From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystem

Abstract

Large language models (LLMs) are rapidly evolving from single-modal systems to multimodal LLMs and intelligent agents, expanding their capabilities while introducing new security risks. This paper presents a systematic survey of the complexity of jailbreak attacks and defense mechanisms within the expanding LLM ecosystem. We first trace the developmental trajectory from LLMs to MLLMs and Agents, highlighting the core security challenges emerging at each stage. Next, we categorize mainstream jailbreak techniques from the attack impact and attacker permissions perspectives, and provide comprehensive analysis of representative attack methods, related datasets, and evaluation metrics. On the defense side, we organize existing strategies based on response timing and technical approach, offering a structured understanding of their implementation. Furthermore, we identify key limitations in existing surveys, such as insufficient attention to agent-specific security issues, absence of a clear taxonomy for hybrid jailbreak methods, lack of detailed analysis of experimental setups, and outdated coverage of recent advancements. To address these limitations, we provide an updated synthesis of recent work and introduce future research directions in areas such as dataset construction, evaluation framework optimization, and strategy generalization. Our study aims to deepen the understanding of jailbreak mechanisms and promote the development of adaptive defenses for LLMs.

The authors' abstract, as published at the source. ACM Transactions on Knowledge Discovery from Data, 2026 · DOI ↗