Elamur Research⌕
☰
home / papers / 2026 / DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs

Paper · 2026 · Wenzhuo Xu, Zhipeng Wei, Zonghao Ying et al.

Summary

Many current multimodal LLMs accept several images in one query, but most safety alignment work has targeted single-image inputs. This paper (ACL 2026, 360 AI Security Lab and collaborators) shows that attackers can exploit this gap in a black-box, single-turn setting. The authors present DMN, an attack framework that combines three groups of images under one guiding text prompt:

  • Distributed instruction: a typographic request is split into one-word, FigStep-style images.
  • Multimodal evidence: an auxiliary LLM and a T2I model produce paired textual and visual "case" materials. Framing generation this way lowers refusals from image generators and makes model answers more detailed.
  • Number chain task: a distractor puzzle in which the model reads digits from frames in a set order.

Across three datasets and 10 MLLMs, DMN outperforms earlier attacks by a wide margin and stays effective against existing defenses. The work matters because it exposes a structural weakness in multi-image safety and motivates dedicated alignment and defense research.

Key points

  • DMN's attack success rate (ASR) exceeds 90% on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4. Other tested models include GPT-5, o3, o4-mini, Qwen3-VL-plus and Seed1.5-VL.
  • The authors cite VideoJail as the only prior multi-image attack. They argue it mostly adds redundant video frames rather than new attack mechanisms.
  • Ablations show that the gains come from the modules themselves, not from simply adding more images. Splitting the instruction across images evades safety checks better than a single image does.
  • Two new metrics, PFIR (task complexity) and KFAR (attention share on distractor frames, measured on Qwen-2.5-VL-7B), indicate that more complex auxiliary tasks distract models more. The number chain task scored highest on both.
  • On SafeBench, placing number chain frames randomly gives an average ASR of 89.32 versus 85.18 when they are placed at the end. For Claude Sonnet 4 the difference is 14.4 points. More evidence pairs raise both ASR and response length.

Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.

 Institutions

🎓University of California, BerkeleyBerkeley · United States209 works · 244,782 citations🔬International Computer Science InstituteBerkeley · United States18 works · 16,605 citations🎓Beihang UniversityBeijing · China86 works · 9,097 citations

 Fields, topics and concepts

📚 Shelves 3The field of science this work belongs to (OpenAlex fields).Computer Science · 18,614 worksArtificial Intelligence · 17,965 worksComputer Vision and Pattern Recognition · 3,486 works

🧭 Topics 2Research subjects and languages the work is about.Language models & pretraining · 3,894 worksVision & language · 811 works

Cite

Cite as Wenzhuo Xu, Zhipeng Wei, Zonghao Ying, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang and Quanchen Zou. 2026. DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work. DOI 10.18653/v1/2026.acl-long.514

@inproceedings{xu2026dmn,
  title = {{DMN: A Compositional Framework for Jailbreaking Multimodal LLMs with Multi-Image Inputs}},
  author = {Wenzhuo Xu, Zhipeng Wei, Zonghao Ying, Deyue Zhang, Dongdong Yang, Xiangzheng Zhang and Quanchen Zou},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.514},
  url = {https://doi.org/10.18653/v1/2026.acl-long.514}
}

References

35 references, 11 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

  1. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. Gpt-4 technical report. arXiv preprint arXiv:2303.08774.
  2. Anthropic. 2025. System card: Claude opus 4 & claude sonnet 4. Technical report, Anthropic. Version published May 22, 2025. find
  3. Shengyuan Ding, Shenxi Wu, Xiangyu Zhao, Yuhang Zang, Haodong Duan, Xiaoyi Dong, Pan Zhang, Yuhang Cao, Dahua Lin, and Jiaqi Wang. 2025. Mm-ifengine: Towards multimodal instruction following. arXiv preprint arXiv:2504.07957. — [arXiv:2504.07957](https://arxiv.org/abs/2504.07957) find
  4. Hang Du, Jiayang Zhang, Guoshun Nan, Wendi Deng, Zhenyan Chen, Chenyang Zhang, Wang Xiao, Shan Huang, Yuqi Pan, Tao Qi, and 1 others. 2025. From easy to hard: The mir benchmark for progressive interleaved multi-image reasoning. In Proceedings of the IEEE/CVF International Conference on Computer Visi… find
  5. Alisa Fortin, Guillaume Vernade, Kat Kampf, and Ammaar Reshi. 2025. Introducing Gemini 2.5 Flash Image, our state-of-the-art image model. https://developers.googleblog.com/ en/introducing-gemini-2-5-flash-image/. ↗
  6. Gemini Team. 2025. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. Preprint, arXiv:2507.06261.
  7. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 39, pages 23951–23959.
  8. Yunhao Gou, Kai Chen, Zhili Liu, Lanqing Hong, Hang Xu, Zhenguo Li, Dit-Yan Yeung, James T Kwok, and Yu Zhang. 2024. Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation. In European Conference on Computer Vision, pages 388–404. Springer. find
  9. Aaron Grattafiori, Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Alex Vaughan, Amy Yang, Angela Fan, Anirudh Goyal, Anthony Hartshorn, Aobo Yang, Archi Mitra, Archie Sravankumar, Artem Korenev, Arthur Hinsvark, and 542 o… — The Llama 3 Herd of Models
  10. Dong Guo, Faming Wu, Feida Zhu, Fuxing Leng, Guang Shi, Haobin Chen, Haoqi Fan, Jian Wang, Jianyu Jiang, Jiawei Wang, Jingji Chen, Jingjia Huang, Kang Lei, Liping Yuan, Lishu Luo, Pengfei Liu, Qinghao Ye, Rui Qian, Shen Yan, and 178 others. 2025. Seed1.5-vl technical report. Preprint, arXiv:2505.070…
  11. Lukas Helff, Felix Friedrich, Manuel Brack, Patrick Schramowski, and Kristian Kersting. 2025. Llavaguard: An open vlm-based framework for safeguarding vision datasets and models. In Proceedings of the 41st International Conference on Machine Learning (ICML). find
  12. Wenbo Hu, Shishen Gu, Youze Wang, and Richang Hong. 2025. Videojail: Exploiting video-modality vulnerabilities for jailbreak attacks on multimodal large language models. In ICLR 2025 Workshop on Building Trust in Language Models and Applications. find
  13. Yukun Jiang, Mingjie Li, Michael Backes, and Yang Zhang. 2025. Adjacent words, divergent intents: Jailbreaking large language models via task concurrency. arXiv preprint arXiv:2510.21189. — [arXiv:2510.21189](https://arxiv.org/abs/2510.21189) find
  14. Yifan Li, Hangyu Guo, Kun Zhou, Wayne Xin Zhao, and Ji-Rong Wen. 2024. Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models. In European Conference on Computer Vision, pages 174–189. Springer. find
  15. Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024a. Mm-safetybench: A benchmark for safety evaluation of multimodal large language models. In European Conference on Computer Vision, pages 386–403. Springer.
  16. Yuan Liu, Haodong Duan, Yuanhan Zhang, Bo Li, Songyang Zhang, Wangbo Zhao, Yike Yuan, Jiaqi Wang, Conghui He, Ziwei Liu, and 1 others. 2024b. Mmbench: Is your multi-modal model an all-around player? In European conference on computer vision, pages 216–233. Springer.
  17. OpenAI. 2023. Gpt-4v(ision) system card. Technical report, OpenAI. Version published on September 25, 2023. find
  18. OpenAI. 2025. Gpt-5 system card. Technical report, OpenAI. Version published August 2025. find
  19. OpenAI. 2025. gpt-image-1: Image generation model (openai api). https://platform.openai.com/ docs/models/gpt-image-1. ↗
  20. OpenAI. 2025. o3 and o4-mini system card. Technical report, OpenAI. Version published April 16, 2025. find
  21. OpenAI, Aaron Hurst, Adam Lerer, Adam P. Goucher, Adam Perelman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, Aleksander M adry, Alex Baker-Whitcomb, Alex Beutel, Alex Borzunov, Alex Carney, Alex Chow, Alex Kirillov, Alex Nichol, and 400 others. 2024. Gpt-4o sys…
  22. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527–21536.
  23. Xiangyu Qi, Yi Zeng, Tinghao Xie, Pin-Yu Chen, Ruoxi Jia, Prateek Mittal, and Peter Henderson. 2023. Fine-tuning aligned language models compromises safety, even when users do not intend to! arXiv preprint arXiv:2310.03693.
  24. Yusu Qian, Hanrong Ye, Jean-Philippe Fauconnier, Peter Grasch, Yinfei Yang, and Zhe Gan. 2025. Mia-bench: Towards better instruction following evaluation of multimodal llms. In The Thirteenth International Conference on Learning Representations. find
  25. Qwen Team. 2025. Qwen3-vl: Sharper vision, deeper thought, broader action. https://qwen.ai/blog?id= 99f0335c4ad9ff6153e517418d48535ab6d8afef& from=research.latest-advancements-list. ↗
  26. Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Durante, Joe Benton, Brando Miranda, Henry Sleight, John Hughes, and 1 others. 2024. Failures to find transferable image jailbreaks between vision-language models. arXiv preprint arXiv:2407.15211. — [arXiv:2407.15211](https://arxiv.org/abs/2407.15211) find
  27. Yu Wang, Xiaogeng Liu, Yu Li, Muhao Chen, and Chaowei Xiao. 2024. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In European Conference on Computer Vision, pages 77–94. Springer. find
  28. Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. 2025. Jailbreak large vision-language models through multi-modal linkage. In Proceedings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1466–1494.
  29. Zhen Xiang, Yi Zeng, Mintong Kang, Chejian Xu, Jiawei Zhang, Zhuowen Yuan, Zhaorun Chen, Chulin Xie, Fengqing Jiang, Minzhou Pan, and 1 others. 2024. find
  30. Clas 2024: The competition for llm and agent safety. In NeurIPS 2024 Competition Track. find
  31. Yueqi Xie, Jingwei Yi, Jiawei Shao, Justin Curl, Lingjuan Lyu, Qifeng Chen, Xing Xie, and Fangzhao Wu. 2023. Defending chatgpt against jailbreak attack via self-reminders. Nature Machine Intelligence, 5(12):1486–1496. find
  32. Nan Xu, Fei Wang, Ben Zhou, Bangzheng Li, Chaowei Xiao, and Muhao Chen. 2024. Cognitive overload: Jailbreaking large language models with overloaded logical thinking. In Findings of the Association for Computational Linguistics: NAACL 2024, pages 3526–3548. find
  33. Wenzhuo Xu, Zhipeng Wei, Xiongtao Sun, Deyue Zhang, Dongdong Yang, Quanchen Zou, and Xiangzheng Zhang. 2025. Utilizing jailbreak probability to attack and safeguard multimodal llms. arXiv preprint arXiv:2503.06989. — [arXiv:2503.06989](https://arxiv.org/abs/2503.06989) find
  34. Zuopeng Yang, Jiluan Fan, Anli Yan, Erdun Gao, Xin Lin, Tao Li, Kanghua Mo, and Changyu Dong. 2025. find
  35. Distraction is all you need for multimodal large language model jailbreaking. In Proceedings of the Computer Vision and Pattern Recognition Conference, pages 9467–9476. find

Updated

↑ back to top

This page in Markdown → https://md.research.elamur.ai/free/en/papers/xu-2026-dmn-compositional-framework-jailbreaking-multimodal/