Pith. sign in

REVIEW 4 major objections 5 minor 39 references

DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities

T0 review · 4 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a white-box attacker can make DeepSeek Janus describe a chosen target scene instead of the actual image by matching mean-pooled vision embeddings, achieving up to 98.0% hallucination rates on open-ended questions…

desk verdict A plausible embedding attack that works on Janus-Pro 7B, but the 98% figure rests on an unvalidated judge and the 1B claim isn't backed by the data. read the letter →

arxiv 2502.07905 v1 pith:BLDWNUJW submitted 2025-02-11 cs.CV cs.LG

Chashi Mahiul Islam , Samuel Jacob Chacko , Preston Horne , Xiuwen Liu This is my paper · ORCID
classification cs.CVcs.LG
keywords MultimodalLargeLanguageModelsEmbeddingManipulationAttacksDeepSeekJanusVision-LanguageSecurityTargetedHallucinationsAdversarialMachineLearning
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that DeepSeek Janus, an open-source multimodal language model, can be made to 'see' content that is not in the image. The attack is a white-box one: starting from a real source image, the attacker runs gradient descent on the image pixels so that the model's mean-pooled vision embedding matches the embedding of a chosen target image. On open-ended questions the manipulated images reportedly trigger hallucinations up to 98.0% of the time while keeping structural similarity to the source above 0.88 SSIM, and both the 1B and 7B Janus Pro variants are said to be vulnerable. If this holds, then any deployment that trusts an MLLM's visual description on security-sensitive content is exposed, because the picture still looks normal to a casual observer.

What carries the argument

The load-bearing object is the mean-pooled patch embedding $\overline{e} = g(f_v(x)) = \frac{1}{N}\sum_{i=1}^N e_i$, the single averaged vector that DeepSeek's vision encoder sends onward to the language model. The attack treats that vector as the target of optimization: with $x_a$ initialized as the source image and $e_t$ computed from the target image, it runs Adam on pixels to minimize the MSE $\|\overline{e}_a - \overline{e}_t\|_2^2$ until $\|\overline{e}_a - \overline{e}_t\|_2^2 \le \tau_l$ and the cosine similarity is $\ge \tau_c$, with $\tau_l = 1.44$ and $\tau_c = 0.95$. Because only the mean embedding is matched, the manipulated image need not look like the target at all, which is why SSIM with the source stays high while the model's reported content flips toward the target.

What would settle it

Take a random sample of, say, 200 optimized-image responses from the COCO open-ended condition and have independent human annotators (blind to the attack) mark whether the response mentions target-image content, then compare their labels to the LLaMA judge's PASS/FAIL outputs; a large disagreement would show the reported hallucination rates are an artifact of the judge. A second check: run the same judge on original-image responses after removing the ground-truth sentence from the prompt; if the PASS/FAIL pattern changes sharply, the judge is relying on the prompt's ground truth rather than on the model response.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that DeepSeek Janus Pro's vision-language bridge has a representation vulnerability: the entire content signal the language model receives is the mean-pooled patch embedding, so aligning that single vector is enough to redirect what the model reports. The paper demonstrates that optimizing the source image to minimize $\|g(f_v(x_a)) - g(f_v(x_t))\|_2^2$ produces images that are visually close to the source but semantically read as the target. Hallucination rates reach 98.0% for open-ended baseline questions on COCO at learning rate 0.001, and closed-form questions reach 99.5% at 0.007; DALL·E 3 and SVIT also show strong but somewhat lower rates. The attack was generated with Janus Pro 7B and transfers partially to Janus Pro 1B, meaning the vulnerability is not an artifact of one model size. The paper also introduces its evaluation instrument, a LLaMA-3.1 8B Instruct-based judge, and a 600-plus-pair benchmark called LSD-Hallucination.

Load-bearing premise

The entire quantitative case rests on LLaMA-3.1 8B Instruct's PASS/FAIL verdicts from a hand-written prompt that declares any response containing target-image elements a hallucination, and no human validation or inter-rater agreement for that judge is reported.

Editorial extensions

If this is right

  • A white-box attacker who can run gradients through the vision encoder can craft images that make Janus Pro report a chosen target scene instead of the actual one, including on open-ended questions.
  • Both Janus Pro 1B and 7B are affected; the 7B model shows stronger source-to-target semantic shift, and attacks transfer to the 1B model only partially.
  • Closed-form 'do you see X' questions are at least as susceptible as open-ended ones, so simple yes/no visual safety filters would not stop the attack.
  • At learning rate 0.001 the manipulated images keep SSIM above 0.88 with the source, so visual inspection or standard image-quality checks are unlikely to flag them.
  • The reported trade-off between learning rate and quality means hallucination rate and visual stealth can be dialed up or down depending on the attacker's goals.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the same mean-pooled embedding feeds the language model in other open multimodal LLMs, the attack should transfer there too; the paper tests only DeepSeek Janus Pro.
  • A testable extension is to match only a subset of patch embeddings or per-patch statistics; if that also induces hallucinations, then the vulnerability is not about the pooled mean alone but about the encoder's internal geometry.
  • Calibrating the LLaMA-3.1 judge against human annotators on a random sample would show whether the headline 98.0% is an upper or lower bound for true hallucination frequency.
  • Since the optimization never demands pixel similarity to the target, the attack doubles as evidence that Janus's visual grounding is shallow, a point that bears on any downstream task where local details matter.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper proposes a white-box embedding-manipulation attack against DeepSeek Janus-Pro vision encoders. The attack optimizes a source image in pixel space so that its mean-pooled patch embedding matches that of a target image, then evaluates whether the model's open-ended and closed-form responses mention target-image content. The authors report hallucination rates up to 98% on COCO with SSIM > 0.88, claim that both 1B and 7B variants are susceptible, and introduce a LLaMA-based judge and a dataset of 600+ input-target pairs.

Significance. If the headline numbers are reliable, the paper demonstrates a practical security vulnerability in open-source MLLMs: a white-box adversary can reliably steer a model's description toward a chosen target image while preserving the source image's visual appearance. The work is a useful extension of embedding-space attacks to a mainstream open-weights model family, and the release of the LSD-Hallucination dataset and the explicit Algorithm 1 are positive contributions. The machine-checked attack pipeline and the use of BLEU/ROUGE and SSIM/PSNR provide some convergent evidence that the attack changes outputs and preserves image quality. However, the current evaluation does not yet establish the headline 98% rate or the both-scales susceptibility claim, because the judge is unvalidated and Table 2 omits the model identifier.

major comments (4)
  1. [Section 4.4, Table 2] Table 2 reports hallucination rates without any model column, even though Section 4.3 states that adversarial examples were generated on Janus-Pro 7B and evaluated on both 1B and 7B variants. The reader cannot determine whether the 98.0% COCO baseline figure, or any other value in Table 2, was produced by the 7B model, the 1B model, or some pooled average. Consequently, the abstract's claim that 'both 1B and 7B variants of DeepSeek Janus are susceptible' is not backed by the hallucination-rate evidence; Table 1 shows the 1B model's target-text gains are minimal (e.g., COCO target BLEU-4 +0.01, ROUGE-L +0.01), which is weak support for a strong 1B susceptibility claim. Please add a model column to Table 2, or separate tables per model, and adjust the abstract and conclusion accordingly.
  2. [Appendix A, Section 4.4, Table 2] The LLaMA-based hallucination judge is not validated. The Appendix A prompt instructs the judge to FAIL an optimized-image response if it 'includes ANY elements from the target image,' which is exactly the property the attack's loss function (Eq. 3) is designed to produce. The paper reports no human labeling, no inter-rater agreement, no calibration against a held-out set, and no false-positive analysis on original images. Given that the original-image baseline for COCO target questions is already 10% (Table 2), the judge may be over-triggering on generic words present in both source and target images. Without such validation, all quantitative claims in Table 2 are uncertain, including the headline 98.0%. I recommend validating the judge against human annotations on a random sample of at least 100 responses and reporting agreement rates, per-question-type breakdowns, and error analysis.
  3. [Equation (3), Appendix A, Section 4.4] Related to the previous point, the evaluation is partly circular: the optimization objective (minimizing mean-pooled embedding distance to the target) is the same target-criterion used by the judge to declare FAIL. This is not fully circular because the optimization must still induce the language model to verbalize target content, and the original-image baselines show that the judge does not always trigger. However, the absence of any independent ground-truth measure means the 98% figure could reflect the judge's sensitivity to any target-related phrase rather than a true semantic hallucination. A concrete test: compute hallucination rates on original (non-optimized) images using the same judge and compare with human labels; if the judge's false-positive rate is nonzero on original images (as the 10% target-question baseline suggests), the reported attack success rates should be corrected for this.
  4. [Section 4.3, Section 5] There is a direct contradiction about the effect of model scale. Section 4.3 states that the larger 7B model 'demonstrated both stronger base performance and higher vulnerability to attacks' (with larger target BLEU/ROUGE gains), while the Conclusion states that 'larger models exhibit marginally superior robustness.' These claims cannot both be true, and this inconsistency affects the paper's central message about which model variants are most at risk. Please resolve the contradiction and ensure the abstract and conclusion are consistent with the actual per-model results.
minor comments (5)
  1. [Table 3] Table 3 caption contains a typo: 'Opitmized' should be 'Optimized'.
  2. [Section 4.3] The text contains 'T able 1' with an extra space; please fix the formatting.
  3. [Appendix B] The question transformation prompt changes 'What color is the car?' to 'Do you see any car in this image?', which loses the color attribute; the rule says to keep style questions unchanged, but color is not treated consistently.
  4. [Section 4.2] The paper states that 200 image pairs were randomly selected, but does not report the random seed or the exact selection procedure; please clarify to support reproducibility.
  5. [Abstract, Table 3] The abstract says 'maintaining high visual fidelity (SSIM > 0.88),' but Table 3 shows SSIM values as low as 0.72 at learning rate 0.007; please clarify that the SSIM > 0.88 claim refers to the lr=0.001 configuration.

Circularity Check

1 steps flagged · score 4.0 of 10

The 98% hallucination metric is the attack's own objective relabeled: the loss minimizes embedding distance to the target image and the LLaMA judge FAILs exactly responses containing target elements, so the headline rate is partially self-definitional.

  1. self definitional [Section 3.1, Eq. (3); Appendix A]
    "L = LMSE(g(ea), g(et)) = ∥g(ea) − g(et)∥2 2 (3) where ea = fv(xa) and et = fv(xt) are the patch embeddings of the adversarial and target images respectively. ... For OPTIMIZED image responses: - FAIL if the response includes ANY elements from the target image"

    The attack's loss (Eq. 3) is the squared distance between the adversarial image's pooled embedding and the target image's pooled embedding, so the optimization is explicitly pushing the representation toward the target content. The evaluation prompt then declares an optimized-image response a hallucination (FAIL) precisely when it 'includes ANY elements from the target image.' The reported 'hallucination rate' is therefore, by construction, the rate at which the optimization target appears in the generated text. This is not a fully independent measure of hallucination: it is the attack-success criterion renamed.

full rationale

The central quantitative claim — up to 98.0% hallucination rates (Abstract) — is measured by a LLaMA-3.1 8B judge whose optimized-image criterion is the presence of 'ANY elements from the target image,' which is exactly the semantic target of the embedding loss in Eq. (3). This makes the headline metric partially self-definitional, so I assign 4 rather than 0. It is not higher because the result is an empirical measurement: the optimization could fail to transfer through the language decoder, baseline comparisons exist for original images, and the attack's transferability and visual-fidelity findings (Tables 1 and 3) are not derived from the same criterion. The paper's self-citations to prior work by the same group ([8], [17], [18], [31]) are related-work context and are not load-bearing; no uniqueness theorem or ansatz is imported from them. Separately, the claim that both 1B and 7B variants are susceptible is under-supported: Table 2 has no model column, and Table 1 shows only minimal target-text gains for Janus-Pro 1B (e.g., BLEU-4 Δ 0.00–0.02), so the both-scales conclusion is an evidence gap rather than a circular step.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The ledger shows three domain assumptions: the mean-pooled embedding is a sufficient control channel (Eq. 1-3), the LLaMA judge is a valid proxy for hallucination, and the ground-truth annotations are correct. The free parameters (learning rate, convergence thresholds) are hand-chosen and directly control the reported quality/hallucination trade-off. No new theoretical entities are introduced.

free parameters (3)
  • learning rate = 0.001 and 0.007
    Two values tested; higher rate increases hallucination rates but lowers SSIM from above 0.88 to 0.72-0.74. The abstract's SSIM > 0.88 claim holds only for the lower rate.
  • L2 convergence threshold tau_l = 1.44
    Hand-chosen stopping criterion for the embedding matching optimization in Eq. 4.
  • cosine convergence threshold tau_c = 0.95
    Hand-chosen stopping criterion for the embedding matching optimization in Eq. 4.
assumptions (3)
  • domain assumption Mean-pooled patch embeddings of the vision encoder are a sufficient control channel to shift the language model's semantic interpretation.
    The entire attack optimizes only the mean embedding (Eq. 1-3); if the text decoder were insensitive to this statistic, the attack would fail. This is the core mechanism and is not independently verified.
  • domain assumption LLaMA-3.1 8B Instruct's PASS/FAIL judgments are an accurate proxy for human perception of hallucination.
    All hallucination rates in Table 2 are produced by this judge; no human validation or agreement metric is reported (Section 4.4, Appendix A).
  • domain assumption The ground-truth answers used in evaluation correctly describe the original and target images.
    For COCO, DALL-E 3, and SVIT, the paper adopts existing questions and answers but does not describe how ground truth was verified, so judge errors can compound.

how reviews work

0 comments
Cite this review

Pith. "Pith review of DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities." pith.science (2026). https://pith.science/paper/BLDWNUJW

@misc{pith2026250207905,
  author       = {Pith},
  title        = {Pith review of: DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BLDWNUJW}},
  note         = {Machine review of arXiv:2502.07905}
}
read the original abstract

Multimodal Large Language Models (MLLMs) represent the cutting edge of AI technology, with DeepSeek models emerging as a leading open-source alternative offering competitive performance to closed-source systems. While these models demonstrate remarkable capabilities, their vision-language integration mechanisms introduce specific vulnerabilities. We implement an adapted embedding manipulation attack on DeepSeek Janus that induces targeted visual hallucinations through systematic optimization of image embeddings. Through extensive experimentation across COCO, DALL-E 3, and SVIT datasets, we achieve hallucination rates of up to 98.0% while maintaining high visual fidelity (SSIM > 0.88) of the manipulated images on open-ended questions. Our analysis demonstrates that both 1B and 7B variants of DeepSeek Janus are susceptible to these attacks, with closed-form evaluation showing consistently higher hallucination rates compared to open-ended questioning. We introduce a novel multi-prompt hallucination detection framework using LLaMA-3.1 8B Instruct for robust evaluation. The implications of these findings are particularly concerning given DeepSeek's open-source nature and widespread deployment potential. This research emphasizes the critical need for embedding-level security measures in MLLM deployment pipelines and contributes to the broader discussion of responsible AI implementation.

Figures

Figures reproduced from arXiv: 2502.07905 by the authors.

Figure 1
Figure 1. Examples of induced hallucinations in DeepSeek Janus through adversarial image manipulation. For each pair, we show the original image (green border), the target image (blue border), and the adversarially modified result (red border), along with the model’s responses. with improved training, data scaling, and model size for better multimodal un￾derstanding and text-to-image generation. The transition from traditiona… view at source ↗
Figure 2
Figure 2. Examples of sample questions in our evaluation framework, showing the baseline (top), source (middle), and target (bottom) questions. 4.4 LLaMA-Based Hallucination Detection We developed a systematic evaluation framework using LLaMA-3.1 8B Instruct to detect and quantify hallucinations in vision-language model responses. Our methodology employs a structured approach to questioning that varies both in format and spec… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 13 canonical work pages

  1. [1]

    arXiv preprint arXiv:2303.08774 (2023)

    Achiam, J., Adler, S., Agarwal, S., Ahmad, L., Akkaya, I., Aleman, F.L., Almeida, D., Altenschmidt, J., Altman, S., Anadkat, S., et al.: Gpt-4 technical report. arXiv preprint arXiv:2303.08774 (2023)

    arXiv 2023

  2. [2]

    Advances in neural information processing systems35, 23716– 23736 (2022)

    Alayrac, J.B., Donahue, J., Luc, P., Miech, A., Barr, I., Hasson, Y., Lenc, K., Men- sch, A., Millican, K., Reynolds, M., et al.: Flamingo: a visual language model for few-shot learning. Advances in neural information processing systems35, 23716– 23736 (2022)

    2022

  3. [3]

    In: Proceedings of the IEEE international confer- ence on computer vision

    Antol, S., Agrawal, A., Lu, J., Mitchell, M., Batra, D., Zitnick, C.L., Parikh, D.: Vqa: Visual question answering. In: Proceedings of the IEEE international confer- ence on computer vision. pp. 2425–2433 (2015)

    2015

  4. [4]

    arXiv preprint arXiv:2306.14824 (2023) 16 Islam et al

    Awadalla, A., Prabhumoye, S., Singh, A., Sun, C., Hu, J., Kale, M., Jain, V., Wang, X., , Liu, J., Soricut, R., et al.: Openflamingo: An open-source framework for train- ing large autoregressive vision-language models. arXiv preprint arXiv:2306.14824 (2023) 16 Islam et al

    arXiv 2023

  5. [5]

    arXiv preprint arXiv:2310.15261 (2023)

    Bai, Z., Wu, Q., Zhang, Y., Jiang, Y., Li, X., et al.: Qwen-vl: A scalable and versatile vision-language model. arXiv preprint arXiv:2310.15261 (2023)

    arXiv 2023

  6. [6]

    https://cdn

    Betker, J., Goh, G., Jing, L., Brooks, T., Wang, J., Li, L., Ouyang, L., Zhuang, J., Lee,J.,Guo,Y.,etal.:Improvingimagegenerationwithbettercaptions.Computer Science. https://cdn. openai. com/papers/dall-e-3. pdf2(3), 8 (2023)

    2023

  7. [7]

    Carlini, N., Wagner, D.: Audio adversarial examples: Targeted attacks on speech- to-text (2018), https://arxiv.org/abs/1801.01944

    arXiv 2018

  8. [8]

    Chacko, S.J., Biswas, S., Islam, C.M., Liza, F.T., Liu, X.: Adversarial attacks on large language models using regularized relaxation (2024), https://arxiv.org/ abs/2410.19160

    arXiv 2024

Show all 39 references
  1. [9]

    CAAI Transactions on Intelligence Technology 6(1), 25–45 (2021)

    Chakraborty, A., Alam, M., Dey, V., Chattopadhyay, A., Mukhopadhyay, D.: A survey on adversarial attacks and defences. CAAI Transactions on Intelligence Technology 6(1), 25–45 (2021)

    2021

  2. [10]

    arXiv preprint arXiv:2501.17811 (2025)

    Chen, X., Wu, Z., Liu, X., Pan, Z., Liu, W., Xie, Z., Yu, X., Ruan, C.: Janus-pro: Unified multimodal understanding and generation with data and model scaling. arXiv preprint arXiv:2501.17811 (2025)

    2025 arXiv

  3. [11]

    Cohen, J.M., Rosenfeld, E., Kolter, J.Z.: Certified adversarial robustness via ran- domized smoothing (2019),https://arxiv.org/abs/1902.02918

    2019 arXiv

  4. [12]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Cui, X., Aparcedo, A., Jang, Y.K., Lim, S.N.: On the robustness of large multi- modal models against image adversarial attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. pp. 24625–24634 (2024)

    2024

  5. [13]

    arXiv preprint arXiv:2303.03378 (2023)

    Driess, D., Xia, F., Sajjadi, M.S., Lynch, C., Chowdhery, A., Ichter, B., Wahid, A., Tompson, J., Vuong, Q., Yu, T., et al.: Palm-e: An embodied multimodal language model. arXiv preprint arXiv:2303.03378 (2023)

    2023 arXiv

  6. [14]

    arXiv preprint arXiv:2407.21783 (2024)

    Dubey, A., Jauhri, A., Pandey, A., Kadian, A., Al-Dahle, A., Letman, A., Mathur, A., Schelten, A., Yang, A., Fan, A., et al.: The llama 3 herd of models. arXiv preprint arXiv:2407.21783 (2024)

    2024 arXiv

  7. [15]

    arXiv preprint arXiv:1412.6572 (2014)

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 (2014)

    2014 arXiv

  8. [16]

    arXiv preprint arXiv:2501.12948 (2025)

    Guo, D., Yang, D., Zhang, H., Song, J., Zhang, R., Xu, R., Zhu, Q., Ma, S., Wang, P., Bi, X., et al.: Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning. arXiv preprint arXiv:2501.12948 (2025)

    2025 arXiv

  9. [17]

    Islam, C.M., Chacko, S.J., Nishino, M., Liu, X.: Mechanistic understandings of representation vulnerabilities and engineering robust vision transformers (2025), https://arxiv.org/abs/2502.04679

    2025 arXiv

  10. [18]

    Islam, C.M., Salman, S., Shams, M., Liu, X., Kumar, P.: Malicious path manipula- tionsviaexploitationofrepresentationvulnerabilitiesofvision-languagenavigation systems (2024), https://arxiv.org/abs/2407.07392

    2024 arXiv

  11. [19]

    Jiang, L., Ma, X., Chen, S., Bailey, J., Jiang, Y.G.: Black-box adversarial attacks on video recognition models (2019),https://arxiv.org/abs/1904.05181

    2019 arXiv

  12. [20]

    arXiv preprint arXiv:2301.12597 (2023)

    Li, J., Hu, D., Xie, J., Wu, L., Jain, A., Liu, P., Zhang, L., Hwang, J.N., Gao, J.: Blip-2: Bootstrapped language-image pre-training with frozen image encoders and large language models. arXiv preprint arXiv:2301.12597 (2023)

    2023 arXiv

  13. [21]

    In: Text sum- marization branches out

    Lin, C.Y.: Rouge: A package for automatic evaluation of summaries. In: Text sum- marization branches out. pp. 74–81 (2004)

    2004

  14. [22]

    Advances in neural information processing systems36 (2024)

    Liu, H., Li, C., Wu, Q., Lee, Y.J.: Visual instruction tuning. Advances in neural information processing systems36 (2024)

    2024

  15. [23]

    arXiv preprint arXiv:2402.08577 (2024) DeepSeek on a Trip: Inducing Targeted Visual Hallucinations 17

    Lu, D., Pang, T., Du, C., Liu, Q., Yang, X., Lin, M.: Test-time backdoor attacks on multimodal large language models. arXiv preprint arXiv:2402.08577 (2024) DeepSeek on a Trip: Inducing Targeted Visual Hallucinations 17

    2024 arXiv

  16. [24]

    Ma, Y., Liu, X., Chen, X., Liu, W., Wu, C., Wu, Z., Pan, Z., Xie, Z., Zhang, H., yu, X., Zhao, L., Wang, Y., Liu, J., Ruan, C.: Janusflow: Harmonizing autoregression and rectified flow for unified multimodal understanding and generation (2024)

    2024

  17. [25]

    stat1050(9) (2017)

    Mądry, A., Makelov, A., Schmidt, L., Tsipras, D., Vladu, A.: Towards deep learning models resistant to adversarial attacks. stat1050(9) (2017)

    2017

  18. [26]

    Mahima, K.Y., Ayoob, M., Poravi, G.: Adversarial attacks and defense technologies on autonomous vehicles: A review. Appl. Comput. Syst.26(2), 96–106 (2021)

    2021

  19. [27]

    Moosavi-Dezfooli, S.M., Fawzi, A., Fawzi, O., Frossard, P.: Universal adversarial perturbations (2017), https://arxiv.org/abs/1610.08401

    2017 arXiv

  20. [28]

    In: 2016 IEEE European sym- posium on security and privacy (EuroS&P)

    Papernot, N., McDaniel, P., Jha, S., Fredrikson, M., Celik, Z.B., Swami, A.: The limitations of deep learning in adversarial settings. In: 2016 IEEE European sym- posium on security and privacy (EuroS&P). pp. 372–387. IEEE (2016)

    2016

  21. [29]

    In: Proceedings of the 40th annual meeting of the Association for Computational Linguistics

    Papineni, K., Roukos, S., Ward, T., Zhu, W.J.: Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th annual meeting of the Association for Computational Linguistics. pp. 311–318 (2002)

    2002

  22. [30]

    Applied Sciences9(5), 909 (2019)

    Qiu, S., Liu, Q., Zhou, S., Wu, C.: Review of artificial intelligence adversarial attack and defense technologies. Applied Sciences9(5), 909 (2019)

    2019

  23. [31]

    arXiv preprint arXiv:2401.15568 (2024)

    Salman, S., Shams, M.M.B., Liu, X.: Intriguing equivalence structures of the em- bedding space of vision transformers. arXiv preprint arXiv:2401.15568 (2024)

    2024 arXiv

  24. [32]

    Applied Sciences 14(17), 7782 (2024)

    Shahriar, S., Lund, B.D., Mannuru, N.R., Arshad, M.A., Hayawi, K., Bevara, R.V.K., Mannuru, A., Batool, L.: Putting gpt-4o to the sword: A comprehen- sive evaluation of language, vision, speech, and multimodal proficiency. Applied Sciences 14(17), 7782 (2024)

    2024

  25. [33]

    In: International Conference on Machine Learning

    Wan, A., Wallace, E., Shen, S., Klein, D.: Poisoning language models during in- struction tuning. In: International Conference on Machine Learning. pp. 35413– 35425. PMLR (2023)

    2023

  26. [34]

    arXiv preprint arXiv:2410.13848 (2024)

    Wu, C., Chen, X., Wu, Z., Ma, Y., Liu, X., Pan, Z., Liu, W., Xie, Z., Yu, X., Ruan, C., et al.: Janus: Decoupling visual encoding for unified multimodal understanding and generation. arXiv preprint arXiv:2410.13848 (2024)

    2024 arXiv

  27. [35]

    arXiv preprint arXiv:2307.04087 (2023)

    Zhao, B., Wu, B., He, M., Huang, T.: Svit: Scaling up visual instruction tuning. arXiv preprint arXiv:2307.04087 (2023)

    2023 arXiv

  28. [36]

    Zhu, D., Xu, J., Zhang, Z., Zhang, X.: Minigpt-4: Enhancing vision-language un- derstandingwithadvancedlargelanguagemodels.arXivpreprintarXiv:2304.10592 (2023)

    2023 arXiv

  29. [37]

    REASONING

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M.: Universal and transferable adversarial attacks on aligned language models (2023),https: //arxiv.org/abs/2307.15043 18 Islam et al. A Hallucination Detection Prompt WeintroducethetemplateusedforLLaMA-basedh...

    2023 arXiv

  30. [38]

    Do you see any X in this image?

    For questions about objects, use format: "Do you see any X in this image?"

  31. [39]

    What color is the car?

    Keep time/weather/activity/style questions unchanged. Example transformations: "What color is the car?" -> "Do you see any car in this image?" "What time of day is it?" -> "What time of day is it?" Output only the transformed question with no explanation: {response} DeepSeek o...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.