behaviors are encoded and later activated (Han et al. 2024). These training-induct weaknesses are particularly difficult to detect and mitigate post-deployment, as the resulting malicious behaviors are deeply embedded in the model parameters and may only surface under out-of-disttibbttio or trigger-specific conditions (Lyu et al. 2025)
5 Defense Mechanisms
This section presents an overview of defense mechanisms for MLLMs, and tying them according to the attack lamilies in our laxonomy. In classical adversarial robustness, defenses largely focus on hardening modality encoders against bounded perturbations; contrast, MLLM deployments introduce additional system-level failure modes which untrusted multimodal content (o.g., OCR text in images, retrieved documents, or tool outputs) is inadvertently treated as higher-priorite instructions. Consequently, defenses for MLLMs span multiple layers of the pipeline, including perception-layer robustness for integrity attacks, context and
22

---

Published in Transactions on Machine Learning Research (03/2026)
instruction- handling mechanisms for jailbreak and injection attacks, and control-plane constraints for tool- using agents (C), with complementary safeguards for training-time compromise where applicable.
5.1 Input Preprocessing and Perception-Layer Hardening
A first. line of defense operates at the input and perception layer by reducing sensitivity to low-level per- turbations before or within modality encoders. Test-time transformations and feature-space compression can suppress small-magnitude perturbations that exploit weaknesses in visual or audio inpul processing, thereby mitigating integrity attacks based on contimuous signal perturbations in our taxonomy. Feature squeezing is a representative approach that detects adversarial examples by comparing predictions before and after inexpensive input squeezes such as bit-depth reduction and smoothing (Xu et al. 2018). Such preprocessing based defenses are lightweight and can be deployed without retraining, but their protection is typically partial under adaptive attackers and limited against attacks that do not rely on fragile pixel- waveform-level noise. More recently, robustness of vision encoders in vision-language pipelines has been studied directly in the multimodal setting, for example by adversarially fine-tuning CLIP-style encoders to improve resistance against adversarial visual perturbations that propagate into downstream vision- language modols [Schlarmann et al. 2024).
A more robust but costlier approach is adversarial training and robust optimization, which improves em- pirical robustness by training on worst-case (or proxy) adversarial examples. Foundational work on robust optimization and PGD-based adversarial training demonstrated substantial gains in resistance bounded perturbations (Madry et al.) 2019), and TRADES formalized the trade-off between natural accuracy and robustness via principled objective (Zhang et al. 2019). Complementary approaches explore adapting prompt representations rather than model weights, showing that adversarial prompt tuming can improve ro- bustness of vision language models to adversarially perturbed visual inputs without modifying the underlying encoders (Zhang et al.) 2024). In MLLMs, these approaches most directly strengthen modality encoders and thus primarily mitigate integrity attacks rooted in perceptual signal manipulation, with partial benefits for representationn-lee vulnerabilities when the exploited failure originates in encoder embeddings rather than in higher-level instruction handling or fusion logic.
5.2 Certified Robustness for Encoders
Beyond empirical robustness, certified defenses aim to provide formal guarantoes that model predictions are invariant within a specified perturbation set. Randomized smoothing offers probabilistic robustness certificates under & perturbations and has been shown to scale to large neural models (Cohen et al. 2019) Recent work has begun extending certification techniques to vision language models, including incremental randomized smoothing methods that certify robustness of multimodal encoders under bounded perturbations NNrala et al._ 2024), as well as prompt-level certification strategies for medical vision language models Husseen et al. 2024). Such certification most naturally applies to individual perception components within MLLM pipelines and therefore targets integrity attacks arising from bounded input perturbations. However, end-to-end certification of multimodal fusion, autoregressive decoding, and instruetion-following behavior remains challenging, leaving representation-level exploits and higher-level safety control attacks largely outside the scope of current guarantees.
5.3 Multimodal Input Validation and Specification- Based Gating
A distinctly MLLM-oriented defense direction is to validate multimodal inputs against explicit, application- provided specifications before they are allowed to inffuence the model's reasoning. Sharma et all (2024) propose defense specifically for image-based prompt attacks against MLLM chatbots, using two-stage pipcline that (i) validates whether an input image conforms to expected constraints and (ii) performs prompt- injection defense to block malicious intent encoded in the image. This class of defenses directly targets safely bypasses and prompt injection attacks when adversarial instructions are introduced via the image channel (c.g., OCR-readable diroctives), and can also reduce exposure to fusion-Ievel vulnerabilities by preventing untrusted multimodal artifacts from reaching cross- cross-modal reasoning in the first place. Beyond specification- based filtering, recent defenses also exploit moosl interactions themselves disrupt jailbreak attempts.
23

---

Published in Transactions on Machine Learning Research (03/2026)
for example by introducing adversarial visual perturbations that proactively interfere with malicious instruc- tions before they influence the language model [Ti et al. 2025a..
5.4 Instruction-Data Separation for Multimodal Contexts
A central vulnerability behind many injection attacks amplified in multimodal settings is the mixing of trusted instructions with untrusted context such as OCR outputs, retrieved documents, captions, or tool results. Defenses in this category enforce structured separation so that untrusted content is treated as data rather than executable directives. Liu et al. (2025b) formalize prompt injection attacks and defenses for LLM-integrated applications and provide a benchmarked evaluation framework that clarifies why naïve concatenation enables injected tasks to override target tasks. Building on this separation principle, Chen ct al. 2024 propose structured queries that explicitly separate prompt and data channels and demonstrato improved robust.ness against prompt injection. Related defenses further refine instruction-date separation by shaping model preferences or introducing lightweight defensive tokens, demonstrating improved resistance to injected instructions under mixed trusted and untrusted contexts (Chen et al. 2025b ap. In our taxonomy, these defenses map most directly to control and instruction hijackkngg attacks as well as many safety bypass scenarios, and they partially mitigale representation- and fusion-level exploits when the exploit relies on cross-modal context being reinterpreted as commands.
5.5
Defenses for Injection and Hijacking
Detection-based defenses aim to identify injected instructions or malicious intent embedded in untrusted multimodal context, including OCR-extracted text from images. In practice, detection and rejection can complement strict scparation because not all applications and allackers may embed prompt-like directives in visually plausible content. The two-stage approach of (Sharma et al. (2024) explicitly includes prompt-injection defense to detect unsafe intent that bypasses initial validation, while the benchmarking methodology Liu et al. (2025b) emphasizes evaluating defenses under diverse injection strategies and attacker capabilities. These defenses primarily mitigate instruction- hijacking and safety bypass attacks that exploit instruction-data confusability, but they may be bypassed by adaptive attacks that obfuscate or distribute malicious directives across modalities. Recent work has proposed deployable detection mechanisms aimed at identifying prompt injection atlempls al inference time, including lightweight classifiers designed for real-time use in practical systems (Jacob et al. 2025). At the same time, empirical analyses highlight fundamental limitations of LLM-based detection under adaptive adversaries, showing that attackers can often evade detectors through paraphrasing, indirection, or multi- step instruction dispersion (Choudhary et al. 2025
constrain inputs to narrow specification,
5.6 Control-Plane Defenses for Tool-Using Multimodal Agents
When MLLMs are embedded in agentic systems with tools (browsers, shells, retrieval, APIs), the dominant risk shifts from unsafe text outputs to unsafe actions. Defenses therefore must constrain tool invocation, detect malicious environmental artifacts, and prevent agents from being steered into attacker-chosen ac- tion sequences. Ayzenshteyn
al. (2025) propose proactive defenses based on deception and instrumen- tation pioionn deceptive strings, honeytokens, and traps to detect and derail autonomous agent behav- ior demonstrating the utility of such mechanisms against agentic attack workflows. These defenses map most direetly to control-pla mntrol-plane attacks in which adversarial information propagates into tool exccution, in- cluding cases where multimodal inputs (screenshots, documents, OCR) serve as the carrier for adversarial instructions that would otherwise lead to tool misuse. More recent work extends control-plane defenses to end-to-end agent systems, proposing real-time monitoring and intervention mechanisms for computer- use agents (Hu et al., (022a)). ; as well as benchmark-driven evaluations that formalize attack and defense dynamics in L.M--based agents (Zhang et al. 2025b
24

---

Published in Transactions on Machine Learning Research (03/2026)
5.7 Poisoning/Backkoor Defenses
Data poisoning and backdoor threats molivate defenses that operate both during data curation and post- training verification. A common line of work aims to detect and remove poisoned samples using representation outliers, c.g., spectral signature mothods that identify anomalous dircctions in Icarned fcature space and filter suspicious training points (Tran et al. 2018). Complementary approaches attempt post-hoc trigger discovery and mitigation by reverse-enginneerigg candidate triggers and identifying backdoored classes; Neural Cleanse proposes an optimization- accordingly (Wang et al., 2019). At inference time, runtime input filtering measuring prediction consistency under strong perturbat ions, as in STRIP (Gao et al. 2019). Finally, model repair methods can reduce backdoor capacity by pruning neurons that are dormant on clean inputs followed by fine-tuning Pruning demonstrates that combining pruning with fine-tuning can substantially weaken backdoors while largely preserving clean accuracy (Liu et al. 2018).
procedure to reconstruct potential triggers and then repair the model
flag triggered behavior by
6 Limitations
This survey focuses on adversarial attacks against ML.LMs, emphasizing attack objectives, mechanisms, and threat models. As a result, several limitations should be noted. First, our analysis is intentionally attack- centric. While we provide structured overview of defense mochanisms in Section 5 to contextualize these threats, we do not claim to provide an exhaustive catalog of all possible miligation stralegies. Second, regarding scope, we prioritize, peer-reviewed research that evaluates attacks on MLLMs with language- model-based reasoning core. Adversarial studies targeting unimodal models alone or those aiming at content bias, fairness, and privacy leakage are excluded unless explicitly framed as adversarial attacks on multi- modal systems. Third, the survey reflects the inherent skew in the current literature towards MLLMss. While we discuss Audio- and Video-based attacks where available, these modalities are currently less represented in the broader research landscape compared to image-lext pairs. Finally, the laxonomy presented empha- sizes dominant attack objectives. Real-world attacks may combine multiple mechanisms and exploit several vulnerabilitics simultancously, and thus may span multiple categories.
7 Broader Impact
This survey systematically catalogs adversarial attacks and vulnerabilities affecting MLLMs. While such taxonomies can lower the barrier to understanding and potentially reproducing known attacks, our intent is to support the development of more robust, secure, and trustworthy multimodal AT systems. By organizing attacks according to objectives, mechanisms, and thrcat models, we aim to help practitioners, system do- signers, and researchers anticipate realistic threats and reason about their root causes. Understanding how and why attacks succeed is prerequisite for developing effective defenses, auditing deployed systems, and informing responsible deployment decisions.
We acknowledge the inherent lension between disseminating allack knowledge and the risk of misuse. Con- sistent with established practice in security research, we rely on reer-reviewed sources and emphasize analysis rather than operational guidance, avoiding step-by-stop instructions or exploit-rcady artifacts. Morcover, we include a dedicated discussion of defense mechanisms to contextualize attacks and highlight mitigation strategies. Finally, the real-world safety implications of multimodal attacks such misinformation, misuse of autonomous agents, and harm arising from model manipulation underscore the urgency of this research area. We view this survey as contribution toward responsible disclosure and proactive risk mitigation, rather than enabling malicious use.
8 Conclusions
This survey presented a systematic review of adversarial attacks on multimodal large language models, orga- nized through a goal-driven taxonomy and complemented by a vulnerability-cente analysis. By classifying attacks according to their primary adversarial objective and considering different attacker knowledge assump- tions, we provide structured framework for organizing a rapidly growing and diverse body of literature.
25

---

Published in Transactions on Machine Learning Research (03/2026)
The taxonomy is intended to offer unifying perspective that cuts across modalities, attack implementa- tions, and deployment settings. Across the surveyed literature, a substantial portion of existing attacks have been evaluated in vision language model settings, reflecting the prevalence of image text interfaces and the relative maturity of vision encoders in current multimodal systems. At the same time, attacks targeting audio language and video video-language models appear less frequently the literature. We interpret this obser- vation as an indication of uneven research coverage rather than a definitive assessment of comparative risk across modalities.
Our vulnerability analysis highlights several recurring weaknesses that are exploited across different attack families, including cross-modal misalignment, embedding-space fragility, modality-speciffc processing limita- tions, mnstructioonfllloiinng ambiguities, and training-time data integrity issues. The surveyed works suggest that successful attacks often leverage combinations of these vulnerabilities rather than a single isolated weak- ness. In addition, attack objectives multimodal systems frequently overlap: integrity failures may enable safety bypasses, control-oriented attacks may manifest as perception crrors, and training-ting time poisoning can surface as inference-time integrity or control violations. Our laxonomy captures this structure by assigning each attack a primary objective while acknowledging secondary effects. Finally, the survey surfaces several open challenges suggested by patterns in existing work. Evaluation protocols for multimodal robustness remain fragmented, particularly outside rision-languss settings. Reported defenses are often tailored to specific attack classes or threat models and may not generalize across modalities or deployment assumptions. We hope that the taxonomy, vulnerability mappings, and empirical summaries provided in this survey serve as a useful foundation for more systematic analysis and for the development of more robust and reliable multimodal language models.
References
Lukas Aichberger, Alasdair Paren, Guohao Li, Philip Torr, Yarin Gal, and Adel Bibi. Mip against agent: Malicious image patches hijacking multimodal os agents, 2025. URL https://arxiv httpa///aarri..ro//aa/////////// org/abs/2503,,
10809
Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, Lawrence Zitnick, and Devi Parikh. Vqa: Visual question answering. In Proceedings of the IEEE international conference on computer vision, pp. 2433, 2015.
Relja Arandjelović and Andrew Zisserman. Look, listen and learn. In Proc. ICCV, volume 3, pp. 9, 2017.
Daniel Ayzenshteyn, Roy Weiss, and Yisroel Mirsky. Cloak, Honey, Trap: Proactive Defenses Against LLM Agents. In Proceedings of the 34th USENIX Security Symposium (USENIX Security 2025), pp. 8095-8114. USENIX Association, 2025.
Alexei Baevski, Henry Zhou, Abdelrahman Mohamed, and Michael Auli wav2vec 2.0: A framework for self-supervised learning of speech representations. In Advances in Neural Information Processing Systems 34 (NewrIPS 2020), pp. 12449- 12460, 2020.
Eugene Bagdasaryan, Tsung-Yie Yin Hsich, Ben Nassi, and Vitaly Shmatikov. Abusing images and sounds for indirect instruction injection in multi-modal 1lms. arXiv preprint orXi::2307.1000 104999 2023.
Eugene Bagdasaryan, Rishi Jha, Vitaly Shmatikov, and Tingwei Zhang, Adversarial illusions in (Multi- Modal} embeddings. In 33rd USENIX Security Symposium (USENIX Security 24), pp. 3009 3025, 2024.
Luke Bailey, Fuan Ong, Stuart Russell, and Scott Emmons. Image hijacks: Adversarial images can control generative models at runtime, 2024. URL http:::://arxt..oor/a/////////// 00236
Tadas Baltrušaitis, Chaitanya Ahuja, and Louis-Philippe Morency. Multimodal machine learning: A survey and taxonomy. IEEE transactions on pattern analysis and machine intelligence, 41(2):423 443, 2018.
Yue Cao, Yun Xing, Jie Zhang, Di Lin, Tianwci Zhang, Ivor Tsang, Yang Liu, and Qing Guo. Scenetap: Scene-coherent typographic adversarial planner against vision-language models in real-world environments, 2025. URL http:::tp////// http:///aaaa.....//////////111//
26

---

Published in Transactions on Machine Learning Research (03/2026)
Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks speech-to-text. In 2018 IEEE security and prinacy workshops (SPW), pp. IEEE, 2018.
Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang. Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei Ye, Yue Zhang, Yi Chang, Philii S. Yu, Qiang Yang, and Xing Xie, A survey evaluation of large language models, 2023. URL pettps://ariv..oo wwwg///s/300..0000
Sizhe Chen, Julien Piet, Chawin Sitawarin, and David Wagner. Struq: Defending against prompt injection with structured queries, 2024. URL https: wttp://www.rggab///22.2...
Sizhe Chen, Yizhu Wang, Nicholas Carlini, Chawin Sitawarin, and David Wagner. Defending against prompt injection with few defensivetokens, 2025a. URL https://aaxiiv org
Sizhe Chen, Arman Zharnagambetor, Saeed Mahloujifar, Kamalika Chaudhuri, David Wagner, and Chuan Guo. Secalign: Defending against prompt injection with preference optimization. In Proceedings of the 2025 ACM SIGSAC Conference on Computer and Communiications Security, CCS '25, pp. 2833 2847. ACM, November 2025b. doi: 10.1145/3719027.33444 37444866..7 URL http:://txttt//// doi www.oo/g///// 11t./111//379// 01111997777744486666 3744836
Hao Cheng, Erjia Xiao, Jindong Gu, Le Yang. Jinhao Duan, Jize Zhang, Jiahang Cao, Kaidi Xu, and Renjing Xu. Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language model, 2024. URL https: http://aaxvvvvv.. http://xwxxvvv...aa// httpg/ab//240...990 19150
Ruoxi Cheng, Yizhong Ding, Shuirong Cao, Ranjie Duan, Xiaoshuang Jia, Shaowei Yuan, Simeng Qin, Zhiqiang Wang, and Xiaojun Jia. Pbi-attack: Prior-guided bimodal interactive black-box jailbreak attack for toxicity maximization, 2025. URL
Sarthak Choudhary, Divyam Anshumaan, Nils Palumbo, and Somesh Jha. How not to detect prompt injections with an I1m, 2025. URL /tttts://///ttttt org/ absa 05630.
Jan Clusmann, Dyke Ferber, Isabella C. Wiest, Carolin V. Schneider, Titus J. Brinker, Sebastian Foersch, Daniel Truhn, and Jakob N. Kather. Prompt injection attacks on vision-language models oncology. Nature Communications, 16(1):1239, 2025. doi: (0.10088/11147--244556313
Jeremy M Cohen, Elan Rosenfeld, and J. Zico Kolter. Certified adversarial robustness via randomized smoothing, 2019. URL https://arxiv.ort org/ wrwg//ab///...02///
Xuanming Cui, Alejandro Aparcedo, Young Kyun Jang, and Ser-Nam Lim. On the robustness of large multimodal models against image adversarial attacks. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2024.
Ailin Deng, Tri Cao, Zhirui Chen, and Bryan Hooi. Words or vision: Do vision-language models have blind faith in text?, 2025. URL https://aaxiiv wtw.aaiwii.rr.ooeeeoooeooo httg:/abs/200..000 02199
Jacob Devlin, Ming- Wei Chang, Kenton Lee, and Kristina Toutanova. Bert: Pre-training of deep bidirectional transformers for language understanding. In Proceedings of the 2019 conference of the North American chapter of the association for computational linguistics: humman language technologies, volume 1 (long and short popers), pp. 4171-4186, 2019.
Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google's bard to adversarial image attacks? arXiv preprint ar arXiv:2309.11 11751, 2023.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa. Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words. arXiv preprint (xXiv22010.1192) 7, 2020.
Zhihao Dou, Xin Hu, Haibo Yang, Zhuqing Liu, and Minghong Fang. Adversarial attacks to multi-modal models. In Proceedings of the 1st ACM Workshop on Large AI Systems and Models with Privacy and Safely Analysis, pp. 35 35-46, 2023.
27

---

Published in Transactions on Machine Learning Research (03/2026)
Matt Fredrikson, Somesh Jha, and Thomas Ristenpart. Model inversion attacks that exploit confidence information and basic counterneasures. In Proceedings of the 22nd ACM STGSAC conference compuler and commumications security, pp. 1322 1333, 2015.
Xiaohan Fu, Zihan Wang, Shuheng Li, Rajesh K. Gupta, Niloofar Mireshghallah, Taylor King-Kirkpatrick, and Earlence Fernandes. Misusing tools large language models with visual adversarial examples, 2023. URL httpp////axiiv.oraaab/////////
Yansong Gao, Chang Xu, Derui Wang, Shiping Chen, Damith C. Ranasinghe, and Surya Nepal. Strip: A defence against trojan attacks on deep neural networks. In Proceedings of the Annual Computer Security Applications Conference (ACSAC), pp. 113-125, 2019.
Jiahui Geng, Thy Thy Tran, Preslav Nakov, and Iryna Gurevych. Con instruction: Universal jailbreaking of multimodal large language models via non-textual modalities, 2025. URL https:///axiv.... http:/awwvv.or/r/eee/// org/abs/
2506. 005448
Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via lypographic visual prompls, 2025. URL
http:://axxiv..r///a// /atp//2......aa 211.21131...11111.1 05608
Tan J Goodfellow. Intriguing properties of neural networks. arXiv preprint arXiv, 1312:6199, 2014.
Tan J Goodfellow, Jonathon Shlens, and Christian Szegody. Explaining and harnessing adversarial examples. arViv preprint 1rXi6:1412.6572, 2014.
Tianyu Gu, Brendan Dolan- and Siddharth Garg. Badnets: Identifying vulnerabilities in the machine learning model supply chain. arXiv preprinl Xiv: NKKv:100.0000 007306733, 2017.
Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. Agent smith: A single image can jailbreak one million multimodal Ilm agents exponentially fast, 2024.
URL http://aaxvvv...gabbbb. wttp/o/////..o/.////.
Xingshuo Han, Yutong Wu, Qingiie Zhang, Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, and Tianwei Zhang. Backdooring multimodal learning. In 2024 IEEE Symposium on Security and Privacy (SP), pp. 3385-3403. IEEE, 2024.
Shuyang Hao, Bryan Hooi, Jun Liu, Kai-Wei Chang, Zi Huang, and Yujun Cai. Exploring visual vul- ncrabilities via multi-loss adversarial search for jailbreaking vision-language models, 2024. URL https:
//axxiv.. ceeriii.rrg/bbee http///b///111111
Guanyu Hou, Jiaming He, Yinhang Zhou, Ji Guo, Yitong Qiao, Rui Zhang, and Wenbo Jiang. Evaluating robustness of large audio language models to audio injection: An empirical study, 2025. URL https:
Haitao Hu, Peng Chen, Yanpeng Zhao, and Yugi Chen. Agentsentinel: An end-to-end and real-time security defense framework for computer-use agents, 2025a. URL https: ortp:////rrg/aa///000../// 07764
Wenbo Hu, Shishen Gu, Youze Wang, and Richang Hong. Videojail: Exploiting video-modality vulnera- bilities for jailbreak attacks on multimodal large language models. In JCLR 2025 Workshop on Building Trust in Language Models and Applications, 2025b.
Linhao Huang, Xue Jiang, Zhiqiang Wang, Wentao Mo, Xi Xiao, Bo Han, Yongjie Yin, and Feng Zheng, image-based multimodal models as intruders: Transferable multimodal attacks on video-basee based milms, 2025a. URL https: /ttpiv.ivvvv.///////ee./ea.aa www.wawww.ww......ee.erw org/abs/ /ttp//25110000.0
Zhenyu Huang, Yifan Zhang, Yang Liu, Xiaoyuan Wang, and Bo Li. Medical mllm vulnerable: Cross- modality jailbreak and mismatched attacks on medical multimodal large language models. In Proceedings of the AAAI Conference Artificial Intelligence. AAAT Press, 2025b.
28

---

Published in Transactions on Machine Learning Research (03/2026)
Noor Hussein, Fahad Shamshad, Muzammal Nascer, and Karthik Nandakumar. Promptsmooth: Certifying robustness of medical vision-language models via prompt. learning, 2024. URL https://arxiv..rrg abs/
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International conference on machine learning, pp. 2137-2146. PMLR, 2018.
Dennis Jacob, Hend Alzahrani, Zhanhao Hu, Basel Alomair, and David Wagner. Promptshield: Deployable detection for prompt injection attacks, 2025. URL htttps://aaiiiii http://axii..oor/aa///5555/ wtgg/ba////00..o.. 15145
Joonhyun Jeong, Seyun Bae, Yeonsung Jung, Jaeryong Hwang, and Eunho Yang. Playing the fool: Jail- breaking iims and multimodal Ilms with out-of- distribbbtnn strategy, 2025. URL https://arxiv.org abs/2503. 20823
Subaru Kimura, Ryota Tanaka, Shumpei Miyawaki, Jun Suzuki, and Keisuke Sakaguchi. Empirical analysis of large vision-language models against goal hijacking via visual prompt injection, 2024. URL https: //arxiv. abs/ 04554
Alexey Kurakin, Tan J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safety and security, pp. 99 112. Chapman and Hall/CRC, 2018.
Seyong Lee, Jaebcom Kim, and Wooguil Pak. Mind mapping prompt injection: Visual prompt injection
attacks in modern large language models. Electronics, 14(10), 2025. ISSN 2079-9292. doi: 10.3390/
URL https://www wwwp..mppi.... ctmpi..com2007/ 2ttm//0079999921//11/////1/
Chongxin Li, Hanzhang Wang, editor "Christoodollpoolls Christos Fang, Yuchun"", Tanmoy Chakraborty, Carolyn Rose, and Violet Peng. Attack as defense: Safeguarding large vision-language models from jailbreaking by adversarial attacks. In Findings of the Association for Computational Linguistics: EMNLP 2025, pp. putational Linguistics. ISBN 979-8-89176-335-7 https://acllntthollgg/ www.ggg...gg//geo
Suzhou, China, November 2025a. Association for Com- doi: 10. 10.18653/v11 http///1/2222/m///// findings-emmlp 1095. URL
org 2025. w.w...findingg. findings wawddingg-eel..110e..
Chunyuan Li, Zhe Gan, Zhengyuan Yang, Jianwei Yang, Linjie Li, Lijuan Wang, and Jianfeng Gao. Multimodal foundation models: From specialists to general-purpose assistants, 2023. URL https:
7/arxiv. wwexiiv.org/aa absaabbs/////// 10020
Jinmin Li, Kuofeng Gao, Yang Bai, Jingyun Zhang, Shu-tao Xia, and Yisen Wang. Fmm-attack: A flow-
based multi-modal adversarial attack on video-based 1mms. arXie preprint (tt::2403.150000 2024.
Miles Q. Li and Benjamin C. M. Fung. Sccurity concerns for large language models: A survey, 2025. URL https://arxiv: http:s://aaxiv.or//bbss.e 2505. 18889
Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. Images are achilles' heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models, 2025b. URL https:
//arxiv. wwwrii.oorg//bbee wwt.::.//..a........//// 09772
Jiawei Liang, Siyuan Liang, Aishan Liu, and Xiaochun Cao. Vi-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. International Journal of Computer Vision, pp. 1 20, 2025.
Siyuan Liang, Jiawei Liang, Tianyu Pang, Chao Du, Aishan Liu, Mingli Zhu, Xiaochun Cao, and Dacheng Tao. Revisiting backdoor attacks against large vision- vision-language models from domain shift, 2024. URL
/taps://arxiv... wwwpeii.org//baae argg/bbs/2406.. 18844
Zeyi Liao, Lingbo Mo, Chejian Xu, Mintong Kang, Jiawei Zhang, Chaowei Xiao, Yuan Tian, Bo Li, and Huan Sun. Eia: Envirommental injection attack on generalist web agents for privacy leakage, 2025. URL
https://arxis wrg/abs//4/3///
httpss//aarri.orr//b//////99991 11295
29

---

Published in Transactions on Machine Learning Research (03/2026)
Daizong Liu, Mingyu Yang, Xiaoye Qu, Lichao Sun, Keke Tang, Yao Wan, Mingyu Yang, and Pan Zhou. Pandora's box: Towards building universal attackers against real-world large vision-language models. In Advances in Neural Information Processing Systems, volume 37, 2024a.
Daizong Luu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Yu Cheng, and Wei Hu. A survey of attacks on large vision-language models: Resources, advances, and future trends. ar preprint arXit:2407.07403, 2024b.
Hongyi Liu, Shaochen Zhong, Xintong Sun, Minghao Tian, Mohsen Hariri, Zirui Liu, Ruixiang Tang, Zhimeng Jiang, Jiayi Yuan, Yu-Neng Chuang, Li Li, Soo-Hyun Choi, Rui Chen, Vipin Chaudhary, and Xia Hu. Loratk: Lora once, backdoor everywhere in the share-and-play ecosystem, 2025a. URL
https:/ //axxiv..ixvvvv. org/abs//////oooooooo...ooo. aarg/bbs/4433 2203 2400.00188
Kang Liu, Brendan Davant and Siddharth Garg, tacks on deep neural networks. In Proceedings of the International Symposium on Research in Attacks, Intrusions, and Defenses (RAID), pp. 273 294, 2018.
Defending against backdooring at-
Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. Mm-safetybench: A benchmark for salety evaluation of multimodal large language models, 2024c. URL https://arxiv.org//att 17600.
Yi Liu, Chengjun Cai, Xiaoli Zhang, Xingliang Yuan, and Cong Wang. Arondight: Red leaming large vision language models with auto-generated multi-modal jailbreak prompts, 2024d. URL jtttps://arxv...rg 0/////207110500
Yupei Liu, Yuqi Jia, Rumpeng Geng, Jinyuan Jia, and Neil Zhenqiang Gong. Formalizing and benchmarking prompt injection attacks and defenses, 2025b. URL httpps///arrivv.or//aa/////3 12815
Zhaoyi Liu and Huan Zhang. Stealthy backdoor attack in self-supervised learning vision encoders for large vision language models, 2025. URL http://tt.e..aaaa.voooo////////0 18290.
Jiasen Lu, Dhruv Batra, Devi Parikh, and Stefan Lee. Vilbert: Pretraining task-agnostic visiolinguistic representations for vision-and-languuee lasks. Advances in neural information processing systems, 32, 2019.
Weimin Lyu, Lu Pang, Tengfei Ma, Haibin Ling, and Chao Chen. Trojvim: Backdoor attack against vision language models. In European Conference Computer Vision, pp. 467-483 Springer, 2024.
Weimin Lyu, Jiachen Yao, Saumya Gupta, Lu Pang, Tao Sun, Lingjee Yi, Lijie Hu, Haibin Ling, and Chao Chen. Backdooring vision- laiounlanguuag models with distr--iitt data, 2025. URL https://arxiv. org/ aatpa/sss....///////////aaaaaaaa 01264
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks, 2019. URL https://arxiv wrgg/bss//////6
Ziqi Miao, Yi Ding, Lijun Li, and Jing Shao. Visual cottextual attack: Jailbreaking milms with image-driven context injection, 2023. URL
wttp:/iv.org//b//550000 02844
Ruaridh Mon- Williams, Gen Li, Ran Long, Wenqian Du, and Christopher G. Lucas. Embodied large language models enable robots to complete complex tasks in unpredictable environments. Nat. Mac. Intell., 7(4): 592-601, 2025. URL
A K Nirala, A Joshi, C Hegde, and S Sarkar. Fast certification of vision- language models using incremental randomized smoothing, 2024. URL
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on compuler and communications securily, pp. 506 519, 2017.
Fábio Perez and Ian Ribeiro. Ignore previous prompt: Attack techniques for language models. arXiv preprint arXiv:2211.0955 2022.
30

---

Published in Transactions on Machine Learning Research (03/2026)
Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateck Mittal. Visual adversarial examples jailbreak aligned large language models, 2023. URL https:///aaa org/ abs/2366. 13213
Maan Qraitem, Nazia Tasnim, Piotr Teterwak, Kate Saenko, and Bryan A Plummer. Vision-llms can fool therseelvs with self-generated typographic attacks. arXiv preprint arXiv:2402.0000 00626, 2024.
Maan Qraitem, Piotr Teterwak, Kate Saenko, and Bryan A. Plummer. Web artifact attacks disrupt vision language models, 2025. URL https://arxxvv.rrg/ www./aggggg/aaaa/./ 13652
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748 8763. PmLR, 2021.
Jaechul Roh, Virat Shejwalkar, and Amir Houmansadr. Multilingual and multi-accent jailbreaking of audio llms, 2025. URL https://aaxii/ http:///xxxi.oogaaaaa/ owg/ab// 2500
Christian Schlarmann, Naman Deep Singh, Francesco Croce, and Matthias Hein. Robust CLIP: Unsu- pervised adversarial fine-tuning of vision embeddings for robust large vision-language models. Tn Rus- lan Salakhutdinov, Zico Kolter, Katherine Heller, Adrian Weller, Nuria Oliver, Jonathan Scarlett, and Felix Berkenkamp (cds.), Proceedings of the 41st International Conference on Machine Learning, vol- une 235 of Proceedings of Machine Learning Research, pp. 43685 43704. PMLR, 21-27 Jul 2024. URL https::/ppoceeeeee pttppeeinegnss../m// www.iinnn.........m...m........e mww.mmrrrrrerr www..pprees//vv3 http///255//cclaaaa222.aa html
Reshabh K Sharma, Vinayak Gupta, and Dan Grossman. Defending language models against image- based prompt attacks via user-provided specifications. In 2024 IEEE Security and Privacy Workshops (SPW), pp. 112 131, 2024. doi:
Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jailbreak in pieces: Compositional adversarial attacks multi-modal language models, 2023a. URL https://arxiv. orggabs/////eeooooogggooeeeeeeee ab////00 14539
Erfan Shayegani, Md Abdullah Al Mamun, Yu Fu, Pedram Zaree, Yue Dong, and Nael Abu-Ghazaleh. Survey of vulnerabilities in large language models revealed by adversarial attacks. arXiv preprint arXiv:2310. 10844, 2023b.
Xijia Tao, Shuai Zhong, Lei Li, Qi Liu, and Lingpeng Kong. Imgtrojan: Jailbreaking vision-language models with one image. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 7048-7063. Association for Computational Linguistics, 2025. doi: 10. 11118855112000 waw.l..naal-ooo...30.. URL http:://x.doe ottp////.ooo.oo//..oo// 11111.../11/3/222233 naacl-long.
Ma Teng, Jia Xiaojun, Duan Ranjie, Li Xinfeng, Huang Yihao, Jia Xiaoshuang, Chu Zhixuan, and Ren Wenqi. Heuristic-induced multimodal risk distribution jailbreak attack for multimodal large language models, 2025. URL https:://ta:tt http///arxx....//abbaaaa/a httg//bbs/422..... 2212/422222222 05934
Brandon Tran, Jerry Li, and Aleksander Madry. Spectral signatures in backdoor attacks. In Advances in Neural Information Processing Systems (NewrIPS), volume 31, 2018.
Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Usckoreit, Llion Jones, Aidan N Gomez, Lukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in neural information processing systems, 30, 2017.
Oriol Vinyals, Alexander Toshev, Samy Bengio, and Dumitru Erhan. Show and tell: A neural image caption generator. In Proceedings of the IEEE conference on computer vision and pattern recognétion, pp. 3156- 3164, 2015.
Bolun Wang, Yuanshun Yao, Shawn Shan, Huiying Li, Bimal Viswanath, Haitao Zheng, and Ben Y. Zhao. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. In Proceedings of the IEFE Symposium on Security and Privacy (SBP), pp. 707-723, 2019.
31

---

Published in Transactions on Machine Learning Research (03/2026)
Le Wang, Zonghao Ying. Tianyuan Zhang, Siyuan Liang, Shengshan Hu, Mingchuan Zhang, Aishan Liu, and Xianglong Liu. Manipulating multimodal agents via cross-modal prompt injection, 2025a. URL
https://arxiv.org/aae 2504. 14348
Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against large vision-language models, 2024a. URL https: h /arxiv..vvvvv/////v///a///aaa wwweiii.rrg/aaa org/ arg/abs/2405.
17894
Ruofan Wang, Juncheng Li, Yixu Wang, Bo Wang, Xiaosen Wang, Yan Teng, Yingchun Wang, Xingjun Ma, and Yu-Gang Jiang. Ideator: Jailbreaking and benchmarking large vision-language models using themselves, 2025b. URL lnttps://axxii
htt///bb//21111 00827
Xiaosen Wang. Shaokang Wang, Zhijin Ge, Yuyang Luo, and Shudong Zhang. Attention! your vision language model could be maliciously manipulated, 2025c. URL
Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. Jailbreak large vision-language models through multi-modal linkage, 2025d. URL. https://arzti: /wtpriiii..orvveeeooe abs/2412.0047
Yubo Wang, Chaohu Liu, Yanqiu Qu, Haoyu Cao, Deqiang Jiang, and Linli Xu. Break the visual perception: Adversarial attacks targeting encoded visual tokens of large vision-language models, 2024b. URL https:
//arxiv. abggabbs//410.0 246...669999 06699
Zijun Wang, Haoqin Tu, Jieru Mei, Bingchen Zhao, Yisen Wang, and Cihang Xie. Attngog: Enhancing jailbreaking attacks on lims with attention manipulation. arXiv preprint arXie:2410.00 09040, 2024c.
Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. Jailbroken: How does Ilm safety training fail? Advances in Newral Information Processing Systems, 36:80079 80110, 2023.
Chen Henry Wu, Rishi Shah, Jing Yu Koh, Ruslan Salakhutdinor, Daniel Fried, and Aditi Raghumathan, Dissecting adversarial robustness of multimodal Im agents, 2025. URL
cexxivvooze org/ /a//abb//22200 2406.
12814
Peng Xie, Yequan Bie, Jianda Mao, Yangqiu Song, Yang Wang, Hao Chen, and Kani Chen. Chain of attack: On the robustness of vinion-language models against transfer-based adversarial attacks, 2024. URL https: htwp://.orggab////1111
Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. In Proceedings 2018 Network and Distributed System Security Symposium, NDSS 2018. Internet Society, 2018. doi: 10.14722/ndhe http:/dds.2000 2018.23181.2
URL http:://xx.omm /ti//xxxxoii..o 100/ 14722/ndss 201802011111
Yuancheng Xu, Jiarui Yao, Manli Shu, Yanchao Sun, Zichu Wu, Ning Yu, Tom Goldstein, and Furong Huang. Shadowcast: Stealthy data poisoning attacks against vision-language models, 2024. URL https:
wwwpxiiorrg/bbs////00 06659
Hao Yang, Lizhen Qu, Ehsan Shareghi, and Gholamreza Haffari. Audio is the achilles' heel: Red teaming audio large multimodal models, 2024. URL https: http:///xxxvvvog/aaaa/ htrg/bss/4111 23861
Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Kanghua Mo, and Changyu Dong. Distraction is all you need for multimodal large language model jailbreaking, 2025. URL htg/abs//502.1077
Andrew Yeo and Daeseon Choi. Multimodal prompt injection attacks: Risks and defenses for modern llms, 2025. URL
Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models. Aduances in Neural Information Processing Systems, 36:52936- -22256 2023.
32

---

Published in Transactions on Machine Learning Research (03/2026)
Ziyi Yin, Muchao Ye, Yuanpu Cao, Jiaqi Wang, Aofei Chang, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Shadow-activaten backdoor attacks on multimodal large language models. In Wanxiang Che, Joyce Nabende, Ekaterina Shutova, and Mohammad Taher Pilehvar (eds.), Findings of the Association for Computational Linguistics: ACL 2023, pp. 4808-4829, Vienna, Austria, July 2025. Association for 248. URL https:
Computational Linguisties. ISBN 89166-25--6- doi: 10. 10.18653/v1 /2255// //acllatholooy..or//0055... awd.ingnnnnnn...cc 248/
Zonghao Ying, Aishan Liu, Tianyua Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. Jailbreak vision language models via bi-modal adversarial prompt, 2024. URL htttps://arxiii org.///ivooooooooooooo abs/ 2406.
Zenghui Yuan, Jiawen Shi, Pan Zhou, Neil Zhenqiang Gong, and Lichao Sun. Badtoken: Token-level backdoor attacks to multi-modal large language models, 2025. URL https://aaxiiie hwtpgg/ab//250.... 16023
Chenyang Zhang, Xiaoyu Zhang, Jian Lou, Kai Wu, Zilong Wang, and Xiaofeng Chen. Poisoned- eye: Knowledge poisoning attack on retrieval-angmenned generation based large vision-language
models. In Proceedings of the 42nd International Conference on Machine Learning. volume
267, Vancouver, Canada, 2025a. PMTR. URL hetpgs///aaallccc/craaa//////s/p ICML 2025 (PMLR vol. 267). OpenReview: ht////maa//ssst https://raw.ithhuuusseee www.ggibbbssrootttttttoo.. /ammm//llllcc//2///. hattr//arra//22///maaaaaass///// haanin//ssccc/hhaanga2aaaaagagga
PDF:
Guorning Zhang, Chen Yan, Xiaoyu Ji, Tianchen Zhang, Taimin Zhang, and Wenyuan Xu. Dolphinat- tack: Inaudible voice commands. In Proceedings of the 2017 ACM SIGSAC conference on computer and communications security, pp. 103 117, 2017.
Hanrong Zhang, Jingyuan Huang, Kai Mei, Yifei Yao, Zhenting Wang, Chenlu Zhan, Hongwei Wang, and Yongfeng Zhang. Agent security bench (asb): Formalizing and benchmarking attacks and defenses in llm-based agents, 2025b. URL http::ttp///// //tpsi///axvv.. org abs./410..222222 02644
Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric P. Xing, Laurent El Ghaoui, and Michael I. Jordan. Theoretically principled trade-off between robustness and accuracy, 2019. URL https faaaiivoorg.
1te//9901.08577
Jiaming Zhang, Xingjun Ma, Xin Wang, Lingyu Qiu, Jiaqi Wang, Yu-Gang Jiang, and Jitao Sang. Adver- sarial prompt tuning for vision-language models, 2024. URL
2311.11261
Yanzhe Zhang, Tao Yu, and Diyi Yang. Attacking vision-language computer agents via pop-ups, 2025c. URL 02391
Yudong Zhang, Ruobing Xie, Jiansheng Chen, Xingwu Sun, Zhanhui Kang, and Yu Wang. Qava: Query- agnostic visual attack to large vision-language models, 2025d. Bttps:ttss//aaxit www.aawwvv.r.ooreeeoooeoee www.oogg////a//eeeoooooooeee
11038.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36:54111- 1555111-5418, 2023.
A Survey Methodology
This section outlines the methodology used to identify, select, and analyze the literature for this survey, ensuring both its comprchensiveness and reliability.
A.1 Search Strategy
To identify relevant publications, we conducted a systematic literature scarch using the Semantic Scholar database, selected for its broad coverage of computer science rescarch. Our search employed key terms related to adversarial attacks and multimodal I.I.M's, including large language models and text, vision, audio, and
33

---

Published in Transactions on Machine Learning Research (03/2026)
video modalitics. To ensure relevance to current systems and threat models, we prioritized work published in recent years, while selectively incorporating earlier foundational studies when necessary for context. In addition, we performed targeted searches focusing on audio- based adversarial attacks to ensure adequate coverage of less-represented modalities.
A.2 Inclusion and Exclusion Criteria
We include research works that satisfy all of the following conditions:
Inclusion Criteria
Target Model Scope:
The work studies attacks on MLLMs that:
process two imput modalities (e.g., text, image, audio, video), and
language-moddl-basee reasoning or instruction-folloiing core (c.g., GPT-4V, LLaVA, Gemini, Flamingo, Qwen-VL).
incorporate
The attack evaluated on a multimodal LLM, even if the attack operates single modality (e.g., text-only, vision-only, or audio-only input surfaces). We refer to such atlacks as unimodal atlack surfaces on MLLMs and include them as baseline threats inherited by multimodal systems.
Attack Relevance to MLLMs:
Adversarial Intent: The work presents or analyzes attacks that intentionally induce one or more of the following:
integrity failures (incorrect, misleading, targeted outputs),
safety alignment violations (jailbreaks, policy bypass),
control or authority hijacking (prompt injection, tool misuse, agentic manipulation), or
persistent malicious behavior through training-time data poisoning backdoors.
Attack Stage Coverage: Both inference-time attacks (input, prompt, context, tool, agent manipulation) and training-time atfacks (data poisoning, backdoors, fine-tuning corruption) are included, provided they target multimodal LLM systems.
Scholarly Quality: The work must be peer-reviewed and published a recognized conference or journal venue.
Exclusion Criteria A work is excluded it meets any of the following conditions:
Unimodal Models: Attacks targeting unimodal models only (e-g., text-only LLMs, vision-only classifiers, audio-only ASR systems) without evaluation multimodal LLM.
Non-LLM Multimodal Systems: Works on multimodal systems without language-model-base reasoning or instruction-followingg component, such as:
audio-visual classifiers,
detection or recognition pipelines, or
multimodal perception models without instruction following.
Aon-Adversarial Failures: Studies focusing solely on benign robustness, data bias, calibration, fairness, or generalization without an adversarial threat model, unless explicitly framed as adversarial attacks.
Non-Technical or Opinion Pieces: Editorials, position papers without technical content, blog posts, or anecdotal reports.
Non-Peer-Reviewed Works: Preprints, technical reports, or unpublished manuscripts that have not undergone peer review.
Non-English Language: Only papers published in English included.
34

---

Published in Transactions on Machine Learning Research (03/2026)
A.3
Summary of Adversarial Attacks in the Taxonomy Multimodal Large Language Models
The following table consolidates all papers analyzed and categorized in the proposed laxonomy in Section 3.2.
Table 6: Overview of adversarial attacks on multimodal large language models
Paper
Target Modalities
Atlacker
Impact on Performance
Knowledge
Dong et al.
2023:
Image
Black-box
ASR: Bard 22%, Bing 26%, GPT-4V 45% ERNIE 86%
Qraitem et al. 2024
Image + Text
Black-box
Accuracy drop up to 60%
Liu et al. 2024a
Image Text
Black-box
Semantic similarity score up to 0.879
Cheng et al. 2024
Image + Text
Black-box
Performance drop up to 42% ASR up to 100% (artifact en- sembles)
Qraitem et al.
2025
Image + Text
Black-box
CCoo et al.
2025
Image + Text
Black-box
ASR: 44% (MCQ), 62% (open-ended)
Xie et al. 2024
Image
Black-box
Targeted ASR up 98%
(Shayegani et al.
2023a
Image + Text
Black-box
ASR: 85-87% (image trig- gers)
Zhao et al 2023
Image + Text
Black-box
ASR: High Success Rate
Yin al. 2023
Image + Text
Black-box
ASR up 93.5% (task- dependent)
Teng et 2025
Image + Text
Black-box
ASR: 90% (open-source), 68% (closed-source)
Yang et al.
2021
Audio + Text
Black-box
ASR 70% on harmful queries
Roh et
2025
Audio
Black-box
ASR increase up to +57%
Li et al.
2025b
Image + Text
Black-box
ASR: LLaVA 90%, Gemini 72%
Miao et al. 2025
Image + Text
Black-box
ASR: 85 91% models
Wang et al.
2025d
Image + Text
Black-box
ASR up to 99% across bench- marks
Yang et al.
2025
Image + Text
Black-box
Average ASR 52%; ensemble 74%
Jeong et al.
2025
Image + Text
Black-box
Achieved upto 100% on
LLaVA-1.5 13B
Hou et al.
2025
Audio + Text
Black-box
High Defense Success Rate (3%)
Lee et al. 2025
Image + Text
Black-box
ASR upto 90%
Clusmann et al.
2025
Image + Text
Black-box
ASR 67% (GPT4o) varies by model
(Zhang et al.
2025c
Image + Text
Black-box
86%
Wang et
2025a
Image + Text
Black-box
Increase of upto 30%
Zhang et al.
2025al
Image + Text
Black-box
Poison success rate of upto 92%
Liao et al.
2025
Image + Text
Black-box
Specific PII leakage upto 70%
(Too et al.
2025
Image + Text
Black-box
83.5% for AntiGPT prompt
35

---

Published in Transactions on Machine Learning Research (03/2026)
Paper
Target Modalities
Atlacker
Impact Performance
Knowledge
(Lyu al.
2025)
Image + Text
Black-box
Consistently high
Tiang et al.
2024
Image + Text
Black-box
ASR >97% at 0.2% poisoning
Hu al. 2025b
Video Text
Black-box
Upto 96.5% LLaVA- Videoo- 7B, depends model
Kimura et al.
2024
Image + Text
Black-box
ASR up to 15.80%
Wang et al.
2025b
Image + Text
Black-box
ASR up to 94%
Cheng et al.
2025
Image + Text
Black-box
ASR up to 67.3%
Gong al.
2025
Image + Text
Black-box
Average ASR 82.50%
Liu et al.
2024c
Image + Text
Black-box
ASR up to 72.14%
Liu et al. 2024d)
Image Text
Black-box
ASR up to 84.50%
Huang et al. 2025a
Video + Text
Black-box
ASR. up to 55.48% (MSVD-
QA), ASR up 58.26%
(MSRVTT-QA)
(Ling et 2024
Image + Text
Black box
ASR 97%
Aichberger et al. 2025
Image + Text
Gray-box
Universal Attacks 100%
Liu & Zhang
2025
Image
Gray-box
ASR >99%
(Geng al. 2025)
Image + Audio
Gray-box
ASR up to 86.6%
(Liagg et al.
2025
Image + Text
Gray-box
ASR up to 99.82%
Zhang al.
2017
Audio
Gray-box
ASR almost 100% in ideal conditions
Wang et
2024b
Image + Text
Gray box
ASR up 81.60%
Xu et al.
2024
Image + Text
Gray + Black-
ASR >95% (label flips)
Poison
box
Xu et al. 2024
Image + Text
Gray + Black-
ASR > 95%
box
[T
[iang et al. 2025
Text + Image
Gray Black
ASR up to 99.82%
box
Wann et al. 2025ch
Image
White-box
Jailbreak ASR >88% halluci- nation >98%
Ying et al.
2024
Image Text
White-bux
Average ASR upto 68.17% for MiniGPT4
Yin al.
2025
Image + Text
White-box
ASR upto 100%
Lyu et al, 2024)
Image + Text
White-box
Image captioning around 0.97
Yuan et al. 2025
Image + Text
White-box
ASR up 100% (captioning)
Gu et al.
2024)
Image + Text
White-box
Near-100% infection ASR
Qi
2023
Image + Text
White-box
Jailbreak ASR up to 91%
Wang et al.
2024a
Image + Text
White-box
ASR: 96% (MmnGGPT-4)
Bagdasaryau et al.
2023
Image + Audio
White-box
Not provided
Carlini & Wagner
2018
Audio
White box
ASR almost 100%
[Li et al.
2024
Video
White box
Almost 60% garble rate
Wang et al.
2024ch
Text
White box
ASR up 70.60%
Liu & Zhang
2025
Image + Text
White box
ASR up to 99%
Cui al.
20244
Image
White box
Caption Retrieval Drop 90%
Recall
36

---

Published in Transactions on Machine Learning Research (03/2026)
Paper
Target Modalities
Attacker Knowledge
Impact Performance
(Han et al.
2024
Image
Text +
White box
ASR 96%
+
Audio
Video
Liu et al.
2025a
Text
White box
ASR up to 95.8% 100%
(uu et 2023)
Image + Text
White-box
98%
Huang et al.
2025b
Image + Text
White + Black-
ASR up to 98.5% (transfer)
box
Huang et al.
2025b
Image + Text
White + Black- box
White Box ASR: 82.04%
Black Box ASR: Upto 98.5%
Zhang al.
2025d
Image Text
White + Black- box
Performance drops from 78% to 44.85% for InstructBLIP
Model
Hao et al. 2024
Image + Text
White + Black-
ASR (MiniGPT-4)
to 77.75%
box
Bailey et al.
2024
Image + Text
White + Black- box
ASR > 80%
Wu et al. 2025
Image + Text
White + Black-
ASR. > 67%
box
Bagdasaryan et al.
2024
Image Text +
White Black + Gray box
ASR Bind/ (Md//AdiCCLLP)
99.5% (Image-
+
Audio
Thermal
37


Reviews:
[{"review_id": "laGApOu0Qk", "reviewer": "Reviewer_FnpH", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper discusses the topic of adversarial attacks on multimodal large language models. \nThe primary contribution of this paper is a comprehensive survey that focuses on multimodal settings rather than single-modality models. \nThe paper emphasizes analyzing why adversarial attacks succeed instead of only listing existing attack methods. \nTo support this goal, the paper introduces a modality-agnostic framework for organizing adversarial attacks. \nThis framework classifies attacks along two dimensions: attack vectors and the attacker’s knowledge. \nThe paper provides a clear architectural and mathematical description of multimodal LLMs and identifies potential attack surfaces. \nThe survey shows that many attacks exploit weaknesses in cross-modal fusion and attention mechanisms. \nIt further argues that vulnerabilities in shared embedding spaces are a major factor behind successful multimodal attacks. \nThe paper organizes these weaknesses into a hierarchical vulnerability taxonomy grounded in prior empirical studies.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The submission's main claims appear to be generally supported by accurate, clearly presented evidence.\n\nThe paper is appropriately positioned as a comprehensive survey, and it supports this positioning by describing its survey methodology by grounding the discussion in extensive prior work throughout the Introduction and Sections 2-4.\n\nThe proposed two-dimensional taxonomy is clearly defined in Section 3, and it is visually summarized through Figure 2 and instantiated with representative techniques in Table 1, after which it is applied consistently across the subsequent attack-vector discussions.\nThe claim that many attacks exploit vulnerabilities in cross-modal fusion, attention, and embeddings is supported by a structured vulnerability analysis  in Section 4 and representative examples from the literature.\n\nHowever, some broader conclusions, such as the prevalence of certain modalities or whether cross-modal integration is the most critical vulnerability, rely mainly on qualitative synthesis rather than clear quantitative summaries.\n\nOverall, the evidence appears to be convincing for a survey paper, but some claims would be stronger with clearer quantitative characterization of the surveyed literature.", "audience_yn": "Yes", "audience_explanation": "If I understand correctly, this survey paper presents several new findings. For example, it argues that the primary vulnerability in multimodal large language models lies in cross-modal integration rather than in individual modality encoders. It also shows that diverse adversarial attacks can be systematically categorized within a two-dimensional framework defined by the attack vector and the attacker’s knowledge, providing a unified view of threat mechanisms. In addition, it notes that prior work has disproportionately focused on vision-text models, where white-box, gradient-based perturbations and black-box, prompt-based jailbreaks dominate, while audio, video, and gray-box settings remain relatively underexplored.\n\nThese findings could be valuable for researchers and engineers working on adversarial attacks against LLMs.", "requested_changes": "* Clarify and lightly quantify prevalence claims  \n  The paper makes several claims about the prevalence of specific attack types, modalities, and threat models in the literature, such as the dominance of vision-text attacks and the emphasis on white-box perturbations over black-box jailbreaks. These trends appear plausible and are visually suggested by Figure 2, but the supporting evidence remains largely qualitative. The paper would be stronger if it included a brief quantitative snapshot of the surveyed literature, such as approximate counts or percentages by modality and attack vector, for example, in a table in Section 4.1.\n\n* Better motivate the choice of the two-dimensional taxonomy  \n  The proposed two-dimensional taxonomy, organized by attack vector and attacker knowledge, is clear and easy to follow. However, the rationale for choosing these dimensions over alternative organizational schemes remains implicit. The paper would benefit from a short, explicit discussion of why these dimensions are particularly well suited to multimodal LLMs. For example, a brief comparison with modality-based or task-based taxonomies in Section 3 would help clarify the advantages of the proposed framework.\n\n* Align the conclusion on cross-modal integration with the presented evidence  \n  The conclusion states that vulnerabilities in cross-modal integration represent the most critical weakness in multimodal LLMs. This claim is supported by the structured vulnerability analysis in Section 4, but the evidence is primarily qualitative. In my view, the paper could better align the evidence and the claim by refining the wording to emphasize consistency across surveyed studies. For example, framing cross-modal integration as one of the most frequently or systematically exploited vulnerabilities would better match the presented analysis.\n\n* Make the connection between the taxonomy and representative attacks more explicit  \n  The appendix presents a useful catalog of representative attacks. However, the link between these attacks and the proposed taxonomy and vulnerability hierarchy remains implicit. The paper would be clearer if each representative attack were explicitly mapped to its attack vector, attacker knowledge level, and vulnerability category.\n\n\n### ##Minor comments\n\n* Clarify and strengthen the comparison with prior survey work  \n  The Introduction already positions the paper relative to several closely related surveys, but the comparison remains brief and would benefit from a clearer discussion of how the proposed two-dimensional taxonomy and vulnerability-focused perspective differ from, and complement, prior survey work. In addition, the following survey papers could be included, as they do not appear to be cited in the current version, if appropriate:\n\n  - Mao+, \"From LLMs to MLLMs to Agents: A Survey of Emerging Security and Jailbreak Issues\" (2025).\n  - Li+, \"Security Concerns for Large Language Models: A Survey\" (2025).\n  - Yeo+, \"Multimodal Prompt Injection Attacks: Risks and Defenses for Modern LLMs\" (2025).\n  - Wen+, \"Investigating Vulnerabilities and Defenses against Audio-Visual Attacks with an Emphasis on Multimodal Models\" (2025).　(cited but could be discussed more explicitly)\n\n* Make the limitations of the survey more explicit and easier to locate  \n  The paper already acknowledges several limitations of its scope and methodology, including its focus on attack-side analysis and its emphasis on surveyed literature with empirical validation, as discussed in the Conclusion and the survey methodology appendix. \nHowever, the paper would benefit from making them more explicit and easier to find, for example, by briefly consolidating them in a clearly marked section as Limitations.\n\n* More explicitly connect the vulnerability analysis to implications for defense  \n  The paper focuses primarily on attacks, and its taxonomy and vulnerability analysis naturally suggest implications for defense. If I am not missing something, these implications are currently only briefly mentioned in the conclusion. The paper would be strengthened by a brief, structured discussion linking major vulnerability categories, such as fusion-level or embedding-level weaknesses, to corresponding defense directions.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "G8IlBwwGvt", "reviewer": "Reviewer_q24q", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This survey paper provides a comprehensive overview of adversarial attacks on multimodal large language models (LLMs) that process text, images, audio, and video. The main contribution of this survey is a two-dimensional taxonomy that classifies attacks along two axes: (1) the attack vector (i.e., how is the attack performed, e.g. using perturbations, crafting prompts, etc.), and (2) the attacker's knowledge level (white, gray or black-box). The paper also presents a hierarchical framework (Figure 5) that categorizes weaknesses enabling these attacks, from architectural principles to component-level flaws. The survey covers attacks across multiple modalities and provides mathematical formalization of adversarial perturbations in the multimodal context in Section 2.2.\n\nStrenghts:\n\n- The proposed taxonomy offers a clear organization of the attack landscape, facilitating categorization across various model modalities and attack types. The formalization in Section 2.2 also defines the adversarial attack problem for multimodal systems, establishing a common notation that unifies discussion across different attack types. The survey methodology in Appendix A is also well-documented, with clear inclusion/exclusion criteria for related studies.\n\n- The vulnerability analysis in Section 4 provides a useful shift in perspective from documenting attacks to understanding why multimodal systems are susceptible, with the hierarchical vulnerability diagram (Figure 5) providing a taxonomy of weaknesses (e.g., cross-modal interaction vs. architectural) that is often neglected in literature-focused surveys.\n\n- The paper provides good coverage of emerging attack surfaces (audio, video) alongside the more established vision-text domain, acknowledging the asymmetric maturity of research across modalities.\n\nWeaknesses:\n\n- While the paper explicitly claims to provide \"a comprehensive characterization of representative attacks from the literature\" in the Appendix (page 2), the Appendix only contains the survey methodology.\n\n- Section 4 analysis, while conceptually useful, remains at a high level and lacks quantitative evidence or case studies demonstrating how specific vulnerabilities are exploited by specific attacks.\n\n- The discussion of defenses is minimal, relegated to a brief mention in the conclusions. Given the survey's goal of systematically understanding the threat landscape of adversarial, a dedicated section on defense mechanisms and their effectiveness would have been essential to ensure a comprehensive coverage of relevant literature.", "claims_and_evidence_yn": "No", "claims_explanation": "While the paper does provides a modality-agnostic framework for understanding adversarial attacks on multimodal LLMs, some of its claims are not thoroughly supported.\nIn particular, the claim that the paper moves \"from a catalogue of the attacker's actions to an analysis of the system's inherent weaknesses\" is partially supported. While section 4's vulnerability analysis does provide an overview of why attacks succeed, categorizing various types of vulnerabilities, the connection between specific documented attacks and specific vulnerabilities could be made more explicit with concrete examples. Moreover, the claimed comprehensiveness is also questionable: the survey methodology indicates a screening of 500+ papers, but the final reference list contains approximately 80 citations, and the paper does not clearly state how many papers were ultimately included. Some recent notable works in the rapidly evolving field may be underrepresented as a result of this procedure.", "audience_yn": "Yes", "audience_explanation": "This survey addresses a topic of significant and growing importance to the machine learning community. In particular, the deployment of multimodal LLMs in safety-critical applications (autonomous vehicles, healthcare, robotics) creates an urgent need for systematic understanding of their vulnerabilities. Relatedly, the proliferation of multimodal commercial systems like GPT-4o means that adversarial robustness in these domains is no longer a merely academic concern, and could benefit from the conceptual organization provided by the paper taxonomy. The identification of underexplored areas (gray-box attacks, audio/video modalities) is also a valuable contribution to benefit  future research in this area. Overall, these aspect make this work a potentially valuable reference for the community.", "requested_changes": "Critical changes required for acceptance:\n1. The paper promises in Section 1 that \"the Appendix provides a comprehensive characterization of representative attacks from the literature, mapping them to our proposed framework.\" However, Appendix A only contains the survey methodology. The authors must either add the promised attack characterization or revise the claim in the introduction.\n2. Better develop the connections between the attacks discussed in Section 3 and the vulnerabilities catalogued in Section 4. Currently, these sections are somewhat disconnected, with only passing mentions of which methods exploit which vulnerability. A more explicit discussion citing studies that empirically validate this connection would be necessary to provide convincing and clear evidence that the listed vulnerabilities are the primary drivers for the success of respective attacks.\n3. Figure 2 should be significantly revised to accurately reflect the surveyed works. At the moment, bar colors and text \"All knowledge levels\" hold no meaning, and bar width (which is supposed to represent prevalence in the literature, as per the caption) does not vary across the X axis. A correct rendition of the graph should provide accurate numeric information about the prevalence of studies employing these methodologies for each Vector / Knowledge (X / Y) pair.\n4. Add a dedicated section on defense mechanisms, even if brief. The current treatment (one sentence in conclusions) is insufficient for a \"comprehensive survey.\" At minimum, categorize defenses analogously to attacks (e.g., input preprocessing, adversarial training, detection-based) and discuss their effectiveness against different attack vectors.\n\nAdditional changes that would strengthen the paper:\n\n1. Include a quantitative meta-analysis or comparison of attack success rates where available. Table 1 lists representative techniques but provides no sense of their relative effectiveness, transferability, or practical threat level.\n2. Expand coverage of audio-specific attacks and vulnerabilities with more technical depth. Section 3.3.1's audio perturbation discussion is notably shorter than the visual counterpart, and the \"Achilles' Heel\" characterization from Yang et al. (2024) deserves more exploration given its implications. If there is limited work in this area, say so explicitly.\n3. The hierarchical vulnerability diagram (Figure 5) would benefit from citations to specific attacks that exploit each vulnerability node, making it a more actionable reference.", "broader_impact_concerns": "This survey paper raises some broader impact considerations that warrant attention. In particular, by systematically cataloguing attack methods and vulnerabilities, this survey could potentially lower the barrier for malicious actors to attack deployed multimodal systems. While the educational and defensive value of such surveys typically outweighs these risks, the authors should acknowledge this tension and emphasize responsible disclosure practices. Real-world safety implications of these attacks are not thoroughly discussed, despite being the main driver for the urgency of this research area. Finally, as already stated above, the near-total absence of defense discussion means practitioners receive no mitigation guidance. For these reasons, the paper would benefit from a dedicated Broader Impact Statement, acknowledging the value of understanding attacks for building robust systems and the responsibility that comes with publishing detailed attack taxonomies.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "BnGez2WCdv", "reviewer": "Reviewer_gXMn", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a survey on adversarial attacks against multimodal large language models (MLLMs). It categorizes existing adversarial attacks along two dimensions: Attacker Knowledge and Attack Vectors (i.e., what the adversary actually does). The paper provides explanations and examples for each type of attack and appropriately analyzes the vulnerabilities of MLLMs from perspectives such as cross-modal interaction and modality-specific input processing.\n\nThere are some weaknesses, including:\n\n1. The survey does not offer any insightful findings or in-depth discussions.\n\n2. In terms of the number and diversity of papers reviewed, the coverage is insufficient. For each type of adversarial attack, only 12 representative works are selected for illustration, omitting a large body of relevant literature. Below are some recently published papers that were overlooked:\n[1] Zhang et al., “Exploring the transferability of visual prompting for multimodal large language models.”\n[2] Lu et al., “Set-level guidance attack: boosting adversarial transferability of vision-language pre-training models.”\n[3] Wang et al., “Attention! Your Vision Language Model Could Be Maliciously Manipulated”\n[4] Niu et al. “Jailbreaking attack against multimodal large language model”\n[5] Jeong et al. “Playing the Fool: Jailbreaking LLMs and Multimodal LLMs with Out-of-Distribution Strategy”\n[6] Zhao et al. “On evaluating adversarial robust- ness of large vision-language models”\n[7] Wang et al. “White-box multimodal jailbreaks against large vision-language models”\n[8] Sima et al. “VisCRA: A Visual Chain Reasoning Attack for Jailbreaking Multimodal Large Language Models”\n\n3. Regarding the proposed classification dimensions:\n(1) Dimension-1: for Attacker Knowledge, this is a common and generic classification method in the community. The survey merely adopts it without further organizing or analyzing the existing works from this perspective.\n(2) Dimension-2: for Attack Vectors, while proposed as a novel classification dimension, its design is not convincing for the following reasons: (a) The goal of adversarial attacks is to cause model errors, and manipulating the embedding space is merely one technical means to achieve this, not an attack vector per se. Both generation-based and perturbation-based attacks can utilize embedding space as a technical approach. (b) The boundary between prompt-based and perturbation-based attacks is ambiguous. In Section 3.3.1, \"Adversarial Perturbation Based Attacks,\" perturbation is broadly defined as modifications to inputs (image, audio, text, or video). This leads to significant overlap between the two categories. (c) Data poisoning is categorized separately. However, data poisoning is typically a training-phase attack, while adversarial attacks generally refer to inference-phase attacks. The two differ significantly in implementation. Additionally, backdoor attack is a specific form of data poisoning, but the paper appears to conflate these concepts in subsequent explanations.", "claims_and_evidence_yn": "No", "claims_explanation": "1. There is an inconsistency between the paper's title, content, and the \"Inclusion and Exclusion Criteria.\" The title, \"Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Survey,\" defines the survey's scope as adversarial attacks on Multimodal Large Language Models (MLLMs). However, in the main text, when providing key examples of adversarial attacks, it cites papers [1, 2, 3] that are not related to Large Language Models. Furthermore, the provided \"Inclusion and Exclusion Criteria\" limit the selected articles to being \"multimodal\" but do not require them to be related to \"large language models.\"\n[1] Zhang et al. Cross-modal and cross-medium adversarial attack for audio.\n[2] Chen et al. Push-pull: Characterizing the adversarial robustness for audio-visual active speaker detection.\n[3] Du et al. Sirenattack: Generating adversarial audio for end-to-end acoustic systems.\n\n2. The \"Inclusion and Exclusion Criteria\" state that \"Only peer-reviewed papers were included to ensure quality,\" but the article in fact cites multiple non-peer-reviewed papers. For example:\n[1] Zou et al. Universal and transferable adversarial attacks on aligned language models.\n[2] Wang et al. Black-box adversarial attack on vision language models for autonomous driving.\n[3] Guo et al. A grey-box attack against latent diffusion model-based image editing by posterior collapse.\n\n3. The article does not provide a detailed argument, illustrative examples from papers, or comparative experimental data to support the claim that \"the most significant and defining vulnerabilities arise not from weaknesses within individual encoders, but from the fragile and complex process of cross-modal integration.\"", "audience_yn": "No", "audience_explanation": "The number and scope of papers reviewed in this paper are insufficient, the classification criteria are unconvincing, and the proposed claims lack detailed substantiation. Therefore, I do not believe this survey would be particularly helpful to the TMLR audience. Refer to the detailed comments above.", "requested_changes": "1. Align scope and criteria: Strictly limit the survey to MLLMs and remove non-relevant or non-peer-reviewed papers.\n\n2. Revise classification: Redefine the \"Attack Vectors\" dimension to resolve conceptual overlaps and inaccuracies.\n\n3. Expand literature review: Include more and diverse works for each attack category.\n\n4. Substantiate key claim: Provide concrete evidence for the central argument about cross-modal integration vulnerabilities.", "broader_impact_concerns": "No ethical concerns were identified.", "additional_comments": "N.A.", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)