Pith. sign in

REVIEW 3 major objections 5 minor 45 references

Universal Adversarial Attack on Aligned Multimodal LLMs

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that a single optimized image can override safety alignment in several multimodal LLMs and partly transfer to unseen models, achieving higher attack success rates than text-only universal prompts.

desk verdict The multi-model joint optimization is a genuine extension of Qi et al., but the headline ASR numbers likely overstate the attack because the judge flags the target phrase itself as unsafe. read the letter →

arxiv 2502.07987 v3 pith:Q6TUQA2A submitted 2025-02-11 cs.AI

Temurbek Rahmatullaev , Polina Druzhinina , Nikita Kurdiukov , Matvey Mikhalchuk , Andrey Kuznetsov , Anton Razzhigaev This is my paper · ORCID
classification cs.AI
keywords adversarialattackuniversalperturbationmultimodalLLMjailbreaksafetyalignmentvision-languagemodelsuccessratecross-modeltransfer
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that a single synthetic image, optimized by gradient backpropagation through a multimodal LLM's vision encoder and language head, can override safety alignment and force the model to begin responses with a target phrase such as 'Sure, here it is' even for harmful prompts. The authors show on SafeBench and MM-SafetyBench that this universal visual attack achieves higher attack success rates than text-only universal prompts and prior multimodal baselines, with rates up to 81% on some models. They also show that an image trained jointly on several models transfers partly to an unseen model, and that a multi-answer variant produces more natural-sounding unsafe responses. If true, this would mean current vision-language alignment is fragile in a way that text-only attacks are not, and that a single distributed image could pose a practical threat across deployed systems.

What carries the argument

The load-bearing object is the universal adversarial image $z = z_0 + g(z_1)$, where $z_0$ is a grayscale base image and $g(z_1) = \gamma_1 \tanh(z_1)$ is a bounded trainable perturbation. The optimization minimizes the masked cross-entropy loss of a fixed target answer (or a sampled answer in the multi-answer variant) with gradients flowing through the language model, the vision-language adapter, and the vision encoder. Additional components are random noise for quantization robustness, Gaussian blurring to reduce high-frequency artifacts, and randomized local cropping to concentrate perturbations in salient regions. This machinery is what makes a single image serve as a prompt-universal jailbreak and, when the loss is summed over multiple models, a cross-model jailbreak.

What would settle it

Have human annotators label the exact responses the paper counts as successful attacks, and compare the human-based ASR to the judge-based ASR on the same responses; if the judge is flagging the presence of the target phrase 'Sure, here it is' rather than actual unsafe content, the human-based ASR would be substantially lower, especially for 'Ours' and baseline 'Sure, here it is' rows.

Watch

Extended reading notes

Core claim

The central discovery is that high-dimensional visual input provides a universal attack surface for aligned multimodal LLMs: a single perturbation image, optimized against a masked cross-entropy loss on target answer tokens, can redirect the model's generation for a wide range of textual prompts, including prompts the model was trained to refuse. The attack works by minimizing the loss of the fixed target response while the perturbation is constrained with a tanh-scaled additive tensor, and robustness to quantization is added by injecting noise at each optimization step. The paper reports that an image optimized jointly over three or four models retains high attack success on each and shows partial transfer to a held-out architecture.

Load-bearing premise

The reported attack success rates rest on the assumption that the Gemma-3-4B-it judge, shown only the model's response, correctly labels unsafe content; Appendix B reports its precision at 0.637 and recall at 0.442 on a manually annotated subset, and prepending the target phrase alone raises ASR on one model from 2.2% to 41.3%.

Editorial extensions

If this is right

  • If this attack generalizes as claimed, a single adversarially crafted image distributed online could force aligned multimodal LLMs to produce disallowed content across many prompts, not just one query.
  • The cross-model leave-one-out results imply that an attacker with white-box access to a few open models may obtain a transferable image that degrades safety on unseen black-box models, without needing query-specific optimization.
  • The multi-answer variant implies that detection systems matching a fixed phrase can be evaded, since the model can be steered toward a variety of affirmative malicious responses.
  • The method's dependence on white-box access identifies a concrete target for defense: if gradient-based optimization through the vision encoder is blocked or made noisy, the universal image loses efficacy.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper's own Table 2, where prepending the phrase 'Sure, here it is' raises ASR on Phi from 2.2% to 41.3%, suggests the judge may treat the target phrase as unsafe regardless of content; a defense-aware evaluator could therefore report lower effective attack success. This is an inference, not the paper's claim.
  • A practical extension would be to test whether the same single image degrades performance when the model must answer a question about the image itself rather than a separate textual prompt, since the attack is trained on text queries unrelated to the image content.
  • The 'Localize' and 'Blur' variants suggest the adversarial signal is not purely high-frequency; testing the attack against JPEG compression or image resizing in a deployed pipeline would reveal whether real-world distribution is as fragile as the benchmark suggests.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes a universal adversarial attack on multimodal LLMs. The method optimizes a single synthetic image via gradients through the vision encoder and language head so that, when paired with any textual prompt, the model responds with a targeted phrase (e.g., 'Sure, here it is') or otherwise unsafe content. The authors evaluate on SafeBench and MM-SafetyBench across four models (Phi-3.5, Llama-3.2, Qwen2-VL, Llava-1.5), report attack success rates (ASR) up to 81%, and demonstrate cross-model transfer through leave-one-out experiments. Variants include multi-answer targets, Gaussian blur, and localized perturbations.

Significance. If the quantitative results hold, the work demonstrates a serious and practical vulnerability: a single image artifact that can override alignment across multiple multimodal LLMs and partly transfer to unseen models. The paper ships qualitative evidence (Table 9) that real harmful content is elicited, so the phenomenon itself is credible. The method is a combination of known techniques (white-box gradient optimization, universal perturbations, adversarial training on multiple models), but the claimed state-of-the-art ASR and cross-model universality would be a meaningful addition to the adversarial robustness literature. The principal weakness is that the evaluation oracle is demonstrably biased toward the attack's own target phrase, so the headline quantitative claims are not yet supported.

major comments (3)
  1. [§4.2, Appendix B, Table 2] The ASR metric relies on Gemma-3-4B-it as an oracle that judges responses without seeing the input prompt (Sec. 4.2). Appendix B reports precision 0.637 and recall 0.442 on a manually annotated sample (Table 8). With reference ASR values of only 2–14% (Table 2), this precision level implies a substantial number of false positives. More directly, the 'Sure, here it is' text-prefix baseline in Table 2 raises ASR on Phi from 2.2% to 41.3% and on Llava from 14.4% to 36.6%, even though the prefix itself is not harmful. Because the attack is explicitly optimized to produce that phrase (§3.3), the reported ASR values likely measure the oracle's tendency to flag the target phrase rather than actual unsafe content. The claim of up to 81% ASR for Ours-MA (Table 2) is therefore not established as a measure of harmful response generation.
  2. [Tables 2–7] No error bars, number of seeds, or statistical significance tests are reported for any ASR result. Adversarial image optimization can be sensitive to initialization and hyperparameters, and the differences between some methods are small (e.g., 15.0 vs. 17.2 on Phi in Table 2). Without variance estimates, it is impossible to determine whether the observed improvements over baselines are reliable. The paper should report mean and standard deviation over multiple independent optimization runs and evaluations.
  3. [§3.3, Table 2] The training objective forces the model to begin responses with 'Sure, here it is' for any prompt, including safe ones. The paper does not report the rate at which this target phrase appears on benign, safe queries (e.g., 'What is the capital of France?') or the false-positive rate of the attack on safe prompts. Such a control is needed to separate two effects: (i) the attack genuinely enables harmful content, versus (ii) the attack simply induces a generic affirmative prefix that the oracle misclassifies as unsafe. Reporting ASR on a safe query set would clarify whether the optimization produces prompt-agnostic refusal suppression or only a judge-triggering artifact.
minor comments (5)
  1. [Abstract] Typo: 'auniversal' should be 'a universal'.
  2. [Table 2] The row labeled 'GCC' should be 'GCG' to match the description in Section 2.5 and the other tables.
  3. [Figure 3] The bar chart is difficult to read because many values are printed in small font and the baseline labels are truncated; Table 2 is clearer.
  4. [Appendix B] The model name is inconsistent: 'Gemma-3-4B-it' appears in §4.2 and Table 8, while 'Gemma-3-4B-it' and 'Gemma-3-4B-it' are used elsewhere. Also, the description of the manual annotation dataset (sample size, annotator agreement) is omitted.
  5. [§2.4] The training dataset descriptions (100 safe questions, 50 adversarial questions) are minimal; it is unclear whether validation and test queries come from the same distribution and whether the SafeBench evaluation uses all 23 risk scenarios.

Circularity Check

2 steps flagged · score 6.0 of 10

Reported ASR is partly by construction: the image is trained to output the affirmative phrase "Sure, here it is" while the Oracle that defines ASR flags that phrase as unsafe, inflating success rates.

  1. self definitional [Sec. 2.4, Sec. 3.3, Sec. 4.2, Table 2]
    "In all experiments, except for the multi-answer setup, the target response was prefixed with "Sure, here it is!". An attack is considered successful if the model's response, evaluated in isolation by an external evaluator (Oracle) without access to the input prompt, is classified as unsafe. Reference values 2.2 6.6 6.0 14.4. Sure, here it is 41.3 20.5 16.1 36.6."

    The attack's optimization objective is to make the model emit the affirmative phrase "Sure, here it is" (Sec. 3.3). The ASR success criterion is Oracle(R_i)=unsafe. The paper's own textual control, which merely prepends the same phrase without any image optimization, raises ASR on Phi from 2.2% to 41.3% and on Llava from 14.4% to 36.6%. Therefore the Oracle already counts the bare target phrase as unsafe in a large fraction of cases. Since the optimized image is trained to produce exactly that phrase, a substantial part of the reported ASR is measuring whether the target phrase appears, not whether independently verified unsafe content was generated. The multi-answer variant uses the same Oracle on a preset set of affirmative/malicious phrases, inheriting the same entanglement.

  2. other [Appendix B, Table 8 and Sec. B.3]
    "Gemma-3-4B-it provides a better balance between precision and recall and achieves the highest overall accuracy and precision, making it the most reliable candidate for evaluation of attack success. Based on these findings, we used Gemma-3-4B-it as the default oracle for the main experiments and ASR evaluation presented in the paper."

    The Oracle is not an external ground truth: on a manually labeled sample it has precision 0.637 and recall 0.442 (Table 8). With SafeBench reference ASR values as low as 2.2-14.4%, precision below 0.7 implies that many 'unsafe' verdicts are false positives. The paper applies no error correction or reweighting for these rates and then uses this same Oracle as the definition of success for every attack and baseline. Consequently, the quantitative comparison with baselines is partly a comparison of how often the Oracle labels the target phrase as unsafe, rather than a measure of independently confirmed harmful content.

full rationale

The paper's derivation chain is a direct gradient-based image optimization; there is no self-citation chain or imported uniqueness theorem, so no separate self-citation circularity is present. The central quantitative claim, however, is entangled with its own evaluation target. The image is optimized to make models respond with the affirmative phrase "Sure, here it is", and the Oracle used to compute ASR is shown by the paper's own control to label that exact phrase as unsafe in many cases (Phi ASR jumps from 2.2% to 41.3% when the phrase is merely prepended). Thus the headline ASR values, including the up-to-81% figures and the multi-answer variant, partly reduce to the optimized target phrase itself rather than to validated unsafe content. Appendix B documents the Oracle's limited precision/recall but applies no correction when using it for the main experiments. The qualitative examples in Appendix A do show genuine harmful outputs, so the attack phenomenon is real and the circularity is partial rather than total. Score 6 reflects this partial by-construction entanglement without claiming the entire result is vacuous.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The method has no invented physical or formal entities. Its load-bearing assumptions are empirical: the small training prompt set is assumed to cover the benchmark distribution, and the judge model is assumed to label harmfulness accurately despite seeing no input prompt. The main hand-tuned hyperparameters are the perturbation bound, learning rate, and blur settings, none of which are ablated in the paper.

free parameters (4)
  • perturbation bound gamma_1 = 0.1 single-model, 0.5 multi-model
    Controls perturbation magnitude; authors set it higher for multi-model attacks to amplify generalizability (Section 4.1).
  • learning rate = 1e-2
    AdamW learning rate for image optimization (Section 4.1); no ablation is reported.
  • Gaussian blur kernel size k and sigma_Blur = not reported
    Introduced in Section 3.5.2 but no values are provided in the experiments.
  • number of optimization steps = not reported
    Training duration is unspecified, a critical hyperparameter for reproducibility.
assumptions (3)
  • domain assumption A small set of 150 training prompts (100 safe, 50 adversarial) is sufficient to make the image universal across the benchmark query distribution.
    Section 2.4: the training set is far smaller than SafeBench's 23 risk scenarios or MM-SafetyBench's 1,680 queries; the paper does not analyze coverage.
  • domain assumption The judge model gemma-3-4b-it labels response unsafe correctly despite seeing no input prompt.
    Section 4.2 and Appendix B: judge precision is 0.637, recall is 0.442 on the annotated subset.
  • ad hoc to paper Gradients from a set of three models transfer to an unseen fourth model.
    The leave-one-out results in Tables 4-7 show this holds only partially; the assumption underpins the cross-model universality claim.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Universal Adversarial Attack on Aligned Multimodal LLMs." pith.science (2026). https://pith.science/paper/Q6TUQA2A

@misc{pith2026250207987,
  author       = {Pith},
  title        = {Pith review of: Universal Adversarial Attack on Aligned Multimodal LLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/Q6TUQA2A}},
  note         = {Machine review of arXiv:2502.07987}
}
read the original abstract

We propose a universal adversarial attack on multimodal Large Language Models (LLMs) that leverages a single optimized image to override alignment safeguards across diverse queries and even multiple models. By backpropagating through the vision encoder and language head, we craft a synthetic image that forces the model to respond with a targeted phrase (e.g., "Sure, here it is") or otherwise unsafe content -- even for harmful prompts. In experiments on the SafeBench and MM-SafetyBench benchmarks, our method achieves higher attack success rates than existing baselines, including text-only universal prompts (e.g., up to 81% on certain models). We further demonstrate cross-model universality by training on several multimodal LLMs simultaneously. Additionally, a multi-answer variant of our approach produces more natural-sounding (yet still malicious) responses. These findings underscore critical vulnerabilities in current multimodal alignment and call for more robust adversarial defenses. We will release code and datasets under the Apache-2.0 license. Warning: some content generated by Multimodal LLMs in this paper may be offensive.

Figures

Figures reproduced from arXiv: 2502.07987 by the authors.

Figure 1
Figure 1. An example of a single universal adversarial [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Attack pipeline: gradients from a fixed target [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Model-wise attack performance on SafeBench, ASR (%). [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: An example of a single universal adversarial [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

45 extracted references · 9 canonical work pages

  1. [1]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block STRING...

  2. [2]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

  3. [3]

    Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, and 1 others. 2024. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219

    arXiv 2024

  4. [4]

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2023. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36:61478--61500

    2023

  5. [5]

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2024. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36

    2024

  6. [6]

    Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. IEEE Symposium on Security and Privacy

    work page 2017

  7. [7]

    Yen-Chun Chen, Xavier Bresson, and 1 others. 2023. Pali: A joint vision-language model via multi-task training. arXiv preprint arXiv:2303.00833

    work page Pith review arXiv 2023

  8. [8]

    Jianfeng Chi, Ujjwal Karn, Hongyuan Zhan, Eric Smith, Javier Rando, Yiming Zhang, Kate Plawiak, Zacharie Delpierre Coudert, Kartikeya Upasani, and Mahesh Pasupuleti. 2024. Llama guard 3 vision: Safeguarding human-ai image understanding conversations. arXiv preprint arXiv:2411.10414

    arXiv 2024

Show all 45 references
  1. [9]

    Bohan Deng, Xiang Chen, Han Zhang, and 1 others. 2023. Mm-react: Prompting chatgpt for multimodal reasoning and action. arXiv preprint arXiv:2303.11381

    2023 arXiv

  2. [10]

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. https://arxiv.org/abs/1710.06081 Boosting adversarial attacks with momentum . arXiv preprint

    2018 arXiv

  3. [11]

    Abhimanyu Dubey, Abhinav Jauhri, Abhinav Pandey, Abhishek Kadian, Ahmad Al-Dahle, Aiesha Letman, Akhil Mathur, Alan Schelten, Amy Yang, Angela Fan, and 1 others. 2024. The llama 3 herd of models. arXiv preprint arXiv:2407.21783

    2024 arXiv

  4. [12]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2023. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608

    2023 arXiv

  5. [13]

    Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. 2024. Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast. arXiv preprint arXiv:2402.08567

    2024 arXiv

  6. [14]

    Chuan Guo, Alexandre Sablayrolles, Herv \'e J \'e gou, and Douwe Kiela. 2021. Gradient-based adversarial attacks against text transformers. arXiv preprint arXiv:2104.13733

    2021 arXiv

  7. [15]

    Yue Huang, Chujie Gao, Siyuan Wu, Haoran Wang, Xiangqi Wang, Yujun Zhou, Yanbo Wang, Jiayi Ye, Jiawen Shi, Qihui Zhang, and 1 others. 2025. On the trustworthiness of generative foundation models: Guideline, assessment, and perspective. arXiv preprint arXiv:2502.14296

    2025 arXiv

  8. [16]

    Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically auditing large language models via discrete optimization. In International Conference on Machine Learning, pages 15307--15329. PMLR

    2023

  9. [17]

    Alexey Kurakin, Ian Goodfellow, and Samy Bengio. 2018. https://arxiv.org/abs/1607.02533 Adversarial examples in the physical world . In Artificial Intelligence Safety and Security, pages 99--112. Chapman and Hall/CRC

    2018 arXiv

  10. [18]

    Dan Li, Shang-Tse Deng, Andy Zou, James Zou, and 1 others. 2023 a . Context-aware jailbreaks for aligned language models. arXiv preprint arXiv:2310.03666

    2023 arXiv

  11. [19]

    Dan Li, Andy Zou, and James Zou. 2023 b . Multimodal jailbreaking via unrestricted visual prompts. arXiv preprint arXiv:2311.06854

    2023 arXiv

  12. [20]

    Jinfeng Li, Shouling Ji, Tianyu Du, Bo Li, and Ting Wang. 2019. https://arxiv.org/abs/1812.05271 TextBugger : Generating adversarial text against real-world applications . In Network and Distributed System Security Symposium (NDSS)

    2019 arXiv

  13. [21]

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023 c . BLIP-2: bootstrapping language-image pre-training with frozen image encoders and large language models. In ICML

    2023

  14. [22]

    Zhaoyi Li, Xiaohan Zhao, Dongdong Wu, Jiacheng Cui, and Zhiqiang Shen. 2025. https://doi.org/10.48550/arXiv.2503.10635 A frustratingly simple yet highly effective attack baseline: Over 90\ arXiv preprint arXiv:2503.10635

    2025 doi

  15. [23]

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024 a . Improved baselines with visual instruction tuning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296--26306

    2024

  16. [24]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. https://openreview.net/forum?id=w0H2xGHlkw Visual instruction tuning . In Thirty-seventh Conference on Neural Information Processing Systems

    2023

  17. [25]

    Xin Liu, Yichen Zhu, Jindong Gu, Yunshi Lan, Chao Yang, and Yu Qiao. 2024 b . https://doi.org/10.1007/978-3-031-72992-8_22 Mm-safetybench: A benchmark for safety evaluation of multimodal large language models . In Computer Vision -- ECCV 2024, volume 13689 of Lecture Notes in ...

    2024 doi

  18. [26]

    Siyuan Ma, Weidi Luo, Yu Wang, and Xiaogeng Liu. 2024. Visual-roleplay: Universal jailbreak attack on multimodal large language models via role-playing image character. arXiv preprint arXiv:2405.20773

    2024 arXiv

  19. [27]

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. 2017. https://arxiv.org/abs/1610.08401 Universal adversarial perturbations . In Proceedings of the IEEE conference on computer vision and pattern recognition (CVPR), pages 1765--1773

    2017 arXiv

  20. [28]

    Paarth Neekhara, Shehzeen Hussain, Shlomo Dubnov, and Farinaz Koushanfar. 2018. Adversarial reprogramming of text classification neural networks. arXiv preprint arXiv:1809.01829

    2018 arXiv

  21. [29]

    Nicolas Papernot, Patrick McDaniel, and Ian Goodfellow. 2016. https://arxiv.org/abs/1605.07277 Transferability in machine learning: from phenomena to black-box attacks using adversarial samples . arXiv preprint

    2016 arXiv

  22. [30]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2023. Visual adversarial examples jailbreak aligned large language models. arXiv preprint arXiv:2306.13213

    2023 arXiv

  23. [31]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI conference on artificial intelligence, volume 38, pages 21527--21536

    2024

  24. [32]

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. arXiv preprint arXiv:2307.14539

    2023 arXiv

  25. [33]

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. https://arxiv.org/abs/1312.6199 Intriguing properties of neural networks . In International Conference on Learning Representations (ICLR)

    2014 arXiv

  26. [34]

    Gemma Team, Aishwarya Kamath, Johan Ferret, Shreya Pathak, Nino Vieillard, Ramona Merhej, Sarah Perrin, Tatiana Matejovicova, Alexandre Ramé, Morgane Rivière, Louis Rouillard, Thomas Mesnard, Geoffrey Cideron, Jean bastien Grill, Sabela Ramos, Edouard Yvinec, Michelle Casbon, ...

    2025 arXiv

  27. [35]

    Llama Team. 2024. Meta llama guard 2. https://github.com/meta-llama/PurpleLlama/blob/main/Llama-Guard2/MODEL_CARD.md

    2024

  28. [36]

    Eric Wallace, Shi Feng, Nikhil Kandpal, Matt Gardner, and Sameer Singh. 2019. Universal adversarial triggers for attacking and analyzing nlp. arXiv preprint arXiv:1908.07125

    2019 arXiv

  29. [37]

    Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, and 1 others. 2024. Qwen2-vl: Enhancing vision-language model's perception of the world at any resolution. arXiv preprint arXiv:2409.12191

    2024 arXiv

  30. [38]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. https://arxiv.org/abs/2307.02483 Jailbroken: How does llm safety training fail? Preprint, arXiv:2307.02483

    2023 arXiv

  31. [39]

    Meng Xu, Bo Li, Boxin Wang, Hengtong Zhang, Di Chen, Antoinette Chan, Wei Liu, John See, Weiyao Lin, and Junle Wang. 2021. Can audio-visual integration strengthen robustness under multimodal attacks? arXiv preprint arXiv:2104.02000. While the citation key uses 2023, a common r...

    2021 arXiv

  32. [40]

    Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. 2024. Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models. Advances in Neural Information Processing Systems, 36

    2024

  33. [41]

    Zonghao Ying, Aishan Liu, Siyuan Liang, Lei Huang, Jinyang Guo, Wenbo Zhou, Xianglong Liu, and Dacheng Tao. 2024. https://arxiv.org/abs/2410.18927 Safebench: A safety evaluation framework for multimodal large language models . Preprint, arXiv:2410.18927

    2024 arXiv

  34. [42]

    Jiaming Zhang, Qi Yi, and Jitao Sang. 2022 a . Towards adversarial attack on vision-language pre-training models. In ACM Multimedia , pages 5005--5013. ACM

    2022

  35. [43]

    Jiaming Zhang, Qi Yi, and Jitao Sang. 2022 b . Towards adversarial attack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pages 5005--5013

    2022

  36. [44]

    Zeming Zhu, Dan Li, Andy Zou, and 1 others. 2023. Promptbench: On the evaluation of safety benchmarks for large language models. arXiv preprint arXiv:2311.06243

    2023 arXiv

  37. [45]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J. Zico Kolter, and Matt Fredrikson. 2023. https://arxiv.org/abs/2307.15043 Universal and transferable adversarial attacks on aligned language models . arXiv preprint

    2023 arXiv

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.