Phi: Preference Hijacking in Multi-modal Large Language Models at
  Inference Time
Recently, Multimodal Large Language Models (MLLMs) have gained significant
attention across various domains. However, their widespread adoption has also
raised serious safety concerns. In this paper, we uncover a new safety risk of
MLLMs: the output preference of MLLMs can be arbitrarily manipulated by
carefully optimized images. Such attacks often generate contextually relevant
yet biased responses that are neither overtly harmful nor unethical, making
them difficult to detect. Specifically, we introduce a novel method, Preference
Hijacking (Phi), for manipulating the MLLM response preferences using a
preference hijacked image. Our method works at inference time and requires no
model modifications. Additionally, we introduce a universal hijacking
perturbation -- a transferable component that can be embedded into different
images to hijack MLLM responses toward any attacker-specified preferences.
Experimental results across various tasks demonstrate the effectiveness of our
approach. The code for Phi is accessible at https://github.com/Yifan-Lan/Phi.
68cabaa55a7803ff3be42c04
Yifan Lan
claimed_verified
2025-09-17T15:29:11.234Z
677cc30a38114a126d10b6d2
https://cdn-avatars.huggingface.co/v1/production/uploads/no-auth/Izaxu-ihgWADuVfA1ZAH3.png
Yifan Lan
user
yflantmy
68cabaa55a7803ff3be42c05
Yuanpu Cao
68cabaa55a7803ff3be42c06
Weitong Zhang
68cabaa55a7803ff3be42c07
Lu Lin
68cabaa55a7803ff3be42c08
Jinghui Chen
Phi: Preference Hijacking in Multi-modal Large Language Models at
  Inference Time
Recently, Multimodal Large Language Models (MLLMs) have gained significant
attention across various domains. However, their widespread adoption has also
raised serious safety concerns. In this paper, we uncover a new safety risk of
MLLMs: the output preference of MLLMs can be arbitrarily manipulated by
carefully optimized images. Such attacks often generate contextually relevant
yet biased responses that are neither overtly harmful nor unethical, making
them difficult to detect. Specifically, we introduce a novel method, Preference
Hijacking (Phi), for manipulating the MLLM response preferences using a
preference hijacked image. Our method works at inference time and requires no
model modifications. Additionally, we introduce a universal hijacking
perturbation -- a transferable component that can be embedded into different
images to hijack MLLM responses toward any attacker-specified preferences.
Experimental results across various tasks demonstrate the effectiveness of our
approach. The code for Phi is accessible at https://github.com/Yifan-Lan/Phi.
A novel method, Preference Hijacking (Phi), manipulates Multimodal Large Language Model (MLLM) response preferences using specially crafted images, demonstrating significant effectiveness across various tasks.
Multimodal Large Language Models MLLMs Preference Hijacking Phi preference hijacked image universal hijacking perturbation