mllm-jailbreak-bench: An Adversarial Attack Evaluation Benchmark for Multimodal Large Language Models

mllm-jailbreak-bench is a reproducible benchmark framework for evaluating adversarial attacks on multimodal large language models (MLLMs). It aims to fill the gap in research on multimodal jailbreak attacks, covering five distinct attack categories, and helps researchers and developers systematically assess model security.

With the rapid development of multimodal large language models (MLLMs), their ability to process multimodal inputs such as text and images brings new security challenges—attackers can bypass security mechanisms through cross-modal inputs to induce harmful outputs. Traditional jailbreak attack research focuses on pure text scenarios, while attacks in multimodal scenarios are more complex (e.g., images hiding malicious instructions, text-image combination attacks). Therefore, establishing a systematic evaluation benchmark is crucial.

A jailbreak attack refers to a technical method that bypasses the safety alignment mechanism of an AI model to generate harmful outputs. In text scenarios, it includes:

• Role-playing attack: Letting the model play an unconstrained role
• Encoding obfuscation: Hiding malicious intent using encoding/special formats
• Prompt injection: Inputting instructions to override system prompts
• Multi-turn induction: Guiding the model to deviate from safety guidelines through multi-turn dialogue In multimodal scenarios, new attack methods such as adversarial perturbations embedded in images or hidden text are added.

The framework is designed for comprehensive and reproducible evaluation, covering five attack categories:

1. Pure text jailbreak attack: Traditional text prompt engineering attack
2. Image embedding attack: Images hiding malicious instructions or adversarial perturbations
3. Cross-modal combination attack: Collaborative strategies of text and images
4. Visual misleading attack: Using visual characteristics of images to induce wrong judgments
5. Hybrid modal attack: Complex attacks involving multiple modalities Reproducibility is achieved through standardized testing processes and evaluation metrics, supporting different teams to compare model security performance.

• Researchers: Provides structured evaluation methods, attack classification references, benchmark comparison standards, and helps discover new attack vectors
• Developers: Tests security boundaries before deployment, optimizes defense strategies, and meets compliance requirements
• Industry: Manages security risks of multimodal AI applications and supports safety regulatory needs

• Expanded attack surface: Multimodal inputs increase potential attack vectors, making traditional text filtering mechanisms ineffective
• Increased defense difficulty: Multimodal content is complex, requiring new detection technologies for joint analysis
• Standardization needs: With strengthened AI safety supervision, the industry needs unified evaluation methods

• More fine-grained attack classification
• Dynamic attack generation (AI automatically generates samples)
• Real-time defense mechanisms
• Universal standards for cross-model evaluation

mllm-jailbreak-bench provides a basic tool for multimodal LLM security research. Through systematic attack classification and reproducible evaluation, it helps understand security challenges. Security research should not lag behind the development of AI technology, and this framework is an important step to ensure the safety and controllability of multimodal AI.