{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T07:06:59Z","timestamp":1789024019809,"version":"build-2803163510"},"publisher-location":"Cham","reference-count":54,"publisher":"Springer Nature Switzerland","isbn-type":[{"value":"9783032372109","type":"print"},{"value":"9783032372116","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-3-032-37211-6_14","type":"book-chapter","created":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T06:36:53Z","timestamp":1789022213000},"page":"240-257","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities"],"prefix":"10.1007","author":[{"given":"Yuan","family":"Xiong","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Ziqi","family":"Miao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lijun","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Chen","family":"Qian","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jie","family":"Li","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Jing","family":"Shao","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,9,11]]},"reference":[{"key":"14_CR1","doi-asserted-by":"crossref","unstructured":"Antol, S., Agrawal, A., Lu, J., Mitchell, M., Batra, D., Zitnick, C.L., Parikh, D.: VQA: Visual question answering. In: Proceedings of the IEEE International Conference on Computer Vision, pp. 2425\u20132433 (2015)","DOI":"10.1109\/ICCV.2015.279"},{"key":"14_CR2","unstructured":"Bai, S., et\u00a0al.: Qwen2.5-vl technical report. arXiv preprint arXiv:2502.13923 (2025)"},{"key":"14_CR3","unstructured":"Bailey, L., Ong, E., Russell, S., Emmons, S.: Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236 (2023)"},{"key":"14_CR4","unstructured":"Bordes, F., et\u00a0al.: An introduction to vision-language modeling. arXiv preprint arXiv:2405.17247 (2024)"},{"issue":"3","key":"14_CR5","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3641289","volume":"15","author":"Y Chang","year":"2024","unstructured":"Chang, Y., et al.: A survey on evaluation of large language models. ACM Trans. Intell. Syst. Technol. 15(3), 1\u201345 (2024)","journal-title":"ACM Trans. Intell. Syst. Technol."},{"key":"14_CR6","doi-asserted-by":"crossref","unstructured":"Chen, Z., et\u00a0al.: Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 24185\u201324198 (2024)","DOI":"10.1109\/CVPR52733.2024.02283"},{"key":"14_CR7","unstructured":"Comanici, G., et al.: Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities arXiv preprint arXiv:2507.06261 (2025)"},{"key":"14_CR8","unstructured":"Ding, Y., Li, L., Cao, B., Shao, J.: Rethinking bottlenecks in safety fine-tuning of vision language models. arXiv preprint arXiv:2501.18533 (2025)"},{"key":"14_CR9","doi-asserted-by":"crossref","unstructured":"Girdhar, R., et al.: Imagebind: One embedding space to bind them all. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 15180\u201315190 (2023)","DOI":"10.1109\/CVPR52729.2023.01457"},{"key":"14_CR10","doi-asserted-by":"crossref","unstructured":"Gong, Y., et al.: Figstep: Jailbreaking large vision-language models via typographic visual prompts. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol.\u00a039, pp. 23951\u201323959 (2025)","DOI":"10.1609\/aaai.v39i22.34568"},{"key":"14_CR11","doi-asserted-by":"crossref","unstructured":"Hu, X., et al.: Scaling up vision-language pre-training for image captioning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 17980\u201317989 (2022)","DOI":"10.1109\/CVPR52688.2022.01745"},{"key":"14_CR12","unstructured":"Hurst, A., et al.: GPT-4o system card. arXiv preprint arXiv:2410.21276 (2024)"},{"key":"14_CR13","unstructured":"Jiang, C., Wang, Z., Dong, M., Gui, J.: Survey of adversarial robustness in multimodal large language models. arXiv preprint arXiv:2503.13962 (2025)"},{"key":"14_CR14","unstructured":"Jin, H., et al.: Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models. arXiv preprint arXiv:2407.01599 (2024)"},{"key":"14_CR15","doi-asserted-by":"crossref","unstructured":"Khan, Z., BG, V.K., Schulter, S., Yu, X., Fu, Y., Chandraker, M.: Q: How to specialize large vision-language models to data-scarce VQA tasks? a: Self-train on unlabeled images! In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 15005\u201315015 (2023)","DOI":"10.1109\/CVPR52729.2023.01441"},{"key":"14_CR16","unstructured":"Lab, S.A., et\u00a0al.: Safework-r1: Coevolving safety and intelligence under the ai-45$$^\\circ $$ law. arXiv preprint arXiv:2507.18576 (2025)"},{"key":"14_CR17","doi-asserted-by":"crossref","unstructured":"Li, J., Vo, D.M., Sugimoto, A., Nakayama, H.: Evcap: retrieval-augmented image captioning with external visual-name memory for open-world comprehension. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 13733\u201313742 (2024)","DOI":"10.1109\/CVPR52733.2024.01303"},{"key":"14_CR18","doi-asserted-by":"crossref","unstructured":"Liu, A., Tang, L., Pan, T., Yin, Y., Wang, B., Yang, A.: Pico: Jailbreaking multimodal large language models via pictorial code contextualization. In: 2025 IEEE International Conference on Multimedia and Expo (ICME), pp. 1\u20136. IEEE (2025)","DOI":"10.1109\/ICME59968.2025.11210045"},{"key":"14_CR19","doi-asserted-by":"crossref","unstructured":"Liu, H., Li, C., Li, Y., Lee, Y.J.: Improved baselines with visual instruction tuning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 26296\u201326306 (2024)","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"14_CR20","unstructured":"Liu, X., Xu, N., Chen, M., Xiao, C.: Autodan: generating stealthy jailbreak prompts on aligned large language models. In: International Conference on Learning Representations, vol. 2024, pp. 56174\u201356194 (2024)"},{"key":"14_CR21","doi-asserted-by":"crossref","unstructured":"Liu, X., Zhu, Y., Gu, J., Lan, Y., Yang, C., Qiao, Y.: Mm-safetybench: a benchmark for safety evaluation of multimodal large language models. In: European Conference on Computer Vision, pp. 386\u2013403. Springer (2024)","DOI":"10.1007\/978-3-031-72992-8_22"},{"key":"14_CR22","unstructured":"Liu, X., et al.: Jailbreak attacks and defenses against multimodal generative models: a survey. arXiv preprint arXiv:2411.09259 (2024)"},{"key":"14_CR23","unstructured":"Ma, S., Luo, W., Wang, Y., Liu, X.: Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character (2024). arXiv preprint arXiv:2405.20773"},{"key":"14_CR24","unstructured":"Miao, Z., Ding, Y., Li, L., Shao, J.: Visual contextual attack: Jailbreaking MLLMs with image-driven context injection. arXiv preprint arXiv:2507.02844 (2025)"},{"key":"14_CR25","unstructured":"Miao, Z., Li, L., Xiong, Y., Liu, Z., Zhu, P., Shao, J.: Response attack: Exploiting contextual priming to jailbreak large language models. arXiv preprint arXiv:2507.05248 (2025)"},{"key":"14_CR26","unstructured":"Niu, Z., Ren, H., Gao, X., Hua, G., Jin, R.: Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309 (2024)"},{"key":"14_CR27","unstructured":"OpenAI: GPT-4V(ision) system card. https:\/\/openai.com\/index\/gpt-4v-system-card\/ (Sept 2023). Accessed 29 June 2026"},{"key":"14_CR28","doi-asserted-by":"crossref","unstructured":"Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., Mittal, P.: Visual adversarial examples jailbreak aligned large language models. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 38, pp. 21527\u201321536 (2024)","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"14_CR29","unstructured":"Qi, X., Zeng, Y., Xie, T., Chen, P.Y., Jia, R., Mittal, P., Henderson, P.: Fine-tuning aligned language models compromises safety, even when users do not intend to. In: International Conference on Learning Representations, vol. 2024, pp. 30988\u201331043 (2024)"},{"key":"14_CR30","doi-asserted-by":"crossref","unstructured":"Rombach, R., Blattmann, A., Lorenz, D., Esser, P., Ommer, B.: High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 10684\u201310695 (2022)","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"14_CR31","unstructured":"Shayegani, E., Dong, Y., Abu-Ghazaleh, N.: Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In: International Conference on Learning Representations, vol. 2024, pp. 30853\u201330885 (2024)"},{"key":"14_CR32","doi-asserted-by":"crossref","unstructured":"Shen, X., Chen, Z., Backes, M., Shen, Y., Zhang, Y.: \" do anything now\": Characterizing and evaluating in-the-wild jailbreak prompts on large language models. In: Proceedings of the 2024 on ACM SIGSAC Conference on Computer and Communications Security, pp. 1671\u20131685 (2024)","DOI":"10.1145\/3658644.3670388"},{"key":"14_CR33","doi-asserted-by":"crossref","unstructured":"Tanaka, R., Nishida, K., Yoshida, S.: Visualmrc: machine reading comprehension on document images. In: Proceedings of the AAAI Conference on Artificial Intelligence, vol. 35, pp. 13878\u201313888 (2021)","DOI":"10.1609\/aaai.v35i15.17635"},{"key":"14_CR34","unstructured":"Team, G., et al.: Gemini: a family of highly capable multimodal models. arXiv preprint arXiv:2312.11805 (2023)"},{"key":"14_CR35","doi-asserted-by":"crossref","unstructured":"Wang, Y., Liu, X., Li, Y., Chen, M., Xiao, C.: Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. In: European Conference on Computer Vision, pp. 77\u201394. Springer (2024)","DOI":"10.1007\/978-3-031-72661-3_5"},{"key":"14_CR36","unstructured":"Wei, H., Sun, Y., Li, Y.: Deepseek-OCR: Contexts optical compression. arXiv preprint arXiv:2510.18234 (2025)"},{"key":"14_CR37","doi-asserted-by":"crossref","unstructured":"Weng, F., Xu, Y., Fu, C., Wang, W.: MMJ-bench: A comprehensive study on jailbreak attacks and defenses for multimodal large language models. arXiv preprint arXiv:2408.08464 (2024)","DOI":"10.1609\/aaai.v39i26.34983"},{"key":"14_CR38","unstructured":"Wu, C., et\u00a0al.: Qwen-image technical report. arXiv preprint arXiv:2508.02324 (2025)"},{"issue":"12","key":"14_CR39","doi-asserted-by":"publisher","first-page":"1486","DOI":"10.1038\/s42256-023-00765-8","volume":"5","author":"Y Xie","year":"2023","unstructured":"Xie, Y.: Defending ChatGPT against jailbreak attack via self-reminders. Nature Mach. Intell. 5(12), 1486\u20131496 (2023)","journal-title":"Nature Mach. Intell."},{"key":"14_CR40","unstructured":"Yang, C., Lu, C., Wang, Y., Zhou, B.: Towards ai-45$$\\circ $$ law: A roadmap to trustworthy AGI. arXiv preprint ArXiv:2412.14186 (2024)"},{"key":"14_CR41","unstructured":"Yi, S., et al.: Jailbreak attacks and defenses against large language models: a survey. arXiv preprint arXiv:2407.04295 (2024)"},{"key":"14_CR42","doi-asserted-by":"crossref","unstructured":"Yin, S., et al.: A survey on multimodal large language models. National Sci. Rev. 11(12), nwae403 (2024)","DOI":"10.1093\/nsr\/nwae403"},{"key":"14_CR43","doi-asserted-by":"crossref","unstructured":"Yu, Z., Ouyang, X., Shao, Z., Wang, M., Yu, J.: Prophet: Prompting large language models with complementary answer heuristics for knowledge-based visual question answering. IEEE Trans. Pattern Anal. Mach. Intell. (2025)","DOI":"10.1109\/TPAMI.2025.3562422"},{"key":"14_CR44","doi-asserted-by":"crossref","unstructured":"Zellers, R., Bisk, Y., Farhadi, A., Choi, Y.: From recognition to cognition: visual commonsense reasoning. In: Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, pp. 6720\u20136731 (2019)","DOI":"10.1109\/CVPR.2019.00688"},{"key":"14_CR45","doi-asserted-by":"crossref","unstructured":"Zhang, H., Li, X., Bing, L.: Video-llama: an instruction-tuned audio-visual language model for video understanding. In: Proceedings of the 2023 Conference on Empirical Methods in Natural Language Processing: System Demonstrations, pp. 543\u2013553 (2023)","DOI":"10.18653\/v1\/2023.emnlp-demo.49"},{"issue":"8","key":"14_CR46","doi-asserted-by":"publisher","first-page":"5625","DOI":"10.1109\/TPAMI.2024.3369699","volume":"46","author":"J Zhang","year":"2024","unstructured":"Zhang, J., Huang, J., Jin, S., Lu, S.: Vision-language models for vision tasks: a survey. IEEE Trans. Pattern Anal. Mach. Intell. 46(8), 5625\u20135644 (2024)","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"14_CR47","doi-asserted-by":"publisher","first-page":"49279","DOI":"10.52202\/079017-1561","volume":"37","author":"Y Zhang","year":"2024","unstructured":"Zhang, Y., et al.: Multitrust: a comprehensive benchmark towards trustworthy multimodal large language models. Adv. Neural. Inf. Process. Syst. 37, 49279\u201349383 (2024)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"14_CR48","doi-asserted-by":"crossref","unstructured":"Zhang, Z., Sun, Z., Zhang, Z., Guo, J., He, X.: Fc-attack: Jailbreaking multimodal large language models via auto-generated flowcharts. arXiv preprint ArXiv:2502.21059 (2025)","DOI":"10.18653\/v1\/2025.findings-emnlp.494"},{"key":"14_CR49","doi-asserted-by":"crossref","unstructured":"Zhao, S., Duan, R., Wang, F., Chen, C., Kang, C., Ruan, S., Tao, J., Chen, Y., Xue, H., Wei, X.: Jailbreaking multimodal large language models via shuffle inconsistency. In: Proceedings of the IEEE\/CVF International Conference on Computer Vision. pp. 2045\u20132054 (2025)","DOI":"10.1109\/ICCV51701.2025.00198"},{"issue":"12","key":"14_CR50","doi-asserted-by":"publisher","first-page":"2012627","DOI":"10.1007\/s11704-026-60308-3","volume":"20","author":"WX Zhao","year":"2026","unstructured":"Zhao, W.X., et al.: A survey of large language models. Front. Comp. Sci. 20(12), 2012627 (2026)","journal-title":"Front. Comp. Sci."},{"key":"14_CR51","doi-asserted-by":"publisher","first-page":"54111","DOI":"10.52202\/075280-2355","volume":"36","author":"Y Zhao","year":"2023","unstructured":"Zhao, Y.: On evaluating adversarial robustness of large vision-language models. Adv. Neural. Inf. Process. Syst. 36, 54111\u201354138 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"14_CR52","doi-asserted-by":"publisher","first-page":"46595","DOI":"10.52202\/075280-2020","volume":"36","author":"L Zheng","year":"2023","unstructured":"Zheng, L., et al.: Judging LLM-as-a-judge with mt-bench and chatbot arena. Adv. Neural. Inf. Process. Syst. 36, 46595\u201346623 (2023)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"14_CR53","unstructured":"Zhu, D., Shen, X., Li, X., Elhoseiny, M.: Minigpt-4: Enhancing vision-language understanding with advanced large language models. In: International Conference on Learning Representations, vol. 2024, pp. 18378\u201318394 (2024)"},{"key":"14_CR54","unstructured":"Zong, Y., Bohdal, O., Yu, T., Yang, Y., Hospedales, T.: Safety fine-tuning at (almost) no cost: A baseline for vision large language models. arXiv preprint arXiv:2402.02207 (2024)"}],"container-title":["Lecture Notes in Computer Science","Computer Vision \u2013 ECCV 2026"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-3-032-37211-6_14","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,9,10]],"date-time":"2026-09-10T06:37:11Z","timestamp":1789022231000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-3-032-37211-6_14"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9783032372109","9783032372116"],"references-count":54,"URL":"https:\/\/doi.org\/10.1007\/978-3-032-37211-6_14","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"11 September 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"ECCV","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"European Conference on Computer Vision","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Malm\u00f6","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Sweden","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2026","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"8 September 2026","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"12 September 2026","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"19","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"eccv2026","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/eccv.ecva.net\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}