<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="lu-etal-2026-maviq">
    <titleInfo>
        <title>MAViQ: Memory-Augmented Visual Querying for Multi-Turn MLLM Jailbreaks</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">JinYun</namePart>
        <namePart type="family">Lu</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Xiaodan</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Guanghao</namePart>
        <namePart type="family">Zhou</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Cen</namePart>
        <namePart type="family">Chen</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">YueFeng</namePart>
        <namePart type="family">Chen</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-459-0</identifier>
    </relatedItem>
    <abstract>Jailbreaks against multimodal large language models (MLLMs) typically operate through image-text inputs. After each target response, the attacker must decide how the new feedback should shape the next image-text query: which clues should be stated in the text, which should appear as visual evidence, and how the text should refer to the image.Existing multimodal attacks typically rely on fixed image-text pairs or candidate search, limiting their ability to adapt across turns.Text-only multi-turn attacks can adapt to prior responses, but they do not decide how response-derived clues should be expressed across image and text.In this paper, we formulate this missing step as trace-to-query realization and propose \underlineMemory-\underlineAugmented \underlineVisual \underlineQuerying (MAViQ), a black-box framework that converts response-derived clues into visual and textual constraints, refines the query after observing the generated image, and propagates feedback to subsequent turns.Extensive experiments on two benchmarks across six target MLLMs show that MAViQ achieves average attack success rates (ASRs) of 70.60% on MM-SafetyBench and 82.13% on JailbreakV-mini, outperforming the strongest baseline by 5.90% and 8.32%, respectively. Our code is available at https://github.com/jixingtian/Maviq.</abstract>
    <identifier type="citekey">lu-etal-2026-maviq</identifier>
    <location>
        <url>https://aclanthology.org/2026.emnlp-main.1097/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>25170</start>
            <end>25188</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T MAViQ: Memory-Augmented Visual Querying for Multi-Turn MLLM Jailbreaks
%A Lu, JinYun
%A Li, Xiaodan
%A Zhou, Guanghao
%A Chen, Cen
%A Chen, YueFeng
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-459-0
%F lu-etal-2026-maviq
%X Jailbreaks against multimodal large language models (MLLMs) typically operate through image-text inputs. After each target response, the attacker must decide how the new feedback should shape the next image-text query: which clues should be stated in the text, which should appear as visual evidence, and how the text should refer to the image.Existing multimodal attacks typically rely on fixed image-text pairs or candidate search, limiting their ability to adapt across turns.Text-only multi-turn attacks can adapt to prior responses, but they do not decide how response-derived clues should be expressed across image and text.In this paper, we formulate this missing step as trace-to-query realization and propose \underlineMemory-\underlineAugmented \underlineVisual \underlineQuerying (MAViQ), a black-box framework that converts response-derived clues into visual and textual constraints, refines the query after observing the generated image, and propagates feedback to subsequent turns.Extensive experiments on two benchmarks across six target MLLMs show that MAViQ achieves average attack success rates (ASRs) of 70.60% on MM-SafetyBench and 82.13% on JailbreakV-mini, outperforming the strongest baseline by 5.90% and 8.32%, respectively. Our code is available at https://github.com/jixingtian/Maviq.
%U https://aclanthology.org/2026.emnlp-main.1097/
%P 25170-25188

Markdown (Informal)

[MAViQ: Memory-Augmented Visual Querying for Multi-Turn MLLM Jailbreaks](https://aclanthology.org/2026.emnlp-main.1097/) (Lu et al., EMNLP 2026)

• MAViQ: Memory-Augmented Visual Querying for Multi-Turn MLLM Jailbreaks (Lu et al., EMNLP 2026)

ACL

• JinYun Lu, Xiaodan Li, Guanghao Zhou, Cen Chen, and YueFeng Chen. 2026. MAViQ: Memory-Augmented Visual Querying for Multi-Turn MLLM Jailbreaks. In Proceedings of the 2026 Conference on Empirical Methods in Natural Language Processing, pages 25170–25188, Budapest, Hungary. Association for Computational Linguistics.