Pith. sign in

REVIEW 3 major objections 7 minor 130 references

When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs

T0 review · 3 major / 7 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read VLM attacks organize along two independent axes: attack goal and data manipulation, with jailbreak and camouflage as distinct classes.

desk verdict A useful but not fully reliable survey; the jailbreak-camouflage split is the weak joint. read the letter →

arxiv 2502.06390 v2 pith:VT4HCJZJ submitted 2025-02-10 cs.CV

Aobotao Dai , Xinyu Ma , Lei Chen , Songze Li , Lin Wang This is my paper · ORCID
classification cs.CV
keywords vision-languagemodelsadversarialattacksjailbreakcamouflageexploitationtypographydatamanipulationmultimodalsecurity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This survey proposes that attacks on vision-language models (VLMs) are best understood through two independent axes: what the attacker wants, and how the input is altered. On the goal axis it places jailbreak attacks, which coax out logically coherent but safety-blocked content; camouflage attacks, which make the model give logically wrong answers; and exploitation attacks, which inflate inference cost. On the manipulation axis it places visual perturbation, gradient-driven prompts, human-like deceptive prompts, and typography. The paper argues that this two-axis structure fixes omissions and contradictions in earlier surveys, especially by separating jailbreak from camouflage and by adding camouflage and exploitation as explicit goal categories. A reader should care because the taxonomy gives the field a shared language for comparing attacks, pairing them with defenses, and choosing evaluation metrics.

What carries the argument

The load-bearing structure is the two-axis taxonomy, with attack goals (jailbreak, camouflage, exploitation) on one axis and data manipulation strategies (visual perturbation, gradient-driven prompts, human-like deceptive prompts, typography) on the other. The taxonomy does the argument's work: it is the device that turns a scattered literature into a grid, lets each attack be described by a (goal, manipulation) pair, exposes the jailbreak-camouflage distinction, and determines which defense and which evaluation metric fit a given cell. The formal backdrop is a generic VLM model $M = D \circ P \circ E$ with visual and textual encoders, where malicious inputs are benign inputs plus bounded perturbations, and an attack loss combines stealth, utility preservation, and malice terms.

What would settle it

Take a systematic sample of VLM attack papers from the past three years and classify each attack using the survey's two axes. If a non-trivial share of attacks lands in both jailbreak and camouflage, or cannot be placed in any of the four manipulation strategies, the taxonomy's exhaustiveness claim fails; the survey never runs this test, so the observation would settle the matter.

Watch

Extended reading notes

Core claim

The paper's central claim is that the space of VLM attacks is not a flat list but a product of two orthogonal classifications. An attack's goal is one of three: jailbreak (the model produces an answer that satisfies the request but is blocked only by safety defenses), camouflage (the model produces an output that fails the logical or rational requirements of the task), or exploitation (the model spends more time, energy, or tokens than necessary). The method used to reach that goal is one of four: visual perturbation, gradient-driven prompts, human-like deceptive prompts, or typography. The paper argues that prior taxonomies collapsed these two dimensions, which led them to miss the jailbreak-camouflage distinction and to leave camouflage and exploitation as unnamed residuals; its contribution is to name these categories, map representative attacks into the resulting cells, and attach defenses and evaluation metrics to each cell.

Load-bearing premise

The load-bearing premise is that the taxonomy is exhaustive and its categories are mutually exclusive: every real VLM attack fits exactly one attack goal and one data manipulation strategy, with no attack that is simultaneously jailbreak and camouflage and no method outside the four manipulation categories.

Editorial extensions

If this is right

  • Every VLM attack can be labelled by a (goal, manipulation) pair, so future papers can state the cell they work in and compare directly with attacks in the same cell.
  • Jailbreak and camouflage require different defenses: jailbreak defenses must restore safety alignment, while camouflage defenses must restore perceptual or logical correctness, and methods that do one will not automatically do the other.
  • Because typography moves malicious text into the image, text-only filters such as keyword or perplexity filters can be bypassed; defenses must check the visual channel for embedded instructions.
  • Exploitation attacks should be measured by time cost, memory usage, and energy consumption rather than by attack success rate alone, and these metrics belong in any unified attack benchmark.
  • Standardized evaluation would separate attack success rate into goal-specific forms: content harm degree for jailbreak, correctness or consistency for camouflage, and resource overhead for exploitation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper stops short of testing exhaustiveness; a direct extension would be to sample all VLM attack papers in a fixed period and count how many fail to fit one of the three goals or one of the four manipulation strategies.
  • The jailbreak-camouflage boundary is likely to be fuzzy in practice, since an output can be both harmful and logically wrong; the taxonomy would be strengthened by an explicit rule for such dual cases.
  • The two-axis grid suggests where new attacks will appear: for instance, the paper notes chain-of-thought verbosity as a possible exploitation vector, which would occupy the (exploitation, human-like deceptive prompts) cell.
  • If the taxonomy generalizes, it should also organize defenses: one could build a benchmark that reports a defense's score per cell, exposing which goal-manipulation combinations remain undefended.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 7 minor

Summary. The paper surveys attack strategies for vision-language models (VLMs) and proposes a taxonomy based on two axes: attack goals, divided into jailbreak, camouflage, and exploitation, and data manipulation strategies, divided into visual perturbation, gradient-driven prompts, human-like deceptive prompts, and typography. It reviews representative attacks, defense mechanisms, evaluation metrics, and datasets, and maintains a public project page. The central claim is that this two-axis taxonomy reveals connections and distinctions—especially the jailbreak–camouflage distinction—that prior surveys missed.

Significance. If the taxonomy were validated, it would give the VLM-attack community a common descriptive structure and would genuinely extend prior surveys, which the paper documents in Table I. The survey has several concrete strengths: it covers a broad set of representative works in tabular form, pairs attack categories with corresponding defenses, discusses evaluation dimensions (effectiveness, stealthiness, transferability, efficiency) that are often scattered across the literature, and provides a useful entry point for newcomers. The paper also ships a project page that is a practical community resource. However, the taxonomy's load-bearing claims—especially the jailbreak–camouflage distinction and the exhaustiveness/mutual exclusivity of the goal axis—are not established by the manuscript; the definitions are applied inconsistently even to the paper's own examples, and backdoor attacks are left unmapped. The contribution is therefore best viewed as a plausible proposal that needs substantial sharpening rather than a completed classification.

major comments (3)
  1. [Sec. III.B.1-2 and Table VI] The defining contrast between jailbreak and camouflage is not operationalized, and the paper's own lead camouflage example contradicts it. The text states that jailbreak outputs 'typically meet' logical/rational requirements but are blocked by defenses, while camouflage outputs 'do not adhere to the logical and rational requirements' of the problem. Yet BadVLMDriver (Table VI, Sec. III.B.2) induces the victim to 'issue a directive to accelerate instead of coming to a stop' when a pedestrian holds a red balloon. That output is a coherent, goal-directed, harmful instruction, structurally identical to the jailbreak examples in Sec. III.B.1 (e.g., instructions for dangerous behaviors); the only difference is that no safety filter blocks it. The paper needs a principled criterion—for example, whether the output violates a safety policy versus a task-level correctness constraint—or it must explicitly acknowledge that the two categories overlap. Because the jailbreak–camouflage distinction is the paper's claimed novelty, this ambiguity directly undermines the central contribution.
  2. [Sec. II.B vs Sec. III.B] Backdoor attacks are formally introduced as a distinct attack concept with their own objective in Eq. (3), but the goal taxonomy in Sec. III never assigns them a category. Works such as BadCLIP are silently listed under camouflage in Table VI. Since backdoor poisoning is a mechanism that can serve different goals—misclassification (camouflage), harmful-content generation (jailbreak), or cost escalation (exploitation)—the survey should either map backdoor attacks to one of the three goal categories with justification, or explicitly treat backdoor as an orthogonal mechanism outside the goal axis. As written, the goal axis is not shown to be exhaustive even on the paper's own reference set.
  3. [Sec. III.A and Tables V-VII] The paper asserts that its taxonomy provides a 'systematic' classification, but it never tests the proposed categories against a systematic sample of the literature. The tables list representative works selected to fit the framework, and the paper does not state inclusion criteria, report a corpus enumeration, or analyze how many surveyed works fall into each cell of the two-axis matrix. Consequently, the exhaustiveness and mutual exclusivity of both the goal axis and the data-manipulation axis remain unverified. The authors should add a coverage analysis (e.g., a table mapping all surveyed attacks to both axes, with an explicit statement of what is excluded and why) so that the taxonomy's completeness claim is testable.
minor comments (7)
  1. [Sec. III.C.1, Eq. (7)] The loss in Eq. (7) is written as L(M(x_benign ⊙ (1 - m) + δ_img ⊙ m, t_benign) - y_malice); the minus sign before y_malice is presumably a typo and should be L(M(...), y_malice).
  2. [Sec. III.C.2, Eq. (9)] Eq. (9) is missing a closing parenthesis: it reads max cos(E_txt(t_malice), E_txt(t_target) and should be max cos(E_txt(t_malice), E_txt(t_target)).
  3. [Abstract and Sec. I] The project page URL contains a space ('VLM Attack Paper List') and will render as a broken link; it should be 'VLM_Attack_Paper_List' or an equivalent URL-encoded form.
  4. [Table IV] The dataset 'A VIBench' should be 'AVIBench'.
  5. [Fig. 2 and Sec. I] The Google Scholar publication counts in Fig. 2 are not reproducible without knowing the exact search query and retrieval date; please provide these details in the caption or text.
  6. [Sec. I, contributions] The second listed contribution says jailbreak attacks are 'commonly seen in attacks on LVLMs while not in attacks on other VLMs,' but Table V includes MMA-Diffusion, which targets SDXL, and the text discusses jailbreak on diffusion-based models; the claim should be qualified.
  7. [Fig. 4] Fig. 4 refers to 'Section 3.2' and 'Section 3.3,' while the text uses 'Sec. III.B' and 'Sec. III.C'; please unify the cross-referencing style.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the survey proposes a stipulative taxonomy and organizes external published attacks under it; no derivation or prediction reduces to a fitted input or to a self-citation chain.

full rationale

This paper is a survey and taxonomy, not a derivation. Its central claims are classifications: attack goals (jailbreak, camouflage, exploitation) and data manipulation strategies (visual perturbation, gradient-driven prompts, human-like deceptive prompts, typography). These categories are stipulated and then populated with representative works from the literature; the survey does not fit parameters to data, make empirical predictions from fitted values, or invoke a uniqueness theorem. The papers cited for each category are external works, not the authors' own prior results, so there is no load-bearing self-citation chain. The potential weaknesses readers might see, such as the taxonomy's completeness or the consistency of the jailbreak/camouflage distinction, are scope and correctness concerns rather than circularity: an inconsistent example does not make the taxonomy's output equivalent to its input by construction. Similarly, the loss decomposition in Eq. 4 and the backdoor objective in Eq. 3 are summaries of existing formulations, not self-referential reductions. Therefore, no specific circular step can be exhibited, and the appropriate finding is no circularity (score 0).

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The survey introduces no new mathematical objects or entities. Its load-bearing assumptions are about the completeness and exclusivity of its taxonomy categories, and about a generic VLM architecture that underpins the formal attack definitions in Section II. These are domain assumptions about how to organize the literature, not about the physical world.

assumptions (3)
  • domain assumption The three attack goals (jailbreak, camouflage, exploitation) are exhaustive and mutually exclusive.
    Used throughout Section III.B to divide the attack literature into three buckets; no empirical or logical proof is given that all attacks fall into exactly one bucket.
  • domain assumption The four data manipulation strategies (visual perturbation, gradient-driven prompts, human-like deceptive prompts, typography) are exhaustive.
    Used in Section III.C to structure the method-level review; the paper does not demonstrate that these four categories cover all published VLM attack methods.
  • domain assumption A VLM can be decomposed as M = D ∘ P ∘ E with separate image and text encoders.
    Stated in Section II.A as the general problem formulation; it does not hold for all models in Table III, e.g., black-box GPT-4V where the architecture is unknown, yet the formulation is used to define attack objectives.

how reviews work

0 comments
Cite this review

Pith. "Pith review of When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs." pith.science (2026). https://pith.science/paper/VT4HCJZJ

@misc{pith2026250206390,
  author       = {Pith},
  title        = {Pith review of: When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/VT4HCJZJ}},
  note         = {Machine review of arXiv:2502.06390}
}
read the original abstract

Vision-Language Models (VLMs) have gained considerable prominence in recent years due to their remarkable capability to effectively integrate and process both textual and visual information. This integration has significantly enhanced performance across a diverse spectrum of applications, such as scene perception and robotics. However, the deployment of VLMs has also given rise to critical safety and security concerns, necessitating extensive research to assess the potential vulnerabilities these VLM systems may harbor. In this work, we present an in-depth survey of the attack strategies tailored for VLMs. We categorize these attacks based on their underlying objectives - namely jailbreak, camouflage, and exploitation - while also detailing the various methodologies employed for data manipulation of VLMs. Meanwhile, we outline corresponding defense mechanisms that have been proposed to mitigate these vulnerabilities. By discerning key connections and distinctions among the diverse types of attacks, we propose a compelling taxonomy for VLM attacks. Moreover, we summarize the evaluation metrics that comprehensively describe the characteristics and impact of different attacks on VLMs. Finally, we conclude with a discussion of promising future research directions that could further enhance the robustness and safety of VLMs, emphasizing the importance of ongoing exploration in this critical area of study. To facilitate community engagement, we maintain an up-to-date project page, accessible at: https://github.com/AobtDai/VLM_Attack_Paper_List.

Figures

Figures reproduced from arXiv: 2502.06390 by the authors.

Figure 1
Figure 1. Illustration of attacks on VLMs, where tailored data manipulation strategies for different attack goals are employed for VLMs, inducing various kinds of malicious outputs. For each of them, the representative methods and outcomes from [11] (Visual Perturbation), [12] (Gradient￾Driven Prompts), [13] (Human-Like Deceptive Prompts), [14] (Typography), [12] (Jailbreak Attack), [15] (Camouflage At￾tack) and [16] (Exploit… view at source ↗
Figure 2
Figure 2. Google Scholar search results for VLM attacks, with the vertical axis representing the number of publications and the horizontal axis indicating the corresponding years. different VLMs [11]–[16], as shown in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. An overview of the general model architecture of VLMs. In certain configurations of VLMs, the input text is transmitted directly to the projector without an intermediate encoding step. In LVLMs, LLMs are employed as decoders to facilitate the processing of multimodal input. Instead, the attacker interacts with the model solely through its outputs, making inferences based on the input-output behavior. This limitation… view at source ↗
Figures from the paper (9 more)
Figure 4
Figure 4. Figure 4: Illustration of attack framework specific for VLMs and LVLMs, encompassing three key aspects: 1) the goals of VLM attacks, 2) the data manipulation strategies specialized to VLMs, and 3) the evaluation methods used to assess the attack. TABLE V: Representative VLM atta…
Figure 5
Figure 5. Figure 5: Schematic illustration of the jailbreak attack, summarized from the representative works in Table V. The crafted input is designed to circumvent defense mechanisms, represented by a shield icon, enabling the generation of malicious content. loss during the image genera…
Figure 6
Figure 6. Figure 6: Schematic illustration of the camouflage attack, summarized from the representative works in Table VI. The crafted input is designed to induce the model to produce incorrect outputs by utilizing a logical mismatch. TABLE VI: Representative works for camouflage attacks.…
Figure 8
Figure 8. Figure 8: Overall illustration of the loss composition. The defense mechanism within the model is represented by a shield icon. The components aim to maintain utility, ensure stealthiness of the attack, and enhance its effectiveness. TABLE VII: Representative VLM attack works ut…
Figure 9
Figure 9. Figure 9: Schematic illustration of attacks utilizing visual perturbation, summarized from the representative works in Table VII. Global perturbation matches the size of the original image, while patch perturbation is applied to specific localized areas within the image. These t…
Figure 10
Figure 10. Figure 10: Schematic illustration of various modifications to text when employing gradient-driven prompt methods, summarized from the representative works in Table VIII. It is important to note that the substitute words may consist of randomized characters. words, denoted as c, …
Figure 11
Figure 11. Figure 11: Schematic illustration of various expressions when utilizing human-like deceptive prompt methods, summa￾rized from SASP [13]. The process begins by initializing tmalice with random to￾kens. Subsequently, it employs gradient-based optimization techniques in conjunction…
Figure 12
Figure 12. Figure 12: Evaluation strategies for VLM attacks, encompassing: 1) Effectiveness: measuring how successfully an attack can manipulate or mislead the VLM’s outputs, 2) Stealthiness: evaluating how undetectable an attack remains during implementation, 3) Transferability: examining…
Figure 13
Figure 13. Figure 13: Two paradigms of typography attacks, summarized from the representative works in Table IX. Left: Directly converting a text prompt into an image. Right: Pairing a malicious prompt with a related image. in detail to perform this activity.), thereby skillfully manipulat…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

130 extracted references · 22 canonical work pages

  1. [20]

    A survey of attacks on large vision-language models: Resources, advances, and future trends,

    D. Liu, M. Yang, X. Qu, P. Zhou, Y . Cheng, and W. Hu, “A survey of attacks on large vision-language models: Resources, advances, and future trends,” 2024, arXiv:2407.07403

    arXiv 2024

  2. [1]

    Efficient multimodal large language models: A survey,

    Y . Jin, J. Li, Y . Liu, T. Gu, K. Wu, Z. Jiang, M. He, B. Zhao, X. Tan, Z. Gan, Y . Wang, C. Wang, and L. Ma, “Efficient multimodal large language models: A survey,” 2024, arXiv:2405.10739

    arXiv 2024

  3. [2]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,” IEEE Trans. Pattern Anal. Mach. Intel. , 2024

    2024

  4. [3]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in Proc. Int. Conf. Mach. Learn., 2021, pp. 8748–8763

    2021

  5. [4]

    Vision language models in autonomous driving: A survey and outlook,

    X. Zhou, M. Liu, E. Yurtsever, B. L. Zagar, W. Zimmer, H. Cao, and A. C. Knoll, “Vision language models in autonomous driving: A survey and outlook,” IEEE Trans. Intell. Veh., 2024

    2024

  6. [5]

    Vision-and-language navigation today and tomorrow: A survey in the era of foundation models,

    Y . Zhang, Z. Ma, J. Li, Y . Qiao, Z. Wang, J. Chai, Q. Wu, M. Bansal, and P. Kordjamshidi, “Vision-and-language navigation today and tomorrow: A survey in the era of foundation models,” 2024, arXiv:2407.07035

    arXiv 2024

  7. [6]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y . J. Lee, “Visual instruction tuning,” Proc. Adv. Neural Inf. Process. Syst. , 2024

    2024

  8. [7]

    Listen, think, and understand,

    Y . Gong, H. Luo, A. H. Liu, L. Karlinsky, and J. Glass, “Listen, think, and understand,” 2024, arXiv:2305.10790

    arXiv 2024

Show all 130 references
  1. [8]

    Sonicvisionlm: Playing sound with vision language models,

    Z. Xie, S. Yu, Q. He, and M. Li, “Sonicvisionlm: Playing sound with vision language models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2024, pp. 26 866–26 875

    2024

  2. [9]

    Grounded language-image pre- training,

    L. H. Li, P. Zhang, H. Zhang, J. Yang, C. Li, Y . Zhong, L. Wang, L. Yuan, L. Zhang, J.-N. Hwang et al., “Grounded language-image pre- training,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2022, pp. 10 965–10 975

    2022

  3. [10]

    Segment anything,

    A. Kirillov, E. Mintun, N. Ravi, H. Mao, C. Rolland, L. Gustafson, T. Xiao, S. Whitehead, A. C. Berg, W.-Y . Loet al., “Segment anything,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2023, pp. 4015– 4026

    2023

  4. [11]

    On evaluating adversarial robustness of large vision-language models,

    Y . Zhao, T. Pang, C. Du, X. Yang, C. Li, N.-M. M. Cheung, and M. Lin, “On evaluating adversarial robustness of large vision-language models,” Proc. Adv. Neural Inf. Process. Syst. , 2024

    2024

  5. [12]

    Mma- diffusion: Multimodal attack on diffusion models,

    Y . Yang, R. Gao, X. Wang, T.-Y . Ho, N. Xu, and Q. Xu, “Mma- diffusion: Multimodal attack on diffusion models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 7737–7746. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 18

    2024

  6. [13]

    Jailbreaking gpt-4v via self-adversarial attacks with system prompts,

    Y . Wu, X. Li, Y . Liu, P. Zhou, and L. Sun, “Jailbreaking gpt-4v via self-adversarial attacks with system prompts,” 2024, arXiv:2311.09127

    2024 arXiv

  7. [14]

    Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character,

    S. Ma, W. Luo, Y . Wang, and X. Liu, “Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character,” 2024, arXiv:2405.20773

    2024 arXiv

  8. [15]

    Physical backdoor attack can jeopardize driving with vision-large-language models,

    Z. Ni, R. Ye, Y . Wei, Z. Xiang, Y . Wang, and S. Chen, “Physical backdoor attack can jeopardize driving with vision-large-language models,” 2024, arXiv:2404.12916

    2024 arXiv

  9. [16]

    Inducing high energy-latency of large vision-language models with verbose images,

    K. Gao, Y . Bai, J. Gu, S.-T. Xia, P. Torr, Z. Li, and W. Liu, “Inducing high energy-latency of large vision-language models with verbose images,” 2024, arXiv:2401.11170

    2024 arXiv

  10. [17]

    Safety of multimodal large language models on images and texts,

    X. Liu, Y . Zhu, Y . Lan, C. Yang, and Y . Qiao, “Safety of multimodal large language models on images and texts,” 2024, arXiv:2402.00357

    2024 arXiv

  11. [18]

    Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security,

    Y . Fan, Y . Cao, Z. Zhao, Z. Liu, and S. Li, “Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security,” 2024, arXiv:2404.05264

    2024 arXiv

  12. [19]

    From llms to mllms: Exploring the landscape of multimodal jailbreaking,

    S. Wang, Z. Long, Z. Fan, and Z. Wei, “From llms to mllms: Exploring the landscape of multimodal jailbreaking,” 2024, arXiv:2406.14859

    2024 arXiv

  13. [21]

    Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models,

    J. Li, D. Li, S. Savarese, and S. Hoi, “Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models,” in Proc. Int. Conf. Mach. Learn. , 2023, pp. 19 730–19 742

    2023

  14. [22]

    Instructblip: Towards general-purpose vision- language models with instruction tuning,

    W. Dai, J. Li, D. Li, A. M. H. Tiong, J. Zhao, W. Wang, B. Li, P. Fung, and S. Hoi, “Instructblip: Towards general-purpose vision- language models with instruction tuning,” 2023, arXiv:2305.06500

    2023 arXiv

  15. [23]

    Minigpt-4: En- hancing vision-language understanding with advanced large language models,

    D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny, “Minigpt-4: En- hancing vision-language understanding with advanced large language models,” 2023, arXiv:2304.10592

    2023 arXiv

  16. [24]

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,

    W.-L. Chiang, Z. Li, Z. Lin, Y . Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y . Zhuang, J. E. Gonzalez, I. Stoica, and E. P. Xing, “Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,” March 2023. [Online]. Available: https://lmsys.org/blog/2023-03-30-vicuna/

    2023

  17. [25]

    Llama: Open and efficient foundation language models,

    H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozi `ere, N. Goyal, E. Hambro, F. Azhar, A. Rodriguez, A. Joulin, E. Grave, and G. Lample, “Llama: Open and efficient foundation language models,” 2023, arXiv:2302.13971

    2023 arXiv

  18. [26]

    Llama 2: Open foundation and fine-tuned chat models,

    H. Touvron et al. , “Llama 2: Open foundation and fine-tuned chat models,” 2023, arXiv:2307.09288

    2023 arXiv

  19. [27]

    Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,

    X. Gu, X. Zheng, T. Pang, C. Du, Q. Liu, Y . Wang, J. Jiang, and M. Lin, “Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,” 2024, arXiv:2402.08567

    2024 arXiv

  20. [28]

    Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks,

    W. Luo, S. Ma, X. Liu, X. Guo, and C. Xiao, “Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks,” 2024, arXiv:2404.03027

    2024 arXiv

  21. [29]

    Opt: Open pre-trained transformer language models,

    S. Zhang et al., “Opt: Open pre-trained transformer language models,” 2022, arXiv:2205.01068

    2022 arXiv

  22. [30]

    Scaling instruction-finetuned language models,

    H. W. Chung, L. Hou, S. Longpre, B. Zoph, Y . Tay, W. Fedus, Y . Li, X. Wang, M. Dehghani, S. Brahmaet al., “Scaling instruction-finetuned language models,” Journal of Machine Learning Research , vol. 25, no. 70, pp. 1–53, 2024

    2024

  23. [31]

    Openflamingo: An open-source framework for training large autoregressive vision-language models,

    A. Awadalla et al. , “Openflamingo: An open-source framework for training large autoregressive vision-language models,” 2023, arXiv:2308.01390

    2023 arXiv

  24. [32]

    Introducing mpt-7b: A new standard for open- source, commercially usable llms,

    MosaicML, “Introducing mpt-7b: A new standard for open- source, commercially usable llms,” 2023. [Online]. Available: https://www.databricks.com/blog/mpt-7b

    2023

  25. [33]

    Releasing 3b and 7b redpajama-incite family of models including base, instruction-tuned and chat models,

    Together.xyz, “Releasing 3b and 7b redpajama-incite family of models including base, instruction-tuned and chat models,” 2023. [Online]. Available: https://www.together.ai/blog/redpajama-models-v1

    2023

  26. [34]

    Llama-adapter v2: Parameter-efficient visual instruction model,

    P. Gao et al., “Llama-adapter v2: Parameter-efficient visual instruction model,” 2023, arXiv:2304.15010

    2023 arXiv

  27. [35]

    Mimic-it: Multi-modal in-context instruction tuning,

    B. Li, Y . Zhang, L. Chen, J. Wang, F. Pu, J. Yang, C. Li, and Z. Liu, “Mimic-it: Multi-modal in-context instruction tuning,” 2023, arXiv:2306.05425

    2023 arXiv

  28. [36]

    Gpt-4v(ision) system card,

    OpenAI, “Gpt-4v(ision) system card,” 2023

    2023

  29. [37]

    Gpt-4 technical report,

    ——, “Gpt-4 technical report,” 2024, arXiv:2303.08774

    2024 arXiv

  30. [38]

    Gemini: A family of highly capable multimodal models,

    G. Gemini Team, “Gemini: A family of highly capable multimodal models,” 2023. [Online]. Available: https://storage.googleapis.com/ deepmind-media/gemini/gemini1report.pdf

    2023

  31. [39]

    AI, “Bard,” 2023

    G. AI, “Bard,” 2023. [Online]. Available: https://bard.google.com/

    2023

  32. [40]

    Backdoor attacks and countermeasures on deep learning: A comprehensive review,

    Y . Gao, B. G. Doan, Z. Zhang, S. Ma, J. Zhang, A. Fu, S. Nepal, and H. Kim, “Backdoor attacks and countermeasures on deep learning: A comprehensive review,” 2020, arXiv:2007.10760

    2020 arXiv

  33. [41]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2022, pp. 10 684–10 695

    2022

  34. [42]

    Sdxl: Improving latent diffusion models for high-resolution image synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. M ¨uller, J. Penna, and R. Rombach, “Sdxl: Improving latent diffusion models for high-resolution image synthesis,” 2023, arXiv:2307.01952

    2023 arXiv

  35. [43]

    Zero-shot text-to-image generation,

    A. Ramesh, M. Pavlov, G. Goh, S. Gray, C. V oss, A. Radford, M. Chen, and I. Sutskever, “Zero-shot text-to-image generation,” in Proc. Int. Conf. Mach. Learn. , 2021, pp. 8821–8831

    2021

  36. [44]

    Imagenet: A large-scale hierarchical image database,

    J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2009, pp. 248–255

    2009

  37. [45]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Proc. Eur. Conf. Comput. Vis. , 2014, pp. 740–755

    2014

  38. [46]

    Flickr30k entities: Collecting region-to- phrase correspondences for richer image-to-sentence models,

    B. A. Plummer, L. Wang, C. M. Cervantes, J. C. Caicedo, J. Hock- enmaier, and S. Lazebnik, “Flickr30k entities: Collecting region-to- phrase correspondences for richer image-to-sentence models,” in Proc. Int. Conf. Comput. Vis. , 2015, pp. 2641–2649

    2015

  39. [47]

    Making the v in vqa matter: Elevating the role of image understanding in visual question answering,

    Y . Goyal, T. Khot, D. Summers-Stay, D. Batra, and D. Parikh, “Making the v in vqa matter: Elevating the role of image understanding in visual question answering,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2017, pp. 6904–6913

    2017

  40. [48]

    Realtoxicityprompts: Evaluating neural toxic degeneration in language models,

    S. Gehman, S. Gururangan, M. Sap, Y . Choi, and N. A. Smith, “Realtoxicityprompts: Evaluating neural toxic degeneration in language models,” 2020, arXiv:2009.11462

    2020 arXiv

  41. [49]

    Laion-coco,

    C. Schuhmann, A. K ¨opf, T. Coombes, R. Vencu, B. Trom, and R. Beaumont, “Laion-coco,” 2022. [Online]. Available: https: //laion.ai/blog/laioncoco/

    2022

  42. [50]

    Stanford alpaca: An instruction- following llama model,

    R. Taori, I. Gulrajani, T. Zhang, Y . Dubois, X. Li, C. Guestrin, P. Liang, and T. B. Hashimoto, “Stanford alpaca: An instruction- following llama model,” 2023. [Online]. Available: https://github.com/ tatsu-lab/stanford alpaca

    2023

  43. [51]

    Universal and transferable adversarial attacks on aligned language models,

    A. Zou, Z. Wang, N. Carlini, M. Nasr, J. Z. Kolter, and M. Fredrikson, “Universal and transferable adversarial attacks on aligned language models,” 2023, arXiv:2307.15043

    2023 arXiv

  44. [52]

    Figstep: Jailbreaking large vision-language models via typographic visual prompts,

    Y . Gong, D. Ran, J. Liu, C. Wang, T. Cong, A. Wang, S. Duan, and X. Wang, “Figstep: Jailbreaking large vision-language models via typographic visual prompts,” 2023, arXiv:2311.05608

    2023 arXiv

  45. [53]

    Avibench: Towards evaluating the robustness of large vision-language model on adversarial visual-instructions,

    H. Zhang, W. Shao, H. Liu, Y . Ma, P. Luo, Y . Qiao, and K. Zhang, “Avibench: Towards evaluating the robustness of large vision-language model on adversarial visual-instructions,” 2024, arXiv:2403.09346

    2024 arXiv

  46. [54]

    Mm-safetybench: A benchmark for safety evaluation of multimodal large language models,

    X. Liu, Y . Zhu, J. Gu, Y . Lan, C. Yang, and Y . Qiao, “Mm-safetybench: A benchmark for safety evaluation of multimodal large language models,” 2024, arXiv:2311.17600

    2024 arXiv

  47. [55]

    Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts,

    Y . Liu, C. Cai, X. Zhang, X. Yuan, and C. Wang, “Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts,” in Proc. ACM Int. Conf. Multimed., 2024, pp. 3578– 3586

    2024

  48. [56]

    Jailbreaking multimodal large language models via shuffle inconsistency,

    S. Zhao, R. Duan, F. Wang, C. Chen, C. Kang, J. Tao, Y . Chen, H. Xue, and X. Wei, “Jailbreaking multimodal large language models via shuffle inconsistency,” 2025, arXiv:2501.04931

    2025 arXiv

  49. [57]

    Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,

    Y . Qu, X. Shen, X. He, M. Backes, S. Zannettou, and Y . Zhang, “Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,” in Proc. ACM SIGSAC Conf. Comput. Commun. Secur., 2023, pp. 3403–3417

    2023

  50. [58]

    White-box multimodal jailbreaks against large vision-language models,

    R. Wang, X. Ma, H. Zhou, C. Ji, G. Ye, and Y .-G. Jiang, “White-box multimodal jailbreaks against large vision-language models,” in Proc. ACM Int. Conf. Multimed. , 2024, pp. 6920–6928

    2024

  51. [59]

    Visual adversarial examples jailbreak aligned large language models,

    X. Qi, K. Huang, A. Panda, P. Henderson, M. Wang, and P. Mittal, “Visual adversarial examples jailbreak aligned large language models,” in Proc. AAAI Conf. Artif. Intell. , 2024, pp. 21 527–21 536

    2024

  52. [60]

    To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images ... for now,

    Y . Zhang, J. Jia, X. Chen, A. Chen, Y . Zhang, J. Liu, K. Ding, and S. Liu, “To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images ... for now,” 2024, arXiv:2310.11868

    2024 arXiv

  53. [61]

    Ring-a-bell! how reliable are concept removal methods for diffusion models?

    Y .-L. Tsai, C.-Y . Hsu, C. Xie, C.-H. Lin, J.-Y . Chen, B. Li, P.-Y . Chen, C.-M. Yu, and C.-Y . Huang, “Ring-a-bell! how reliable are concept removal methods for diffusion models?” 2024, arXiv:2310.10012

    2024 arXiv

  54. [62]

    Are aligned neural networks adversarially aligned?

    N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, P. W. W. Koh, D. Ippolito, F. Tramer, and L. Schmidt, “Are aligned neural networks adversarially aligned?” Proc. Adv. Neural Inf. Process. Syst., 2024

    2024

  55. [63]

    Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models,

    E. Shayegani, Y . Dong, and N. Abu-Ghazaleh, “Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models,” in Proc. Int. Conf. Learn. Represent. , 2023. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 19

    2023

  56. [64]

    Extracting training data from large language models,

    N. Carlini, F. Tramer, E. Wallace, M. Jagielski, A. Herbert-V oss, K. Lee, A. Roberts, T. Brown, D. Song, U. Erlingssonet al., “Extracting training data from large language models,” in USENIX Secur. Symp. , 2021, pp. 2633–2650

    2021

  57. [65]

    Va3: Virtually assured am- plification attack on probabilistic copyright protection for text-to- image generative models,

    X. Li, Q. Shen, and K. Kawaguchi, “Va3: Virtually assured am- plification attack on probabilistic copyright protection for text-to- image generative models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2024, pp. 12 363–12 373

    2024

  58. [66]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,

    J. Li, D. Li, C. Xiong, and S. Hoi, “Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,” in Proc. Int. Conf. Mach. Learn. , 2022, pp. 12 888–12 900

    2022

  59. [67]

    Large language models are zero-shot reasoners,

    T. Kojima, S. S. Gu, M. Reid, Y . Matsuo, and Y . Iwasawa, “Large language models are zero-shot reasoners,” Proc. Adv. Neural Inf. Process. Syst., pp. 22 199–22 213, 2022

    2022

  60. [68]

    Black-box prompt optimization: Aligning large language models without model training,

    J. Cheng, X. Liu, K. Zheng, P. Ke, H. Wang, Y . Dong, J. Tang, and M. Huang, “Black-box prompt optimization: Aligning large language models without model training,” 2024, arXiv:2311.04155

    2024 arXiv

  61. [69]

    Training language models to follow instructions with human feedback,

    L. Ouyang, J. Wu, X. Jiang, D. Almeida, C. Wainwright, P. Mishkin, C. Zhang, S. Agarwal, K. Slama, A. Ray et al. , “Training language models to follow instructions with human feedback,” Proc. Adv. Neural Inf. Process. Syst. , pp. 27 730–27 744, 2022

    2022

  62. [70]

    Rl4f: Generating natural language feed- back with reinforcement learning for repairing model outputs,

    A. F. Aky ¨urek, E. Aky ¨urek, A. Madaan, A. Kalyan, P. Clark, D. Wijaya, and N. Tandon, “Rl4f: Generating natural language feed- back with reinforcement learning for repairing model outputs,” 2023, arXiv:2305.08844

    2023 arXiv

  63. [71]

    Dress: Instructing large vision-language models to align and interact with humans via natural language feedback,

    Y . Chen, K. Sikka, M. Cogswell, H. Ji, and A. Divakaran, “Dress: Instructing large vision-language models to align and interact with humans via natural language feedback,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2024, pp. 14 239–14 250

    2024

  64. [72]

    Mllm-protector: Ensuring mllm’s safety without hurting performance,

    R. Pi, T. Han, J. Zhang, Y . Xie, R. Pan, Q. Lian, H. Dong, J. Zhang, and T. Zhang, “Mllm-protector: Ensuring mllm’s safety without hurting performance,” 2024, arXiv:2401.02906

    2024 arXiv

  65. [73]

    Safety fine-tuning at (almost) no cost: A baseline for vision large language models,

    Y . Zong, O. Bohdal, T. Yu, Y . Yang, and T. Hospedales, “Safety fine-tuning at (almost) no cost: A baseline for vision large language models,” 2024, arXiv:2402.02207

    2024 arXiv

  66. [74]

    Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation,

    Y . Gou, K. Chen, Z. Liu, L. Hong, H. Xu, Z. Li, D.-Y . Yeung, J. T. Kwok, and Y . Zhang, “Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation,” in Proc. Eur. Conf. Comput. Vis., 2025, pp. 388–404

    2025

  67. [75]

    Jailguard: A universal detection framework for llm prompt-based attacks,

    X. Zhang, C. Zhang, T. Li, Y . Huang, X. Jia, M. Hu, J. Zhang, Y . Liu, S. Ma, and C. Shen, “Jailguard: A universal detection framework for llm prompt-based attacks,” 2023, arXiv:2312.10766

    2023 arXiv

  68. [76]

    Adashield: Safeguard- ing multimodal large language models from structure-based attack via adaptive shield prompting,

    Y . Wang, X. Liu, Y . Li, M. Chen, and C. Xiao, “Adashield: Safeguard- ing multimodal large language models from structure-based attack via adaptive shield prompting,” 2024, arXiv:2403.09513

    2024 arXiv

  69. [77]

    Adversarial illusions in multi-modal embeddings,

    E. Bagdasaryan, R. Jha, V . Shmatikov, and T. Zhang, “Adversarial illusions in multi-modal embeddings,” in USENIX Secur. Symp., 2024, pp. 3009–3025

    2024

  70. [78]

    Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,

    S. Liang, M. Zhu, A. Liu, B. Wu, X. Cao, and E.-C. Chang, “Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 24 645–24 654

    2024

  71. [79]

    Badclip: Trigger- aware prompt learning for backdoor attacks on clip,

    J. Bai, K. Gao, S. Min, S.-T. Xia, Z. Li, and W. Liu, “Badclip: Trigger- aware prompt learning for backdoor attacks on clip,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 24 239–24 250

    2024

  72. [80]

    Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,

    Z. Yin, M. Ye, T. Zhang, T. Du, J. Zhu, H. Liu, J. Chen, T. Wang, and F. Ma, “Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,” Proc. Adv. Neural Inf. Process. Syst. , 2024

    2024

  73. [81]

    An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models,

    H. Luo, J. Gu, F. Liu, and P. Torr, “An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models,” 2024, arXiv:2403.09766

    2024 arXiv

  74. [82]

    Break the visual perception: Adversarial attacks targeting encoded visual tokens of large vision-language models,

    Y . Wang, C. Liu, Y . Qu, H. Cao, D. Jiang, and L. Xu, “Break the visual perception: Adversarial attacks targeting encoded visual tokens of large vision-language models,” in Proc. ACM Int. Conf. Multimed. , 2024, pp. 1072–1081

    2024

  75. [83]

    Misusing tools in large language models with visual adversarial examples,

    X. Fu, Z. Wang, S. Li, R. K. Gupta, N. Mireshghallah, T. Berg- Kirkpatrick, and E. Fernandes, “Misusing tools in large language models with visual adversarial examples,” 2023, arXiv:2310.03185

    2023 arXiv

  76. [84]

    Prompt-driven contrastive learning for transferable adversarial attacks,

    H. Yang, J. Jeong, and K.-J. Yoon, “Prompt-driven contrastive learning for transferable adversarial attacks,” in Proc. Eur. Conf. Comput. Vis. , 2025, pp. 36–53

    2025

  77. [85]

    Steering away from harm: An adaptive approach to defending vision language model against jailbreaks,

    H. Wang, G. Wang, and H. Zhang, “Steering away from harm: An adaptive approach to defending vision language model against jailbreaks,” 2024, arXiv:2411.16721

    2024 arXiv

  78. [86]

    Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,

    S. Chen, Z. Song, M. Haque, C. Liu, and W. Yang, “Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2022, pp. 15 365–15 374

    2022

  79. [87]

    Slowlidar: Increasing the latency of lidar-based detection using adversarial exam- ples,

    H. Liu, Y . Wu, Z. Yu, Y . V orobeychik, and N. Zhang, “Slowlidar: Increasing the latency of lidar-based detection using adversarial exam- ples,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2023, pp. 5146–5155

    2023

  80. [88]

    The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,

    S. Chen, H. Chen, M. Haque, C. Liu, and W. Yang, “The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2023, pp. 24 585–24 594

    2023

  81. [89]

    Chain-of-thought prompting elicits reasoning in large language models,

    J. Wei, X. Wang, D. Schuurmans, M. Bosma, F. Xia, E. Chi, Q. V . Le, D. Zhou et al., “Chain-of-thought prompting elicits reasoning in large language models,” Proc. Adv. Neural Inf. Process. Syst. , pp. 24 824– 24 837, 2022

    2022

  82. [90]

    Self-consistency improves chain of thought rea- soning in language models,

    X. Wang, J. Wei, D. Schuurmans, Q. Le, E. Chi, S. Narang, A. Chowd- hery, and D. Zhou, “Self-consistency improves chain of thought rea- soning in language models,” 2023, arXiv:2203.11171

    2023 arXiv

  83. [91]

    Stop reasoning! when multimodal llm with chain-of- thought reasoning meets adversarial image,

    Z. Wang, Z. Han, S. Chen, F. Xue, Z. Ding, X. Xiao, V . Tresp, P. Torr, and J. Gu, “Stop reasoning! when multimodal llm with chain-of- thought reasoning meets adversarial image,” 2024, arXiv:2402.14899

    2024 arXiv

  84. [92]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, “Explaining and harnessing adversarial examples,” 2014, arXiv:1412.6572

    2014 arXiv

  85. [93]

    Adversarial examples in the physical world,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” 2017, arXiv:1607.02533

    2017 arXiv

  86. [94]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” stat, vol. 1050, no. 9, 2017

    2017

  87. [95]

    Boosting adversarial attacks with momentum,

    Y . Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2018, pp. 9185–9193

    2018

  88. [96]

    On the adversarial robustness of multi- modal foundation models,

    C. Schlarmann and M. Hein, “On the adversarial robustness of multi- modal foundation models,” in Proc. Int. Conf. Comput. Vis. , 2023, pp. 3677–3685

    2023

  89. [97]

    Transferable multimodal attack on vision-language pre- training models,

    H. Wang, K. Dong, Z. Zhu, H. Qin, A. Liu, X. Fang, J. Wang, and X. Liu, “Transferable multimodal attack on vision-language pre- training models,” in Proc. IEEE Symp. Secur. Privacy. IEEE Computer Society, 2024, pp. 102–102

    2024

  90. [98]

    Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models,

    D. Lu, Z. Wang, T. Wang, W. Guan, H. Gao, and F. Zheng, “Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models,” in Proc. Int. Conf. Comput. Vis. , 2023, pp. 102– 111

    2023

  91. [99]

    Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory,

    S. Gao, X. Jia, X. Ren, I. Tsang, and Q. Guo, “Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory,” 2024, arXiv:2403.12445

    2024 arXiv

  92. [100]

    Adversarial patch,

    T. B. Brown, D. Man ´e, A. Roy, M. Abadi, and J. Gilmer, “Adversarial patch,” 2018, arXiv:1712.09665

    2018 arXiv

  93. [101]

    Lavan: Localized and visible adversarial noise,

    D. Karmon, D. Zoran, and Y . Goldberg, “Lavan: Localized and visible adversarial noise,” in Proc. Int. Conf. Mach. Learn. , 2018, pp. 2507– 2515

    2018

  94. [102]

    Poisoning and backdooring contrastive learning,

    N. Carlini and A. Terzis, “Poisoning and backdooring contrastive learning,” 2022, arXiv:2106.09667

    2022 arXiv

  95. [103]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,

    Z. Zhou, S. Hu, M. Li, H. Zhang, Y . Zhang, and H. Jin, “Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning,” in Proc. ACM Int. Conf. Multimed. , 2023, pp. 6311–6320

    2023

  96. [104]

    Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,

    S. Zhai, Y . Dong, Q. Shen, S. Pu, Y . Fang, and H. Su, “Text-to-image diffusion models can be easily backdoored through multimodal data poisoning,” in Proc. ACM Int. Conf. Multimed. , 2023, pp. 1577–1587

    2023

  97. [105]

    Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models,

    J. Liang, S. Liang, M. Luo, A. Liu, D. Han, E.-C. Chang, and X. Cao, “Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models,” 2024, arXiv:2402.13851

    2024 arXiv

  98. [106]

    Towards feature space adversarial attack by style perturbation,

    Q. Xu, G. Tao, S. Cheng, and X. Zhang, “Towards feature space adversarial attack by style perturbation,” in Proc. AAAI Conf. Artif. Intell., vol. 35, no. 12, 2021, pp. 10 523–10 531

    2021

  99. [107]

    Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models,

    C. Schlarmann, N. D. Singh, F. Croce, and M. Hein, “Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models,” 2024, arXiv:2402.12336

    2024 arXiv

  100. [108]

    On the robustness of large multimodal models against image adversarial attacks,

    X. Cui, A. Aparcedo, Y . K. Jang, and S.-N. Lim, “On the robustness of large multimodal models against image adversarial attacks,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 24 625–24 634

    2024

  101. [109]

    Black-box generation of adversarial text sequences to evade deep learning classifiers,

    J. Gao, J. Lanchantin, M. L. Soffa, and Y . Qi, “Black-box generation of adversarial text sequences to evade deep learning classifiers,” in Proc. - IEEE Symp. Secur. Priv. Workshops . IEEE, 2018, pp. 50–56

    2018

  102. [110]

    Bert-attack: Adversarial attack against bert using bert,

    L. Li, R. Ma, Q. Guo, X. Xue, and X. Qiu, “Bert-attack: Adversarial attack against bert using bert,” 2020, arXiv:2004.09984

    2020 arXiv

  103. [111]

    Deep text classification can be fooled,

    B. Liang, H. Li, M. Su, P. Bian, X. Li, and W. Shi, “Deep text classification can be fooled,” in Int. Joint Conf. Artif. Intell. , 2018, pp. 4208–4215. JOURNAL OF LATEX CLASS FILES, VOL. 14, NO. 8, AUGUST 2021 20

    2018

  104. [112]

    Textbugger: Generating adversarial text against real-world applications,

    J. Li, S. Ji, T. Du, B. Li, and T. Wang, “Textbugger: Generating adversarial text against real-world applications,” in Annu. Netw. Distrib. Syst. Secur. Symp., 2019

    2019

  105. [113]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment,

    D. Jin, Z. Jin, J. T. Zhou, and P. Szolovits, “Is bert really robust? a strong baseline for natural language attack on text classification and entailment,” in Proc. AAAI Conf. Artif. Intell. , vol. 34, no. 05, 2020, pp. 8018–8025

    2020

  106. [114]

    Securing vision-language models with a robust encoder against jailbreak and adversarial attacks,

    M. Z. Hossain and A. Imteaj, “Securing vision-language models with a robust encoder against jailbreak and adversarial attacks,” 2024, arXiv:2409.07353

    2024 arXiv

  107. [115]

    One prompt word is enough to boost adversarial robustness for pre-trained vision-language models,

    L. Li, H. Guan, J. Qiu, and M. Spratling, “One prompt word is enough to boost adversarial robustness for pre-trained vision-language models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2024, pp. 24 408– 24 419

    2024

  108. [116]

    Jailbroken: How does llm safety training fail?

    A. Wei, N. Haghtalab, and J. Steinhardt, “Jailbroken: How does llm safety training fail?” Proc. Adv. Neural Inf. Process. Syst. , 2024

    2024

  109. [117]

    Introducing chatgpt and whis- per apis,

    G. Brockman et al. , “Introducing chatgpt and whis- per apis,” 2023. [Online]. Available: https://openai.com/index/ introducing-chatgpt-and-whisper-apis/

    2023

  110. [118]

    How easy is it to fool your multimodal llms? an empirical analysis on deceptive prompts,

    Y . Qian, H. Zhang, Y . Yang, and Z. Gan, “How easy is it to fool your multimodal llms? an empirical analysis on deceptive prompts,” 2024, arXiv:2402.13220

    2024 arXiv

  111. [119]

    Vision-llms can fool themselves with self-generated typographic at- tacks,

    M. Qraitem, N. Tasnim, P. Teterwak, K. Saenko, and B. A. Plummer, “Vision-llms can fool themselves with self-generated typographic at- tacks,” 2024, arXiv:2402.00626

    2024 arXiv

  112. [120]

    Empirical analysis of large vision-language models against goal hijacking via visual prompt injection,

    S. Kimura, R. Tanaka, S. Miyawaki, J. Suzuki, and K. Sakaguchi, “Empirical analysis of large vision-language models against goal hijacking via visual prompt injection,” 2024, arXiv:2408.03554

    2024 arXiv

  113. [121]

    Defense-prefix for preventing typographic attacks on clip,

    H. Azuma and Y . Matsui, “Defense-prefix for preventing typographic attacks on clip,” in Proc. Int. Conf. Comput. Vis., 2023, pp. 3644–3653

    2023

  114. [122]

    Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language models,

    H. Cheng, E. Xiao, J. Gu, L. Yang, J. Duan, J. Zhang, J. Cao, K. Xu, and R. Xu, “Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language models,” in Proc. Eur. Conf. Comput. Vis., 2025, pp. 179–196

    2025

  115. [123]

    Detoxify,

    L. Hanu and Unitary team, “Detoxify,” Github. https://github.com/unitaryai/detoxify, 2020

    2020

  116. [124]

    Physical adversarial attack meets computer vision: A decade survey,

    H. Wei, H. Tang, X. Jia, Z. Wang, H. Yu, Z. Li, S. Satoh, L. Van Gool, and Z. Wang, “Physical adversarial attack meets computer vision: A decade survey,” IEEE Trans. Pattern Anal. Mach. Intel. , 2024

    2024

  117. [125]

    Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,

    Y . Zhong, X. Liu, D. Zhai, J. Jiang, and X. Ji, “Shadows can be dangerous: Stealthy and effective physical-world adversarial attack by natural phenomenon,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit., 2022, pp. 15 345–15 354

    2022

  118. [126]

    Intriguing properties of diffusion models: An empirical study of the natural attack capability in text-to-image generative models,

    T. Sato, J. Yue, N. Chen, N. Wang, and Q. A. Chen, “Intriguing properties of diffusion models: An empirical study of the natural attack capability in text-to-image generative models,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 24 635–24 644

    2024

  119. [127]

    Distracting downpour: Ad- versarial weather attacks for motion estimation,

    J. Schmalfuss, L. Mehl, and A. Bruhn, “Distracting downpour: Ad- versarial weather attacks for motion estimation,” in Proc. Int. Conf. Comput. Vis., 2023, pp. 10 106–10 116

    2023

  120. [128]

    Unexplored faces of robustness and out-of-distribution: Covariate shifts in environment and sensor domains,

    E. Baek, K. Park, J. Kim, and H.-S. Kim, “Unexplored faces of robustness and out-of-distribution: Covariate shifts in environment and sensor domains,” in Proc. IEEE Conf. Comput. Vis. Pattern Recognit. , 2024, pp. 22 294–22 303

    2024

  121. [129]

    Aligning cyber space with physical world: A comprehensive survey on embodied ai,

    Y . Liu, W. Chen, Y . Bai, X. Liang, G. Li, W. Gao, and L. Lin, “Aligning cyber space with physical world: A comprehensive survey on embodied ai,” 2024, arXiv:2407.06886

    2024 arXiv

  122. [130]

    The wolf within: Covert injection of malice into mllm societies via an mllm operative,

    Z. Tan, C. Zhao, R. Moraffah, Y . Li, Y . Kong, T. Chen, and H. Liu, “The wolf within: Covert injection of malice into mllm societies via an mllm operative,” 2024, arXiv:2402.14859

    2024 arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.