@inproceedings{xu-etal-2026-dmn,
    title = "{DMN}: A Compositional Framework for Jailbreaking Multimodal {LLM}s with Multi-Image Inputs",
    author = "Xu, Wenzhuo  and
      Wei, Zhipeng  and
      Ying, Zonghao  and
      Zhang, Deyue  and
      Yang, Dongdong  and
      Zhang, Xiangzheng  and
      Zou, Quanchen",
    editor = "Liakata, Maria  and
      Moreira, Viviane P.  and
      Zhang, Jiajun  and
      Jurgens, David",
    booktitle = "Proceedings of the 64th Annual Meeting of the {A}ssociation for {C}omputational {L}inguistics (Volume 1: Long Papers)",
    month = jul,
    year = "2026",
    address = "San Diego, California, United States",
    publisher = "Association for Computational Linguistics",
    url = "https://preview.aclanthology.org/ingest-acl/2026.acl-long.514/",
    pages = "11205--11221",
    ISBN = "979-8-89176-390-6",
    abstract = "Multimodal Large Language Models (MLLMs) are vulnerable to jailbreak attacks, which can elicit harmful responses from MLLMs. Many MLLMs support multi-image inputs, inadvertently introducing new vulnerabilities due to less efforts on multi-image safety alignment. Previous MLLM jailbreak methods only uses a single image, which restricts the attack space: they cannot distribute harmful requests across multiple images, carry abundant information, or exploit additional visual reasoning tasks to distract MLLMs. To address these limitations, in this paper, we propose a compositional jailbreak framework, $\textbf{DMN}$, which leverages $\textbf{D}$istributed instruction, $\textbf{M}$ultimodal evidence and a $\textbf{N}$umber chain task to fully enhance the jailbreak performance. Extensive experiments show that DMN is highly effective for MLLM jailbreaking, e.g. achieving attack success rates of over 90{\%} on GPT-4o, Gemini-2.5-pro and Claude Sonnet 4, surpassing other baselines by a large margin. This compositional, multi-image jailbreak strategy reveals fundamental weaknesses in their safety mechanisms."
}