Elamur Research⌕
☰
home / papers / 2026 / StructBreak: Structural Cognitive Overload-Induced Safety Failures in MLLMs

StructBreak: Structural Cognitive Overload-Induced Safety Failures in MLLMs

Paper · 2026 · Yang Luo, Liu Xinran, TianTian Ji et al.

Summary

The paper argues that the strong diagram-reasoning skills of multimodal LLMs create a new safety weakness. When a model must work through a dense visual structure, the effort of keeping that structure coherent appears to displace its safety alignment. The authors call this Structural Cognitive Overload (SCO) and connect it to Cognitive Load Theory.

To measure the effect, they built StructBreak, an automated black-box pipeline with two parts:

  • StructBreak-Synth disguises a harmful request with role-play or scenario templates. An LLM Graph Builder then breaks the request into a Visual Knowledge Graph (VKG) image, and a judge-driven feedback loop refines the graph.
  • StructBreak-Eval pairs these images with harmless-looking prompts and scores the responses of target models.

From this pipeline they build a benchmark covering ten threat scenarios and test six frontier MLLMs. Attack success is very high, and the more capable graph reasoners turn out to be more vulnerable. Analyses of attention, latent space and geometry explain the mechanism: safety attention fades, and representations drift away from the model's refusal direction. The authors conclude that current alignment methods do not hold up against structurally complex inputs.

Key points

  • Across six MLLMs, including GPT-5 and Gemini 2.5, StructBreak reaches an average ASR of 92%, with a peak of 97% on Gemini 2.5. It outperforms typographic baselines such as FigStep.
  • The attack requires no access to gradients or logits. The Graph Builder is DeepSeek-R1, and ASR is calculated from a judge model that sorts each response into one of three categories (R, V, A).
  • While parsing a VKG, models give noticeably less attention to the system safety prompt, and their attention spreads more diffusely.
  • In t-SNE plots, StructBreak inputs form a separate out-of-distribution cluster, distinct from both harmful and benign inputs. Their cosine projection onto the refusal vector stays close to zero, for example in layers 20–26 of Qwen2.5-VL.
  • Inference-time defenses such as Intent-First Safety Prompts do not stop the attack. The study covers only 2D flowchart-style VKGs and does not test training-time defenses.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🏛️Chinese Academy of SciencesBeijing · China194 works · 23,906 citations🎓Beijing University of Posts and TelecommunicationsBeijing · China57 works · 32,843 citations🔬Institute of Computing TechnologyBeijing · China51 works · 3,411 citations

 Fields, topics and concepts

📚 Shelves 4The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 worksArts and Humanities · 16,039 worksLanguage and Linguistics · 15,891 works

🧭 Topics 1Research subjects and languages the work is about.Bias, fairness & safety · 517 works

Cite

Cite as Yang Luo, Liu Xinran, TianTian Ji, Zhiyi Yin, Lingyun Peng and Shuyu Li. 2026. StructBreak: Structural Cognitive Overload-Induced Safety Failures in MLLMs. Findings of the Association for Computational Linguistics: ACL 2026.

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.findings-acl.293

@inproceedings{luo2026structbreak,
  title = {{StructBreak: Structural Cognitive Overload-Induced Safety Failures in MLLMs}},
  author = {Yang Luo, Liu Xinran, TianTian Ji, Zhiyi Yin, Lingyun Peng and Shuyu Li},
  booktitle = {Findings of the Association for Computational Linguistics: ACL 2026},
  year = {2026},
  doi = {10.18653/v1/2026.findings-acl.293},
  url = {https://doi.org/10.18653/v1/2026.findings-acl.293}
}

References

46 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2025. Introducing claude 4. Announcement of Claude Opus 4 and Claude Sonnet 4. find
  2. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923. — Qwen2.5-VL Technical Report
  3. Julius Broomfield, George Ingebretsen, Reihaneh Iranmanesh, Sara Pieri, Ethan Kosak-Hine, Tom Gibbs, Reihaneh Rabbany, and Kellin Pelrine. Decompose, recompose, and conquer: Multi-modal llms are vulnerable to compositional adversarial attacks in multi-image queries. In Workshop on Responsibly Buildi… find
  4. Davide Caffagni, Federico Cocchi, Luca Barsellotti, Nicholas Moratelli, Sara Sarto, Lorenzo Baraldi, Marcella Cornia, and Rita Cucchiara. 2024. The revolution of multimodal large language models: a survey. arXiv preprint arXiv:2402.12451.
  5. Hao Cheng, Erjia Xiao, Jindong Gu, Le Yang, Jinhao Duan, Jize Zhang, Jiahang Cao, Kaidi Xu, and Renjing Xu. 2024. Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language models. In European Conference on Computer Vision, pages 179–196. Springer. find
  6. Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistein, Ori Ram, Dan Zhang, Evan Rosen, and 1 others. 2025. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. arX…
  7. Yilin Geng, Haonan Li, Honglin Mu, Xudong Han, Timothy Baldwin, Omri Abend, Eduard Hovy, and Lea Frermann. 2025. Control illusion: The failure of instruction hierarchies in large language models. arXiv preprint arXiv:2502.15851. — [arXiv:2502.15851](https://arxiv.org/abs/2502.15851) find
  8. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959. find
  9. Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. 2024. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. In European Conference on Computer Vision, pages 388–404. Springer. find
  10. Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. 2021. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733.
  11. Daya Guo, Dejian Yang, Haowei Zhang, Junxiao Song, Ruoyu Zhang, Runxin Xu, Qihao Zhu, Shirong Ma, Peiyi Wang, Xiao Bi, and 1 others. 2025. Deepseek-r1: Incentivizing reasoning capability in LLMs via reinforcement learning. arXiv preprint arXiv:2501.12948.
  12. Yerin Hwang, Yongil Kim, Jahyun Koo, Taegwan Kang, Hyunkyung Bae, and Kyomin Jung. 2025. Llms can be easily confused by instructional distractions. arXiv preprint arXiv:2502.04362. find
  13. Joonhyun Jeong, Seyun Bae, Yeonsung Jung, Jaeryong Hwang, and Eunho Yang. 2025. Playing the fool: Jailbreaking llms and multimodal llms with out-of-distribution strategy. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 29937–29946. find
  14. Jiaming Ji, Xinyu Chen, Rui Pan, Han Zhu, Conghui Zhang, Jiahao Li, Donghai Hong, Boyuan Chen, Jiayi Zhou, Kaile Wang, and 1 others. 2025. Safe rlhf-v: Safe reinforcement learning from human feedback in multimodal large language models. arXiv e-prints, pages arXiv–2503. find
  15. Fengqing Jiang, Zhangchen Xu, Luyao Niu, Zhen Xiang, Bhaskar Ramasubramanian, Bo Li, and Radha Poovendran. 2024. Artprompt: Ascii art-based jailbreak attacks against aligned llms. In Proceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), page…
  16. Yilei Jiang, Xinyan Gao, Tianshuo Peng, Yingshui Tan, Xiaoyong Zhu, Bo Zheng, and Xiangyu Yue. 2025. Hiddendetect: Detecting jailbreak attacks against large vision-language models via monitoring hidden states. arXiv preprint arXiv:2502.14744. — [arXiv:2502.14744](https://arxiv.org/abs/2502.14744) find
  17. Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer Vision– ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pag…
  18. Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024a. Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 26296–26306.
  19. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024b. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. Springer. find
  20. Weikai Lu, Hao Peng, Huiping Zhuang, Cen Chen, and Ziqian Zeng. 2025a. Sea: Low-resource safety alignment for multimodal large language models via synthetic embeddings. arXiv preprint arXiv:2502.12562. find
  21. Yida Lu, Jiale Cheng, Zhexin Zhang, Shiyao Cui, Cunxiang Wang, Xiaotao Gu, Yuxiao Dong, Jie Tang, Hongning Wang, and Minlie Huang. 2025b. Longsafety: Evaluating long-context safety of large language models. arXiv preprint arXiv:2502.16971. find
  22. Meta AI. 2024. Meta llama-3.2-11b-vision-instruct: A multimodal vision-language model. Model Card on Hugging Face and official release announcement. https://huggingface.co/meta-llama/ Llama-3.2-11B-Vision-Instruct. ↗
  23. Fei Ni, Jianye Hao, Shiguang Wu, Longxin Kou, Yifu Yuan, Zibin Dong, Jinyi Liu, MingZhi Li, Yuzheng Zhuang, and Yan Zheng. 2024. Peria: Perceive, reason, imagine, act via holistic language and vision planning for manipulation. Advances in Neural Information Processing Systems, 37:17541–17571. find
  24. OpenAI. 2024. Hello gpt-4o. Official announcement of GPT-4o. find
  25. OpenAI. 2025. Introducing gpt-5. Official launch post for GPT-5. find
  26. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536. find
  27. Javier Rando, Hannah Korevaar, Erik Brinkman, Ivan Evtimov, and Florian Tramèr. 2024. Gradient-based jailbreak images for multimodal fusion models. arXiv preprint arXiv:2410.03489. — [arXiv:2410.03489](https://arxiv.org/abs/2410.03489) find
  28. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv preprint arXiv:2307.14539. find
  29. Shubhankar Singh, Purvi Chaurasia, Yerram Varun, Pranshu Pandya, Vatsal Gupta, Vivek Gupta, and Dan Roth. 2024. Flowvqa: Mapping multimodal logic in visual question answering with flowcharts. arXiv preprint arXiv:2406.19237. find
  30. John Sweller. 1988. Cognitive load during problem solving: Effects on learning. Cognitive science, 12(2):257–285. find
  31. Xijia Tao, Shuai Zhong, Lei Li, Qi Liu, and Lingpeng Kong. 2025. Imgtrojan: Jailbreaking vision-language models with one image. In Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long P… find
  32. Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, and 1 others. 2024. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530.
  33. Bibek Upadhayay, Vahid Behzadan, and Amin Karbasi. 2024. Cognitive overload attack: Prompt injection for long context. arXiv preprint arXiv:2410.11272. — [arXiv:2410.11272](https://arxiv.org/abs/2410.11272) find
  34. Siyin Wang, Xingsong Ye, Qinyuan Cheng, Junwen Duan, Shimin Li, Jinlan Fu, Xipeng Qiu, and Xuan-Jing Huang. 2025. Safe inputs but unsafe output: Benchmarking cross-modality safety alignment of large vision-language models. In Findings of the Association for Computational Linguistics: NAACL 2025, pag… find
  35. Yuxin Wen, Neel Jain, John Kirchenbauer, Micah Goldblum, Jonas Geiping, and Tom Goldstein. 2023. Hard prompts made easy: Gradient-based discrete optimization for prompt tuning and discovery. Advances in Neural Information Processing Systems, 36:51008– 51025. find
  36. Nan Xu, Fei Wang, Ben Zhou, Bangzheng Li, Chaowei Xiao, and Muhao Chen. 2024a. Cognitive overload: Jailbreaking large language models with overloaded logical thinking. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3526–3548. persuade llms to jailbreak them: Rethinki… find
  37. Ziyi Zhang, Zhen Sun, Zongmin Zhang, Jihui Guo, and Xinlei He. 2025. Fc-attack: Jailbreaking multimodal large language models via auto-generated flowcharts. arXiv preprint ArXiv:2502.21059. find
  38. Jianli Zhao, Tingchen Fu, Rylan Schaeffer, Mrinank Sharma, and Fazl Barez. 2025. Chain-of-thought hijacking. arXiv preprint arXiv:2510.26418. — [arXiv:2510.26418](https://arxiv.org/abs/2510.26418) find
  39. Erle Zhu, Yadi Liu, Zhe Zhang, Xujun Li, Jin Zhou, Xinjie Yu, Minlie Huang, and Hongning Wang. 2025. Maps: Advancing multi-modal reasoning in expert-level physical science. arXiv preprint arXiv:2501.10768. — [arXiv:2501.10768](https://arxiv.org/abs/2501.10768) find
  40. Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. 2023. Universal and transferable adversarial attacks on aligned language models, 2023. URL https://arxiv.org/abs/2307.15043, 19:3. ↗
  41. Zhengzhuo Xu, Bowen Qu, Yiyan Qi, Sinan Du, Chengjin Xu, Chun Yuan, and Jian Guo. 2024b. Chartmoe: Mixture of diversely aligned expert connector for chart understanding. arXiv preprint arXiv:2409.03277. — [arXiv:2409.03277](https://arxiv.org/abs/2409.03277) find
  42. Yang Yao, Xuan Tong, Ruofan Wang, Yixu Wang, Lu-jundong Li, Liang Liu, Yan Teng, and Yingchun Wang. 2025. A mousetrap: Fooling large reasoning models for jailbreak with chain of iterative chaos. In Findings of the Association for Computational Linguistics: ACL 2025, pages 7837–7855. find
  43. Shukang Yin, Chaoyou Fu, Sirui Zhao, Ke Li, Xing Sun, Tong Xu, and Enhong Chen. 2024. A survey on multimodal large language models. National Science Review, 11(12):nwae403.
  44. Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. 2025. Jailbreak vision language models via bimodal adversarial prompt. IEEE Transactions on Information Forensics and Security. find
  45. Zhiyuan Yu, Xiaogeng Liu, Shunning Liang, Zach Cameron, Chaowei Xiao, and Ning Zhang. 2024. Don’t listen to me: Understanding and exploring jailbreak prompts of large language models. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4675–4692. find
  46. Yi Zeng, Hongpeng Lin, Jingwen Zhang, Diyi Yang, Ruoxi Jia, and Weiyan Shi. 2024. How johnny can find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/luo-2026-structbreak-structural-cognitive-overload-induced/