{"as_of":"2026-08-09T19:49:00Z","caps":{"database_statements":6,"inbound":100,"outbound":100},"context_digest":"sha256:55ed5e7597d8aec3f3899d57363896746897a04bb6abfd2fffb68f277d619468","coverage":[{"denominator":130,"lane":"reference_resolution","note":"Typed states for the displayed outbound observations.","records_observed":100,"source":"paper_references, paper_reference_links","source_observed_at":"2026-08-08T15:38:17.453227Z","state":"measured"},{"denominator":100,"lane":"standing_notices","note":"One-hop event checks from named stored sources.","records_observed":100,"source":"scholarly_work_events, retraction_status_cache","source_observed_at":"2026-08-09T06:31:02.800959+00:00","state":"measured"},{"denominator":0,"lane":"inbound_itemization","note":"Pith citing papers itemized under the disclosed page cap.","records_observed":0,"source":"paper_references, paper_reference_links","source_observed_at":null,"state":"measured"},{"denominator":1,"lane":"external_citation_measurements","note":"A source-named dated measurement, never combined with another source.","records_observed":0,"source":"cited_works","source_observed_at":null,"state":"measured"}],"external_citation_measurements":[],"inbound":[],"links":{"evidence":"/evidence","html":"/paper/2502.06390/citation-record","integrity":"/paper/2502.06390/integrity","json":"/paper/2502.06390/citation-record.json","paper":"/paper/2502.06390"},"outbound":[{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.028360Z","title":"Efficient multimodal large language models: A survey,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":1,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.028360Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d77187e023b5e671d383f9be7310ea8859274c88308efa53a3e6a5ec6d14cbc2","observation_id":"099f1e85-e121-4dd7-82fa-771525c9fef7","resolution":{"observed_at":"2026-08-08T15:38:17.028360Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.033499Z","title":"Vision-language models for vision tasks: A survey,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":2,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.033499Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:146fb50f5c895abe99f7b7889dfde9a546139b8a9d4ca193072ae90e2c27cec9","observation_id":"b736f5bf-c1a3-4c91-8983-9ffb7500cb1d","resolution":{"observed_at":"2026-08-08T15:38:17.033499Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.038157Z","title":"Learning transferable visual models from natural language supervision,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":3,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.038157Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ab6c3ee5c4d5213095176d264d4dd61d7512fd1c5535a45d8367bc30caf9e630","observation_id":"15d7f862-3768-4384-9218-bfcad2b6fdf1","resolution":{"observed_at":"2026-08-08T15:38:17.038157Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.042884Z","title":"Vision language models in autonomous driving: A survey and outlook,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":4,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.042884Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:0f220c48cc561f8e7b25ff68397d19f8c9865e9fc08c41e28537d5bf051d9974","observation_id":"1f70bd67-0e81-4ffe-9075-4d11bb96dfdc","resolution":{"observed_at":"2026-08-08T15:38:17.042884Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.07035","last_updated":"2024-12-29T23:16:37Z","snapshot_observed_at":"2026-07-06T18:43:47.559289Z","submitted_at":"2024-07-09T16:53:36Z","title":"Vision-and-Language Navigation Today and Tomorrow: A Survey in the Era of Foundation Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.07035","snapshot_observed_at":"2026-08-08T15:38:17.047450Z","title":"Vision-and-language navigation today and tomorrow: A survey in the era of foundation models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":5,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.047450Z"},"links":{"cited_paper":"/paper/2407.07035","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ced51c7b7aac67c9696267b9c75a7e668ebcf2068dbad7da46ad08248384da5e","observation_id":"d46bf3ae-44a0-48e9-9bb1-4a01bf7215d1","resolution":{"observed_at":"2026-08-08T15:38:17.047450Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.052425Z","title":"Visual instruction tuning,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":6,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.052425Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:dd9382683d78d8f98246896af5e2004b0a1170dcbe4e9ba8ebffb890640f3c14","observation_id":"32dbaf8f-1567-4bbf-9a52-3ef8a9f551fc","resolution":{"observed_at":"2026-08-08T15:38:17.052425Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.10790","last_updated":"2024-02-19T23:51:49Z","snapshot_observed_at":"2026-08-06T15:52:37.531678Z","submitted_at":"2023-05-18T08:03:37Z","title":"Listen, Think, and Understand","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.10790","snapshot_observed_at":"2026-08-08T15:38:17.057432Z","title":"Listen, think, and understand,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":7,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.057432Z"},"links":{"cited_paper":"/paper/2305.10790","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f5992bb4894027399ac59fca35a5671d467b67703590307867ac4d107a3d4e89","observation_id":"cd77a381-8ad5-4801-b6df-7d80726574a8","resolution":{"observed_at":"2026-08-08T15:38:17.057432Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.062234Z","title":"Sonicvisionlm: Playing sound with vision language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":8,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.062234Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:62408a7aa14f4baf09294563d1e450d29daa1f3f9c9fadd70165171ff315cb8b","observation_id":"746508a9-917e-431b-a74b-ea30b275419b","resolution":{"observed_at":"2026-08-08T15:38:17.062234Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.067115Z","title":"Grounded language-image pre- training,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":9,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.067115Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f91771871c438a8de2a33891be9055b5eeabd3b2406ccac3ef867a5b036faba2","observation_id":"46bd1cec-8f67-4472-80c8-b5a06e2115ba","resolution":{"observed_at":"2026-08-08T15:38:17.067115Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.071570Z","title":"Segment anything,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":10,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.071570Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:61d221af447aa8f64bac2b0e0771c1dd3cbf6d50c49cd8a9dff531eb320edcc2","observation_id":"00734e26-a685-47bb-991a-a66f5039580d","resolution":{"observed_at":"2026-08-08T15:38:17.071570Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.076098Z","title":"On evaluating adversarial robustness of large vision-language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":11,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.076098Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d6832c4140256807375a76b3467780e152d5a3c7260985832377a38d9bd305ac","observation_id":"845577d3-c834-4cf7-8a40-9e0b9b155257","resolution":{"observed_at":"2026-08-08T15:38:17.076098Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.080542Z","title":"Mma- diffusion: Multimodal attack on diffusion models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":12,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.080542Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:51b8045417a933a4cea55c9277ba1a6d99d26faef43ef2d9408f3e83f71f205f","observation_id":"067c0329-e16f-4c3e-88ac-a626ce7d55e7","resolution":{"observed_at":"2026-08-08T15:38:17.080542Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.09127","last_updated":"2024-01-20T18:55:51Z","snapshot_observed_at":"2026-08-09T01:09:44.001852Z","submitted_at":"2023-11-15T17:17:39Z","title":"Jailbreaking GPT-4V via Self-Adversarial Attacks with System Prompts","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.09127","snapshot_observed_at":"2026-08-08T15:38:17.084735Z","title":"Jailbreaking gpt-4v via self-adversarial attacks with system prompts,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":13,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.084735Z"},"links":{"cited_paper":"/paper/2311.09127","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:92eceb15a73f2385d9996c1391c64eef76129cd317efc831dde1445aefa14ac8","observation_id":"d508c24d-5592-4712-a758-1cb1b657c72c","resolution":{"observed_at":"2026-08-08T15:38:17.084735Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2405.20773","last_updated":"2024-06-12T07:13:48Z","snapshot_observed_at":"2026-08-08T10:04:07.258178Z","submitted_at":"2024-05-25T17:17:18Z","title":"Visual-RolePlay: Universal Jailbreak Attack on MultiModal Large Language Models via Role-playing Image Character","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2405.20773","snapshot_observed_at":"2026-08-08T15:38:17.089320Z","title":"Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":14,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.089320Z"},"links":{"cited_paper":"/paper/2405.20773","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:0de52d7ecd966cae40c14541d84ca0df80d36c88f583fc1d43dec8fd2dd63638","observation_id":"631adf9a-90c7-43e1-ae22-9610b9e7c1ea","resolution":{"observed_at":"2026-08-08T15:38:17.089320Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.12916","last_updated":"2024-04-22T14:05:37Z","snapshot_observed_at":"2026-08-04T15:56:49.583280Z","submitted_at":"2024-04-19T14:40:38Z","title":"Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.12916","snapshot_observed_at":"2026-08-08T15:38:17.093802Z","title":"Physical backdoor attack can jeopardize driving with vision-large-language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":15,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.093802Z"},"links":{"cited_paper":"/paper/2404.12916","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:e011dac3d02012be64546076f2268b8c72157e1ab12cf78d368bdafc32dd9031","observation_id":"3037f0c1-e04b-4d46-a13a-2a6106a1b05a","resolution":{"observed_at":"2026-08-08T15:38:17.093802Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.11170","last_updated":"2024-03-22T15:31:39Z","snapshot_observed_at":"2026-08-09T06:30:07.448180Z","submitted_at":"2024-01-20T08:46:06Z","title":"Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.11170","snapshot_observed_at":"2026-08-08T15:38:17.098397Z","title":"Inducing high energy-latency of large vision-language models with verbose images,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":16,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.098397Z"},"links":{"cited_paper":"/paper/2401.11170","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:596c1590e64b3f9402974a6c42f4f7d2d3591a524cc93aceee951fd8c2cea272","observation_id":"555c05e6-2912-4c4c-82e6-9d5d054b1f52","resolution":{"observed_at":"2026-08-08T15:38:17.098397Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.00357","last_updated":"2024-06-20T15:06:10Z","snapshot_observed_at":"2026-07-06T17:23:31.057358Z","submitted_at":"2024-02-01T05:57:10Z","title":"Safety of Multimodal Large Language Models on Images and Texts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.00357","snapshot_observed_at":"2026-08-08T15:38:17.103048Z","title":"Safety of multimodal large language models on images and texts,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":17,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.103048Z"},"links":{"cited_paper":"/paper/2402.00357","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:c75ccec9cbac14215fa626cb7c3bb89b2119b41071d66bec6f63f0f3587c5aef","observation_id":"fd9d8eb5-393c-4e58-a585-61fa9825b70d","resolution":{"observed_at":"2026-08-08T15:38:17.103048Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.05264","last_updated":"2024-08-11T11:39:54Z","snapshot_observed_at":"2026-07-06T17:57:02.141961Z","submitted_at":"2024-04-08T07:54:18Z","title":"Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Security","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.05264","snapshot_observed_at":"2026-08-08T15:38:17.107046Z","title":"Unbridled icarus: A survey of the potential perils of image inputs in multimodal large language model security,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":18,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.107046Z"},"links":{"cited_paper":"/paper/2404.05264","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:34a9fb8af1fb2496fd7730d210fcc0e9a74c9bdf3f42b45fce380561e702300c","observation_id":"25248a1d-fd28-42f5-be5f-2c1319542a97","resolution":{"observed_at":"2026-08-08T15:38:17.107046Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2406.14859","last_updated":"2024-06-21T04:33:48Z","snapshot_observed_at":"2026-08-06T16:35:40.303498Z","submitted_at":"2024-06-21T04:33:48Z","title":"From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2406.14859","snapshot_observed_at":"2026-08-08T15:38:17.110619Z","title":"From llms to mllms: Exploring the landscape of multimodal jailbreaking,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":19,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.110619Z"},"links":{"cited_paper":"/paper/2406.14859","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:67cede16cac1c505bca5698f83547bb0c9cb86f4d71156ab53872c922ccfae03","observation_id":"0db4d2a4-38f5-4cce-ba9f-41abdcbb29b4","resolution":{"observed_at":"2026-08-08T15:38:17.110619Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2407.07403","last_updated":"2024-07-12T03:58:05Z","snapshot_observed_at":"2026-08-07T09:29:22.417640Z","submitted_at":"2024-07-10T06:57:58Z","title":"A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2407.07403","snapshot_observed_at":"2026-08-08T15:38:17.114309Z","title":"A survey of attacks on large vision-language models: Resources, advances, and future trends,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":20,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.114309Z"},"links":{"cited_paper":"/paper/2407.07403","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f14131c6e398383834d4ebb5ab0459b7d3534e260f0f5134c86a94633c8ef258","observation_id":"0917c57e-d361-42ac-b959-9fe6f0a3b87c","resolution":{"observed_at":"2026-08-08T15:38:17.114309Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.117952Z","title":"Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":21,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.117952Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:778f64af8cd89a9846b924ea8e9f77e94686f1f4593904c5d96b3b0c0b5cc1c3","observation_id":"dd5065d5-9f21-4841-aeea-08d517887c04","resolution":{"observed_at":"2026-08-08T15:38:17.117952Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.06500","last_updated":"2023-06-15T08:00:18Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-05-11T00:38:10Z","title":"InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuning","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.06500","snapshot_observed_at":"2026-08-08T15:38:17.121586Z","title":"Instructblip: Towards general-purpose vision- language models with instruction tuning,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":22,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.121586Z"},"links":{"cited_paper":"/paper/2305.06500","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ddbde574fe41c96fc26cb5ec6e5bc7e7b51aaf2a7a570a52098044389350e31e","observation_id":"1d8946c5-1be5-4d0e-9386-e4773a6471da","resolution":{"observed_at":"2026-08-08T15:38:17.121586Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.10592","last_updated":"2023-10-02T16:38:35Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-04-20T18:25:35Z","title":"MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.10592","snapshot_observed_at":"2026-08-08T15:38:17.126010Z","title":"Minigpt-4: En- hancing vision-language understanding with advanced large language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":23,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.126010Z"},"links":{"cited_paper":"/paper/2304.10592","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:c2b41c444963549c9d6a646d35cf88876097b5a21791dce50d34cfd064df8579","observation_id":"941f2746-7dbf-4864-bf01-cd80d9282a10","resolution":{"observed_at":"2026-08-08T15:38:17.126010Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.130611Z","title":"Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":24,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.130611Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f22092509cc0779c810d6e91d60fdc3acec5b14bfe21b0537499e753bd5a094c","observation_id":"ef38d53c-ace8-43ce-8583-d49993e6e61f","resolution":{"observed_at":"2026-08-08T15:38:17.130611Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2302.13971","last_updated":"2023-02-27T17:11:15Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-02-27T17:11:15Z","title":"LLaMA: Open and Efficient Foundation Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2302.13971","snapshot_observed_at":"2026-08-08T15:38:17.134977Z","title":"Llama: Open and efficient foundation language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":25,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.134977Z"},"links":{"cited_paper":"/paper/2302.13971","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:1e871d1557269692f2da7e1e429c9e242a627e3ce01e4beb4d949600bb169e2c","observation_id":"003f4fc9-c90d-4d73-a018-ee564682fb36","resolution":{"observed_at":"2026-08-08T15:38:17.134977Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.09288","last_updated":"2023-07-19T17:08:59Z","snapshot_observed_at":"2026-08-07T12:56:43.323460Z","submitted_at":"2023-07-18T14:31:57Z","title":"Llama 2: Open Foundation and Fine-Tuned Chat Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.09288","snapshot_observed_at":"2026-08-08T15:38:17.139189Z","title":"Llama 2: Open foundation and fine-tuned chat models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":26,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.139189Z"},"links":{"cited_paper":"/paper/2307.09288","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:a34b9d26a80eb4d9de9db1c32151b9521c83b916f37f651d432e50fadb740af4","observation_id":"11729ae4-7e6f-4177-b07f-e09cc9c8cd7b","resolution":{"observed_at":"2026-08-08T15:38:17.139189Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.08567","last_updated":"2024-06-03T14:15:03Z","snapshot_observed_at":"2026-08-09T09:14:39.779608Z","submitted_at":"2024-02-13T16:06:17Z","title":"Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.08567","snapshot_observed_at":"2026-08-08T15:38:17.143275Z","title":"Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":27,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.143275Z"},"links":{"cited_paper":"/paper/2402.08567","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:4cb61b14b54dd93bdf02ad208d50cd1556cca6b38c58457c5d17a5d085735ecd","observation_id":"f32d0cc9-7686-4cc0-aa81-9e02a377b1de","resolution":{"observed_at":"2026-08-08T15:38:17.143275Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2404.03027","last_updated":"2024-11-24T06:22:37Z","snapshot_observed_at":"2026-08-06T14:20:00.145899Z","submitted_at":"2024-04-03T19:23:18Z","title":"JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2404.03027","snapshot_observed_at":"2026-08-08T15:38:17.147602Z","title":"Jailbreakv: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":28,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.147602Z"},"links":{"cited_paper":"/paper/2404.03027","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:e502cea3a885cb31cd26a82aee9a56214031415d967542df5bee33655c5b1058","observation_id":"e4461dbd-432b-4e2f-b074-9f31f946ceee","resolution":{"observed_at":"2026-08-08T15:38:17.147602Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2205.01068","last_updated":"2022-06-21T17:04:40Z","snapshot_observed_at":"2026-08-06T03:13:37.403059Z","submitted_at":"2022-05-02T17:49:50Z","title":"OPT: Open Pre-trained Transformer Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2205.01068","snapshot_observed_at":"2026-08-08T15:38:17.152111Z","title":"Opt: Open pre-trained transformer language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":29,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.152111Z"},"links":{"cited_paper":"/paper/2205.01068","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ae98cbaabbf49b2bc2d3d24e50a20c2667e57c1d232be7ae8653140da47aac31","observation_id":"16c56381-9fb9-4393-9292-6c4bbff720c2","resolution":{"observed_at":"2026-08-08T15:38:17.152111Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.156459Z","title":"Scaling instruction-finetuned language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":30,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.156459Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ced5be7e0034c632c5496d6dc0b17d8a85aed8ca1bec5d5952f151439caf01e3","observation_id":"983b002b-3f83-4f76-a676-5d9ef691c433","resolution":{"observed_at":"2026-08-08T15:38:17.156459Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2308.01390","last_updated":"2023-08-07T17:53:09Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-08-02T19:10:23Z","title":"OpenFlamingo: An Open-Source Framework for Training Large Autoregressive Vision-Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2308.01390","snapshot_observed_at":"2026-08-08T15:38:17.160454Z","title":"Openflamingo: An open-source framework for training large autoregressive vision-language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":31,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.160454Z"},"links":{"cited_paper":"/paper/2308.01390","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:449fb17d9865991192b6cbd1a4c5b63f4903c862c307b91768990b8e2b0ab6c1","observation_id":"edddaa3f-a9ee-4945-bae4-2ae520539233","resolution":{"observed_at":"2026-08-08T15:38:17.160454Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.164950Z","title":"Introducing mpt-7b: A new standard for open- source, commercially usable llms,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":32,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.164950Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:5b880faf1ff576122c05da7aa1ee7bc048af494ac978e85d108cac05c94e64e8","observation_id":"5c14a08b-325f-4be1-aaf3-66564b0eb654","resolution":{"observed_at":"2026-08-08T15:38:17.164950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.169487Z","title":"Releasing 3b and 7b redpajama-incite family of models including base, instruction-tuned and chat models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":33,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.169487Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:813d93ed1399489d2b3f5c1817a00f62a56011e84d47d42229f351b66a96d654","observation_id":"3416eb19-6004-46f8-980b-2cfd858a6705","resolution":{"observed_at":"2026-08-08T15:38:17.169487Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2304.15010","last_updated":"2023-04-28T17:59:25Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-04-28T17:59:25Z","title":"LLaMA-Adapter V2: Parameter-Efficient Visual Instruction Model","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2304.15010","snapshot_observed_at":"2026-08-08T15:38:17.173697Z","title":"Llama-adapter v2: Parameter-efficient visual instruction model,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":34,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.173697Z"},"links":{"cited_paper":"/paper/2304.15010","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:91fd2726ca5a8493bf166d025370886cb2369a0ab43b617fc10757e497550f8c","observation_id":"bdc303a5-d975-4f94-b9d6-8dc809e39f17","resolution":{"observed_at":"2026-08-08T15:38:17.173697Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2306.05425","last_updated":"2023-06-08T17:59:56Z","snapshot_observed_at":"2026-07-06T15:40:24.127663Z","submitted_at":"2023-06-08T17:59:56Z","title":"MIMIC-IT: Multi-Modal In-Context Instruction Tuning","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2306.05425","snapshot_observed_at":"2026-08-08T15:38:17.178121Z","title":"Mimic-it: Multi-modal in-context instruction tuning,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":35,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.178121Z"},"links":{"cited_paper":"/paper/2306.05425","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:3a55cf428e4199aefd518434de12bf4b87608a1ab8d28ad430f283aeec61cfb5","observation_id":"4f146210-a6f6-425d-98f6-66988df75d7c","resolution":{"observed_at":"2026-08-08T15:38:17.178121Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.182522Z","title":"Gpt-4v(ision) system card,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":36,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.182522Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:655e5d76366107e43cba195ccf545a1c25aed02ce6f62230aec3e875f1aa0d2b","observation_id":"d114bf67-f0b6-4562-9331-e42f5946f563","resolution":{"observed_at":"2026-08-08T15:38:17.182522Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2303.08774","last_updated":"2024-03-04T06:01:33Z","snapshot_observed_at":"2026-08-07T07:30:12.213965Z","submitted_at":"2023-03-15T17:15:04Z","title":"GPT-4 Technical Report","version":6},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2303.08774","snapshot_observed_at":"2026-08-08T15:38:17.186790Z","title":"Gpt-4 technical report,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":37,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.186790Z"},"links":{"cited_paper":"/paper/2303.08774","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:4ad37a986a0b3aa4c6495df4f2c0c0b76b379561c24b480445f043952997c9a0","observation_id":"8c7cf713-d876-4f54-a548-41487f2a4a10","resolution":{"observed_at":"2026-08-08T15:38:17.186790Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.190925Z","title":"Gemini: A family of highly capable multimodal models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":38,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.190925Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:1fab5ea76af19d2548eab79282fa53a3b124370be1022717004609fb9be1b6f2","observation_id":"0eb8dd0f-d1cc-4a0c-be49-0ee2c92b8340","resolution":{"observed_at":"2026-08-08T15:38:17.190925Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.194855Z","title":"AI, “Bard,” 2023","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":39,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.194855Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:b8ddafe5963c94e7812ca893d7b542d0bbe22a15427c7acb3eb6f621e8abccfb","observation_id":"a4d978bc-4cfc-4a3a-9fa0-4c829556a078","resolution":{"observed_at":"2026-08-08T15:38:17.194855Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2007.10760","last_updated":"2020-08-02T08:38:25Z","snapshot_observed_at":"2026-08-09T12:13:44.628029Z","submitted_at":"2020-07-21T12:49:12Z","title":"Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2007.10760","snapshot_observed_at":"2026-08-08T15:38:17.198969Z","title":"Backdoor attacks and countermeasures on deep learning: A comprehensive review,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":40,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.198969Z"},"links":{"cited_paper":"/paper/2007.10760","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:6a26477bbecbce79e1672a9aa9eb7343ee2ea800752b6469bcf57ed2afc4c968","observation_id":"b7fd3fdd-3840-4f90-9b56-b47225b8d540","resolution":{"observed_at":"2026-08-08T15:38:17.198969Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.203461Z","title":"High- resolution image synthesis with latent diffusion models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":41,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.203461Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:fec0c08c37e987393c99a06329cae42d1337acf1292f1fe2f223baaca8e30a99","observation_id":"5625fcc6-37d1-415f-80bb-faa10be4830e","resolution":{"observed_at":"2026-08-08T15:38:17.203461Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.01952","last_updated":"2023-07-04T23:04:57Z","snapshot_observed_at":"2026-07-06T02:11:23.670680Z","submitted_at":"2023-07-04T23:04:57Z","title":"SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.01952","snapshot_observed_at":"2026-08-08T15:38:17.207019Z","title":"Sdxl: Improving latent diffusion models for high-resolution image synthesis,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":42,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.207019Z"},"links":{"cited_paper":"/paper/2307.01952","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f8fe041893e948438869d98ba33bd7d893f1c79abace999395691f63e5f8e5de","observation_id":"a177be31-e27d-4e68-8ddf-e0b80f2dcfb6","resolution":{"observed_at":"2026-08-08T15:38:17.207019Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.210902Z","title":"Zero-shot text-to-image generation,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":43,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.210902Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:744f0fb2ed2542542001572786bf75a33076198cee5882202ba99fcc95335e13","observation_id":"ed837fdc-ba9a-4819-bc70-5edd775120a1","resolution":{"observed_at":"2026-08-08T15:38:17.210902Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.214490Z","title":"Imagenet: A large-scale hierarchical image database,","venue":null,"work_id":null,"year":2009},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":44,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.214490Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:99806c8727f0eb5e534daeec47bd2fa4eda5e7f4e9510dbd890431b8108621d2","observation_id":"1100fcc0-ad9e-4ec8-9b38-c0bf3599914a","resolution":{"observed_at":"2026-08-08T15:38:17.214490Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.218337Z","title":"Microsoft coco: Common objects in context,","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":45,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.218337Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:1b30b1a60afc2c01bbc500ec9932ea76939e23a56bf5936de8f43f56c2aa6d61","observation_id":"e3f4e440-2293-4a9d-af2e-25122a822280","resolution":{"observed_at":"2026-08-08T15:38:17.218337Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.221963Z","title":"Flickr30k entities: Collecting region-to- phrase correspondences for richer image-to-sentence models,","venue":null,"work_id":null,"year":2015},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":46,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.221963Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ef9c4100490751a37d66e1d1e00cc88eea064914af9d7ecd9f5ee96e3c4cb350","observation_id":"ac85e91c-d502-4609-b080-0ce4f68c9b18","resolution":{"observed_at":"2026-08-08T15:38:17.221963Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.225531Z","title":"Making the v in vqa matter: Elevating the role of image understanding in visual question answering,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":47,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.225531Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:39e0cac8ef6f5ed3cca28f0d91ca40b145f16d385d1300194d802b3abfb0946d","observation_id":"32692a65-3f1f-48d9-a6b6-76a59f1c9991","resolution":{"observed_at":"2026-08-08T15:38:17.225531Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2009.11462","last_updated":"2020-09-25T20:22:26Z","snapshot_observed_at":"2026-08-09T05:10:26.091710Z","submitted_at":"2020-09-24T03:17:19Z","title":"RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2009.11462","snapshot_observed_at":"2026-08-08T15:38:17.229098Z","title":"Realtoxicityprompts: Evaluating neural toxic degeneration in language models,","venue":null,"work_id":null,"year":2020},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":48,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.229098Z"},"links":{"cited_paper":"/paper/2009.11462","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f7b935405e22673b03c39db5a8428277754ac1aa5f9b4040b565912561a97a68","observation_id":"a1c67bea-2577-4d10-a065-eb1c50eb896a","resolution":{"observed_at":"2026-08-08T15:38:17.229098Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.233181Z","title":"Laion-coco,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":49,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.233181Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:2a4b82627b480b7b1488d2db0f52018bba939de3859b538187921001d42d0ab0","observation_id":"1e710829-82aa-40cb-95e4-a2246126d1d5","resolution":{"observed_at":"2026-08-08T15:38:17.233181Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.237161Z","title":"Stanford alpaca: An instruction- following llama model,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":50,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.237161Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:88ca3d7007d2657d6d1af5bdd5aa6badaf7d25a5bd12886a339f0dfae64ac72f","observation_id":"bab26b47-e212-4fc4-9b81-845154b749c6","resolution":{"observed_at":"2026-08-08T15:38:17.237161Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2307.15043","last_updated":"2023-12-20T20:48:57Z","snapshot_observed_at":"2026-07-06T15:59:23.019044Z","submitted_at":"2023-07-27T17:49:12Z","title":"Universal and Transferable Adversarial Attacks on Aligned Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2307.15043","snapshot_observed_at":"2026-08-08T15:38:17.241278Z","title":"Universal and transferable adversarial attacks on aligned language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":51,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.241278Z"},"links":{"cited_paper":"/paper/2307.15043","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:69a2f12480149c678557722a14f8514dd92a62d256e58cdf651fb4278fe1e65b","observation_id":"3aa30c57-54e4-4291-a717-b60c00693bfe","resolution":{"observed_at":"2026-08-08T15:38:17.241278Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.05608","last_updated":"2025-01-19T16:23:38Z","snapshot_observed_at":"2026-07-06T16:45:24.070954Z","submitted_at":"2023-11-09T18:59:11Z","title":"FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.05608","snapshot_observed_at":"2026-08-08T15:38:17.245674Z","title":"Figstep: Jailbreaking large vision-language models via typographic visual prompts,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":52,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.245674Z"},"links":{"cited_paper":"/paper/2311.05608","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:87535942a1889089b66cea4cd9c9b879c09864447e2c6963395006ea15a4af82","observation_id":"ee3a88df-54f0-4c89-9c74-a5b3a3237360","resolution":{"observed_at":"2026-08-08T15:38:17.245674Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.09346","last_updated":"2024-12-28T07:32:00Z","snapshot_observed_at":"2026-07-06T17:44:33.793754Z","submitted_at":"2024-03-14T12:51:07Z","title":"B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.09346","snapshot_observed_at":"2026-08-08T15:38:17.250038Z","title":"Avibench: Towards evaluating the robustness of large vision-language model on adversarial visual-instructions,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":53,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.250038Z"},"links":{"cited_paper":"/paper/2403.09346","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:23debc8be4b3173b00cc78f529d33d5928127eb48641545bfc1a6296db04a97f","observation_id":"46bc22fa-4bd9-47a4-a302-53cf613a35be","resolution":{"observed_at":"2026-08-08T15:38:17.250038Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.17600","last_updated":"2024-06-19T08:32:14Z","snapshot_observed_at":"2026-07-06T16:54:22.039181Z","submitted_at":"2023-11-29T12:49:45Z","title":"MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models","version":5},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.17600","snapshot_observed_at":"2026-08-08T15:38:17.254478Z","title":"Mm-safetybench: A benchmark for safety evaluation of multimodal large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":54,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.254478Z"},"links":{"cited_paper":"/paper/2311.17600","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ba81b2d34683a7a3cdf1adb3cfb5cf8875103fa19c840e52a480bdeda2ba9aae","observation_id":"f11ade04-d062-432e-aca9-7a1f0d77267a","resolution":{"observed_at":"2026-08-08T15:38:17.254478Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.258909Z","title":"Arondight: Red teaming large vision language models with auto-generated multi-modal jailbreak prompts,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":55,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.258909Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:1d3e5aa831cf5e13da33498a4c23557b217281b7e12ac40cd8eb7678eb944f14","observation_id":"521af43c-1569-4d88-9ae6-c5dfa1c93189","resolution":{"observed_at":"2026-08-08T15:38:17.258909Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2501.04931","last_updated":"2025-06-27T10:07:29Z","snapshot_observed_at":"2026-08-09T10:00:38.301366Z","submitted_at":"2025-01-09T02:47:01Z","title":"Jailbreaking Multimodal Large Language Models via Shuffle Inconsistency","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2501.04931","snapshot_observed_at":"2026-08-08T15:38:17.263253Z","title":"Jailbreaking multimodal large language models via shuffle inconsistency,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":56,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.263253Z"},"links":{"cited_paper":"/paper/2501.04931","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:1121c83714e6a0ee73f8bb4bbdeffc07b1e3cd43ac7bf1fb7626820cd245a445","observation_id":"41103c7b-89af-4865-9aa5-3ae0ef32b93e","resolution":{"observed_at":"2026-08-08T15:38:17.263253Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.268038Z","title":"Unsafe diffusion: On the generation of unsafe images and hateful memes from text-to-image models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":57,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.268038Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:0aa27a9a4d170bd2ff2c14e2310983b7724d3f73df5699df30a41e5db33989e5","observation_id":"7ea2d64e-8301-4b41-9f70-5da442bf8d5c","resolution":{"observed_at":"2026-08-08T15:38:17.268038Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.272280Z","title":"White-box multimodal jailbreaks against large vision-language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":58,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.272280Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:7cb5278788cc201d2fe6ce69d581992e195e2571c6341c2a823298320cc96fe2","observation_id":"8f76bc81-b1b7-4a23-8d96-39574b69da3a","resolution":{"observed_at":"2026-08-08T15:38:17.272280Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.276363Z","title":"Visual adversarial examples jailbreak aligned large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":59,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.276363Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d68b2a92b9e337b1da326373b1fcf2bfc80ab6f3ba3b0f8d939b7d207cd30f12","observation_id":"708e9679-eccd-4a47-a55c-56ee013447f4","resolution":{"observed_at":"2026-08-08T15:38:17.276363Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.11868","last_updated":"2024-07-07T23:10:59Z","snapshot_observed_at":"2026-07-06T16:34:54.717394Z","submitted_at":"2023-10-18T10:36:34Z","title":"To Generate or Not? Safety-Driven Unlearned Diffusion Models Are Still Easy To Generate Unsafe Images ... For Now","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.11868","snapshot_observed_at":"2026-08-08T15:38:17.280459Z","title":"To generate or not? safety-driven unlearned diffusion models are still easy to generate unsafe images ... for now,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":60,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.280459Z"},"links":{"cited_paper":"/paper/2310.11868","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:a5c57f4295b6811c77f0fa7cd00c4095b0da0c39f6983725d32506d339ed8b51","observation_id":"678e795e-b5be-45ba-8444-16542a03c308","resolution":{"observed_at":"2026-08-08T15:38:17.280459Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.10012","last_updated":"2024-06-07T02:48:59Z","snapshot_observed_at":"2026-07-06T16:33:26.145691Z","submitted_at":"2023-10-16T02:11:20Z","title":"Ring-A-Bell! How Reliable are Concept Removal Methods for Diffusion Models?","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.10012","snapshot_observed_at":"2026-08-08T15:38:17.285032Z","title":"Ring-a-bell! how reliable are concept removal methods for diffusion models?","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":61,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.285032Z"},"links":{"cited_paper":"/paper/2310.10012","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:18759f7820e6ddf7cb4fd8044a310a47f3283541203aefa7828d101fcb42922a","observation_id":"d5283b45-37d3-493e-b99f-6cd61d3b3c6c","resolution":{"observed_at":"2026-08-08T15:38:17.285032Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.289387Z","title":"Are aligned neural networks adversarially aligned?","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":62,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.289387Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d73089e5a0cad6200e0173cdfc0f4813a0b7234ef8a1c5b8886f34263ad7fce0","observation_id":"83fb702f-4757-4424-8500-8ad9bc8d54a9","resolution":{"observed_at":"2026-08-08T15:38:17.289387Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.293414Z","title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":63,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.293414Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:f338e5706f9223724bc968362d3fd7c11837afaecdb5efa0a14de136e3f2f71e","observation_id":"e90ebd9a-795b-42d7-8e1c-cc832f82d4dc","resolution":{"observed_at":"2026-08-08T15:38:17.293414Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.297509Z","title":"Extracting training data from large language models,","venue":null,"work_id":null,"year":2021},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":64,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.297509Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:e6adf79484a345e14f45b58f5e9265f724e1d46b2fc0bb4ab9a2e1bdb7ac5248","observation_id":"fa808e8d-d9f1-40b2-9d2c-2f32762d6ecd","resolution":{"observed_at":"2026-08-08T15:38:17.297509Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.301812Z","title":"Va3: Virtually assured am- plification attack on probabilistic copyright protection for text-to- image generative models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":65,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.301812Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:fd83918287e9634ab0d76cd4f010e46937e23fbe2b7fcc2a48feb24d2e289dd7","observation_id":"1ee4c5d8-a577-4edc-ac4d-6a518faf0807","resolution":{"observed_at":"2026-08-08T15:38:17.301812Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.305857Z","title":"Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":66,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.305857Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:aaf52de8711de26f5130e445b7ba0c5c30330416b36938b677b47f09b7144b22","observation_id":"623ce292-9288-4cca-968f-ae441b468e05","resolution":{"observed_at":"2026-08-08T15:38:17.305857Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.309887Z","title":"Large language models are zero-shot reasoners,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":67,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.309887Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:5eab4fb66a4270555917d4656438a23950ba7b10e5cd7a050b4133f9c2226b8b","observation_id":"cabab675-5987-49ed-ba20-d59e8a0236ca","resolution":{"observed_at":"2026-08-08T15:38:17.309887Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2311.04155","last_updated":"2024-06-21T06:06:07Z","snapshot_observed_at":"2026-07-06T16:44:19.336292Z","submitted_at":"2023-11-07T17:31:50Z","title":"Black-Box Prompt Optimization: Aligning Large Language Models without Model Training","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2311.04155","snapshot_observed_at":"2026-08-08T15:38:17.314113Z","title":"Black-box prompt optimization: Aligning large language models without model training,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":68,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.314113Z"},"links":{"cited_paper":"/paper/2311.04155","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:0b61ccaf6dae17c78f89d8acc0852246da4b2da8b451d48478527bad608b3ffa","observation_id":"24ac7ab2-87d9-43c5-881a-87d8a9933c22","resolution":{"observed_at":"2026-08-08T15:38:17.314113Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.318645Z","title":"Training language models to follow instructions with human feedback,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":69,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.318645Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:9db2f03e68576dff97e23bbda5e3da8c920cfd6bcc742a277990f399342eddc1","observation_id":"fdf0ceed-5041-4a53-84f5-954b56bd6274","resolution":{"observed_at":"2026-08-08T15:38:17.318645Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2305.08844","last_updated":"2023-07-11T18:29:12Z","snapshot_observed_at":"2026-07-06T15:27:25.253387Z","submitted_at":"2023-05-15T17:57:16Z","title":"RL4F: Generating Natural Language Feedback with Reinforcement Learning for Repairing Model Outputs","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2305.08844","snapshot_observed_at":"2026-08-08T15:38:17.323020Z","title":"Rl4f: Generating natural language feed- back with reinforcement learning for repairing model outputs,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":70,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.323020Z"},"links":{"cited_paper":"/paper/2305.08844","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:c2db3cd30b607ef04524b2d4feb92d22837733a37872947643aa0fd3f4fa8eb5","observation_id":"aca12052-b038-4c5e-ac9e-45d7fa2bc64b","resolution":{"observed_at":"2026-08-08T15:38:17.323020Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.327520Z","title":"Dress: Instructing large vision-language models to align and interact with humans via natural language feedback,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":71,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.327520Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:550125064407e5d7382dec5a62253c6d2bf3623c5ad60feba00ac88122d4b2e6","observation_id":"3020da8a-d357-4371-8332-36ae6a9b8ec9","resolution":{"observed_at":"2026-08-08T15:38:17.327520Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2401.02906","last_updated":"2024-06-17T16:53:49Z","snapshot_observed_at":"2026-08-07T09:15:19.297634Z","submitted_at":"2024-01-05T17:05:42Z","title":"MLLM-Protector: Ensuring MLLM's Safety without Hurting Performance","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2401.02906","snapshot_observed_at":"2026-08-08T15:38:17.331678Z","title":"Mllm-protector: Ensuring mllm’s safety without hurting performance,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":72,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.331678Z"},"links":{"cited_paper":"/paper/2401.02906","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:448a76bfc997ce1dcbc505a4625307c1c515dc62d4583049f6bf844a70b38955","observation_id":"cc4414d5-f3bf-409e-84a4-11a15b4ce7c6","resolution":{"observed_at":"2026-08-08T15:38:17.331678Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.02207","last_updated":"2024-06-17T22:26:32Z","snapshot_observed_at":"2026-08-09T09:35:21.862266Z","submitted_at":"2024-02-03T16:43:42Z","title":"Safety Fine-Tuning at (Almost) No Cost: A Baseline for Vision Large Language Models","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.02207","snapshot_observed_at":"2026-08-08T15:38:17.335773Z","title":"Safety fine-tuning at (almost) no cost: A baseline for vision large language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":73,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.335773Z"},"links":{"cited_paper":"/paper/2402.02207","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:a7c91cadead102a0777379ce634c959e1075795f60f0a09c72f31e6852ad3663","observation_id":"5fa57646-fe9f-4fef-ae7e-95bd036355e5","resolution":{"observed_at":"2026-08-08T15:38:17.335773Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.340113Z","title":"Eyes closed, safety on: Protecting multimodal llms via image-to-text transformation,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":74,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.340113Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:6949c9f5a1a04cad52a66d6a05afc0506ab0bd2cdac782b154c897f07923e999","observation_id":"1f6b0708-eff5-43d3-b9f1-d5d481deebad","resolution":{"observed_at":"2026-08-08T15:38:17.340113Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2312.10766","last_updated":"2025-03-15T00:49:45Z","snapshot_observed_at":"2026-07-06T17:04:17.738921Z","submitted_at":"2023-12-17T17:02:14Z","title":"JailGuard: A Universal Detection Framework for LLM Prompt-based Attacks","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2312.10766","snapshot_observed_at":"2026-08-08T15:38:17.343991Z","title":"Jailguard: A universal detection framework for llm prompt-based attacks,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":75,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.343991Z"},"links":{"cited_paper":"/paper/2312.10766","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:9cdaa679c183d615dfdb306e1d96d9df4dbfbea57725364ddddbfa4f2a72f4f6","observation_id":"99c2107b-9d2b-4ff9-b4ff-020b4345d0ef","resolution":{"observed_at":"2026-08-08T15:38:17.343991Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.09513","last_updated":"2024-03-14T15:57:13Z","snapshot_observed_at":"2026-07-06T17:44:41.822709Z","submitted_at":"2024-03-14T15:57:13Z","title":"AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.09513","snapshot_observed_at":"2026-08-08T15:38:17.348048Z","title":"Adashield: Safeguard- ing multimodal large language models from structure-based attack via adaptive shield prompting,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":76,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.348048Z"},"links":{"cited_paper":"/paper/2403.09513","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:e6aab231bf8ea5d7ed789166035f4dca0c4e04a3ae33a14820caa0473f52648d","observation_id":"fb549679-a2df-41f3-ba76-183bff6136c9","resolution":{"observed_at":"2026-08-08T15:38:17.348048Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.352864Z","title":"Adversarial illusions in multi-modal embeddings,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":77,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.352864Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:95e0b3efb9f5b160facb26f81fd5d84218794fe9ccf4be3868af2d4aef252a1f","observation_id":"347259e9-cd97-49d3-8e8d-41f127fdb9cb","resolution":{"observed_at":"2026-08-08T15:38:17.352864Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.357496Z","title":"Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":78,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.357496Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:560df3b0f9903a56f8f58833d7206347ef6729a5b61ef74aec097550f6f5727d","observation_id":"e21fc647-f769-4fea-99a0-637a2626a322","resolution":{"observed_at":"2026-08-08T15:38:17.357496Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.361725Z","title":"Badclip: Trigger- aware prompt learning for backdoor attacks on clip,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":79,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.361725Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:af31cef315c146a42c452237e68af3758a44402c55f54a900b7436d042ab929c","observation_id":"6cd72d6f-3c28-4821-a83a-82c1c71a52e9","resolution":{"observed_at":"2026-08-08T15:38:17.361725Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.365929Z","title":"Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":80,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.365929Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:95578eae012b7826d7e86ce7b9171ad1aa6c1a158902d24f3afaaf5cd853c4fa","observation_id":"d5a2d880-df5d-4819-a307-813218e66dd1","resolution":{"observed_at":"2026-08-08T15:38:17.365929Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2403.09766","last_updated":"2024-03-14T17:59:35Z","snapshot_observed_at":"2026-08-06T02:47:52.285574Z","submitted_at":"2024-03-14T17:59:35Z","title":"An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Models","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.09766","snapshot_observed_at":"2026-08-08T15:38:17.370563Z","title":"An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":81,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.370563Z"},"links":{"cited_paper":"/paper/2403.09766","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:e25b3696e418e903222bf275dc4bec849123d4df2f8efd8721cba179edcaa208","observation_id":"e43542ff-2dbe-4099-94ca-8c6b8de0e925","resolution":{"observed_at":"2026-08-08T15:38:17.370563Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.374971Z","title":"Break the visual perception: Adversarial attacks targeting encoded visual tokens of large vision-language models,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":82,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.374971Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:dd13ab3c13e7973836f7c18aec02bb97dfe44e2fb042c25e3520af953ad23b53","observation_id":"b6cfe0d7-418c-4597-842c-c21e74afd408","resolution":{"observed_at":"2026-08-08T15:38:17.374971Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2310.03185","last_updated":"2023-10-04T22:10:01Z","snapshot_observed_at":"2026-07-06T16:27:55.509482Z","submitted_at":"2023-10-04T22:10:01Z","title":"Misusing Tools in Large Language Models With Visual Adversarial Examples","version":1},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2310.03185","snapshot_observed_at":"2026-08-08T15:38:17.379148Z","title":"Misusing tools in large language models with visual adversarial examples,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":83,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.379148Z"},"links":{"cited_paper":"/paper/2310.03185","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d501eef7f70cd972ff7db1e9db630eac3e439ce8d66755f081533cfbdd19be53","observation_id":"715f514c-6c7c-48bf-9423-830233b485fc","resolution":{"observed_at":"2026-08-08T15:38:17.379148Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.383721Z","title":"Prompt-driven contrastive learning for transferable adversarial attacks,","venue":null,"work_id":null,"year":2025},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":84,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.383721Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:ed29f8b67f7cb4758233920a39f2ea39dc208133aaccd650d9fb5f61c911baaf","observation_id":"da0d21db-ba63-41b2-967b-01947986e400","resolution":{"observed_at":"2026-08-08T15:38:17.383721Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2411.16721","last_updated":"2025-05-01T22:22:43Z","snapshot_observed_at":"2026-07-06T19:56:48.086175Z","submitted_at":"2024-11-23T02:17:17Z","title":"Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2411.16721","snapshot_observed_at":"2026-08-08T15:38:17.387834Z","title":"Steering away from harm: An adaptive approach to defending vision language model against jailbreaks,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":85,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.387834Z"},"links":{"cited_paper":"/paper/2411.16721","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:b500e9886323e3656f0a4fe1d932ba0257e3b09f56b08a76134b6d7d65e9930d","observation_id":"395a51a3-4556-4e29-8cee-74623948076a","resolution":{"observed_at":"2026-08-08T15:38:17.387834Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.392810Z","title":"Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":86,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.392810Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:2220536d4309ccc49989d0d2959cdf8a2137b47476c0f8cc3a8ace38c022ba5c","observation_id":"24d757c0-3786-4b74-83e2-fbd6c3eb2232","resolution":{"observed_at":"2026-08-08T15:38:17.392810Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.397009Z","title":"Slowlidar: Increasing the latency of lidar-based detection using adversarial exam- ples,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":87,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.397009Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:31825e0d8f34b66d1301da9e497702d4d163bb9a2b146fba60894bf23e59aa2b","observation_id":"5cc07c5e-937b-4b1a-8724-f3c748fb577e","resolution":{"observed_at":"2026-08-08T15:38:17.397009Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.401241Z","title":"The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":88,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.401241Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:b18a7e34d1d4a83e43ff2c25cc69462b5ee3f458cfa185586a405212c5840309","observation_id":"3cc0603d-1d78-488a-b509-d0acdf803e9a","resolution":{"observed_at":"2026-08-08T15:38:17.401241Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.405556Z","title":"Chain-of-thought prompting elicits reasoning in large language models,","venue":null,"work_id":null,"year":2022},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":89,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.405556Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:9c4c4fd015ef690c6cad16e2b8a5f7909b744c5bf3e51cec4c0500c34c3b36b7","observation_id":"27d46af8-06b9-41d9-8eca-990a446d7cb5","resolution":{"observed_at":"2026-08-08T15:38:17.405556Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2203.11171","last_updated":"2023-03-07T17:57:37Z","snapshot_observed_at":"2026-07-06T12:50:22.773056Z","submitted_at":"2022-03-21T17:48:52Z","title":"Self-Consistency Improves Chain of Thought Reasoning in Language Models","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2203.11171","snapshot_observed_at":"2026-08-08T15:38:17.409426Z","title":"Self-consistency improves chain of thought rea- soning in language models,","venue":null,"work_id":null,"year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":90,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.409426Z"},"links":{"cited_paper":"/paper/2203.11171","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:d4a05faac62910b925dfd0b9b128cb8aae81d64f39b757ac8788741b745bf6dd","observation_id":"04bf9728-5647-4b68-8153-ba90901a86f0","resolution":{"observed_at":"2026-08-08T15:38:17.409426Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"2402.14899","last_updated":"2024-09-22T14:46:30Z","snapshot_observed_at":"2026-08-07T19:07:32.773798Z","submitted_at":"2024-02-22T17:36:34Z","title":"Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2402.14899","snapshot_observed_at":"2026-08-08T15:38:17.413950Z","title":"Stop reasoning! when multimodal llm with chain-of- thought reasoning meets adversarial image,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":91,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.413950Z"},"links":{"cited_paper":"/paper/2402.14899","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:cc91a6797133c4a0c36d6c9f59308249b481f38948d78fa41c9a105c5517b3c8","observation_id":"842c88c7-17ed-4f21-8dbb-e531802b598b","resolution":{"observed_at":"2026-08-08T15:38:17.413950Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1412.6572","last_updated":"2015-03-20T20:19:16Z","snapshot_observed_at":"2026-07-06T04:04:16.777653Z","submitted_at":"2014-12-20T01:17:12Z","title":"Explaining and Harnessing Adversarial Examples","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1412.6572","snapshot_observed_at":"2026-08-08T15:38:17.418146Z","title":"Explaining and harnessing adversarial examples,","venue":null,"work_id":null,"year":2014},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":92,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.418146Z"},"links":{"cited_paper":"/paper/1412.6572","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:a584d91926cad38e0498bb74980f4e9b0d61a1c49e5cff4e256aae10f82573a2","observation_id":"d3cb49b6-d9e9-4162-bbb9-7fc7ad644f0e","resolution":{"observed_at":"2026-08-08T15:38:17.418146Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1607.02533","last_updated":"2017-02-11T00:39:39Z","snapshot_observed_at":"2026-07-06T05:02:57.607157Z","submitted_at":"2016-07-08T21:12:11Z","title":"Adversarial examples in the physical world","version":4},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1607.02533","snapshot_observed_at":"2026-08-08T15:38:17.422466Z","title":"Adversarial examples in the physical world,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":93,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.422466Z"},"links":{"cited_paper":"/paper/1607.02533","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:05b947839d06b987d9866c083e12a9684d5ed2d6fcdff06f0b9575a8dd6eb94f","observation_id":"5e13c29d-db2d-4fc5-b128-4ad787e5a1ba","resolution":{"observed_at":"2026-08-08T15:38:17.422466Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.427191Z","title":"Towards deep learning models resistant to adversarial attacks,","venue":null,"work_id":null,"year":2017},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":94,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.427191Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:87b198ed2946a962648547410dddcdd7ff91f90e501033a4a5946f42ee5ef3b6","observation_id":"63a5e170-3e13-4c20-9864-c3fefbd01bd3","resolution":{"observed_at":"2026-08-08T15:38:17.427191Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:17.431794Z","title":"Boosting adversarial attacks with momentum,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":95,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.431794Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:609ad757682c5304866fa1248bf44557cf5c56840379cb70116ab39ec535bc7d","observation_id":"96a42497-ffce-4860-ae27-4461d962c1b0","resolution":{"observed_at":"2026-08-08T15:38:17.431794Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:18.862431Z","title":"On the adversarial robustness of multi- modal foundation models,","venue":null,"work_id":"c4313180-a4cd-4475-9f46-18ed250a0d90","year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":96,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.436070Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:6030f46b7abc4748d8045eed7f0e86397665e1d87d98a3e2fc384188a5d80955","observation_id":"7e134122-f8e5-49f0-8480-91fcb4c8d387","resolution":{"observed_at":"2026-08-08T15:38:18.866336Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:18.847846Z","title":"Transferable multimodal attack on vision-language pre- training models,","venue":null,"work_id":"cfb76552-9927-41a6-94ee-b9953d1b318c","year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":97,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.440408Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:39833e7bfb4597a7155e752ee4d8441375098faf13b62808acc4bd33ea79b928","observation_id":"796a9483-6eea-4aed-93bf-0e36a26ff584","resolution":{"observed_at":"2026-08-08T15:38:18.852715Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":null,"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":"raw_reference","pith_arxiv_id":null,"snapshot_observed_at":"2026-08-08T15:38:18.834036Z","title":"Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models,","venue":null,"work_id":"2ea41f3a-46e5-41a9-9d58-0a7e16ebd844","year":2023},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":98,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.444773Z"},"links":{"citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:64ee0d39c25d3849fc241866e3a6e47a4998943b23f082cce3818235c55bf01e","observation_id":"74fc4860-c25d-4864-acb5-a8d646622cc4","resolution":{"observed_at":"2026-08-08T15:38:18.838566Z","resolver_source":"raw_fallback","status":"verified_fuzzy"},"standing_notice":{"events":[],"observation":"No event found in the named queried sources as of 2026-08-09T06:31:02.800959+00:00.","reason":null,"source_receipts":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"state":"measured"}},{"citation":{"cited_paper":{"arxiv_id":"2403.12445","last_updated":"2024-07-14T15:58:57Z","snapshot_observed_at":"2026-08-09T07:30:34.621176Z","submitted_at":"2024-03-19T05:10:10Z","title":"Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectory","version":3},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"2403.12445","snapshot_observed_at":"2026-08-08T15:38:17.449204Z","title":"Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory,","venue":null,"work_id":null,"year":2024},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":99,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.449204Z"},"links":{"cited_paper":"/paper/2403.12445","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:b00cc8f66e8ace4b783141b3aa04bb074034e10ba980e7e82bbf080af6dec610","observation_id":"f730f568-73ba-451a-927c-a27f96afe440","resolution":{"observed_at":"2026-08-08T15:38:17.449204Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}},{"citation":{"cited_paper":{"arxiv_id":"1712.09665","last_updated":"2018-05-17T01:44:59Z","snapshot_observed_at":"2026-07-06T06:16:16.225385Z","submitted_at":"2017-12-27T20:03:51Z","title":"Adversarial Patch","version":2},"cited_work":{"arxiv_id":null,"doi":null,"metadata_source":null,"pith_arxiv_id":"1712.09665","snapshot_observed_at":"2026-08-08T15:38:17.453227Z","title":"Adversarial patch,","venue":null,"work_id":null,"year":2018},"citing_paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs","version":2},"reference_index":100,"source":"pdf_text","source_observed_at":"2026-08-08T15:38:17.453227Z"},"links":{"cited_paper":"/paper/1712.09665","citing_paper":"/paper/2502.06390"},"observation_digest":"sha256:7149c2fa71875295f7f9a3c2843e45c69ca355b3eb40bdffff7cea70dcba04a1","observation_id":"28158ef0-3b69-49a8-b5e6-5c1c8098beb6","resolution":{"observed_at":"2026-08-08T15:38:17.453227Z","resolver_source":null,"status":"unresolved"},"standing_notice":{"events":[],"reason":"canonical_work_link_unavailable","source_receipts":[],"state":"unavailable"}}],"paper":{"arxiv_id":"2502.06390","last_updated":"2025-02-11T04:42:24Z","latest_version":2,"primary_category":"cs.CV","snapshot_observed_at":"2026-08-09T09:14:59.400822Z","submitted_at":"2025-02-10T12:20:08Z","title":"When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs"},"reference_resolution":{"displayed":100,"state_counts":{"malformed_identifier":0,"metadata_mismatch":0,"parse_uncertain":0,"unresolved":97,"verified_exact":0,"verified_fuzzy":3},"total_outbound_references":130},"refusal":"A citation records a reference. It does not transfer a finding from one paper to another.","schema":"pith.paper-citation-record.v1","standing_sources":[{"observed_at":"2026-08-09T06:31:02.800959+00:00","source":"crossref"},{"observed_at":"2026-08-09T06:30:57.326959+00:00","source":"retraction_watch"}],"thesis":"As of 9 August 2026, this Paper Citation Record lists 100 of 130 outbound references and 0 inbound Pith citation observations for arXiv:2502.06390."}