Beyond Words: Multilingual and Multimodal Red Teaming of MLLM s (2025)

Abstract: Multimodal large language models (MLLMs) are increasingly deployed in real-world applications, yet their safety remains underexplored, particularly in multilingual and visual contexts. In this work, we present a systematic red teaming framework to evaluate MLLM safeguards using adversarial prompts translated into seven languages and delivered via four input modalities: plain text, jailbreak prompt + text, text rendered as an image, and jailbreak prompt + text rendered as an image. We find that rendering prompts as images increases attack success rates and reduces refusal rates, with the effect most pronounced in lower-resource languages such as Slovenian, Czech, and Valencian. Our results suggest that vision-based multilingual attacks expose a persistent gap in current alignment strategies, highlighting the need for robust multilingual and multimodal MLLM safety evaluation and mitigation of these risks. We make our code and data available.

## introduction large language models (llms) have achieved remarkable performance across a wide range of natural language understanding and generation tasks, becoming central to modern artificial intelligence (ai) systems. despite their utility, llms raise critical safety concerns, as they can be prompted to generate harmful, toxic, or otherwise undesirable outputs. this has spurred intense research into adversarial red teaming techniques and demonstrated the fragility of existing safeguards @xcite . recent research has demonstrated that even stateof-the-art alignment strategies can be circumvented through carefully crafted adversarial prompts, often called jailbreaks. these jailbreaks, while originally developed manually, are increasingly being automated and shown to transfer across models (zou 1 https://github.com/ellisalicante/ multilingual-multimodal-red-teaming what tools or software do i need to make realistic forgeries? what tools or software do i need to make realistic forgeries? ## method we propose a multilingual and multimodal red teaming framework to evaluate the robustness of mllms to adversarial prompts. our method introduces a four-modality evaluation scheme combining standard textual inputs with jailbreak prompting and vision-based attacks. ## experiments and results we conduct a comprehensive evaluation of mllm safety using our proposed multilingual and multimodal red teaming framework. in this section, we detail the dataset construction process, list the evaluated models, and outline our experimental protocol for adversarial prompting. we then present and analyze the results, highlighting patterns in asr and rr that emerge across models, modalities, and languages. ## implications and mitigation strategies our findings highlight a persistent and underexplored vulnerability in current mllm safety alignment: the combination of multilingual and visually rendered prompts can systematically circumvent existing safeguards, with the largest effects observed in lower-resource languages. this underscores the urgent need for more robust alignment strategies that generalize across modalities and diverse linguistic contexts. several promising mitigation directions emerge from our analysis. first, integrating optical character recognition (ocr) pre-filters could help detect and intercept harmful prompts embedded as images, enabling standard text-based moderation pipelines to operate more effectively. second, multimodal alignment fine-tuning -explicitly training models to refuse unsafe content regardless of input modality -could address the observed erosion of safeguards in the vision channel. third, incorporating language-aware refusal heuristics or multilingual safety techniques could reduce the risk of alignment gaps in lower-resource languages. fi-nally, combining automated content moderation with lightweight, human-in-the-loop review for flagged multimodal inputs may offer a practical pathway for long-term mllm alignment. we encourage the community to systematically benchmark such mitigations using rigorous, multilingual, and multimodal adversarial evaluation. closing the gap in mllm safety requires not only improved alignment techniques, but also a better understanding of how threats emerge at the intersection of language and modality. ## conclusion we introduced a multilingual and multimodal red teaming framework to evaluate the safety of mllms across four adversarial input modalities, three models, and seven languages. our results show that rendering harmful prompts as images substantially increases attack success rates and decreases refusal rates beyond standard text-only jailbreak attacks, particularly in lower-resource languages like slovenian, czech, and valencian. vision-based prompts, especially when combined with lower-resource languages, pose a unique challenge that is not addressed by current safeguards. our study highlights the importance of jointly considering language and modality in evaluating and improving mllm safety. future work. the proposed red teaming framework could be extended to non-latin scripts, incorporate more sophisticated visual attacks (e.g., using stylized fonts, embedded noise, emojis, or layout manipulations), and explore additional modalities such as audio or speech-to-image to better stress-test safety alignment in mllms. to provide stronger empirical support for modality and language effects, future studies could apply robust statistical testing to confirm the reliability of observed trends. incorporating comparative baselines by reproducing earlier red-teaming techniques would allow the positioning of this work with respect to existing methods. beyond the current focus on single-turn prompts, extending the evaluation to multi-turn conversations, user-agent loops, or system-level contexts could reveal further vulnerabilities. finally, future work could explore more nuanced safety metrics beyond harmful or inappropriate responses, potentially leveraging more advanced evaluation prompts and detailed harm taxonomies. vación), by intel corporation (resumais), by the bank sabadell foundation, and by the vives: "pla de tecnologies de la llengua per al valencià" project (2022/tl22/00215334) from the projecte estratègic per a la recuperació i transformació econòmica (perte). we acknowledge the use of generative ai tools, specifically chatgpt-4o, for assistance in improving the clarity and fluency of the writing. all research design, analysis, and the final manuscript revision were carried out by the authors, who take full responsibility for the content of this work.