Elamur Research⌕
☰
home / papers / 2026 / Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models

Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models

Paper · 2026 · Yulong Wang, Yifei Fu and Jiayi Gao

Summary

The paper presents Reference Attack, a black-box jailbreak technique for multimodal large language models (MLLMs). Red teams can use it to find weaknesses in how these models check content across modalities. Earlier prompt-to-image methods such as FigStep render a harmful request as an image. This attack goes further: it masks the harmful words with placeholder symbols and hides the disguised request among harmless prompts. A chain of pointers then leads the model, step by step, from an innocent-looking text instruction to content stored in a spreadsheet or image. The model reconstructs the hidden request through its own reasoning. Because each piece looks benign, text-focused moderation does not notice the threat. The authors also give an attention-based theoretical argument for limiting chain length.

Tests on four leading MLLMs show success rates above 93% for every model. The attack beats all baselines, by up to 70.8%. The study shows that models do not run safety checks while they resolve references across modalities. It calls for moderation that audits cross-modal interactions.

Key points

  • Models tested: the evaluation covered LLaMA 3.2 from Meta, Anthropic's Claude 3.5 Sonnet, Google's Gemini 2.0 Flash, and ChatGPT-4o. The attack success rate (ASR) was above 93% on all four, with a maximum improvement of 70.8% over state-of-the-art baselines.
  • Three-stage pipeline:
    • Prompt mixing: harmful terms are replaced with symbols and the request is shuffled among benign prompts.
    • Reference construction: a chain of pointers is built, including a mapping from the symbols back to the original words.
    • Non-text modality conversion: everything except the first item is moved into a spreadsheet, or into an image if spreadsheets are not supported.
  • Ablation: a text-only version of the reference chain reached 59.4% ASR. The image-based version with the same chain length reached 75.2%. This suggests that multi-step reasoning and visual encoding reinforce each other.
  • Risk assessment: harmful outputs were scored on six societal-risk dimensions (IVC, ESI, SND, EHIB, ETAS, NDC). Reference Attack had the highest scores, especially for EHIB and ETAS.
  • Ethics and defenses:
    • The authors notified OpenAI, Google, Anthropic and Meta before publication.
    • Code will be shared only with verified researchers.
    • The appendix sketches defenses such as cross-modal consistency checks and limits on reference-chain length.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓Beijing University of Posts and TelecommunicationsBeijing · China57 works · 32,843 citations

 Fields, topics and concepts

📚 Shelves 2The field of science this work belongs to (OpenAlex fields).Computer Science · 16,667 worksArtificial Intelligence · 16,194 works

🧭 Topics 3Research subjects and languages the work is about.Language models & pretraining · 3,320 worksVision & language · 657 worksBias, fairness & safety · 517 works

Cite

Cite as Yulong Wang, Yifei Fu and Jiayi Gao. 2026. Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.812

@inproceedings{wang2026reference,
  title = {{Reference Attack: A New Cross-Modal Jailbreaking Attack against Multimodal Large Language Models}},
  author = {Yulong Wang, Yifei Fu and Jiayi Gao},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.812},
  url = {https://doi.org/10.18653/v1/2026.acl-long.812}
}

References

28 references, 9 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Anthropic. 2025. Usage policy - anthropic. Accessed: 2026-01-04. find
  2. Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Altman, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, and 1 others. 2021. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258.
  3. Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security,…
  4. Sébastien Bubeck, Varun Chandrasekaran, Ronen Eldan, Johannes Gehrke, Eric Horvitz, Ece Kamar, Peter Lee, Yin Tat Lee, Yuanzhi Li, Scott Lundberg, and 1 others. 2023. Sparks of artificial general intelligence: Early experiments with GPT-4. arXiv preprint arXiv:2303.12712.
  5. Tianle Gu, Zeyang Zhou, Kexin Huang, Dandan Liang, Yixu Wang, Haiquan Zhao, Yuanqi Yao, Xingge Qiao, Keqing Wang, Yujiu Yang, Yan Teng, Yu Qiao, and Yingchun Wang. 2024. Mllmguard: A multidimensional safety evaluation suite for multimodal large language models. In Advances in Neural Information Proc… find
  6. Yupeng Chang, Xu Wang, Jindong Wang, Yuan Wu, Linyi Yang, Kaijie Zhu, Hao Chen, Xiaoyuan Yi, Cunxiang Wang, Yidong Wang, Wei Ye, Yue Zhang, Yi Chang, Philip S. Yu, Qiang Yang, and Xing Xie. 2024. A survey on evaluation of large language models. ACM Trans. Intell. Syst. Technol., 15(3).
  7. Dongchen Han, Xiaojun Jia, Yang Bai, Jindong Gu, Yang Liu, and Xiaochun Cao. 2023. Ot-attack: Enhancing adversarial transferability of vision-language models via optimal transport optimization. arXiv preprint arXiv:2312.04403. — [arXiv:2312.04403](https://arxiv.org/abs/2312.04403) find
  8. Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. 2023. Rethinking model ensemble in transfer-based adversarial attacks. arXiv preprint arXiv:2303.09105. — [arXiv:2303.09105](https://arxiv.org/abs/2303.09105) find
  9. Zhaorun Chen, Zhen Xiang, Chaowei Xiao, Dawn Song, and Bo Li. 2024. Agentpoison: Red-teaming llm agents via poisoning memory or knowledge bases. In Advances in Neural Information Processing Systems, volume 37, pages 130185–130213. Curran Associates, Inc. find
  10. Badhan Chandra Das, M. Hadi Amini, and Yanzhao Wu. 2025. Security and privacy challenges of large language models: A survey. ACM Comput. Surv., 57(6).
  11. Mingkai Deng, Jianyu Wang, Cheng-Ping Hsieh, Yihan Wang, Han Guo, Tianmin Shu, Meng Song, Eric P Xing, and Zhiting Hu. 2022. Rlprompt: Optimizing discrete text prompts with reinforcement learning. arXiv preprint arXiv:2205.12548.
  12. Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. 2023. How robust is Google’s Bard to adversarial image attacks? arXiv preprint arXiv:2309.11751. — [arXiv:2309.11751](https://arxiv.org/abs/2309.11751) find
  13. Tiansheng Huang, Sihao Hu, Fatih Ilhan, Selim Furkan Tekin, and Ling Liu. 2024. Lisa: Lazy safety alignment for large language models against harmful fine-tuning attack. In Advances in Neural Information Processing Systems, volume 37, pages 104521– 104555. Curran Associates, Inc. find
  14. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2025. MM-SafetyBench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. Springer. find
  15. Xin Liu, Yichen Zhu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024. Safety of multimodal large language models on images and texts. arXiv preprint arXiv:2402.00357. — [arXiv:2402.00357](https://arxiv.org/abs/2402.00357) find
  16. Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. 2023. Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 102–111. find
  17. Siyuan Ma, Weidi Luo, Yu Wang, Xiaogeng Liu, Muhao Chen, Bo Li, and Chaowei Xiao. 2024. Visual-RolePlay: Universal jailbreak attack on multimodal large language models via role-playing image char-acte. arXiv preprint arXiv:2405.20773. — [arXiv:2405.20773](https://arxiv.org/abs/2405.20773) find
  18. Meta. 2025. Llama 3 - acceptable use policy - meta AI. Accessed: 2026-01-04. find
  19. David A Noever and Samantha E Miller Noever. 2021. Reading isn’t believing: Adversarial attacks on multimodal neurons. arXiv preprint arXiv:2103.10480. — [arXiv:2103.10480](https://arxiv.org/abs/2103.10480) find
  20. OpenAI. 2025. Usage policies - OpenAI. Accessed: 2026-01-04. find
  21. Sheng Yun Peng, Pin-Yu Chen, Matthew Hull, and Duen Horng Chau. 2024. Navigating the safety landscape: Measuring risks in finetuning large language models. In Advances in Neural Information Processing Systems, volume 37, pages 95692–95715. Curran Associates, Inc. find
  22. Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and 1 others. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748–8…
  23. Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In The Twelfth International Conference on Learning Representations. find
  24. Roman Vershynin. 2018. High-Dimensional Probability: An Introduction with Applications in Data Science. Cambridge Series in Statistical and Probabilistic Mathematics. Cambridge University Press. find
  25. Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail? In Advances in Neural Information Processing Systems, volume 36, pages 80079–80110. Curran Associates, Inc.
  26. Laura Weidinger, John Mellor, Maribeth Rauh, Conor Griffin, Jonathan Uesato, Po-Sen Huang, Myra Cheng, Mia Glaese, Borja Balle, Atoosa Kasirzadeh, and 1 others. 2021. Ethical and social risks of harm from language models. arXiv preprint arXiv:2112.04359.
  27. Zonghao Ying, Aishan Liu, Xianglong Liu, and Dacheng Tao. 2024. Unveiling the safety of GPT-4o: An empirical study using jailbreak attacks. arXiv preprint arXiv:2406.06302. — [arXiv:2406.06302](https://arxiv.org/abs/2406.06302) find
  28. Jiaming Zhang, Qi Yi, and Jitao Sang. 2022. Towards adversarial attack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pages 5005–5013. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/wang-2026-reference-attack-new-cross-modal/