{"id":"https://openalex.org/W7138243560","doi":"https://doi.org/10.1609/aaai.v40i33.40018","title":"TVChain: Leveraging Textual-Visual Prompt Chains for Jailbreaking Large Vision-Language Models","display_name":"TVChain: Leveraging Textual-Visual Prompt Chains for Jailbreaking Large Vision-Language Models","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138243560","doi":"https://doi.org/10.1609/aaai.v40i33.40018"},"language":"en","primary_location":{"id":"doi:10.1609/aaai.v40i33.40018","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i33.40018","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/40018/43979","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://ojs.aaai.org/index.php/AAAI/article/download/40018/43979","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5129710298","display_name":"Hao Yu","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Yu","raw_affiliation_strings":["National University of Defense Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5009525613","display_name":"Ke Liang","orcid":"https://orcid.org/0000-0002-4837-455X"},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Ke Liang","raw_affiliation_strings":["National University of Defense Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129708118","display_name":"Junxian Duan","orcid":null},"institutions":[{"id":"https://openalex.org/I19820366","display_name":"Chinese Academy of Sciences","ror":"https://ror.org/034t30j35","country_code":"CN","type":"government","lineage":["https://openalex.org/I19820366"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Junxian Duan","raw_affiliation_strings":["Institute of automation, Chinese academy of science, Chinese Academy of Sciences"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Institute of automation, Chinese academy of science, Chinese Academy of Sciences","institution_ids":["https://openalex.org/I19820366"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129727263","display_name":"Jun Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Jun Wang","raw_affiliation_strings":["National University of Defense Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology","institution_ids":["https://openalex.org/I170215575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129658195","display_name":"Siwei Wang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Siwei Wang","raw_affiliation_strings":["Intelligent Game and Decision Lab"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Intelligent Game and Decision Lab","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129686504","display_name":"Chuan Ma","orcid":null},"institutions":[{"id":"https://openalex.org/I158842170","display_name":"Chongqing University","ror":"https://ror.org/023rhb549","country_code":"CN","type":"education","lineage":["https://openalex.org/I158842170"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Chuan Ma","raw_affiliation_strings":["Chongqing University"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Chongqing University","institution_ids":["https://openalex.org/I158842170"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5129738958","display_name":"Xinwang Liu","orcid":null},"institutions":[{"id":"https://openalex.org/I170215575","display_name":"National University of Defense Technology","ror":"https://ror.org/05d2yfz11","country_code":"CN","type":"education","lineage":["https://openalex.org/I170215575"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xinwang Liu","raw_affiliation_strings":["National University of Defense Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"National University of Defense Technology","institution_ids":["https://openalex.org/I170215575"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":0.0,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":{"value":0.20480902,"is_in_top_1_percent":false,"is_in_top_10_percent":false},"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"33","first_page":"27943","last_page":"27951"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.701200008392334,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.701200008392334,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.061400000005960464,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12357","display_name":"Digital Media Forensic Detection","score":0.023399999365210533,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.6575999855995178},{"id":"https://openalex.org/keywords/covert","display_name":"Covert","score":0.5946000218391418},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.560699999332428},{"id":"https://openalex.org/keywords/visual-reasoning","display_name":"Visual reasoning","score":0.5367000102996826},{"id":"https://openalex.org/keywords/key","display_name":"Key (lock)","score":0.5070000290870667},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.33160001039505005},{"id":"https://openalex.org/keywords/language-model","display_name":"Language model","score":0.32260000705718994}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7766000032424927},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.6575999855995178},{"id":"https://openalex.org/C2779338814","wikidata":"https://www.wikidata.org/wiki/Q5179285","display_name":"Covert","level":2,"score":0.5946000218391418},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.560699999332428},{"id":"https://openalex.org/C2777508537","wikidata":"https://www.wikidata.org/wiki/Q7936620","display_name":"Visual reasoning","level":2,"score":0.5367000102996826},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.5070000290870667},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4799000024795532},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.33160001039505005},{"id":"https://openalex.org/C137293760","wikidata":"https://www.wikidata.org/wiki/Q3621696","display_name":"Language model","level":2,"score":0.32260000705718994},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.320499986410141},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.3160000145435333},{"id":"https://openalex.org/C184337299","wikidata":"https://www.wikidata.org/wiki/Q1437428","display_name":"Semantics (computer science)","level":2,"score":0.3160000145435333},{"id":"https://openalex.org/C195344581","wikidata":"https://www.wikidata.org/wiki/Q2555318","display_name":"Automated reasoning","level":2,"score":0.3158999979496002},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.29030001163482666},{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.28760001063346863},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.2856999933719635},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.25540000200271606},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.25519999861717224}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1609/aaai.v40i33.40018","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i33.40018","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/40018/43979","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},{"id":"pmh:oai:ojs.aaai.org:article/40018","is_oa":false,"landing_page_url":"https://ojs.aaai.org/index.php/AAAI/article/view/40018","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":"2159-5399","raw_type":"info:eu-repo/semantics/article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i33.40018","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i33.40018","pdf_url":"https://ojs.aaai.org/index.php/AAAI/article/download/40018/43979","source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[{"display_name":"Peace, Justice and strong institutions","id":"https://metadata.un.org/sdg/16","score":0.6826443076133728}],"awards":[{"id":"https://openalex.org/G2455478723","display_name":null,"funder_award_id":"62276271","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G5729763073","display_name":null,"funder_award_id":"62325604","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"},{"id":"https://openalex.org/G6562299470","display_name":null,"funder_award_id":"62441618","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"},{"id":"https://openalex.org/F4320336125","display_name":"National Science Fund for Distinguished Young Scholars","ror":null}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W7138243560.pdf","grobid_xml":"https://content.openalex.org/works/W7138243560.grobid-xml"},"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0,8],"Vision-Language":[1],"Models":[2,10],"(LVLMs)":[3],"enhance":[4],"the":[5,77,98,143,148,165,194],"capabilities":[6,27],"of":[7,76,104,113,127,167,198],"Language":[9],"by":[11],"integrating":[12],"visual":[13,99],"inputs,":[14],"thereby":[15,123],"enabling":[16],"advanced":[17],"multimodal":[18],"reasoning":[19,26,80,102,145],"across":[20,185],"diverse":[21],"applications.":[22],"However,":[23],"these":[24],"enhanced":[25],"introduce":[28],"new":[29],"security":[30],"risks,":[31],"particularly":[32],"to":[33,41,141],"jailbreaking":[34,91],"attacks":[35,58],"that":[36,93,117,159],"bypass":[37],"built-in":[38],"safety":[39,169],"mechanisms":[40,170],"elicit":[42],"harmful":[43],"or":[44],"unauthorized":[45],"outputs.":[46],"While":[47],"recent":[48],"efforts":[49],"have":[50],"explored":[51],"adversarial":[52],"and":[53,73,100,121,182,189,196],"typographic":[54],"prompts,":[55],"most":[56],"existing":[57],"suffer":[59],"from":[60],"three":[61,190],"key":[62],"limitations:":[63],"reliance":[64],"on":[65,177],"auxiliary":[66],"models,":[67],"limited":[68],"effectiveness":[69,195],"in":[70,96,151],"black-box":[71,90],"scenarios,":[72],"inadequate":[74],"exploitation":[75],"LVLMs'":[78],"intrinsic":[79],"abilities.":[81],"In":[82,130],"this":[83,160],"work,":[84],"we":[85],"propose":[86],"TVChain,":[87],"a":[88,111,132,152],"novel":[89],"framework":[92],"explicitly":[94],"intervenes":[95],"both":[97],"textual":[101,137],"processes":[103],"LVLMs.":[105],"TVChain":[106],"decomposes":[107],"malicious":[108],"prompts":[109],"into":[110],"sequence":[112],"semantically":[114],"meaningful":[115],"sub-images":[116],"represent":[118],"relevant":[119],"objects":[120],"behaviors,":[122],"circumventing":[124],"direct":[125],"exposure":[126],"illicit":[128],"content.":[129],"parallel,":[131],"carefully":[133],"designed":[134],"chain-of-thought":[135],"(CoT)":[136],"prompt":[138],"is":[139],"employed":[140],"steer":[142],"model's":[144],"toward":[146],"reconstructing":[147],"intended":[149],"activity":[150],"covert":[153],"yet":[154],"effective":[155],"manner.":[156],"We":[157],"demonstrate":[158],"compositional":[161],"prompting":[162],"strategy":[163],"reduces":[164],"likelihood":[166],"triggering":[168],"while":[171],"preserving":[172],"attack":[173],"efficacy.":[174],"Extensive":[175],"evaluations":[176],"eleven":[178],"LVLMs":[179],"(seven":[180],"open-source":[181],"four":[183],"commercial)":[184],"two":[186],"benchmark":[187],"datasets":[188],"state-of-the-art":[191],"defenses":[192],"validate":[193],"robustness":[197],"TVChain.":[199]},"counts_by_year":[],"updated_date":"2026-07-29T14:22:42.915294","created_date":"2026-03-18T00:00:00"}