REVIEW 3 major objections 5 minor 23 references
Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation
T0 review · 3 major / 5 minor · reviewed 2026-08-03 · deepseek-v4-flash
Pith's one-line read A single adversarial frame can act as a semantic router, forcing a multimodal LLM to output different attacker-chosen targets for different scene types.
desk verdict Interesting and plausibly real many-to-many universal perturbation result on ImageNet, but the RIST fine-grained benchmark's near-duplicate split undermines the paper's strongest driving/robotics claim. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The central object is the Semantic-Aware Universal Perturbation (SAUP), a single spatially constrained additive pattern optimized to act as a semantic router. The optimization is carried out by SORT (Semantic-ORienTed), which combines Normalized Space Optimization — reparameterizing the perturbation into an unconstrained normalized space to stabilize gradient updates — with Semantic Separation Optimization, a margin loss that explicitly pushes perturbed features of different classes apart. The theoretical engine is the first-order decomposition z(c) ≈ φ(δ) + Jδ·x(c), where φ(δ) is the Dominant Shift and Jδ·x(c) is the Semantic Deflection; the feasibility bound ρmax ≤ ∥Jδ∥2 ≤ L ties the requi
What would settle it
Evaluate SAUP on RIST-style categories split by trajectory or video source: train on frames from one intersection or robot scene, then test on the same semantic event recorded in a different video or from a different viewpoint. If the fine-grained attack success rate collapses while ImageNet results remain high, the semantic-routing explanation for the fine-grained claim would be falsified.
Extended reading notes
Core claim
The central claim is that semantic-aware universal perturbations exist: one additive noise pattern δ can satisfy M(x(c) + δ, p) → t(c) for every image from semantic class c, for all classes simultaneously. The paper argues that this works through a two-part geometry in latent space: a Dominant Shift pulls all perturbed features toward the anchor point φ(δ), while a Semantic Deflection term Jδ·x(c) projects each input's intrinsic content toward its assigned proxy target embedding. The paper derives a feasibility bound: if the required expansion ratio ρmax exceeds the Lipschitz constant L of the vision encoder, no successful perturbation exists, which makes fine-grained, near-identical frames
Load-bearing premise
The load-bearing premise is that the fine-grained RIST results — where train and test frames come from the same continuous video and are often nearly identical — genuinely measure semantic generalization rather than memorization of low-level visual similarity.
Editorial extensions
If this is right
- If SAUPs are feasible, stateless MLLM-based decision pipelines can be hijacked as a chain: one perturbation can select different malicious actions at different moments, so the cumulative physical trajectory of an agent is attacker-controlled.
- The perturbation generalizes across unseen images and even unseen prompt phrasings in the reported experiments, which suggests the threat is not limited to the exact frames used during optimization.
- Attack success degrades as the number of targets grows, and the bottleneck is the pixel budget of the perturbation; enlarging the frame or corner patch increases both capacity and test-set generalization.
- Fine-grained, visually near-identical scenes remain the hardest case, but the reported RIST results indicate that even such scenes can be routed with moderate success on some models.
- The information-capacity picture implies a practical scaling relation: for a given perturbation area and model, there is a maximum number of controllable targets.
Reading between the lines
- A natural stronger test of the semantic-routing claim would split RIST categories by trajectory or video source — training on frames from one intersection and testing on a different intersection from another video. If the fine-grained success falls to chance while coarse ImageNet results survive, the 'semantic generalization' reading of the fine-grained results would be undermined.
- The same geometric decomposition suggests a possible defense: monitor latent-space geometry for an unexpected dominant shift with class-specific deflections, which could detect a single adversarial pattern without knowing the target texts.
- The reported capacity bottleneck predicts that the maximum number of routable targets should scale monotonically with the perturbation's pixel budget; this could be tested on larger allowed regions or physically printable patches.
- If the RIST train/test frames are near-duplicates from one continuous video, as the appendix describes, the fine-grained ASR may partly reflect low-level visual matching rather than semantic understanding; the broader semantic-router conclusion therefore rests more securely on the coarse-grained experiments.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper proposes Semantic-Aware Universal Perturbation (SAUP): a single adversarial perturbation that, when added to any input image, routes inputs from C semantic classes to C attacker-chosen target outputs. It introduces a geometric decomposition of the effect into a dominant shift and a semantic deflection, derives a feasibility bound involving the vision encoder's Lipschitz constant, and proposes the SORT optimization algorithm (normalized-space optimization plus a margin-based semantic separation loss). The authors also introduce the RIST dataset of driving/robotic video frames with fine-grained semantic categories. Experiments on Llava-1.5, Qwen2.5-VL, and InternVL3 report ImageNet test-set attack success rates up to 93% for 2 targets and 66% for 5 targets, and RIST test-set average ASRs of 72% (RoboTasking) and 62% (AutoDriving).
Significance. If the central claim is correct, the paper demonstrates a qualitatively new adversarial capability: a single universal perturbation acting as a many-to-many semantic router for MLLMs. This is security-relevant because stateless MLLM-based decision pipelines (e.g., driving and robotics) would be hijackable as a chain. The paper's strengths include end-to-end optimization evaluated on non-overlapping ImageNet test images, ablations showing that both SORT components contribute, and released code. The main weakness is that the fine-grained generalization claim, which motivates the driving/robotics threat model, is measured on a train/test split of near-duplicate frames from the same video trajectories; that evidence is not sufficient to establish semantic routing on fine-grained scenes.
major comments (3)
- [Appendix A.1/A.2 and §6.2.1] Appendix A.1 says each RIST category is "a sequence of 10 visually similar frames" from a continuous POV video, and Appendix A.2 says half the images are used for training and the remaining half for testing. The test frames are therefore near-duplicates of training frames from the same trajectory. The high test ASRs in §6.2.1 (72% RoboTasking, 62% AutoDriving) can be explained by memorizing low-level pixel statistics (lighting, road texture, camera pose) rather than by learning a semantic class-to-target mapping. The Intern AutoDriving drop from 100% train ASR to 61% test ASR, attributed to the 50-image training set, is precisely the signature of such memorization. This is load-bearing because the driving/robotics "stateless decision chain" threat model depends on the RIST evaluation. Please re-split RIST at the trajectory level, or collect new test scenes from different environments, an
- [Remark 3.5 vs §6.2.1] Remark 3.5 argues that fine-grained similar inputs should be hard to attack because small input distance makes the required expansion ratio large and likely violates Theorem 3.4. Yet §6.2.1 reports high ASR on RIST, which is explicitly a fine-grained stress test. The paper never quantifies input distances between or within RIST categories, nor does it estimate the Lipschitz constant L. The bound is therefore not actually tested. This leaves the RIST result either in tension with the paper's own theory or indicative that the RIST categories are not close in input space. Please add quantitative measurements of ||x(i)-x(j)|| for the relevant category pairs and reconcile the empirical ASR with Theorem 3.4, or revise the theoretical claim to make it testable.
- [Assumption 3.2 and §3.2–3.3] The geometric feasibility analysis is conditional on Assumption 3.2, which postulates the existence of a proxy target embedding zhat(c) for every target response and prompt. Equations (6)–(8) and Theorem 3.4 all depend on this assumption, yet the paper provides no evidence that such embeddings exist in the vision-encoder latent space or that the decoder indeed maps them to the specified target text. Section 5 validates output confidence and clustering, but not the geometry of the proxy target embeddings themselves. Please validate the assumption directly, or state clearly that the theory is a heuristic necessary-condition analysis rather than a proof of feasibility.
minor comments (5)
- [§6.1] "Recall from Theorem 3.5" should refer to Remark 3.5, not Theorem 3.5.
- [Figure 6] The axis label "Train T est" is unclear; please add a legend or separate panel labels.
- [Tables 3–4] ASRs are reported without confidence intervals. Many numbers are based on 20 test images or 50 training images, so the binomial error bars are wide; please report standard errors or CIs at least for the headline numbers.
- [Equation (3)] The first-order Taylor expansion is footnoted as approximate, but the text uses it quantitatively in Eqs. (4)–(7). Please add a brief discussion of when the linearization is expected to be reliable.
- [Abstract/§6.3] The phrase "using a single frame against Qwen" is ambiguous: the perturbation is a border frame, but the input image remains a single frame. Consider rephrasing to "a single adversarial frame added to one input image."
Circularity Check
No circular derivation found; central attack results are supported by held-out ImageNet evaluation, with a non-circular data-split caveat on RIST.
full rationale
The paper's derivation chain is not circular in the sense defined here. The geometric analysis (Section 3) rests on an explicitly stated proxy-target-embedding assumption (Assumption 3.2) and a Taylor-expansion necessary condition (Theorem 3.4); it does not fit a parameter to the reported success rates and then re-report the same fit as a prediction. SORT is an optimization procedure, and the headline ImageNet results (e.g., 93%, 77%, 61%, 66% for 2–5 targets on Qwen) are measured on non-overlapping held-out test images, so the central feasibility claim is empirically self-contained. There are no load-bearing self-citations or imported uniqueness theorems: the paper cites external prior work for standard attack settings, not for its own central claim. The one notable weakness is the RIST evaluation: Appendix A.1 says each category is a sequence of 10 visually similar frames, and Appendix A.2 splits each category in half into train/test, so the reported 72%/62% fine-grained ASR may reflect frame-level memorization rather than semantic routing generalization. The paper itself acknowledges overfitting and memorization in §6.2.1 and Appendix E. This is a benchmark-validity and generalization concern, not a circular derivation: it does not reduce an equation to its own input or rename a fitted value as a prediction, and the ImageNet evidence for semantic-aware hijacking is unaffected. Overall, no significant circularity; score 2 reflects the minor RIST caveat rather than any circular step.
Assumptions & free parameters
free parameters (2)
- margin m
- balancing coefficient lambda
assumptions (5)
- ad hoc to paper Proxy Target Embedding exists for each target response (Assumption 3.2)
- domain assumption First-order Taylor expansion of the vision encoder around the perturbation is a valid approximation (Eq. 3)
- domain assumption A finite global Lipschitz constant L bounds the vision encoder over the input domain
- domain assumption MLLM decisions can be modeled as stateless atomic functions y = M(x, p)
- domain assumption Exact token-sequence match is an appropriate success criterion
invented entities (1)
-
Proxy Target Embedding zhat(c)
Cite this review
Pith. "Pith review of Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation." pith.science (2026). https://pith.science/paper/46J7YYE6
@misc{pith2026251120002,
author = {Pith},
title = {Pith review of: Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation},
year = {2026},
howpublished = {\url{https://pith.science/paper/46J7YYE6}},
note = {Machine review of arXiv:2511.20002}
}
read the original abstract
Multimodal Large Language Models (MLLMs) are increasingly deployed in stateless systems, such as autonomous driving and robotics. This paper investigates a novel threat: Semantic-Aware Hijacking. We explore the feasibility of hijacking multiple stateless decisions simultaneously using a single universal perturbation. We introduce the Semantic-Aware Universal Perturbation (SAUP), which acts as a semantic router, "actively" perceiving input semantics and routing them to distinct, attacker-defined targets. To achieve this, we conduct theoretical and empirical analysis on the geometric properties in the latent space. Guided by these insights, we propose the Semantic-Oriented (SORT) optimization strategy and annotate a new dataset with fine-grained semantics to evaluate performance. Extensive experiments on three representative MLLMs demonstrate the fundamental feasibility of this attack, achieving a 66% attack success rate over five targets using a single frame against Qwen.
Figures
Figures from the paper (7 more)
Reference graph
Works this paper leans on
-
[1]
Bai, J., Bai, S., Yang, S., Wang, S., Tan, S., Wang, P., Lin, J., Zhou, C., and Zhou, J. Qwen-vl: A frontier large vision- language model with versatile abilities.arXiv preprint arXiv:2308.12966, 1(2):3,
-
[4]
We observe overfitting when the training set is small. For example, with 10 training samples, both Llava and Qwen achieve near-perfect ASR on the training set, but their performance drops significantly on the test set, especially for Llava under the frame constraint (10% ASR on test images). This discrepancy indicates that the learned perturbation may mem...
2019
-
[10]
Lin, J., Song, C., He, K., Wang, L., and Hopcroft, J. E. Nesterov accelerated gradient and scale invariance for adversarial attacks.arXiv preprint arXiv:1908.06281,
arXiv 1908
-
[11]
Liu, Y ., Chen, X., Liu, C., and Song, D. X. Delving into transferable adversarial examples and black-box attacks. ArXiv, abs/1611.02770,
-
[13]
URL https://openreview.net/forum? id=nc5GgFAvtk. Mao, J., Niu, M., Jiang, C., Liang, H., Chen, J., Liang, X., Li, Y ., Ye, C., Zhang, W., Li, Z., et al. One million scenes for autonomous driving: Once dataset.arXiv preprint arXiv:2106.11037,
-
[14]
Q., Abbasnejad, E., and Ranasinghe, D
V o, V . Q., Abbasnejad, E., and Ranasinghe, D. C. Ramboat- tack: A robust and query efficient deep neural network decision exploit. In29th Annual Network and Distributed System Security Symposium, NDSS 2022, San Diego, California, USA, April 24-28,
2022
-
[16]
Xu, J., Mei, T., Yao, T., and Rui, Y
URL https:// arxiv.org/abs/2505.19840. Xu, J., Mei, T., Yao, T., and Rui, Y . Msr-vtt: A large video description dataset for bridging video and language. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 5288–5296,
-
[17]
Jailbreak vision language models via bi-modal adversarial prompt.arXiv preprint arXiv:2406.04031,
Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., and Tao, D. Jailbreak vision language models via bi-modal adversarial prompt.arXiv preprint arXiv:2406.04031,
Show all 23 references
-
[18]
Anyattack: Towards large-scale self-supervised generation of targeted adversarial ex- amples for vision-language models.arXiv preprint arXiv:2410.05346,
Zhang, J., Ye, J., Ma, X., Li, Y ., Yang, Y ., Sang, J., and Yeung, D.-Y . Anyattack: Towards large-scale self-supervised generation of targeted adversarial ex- amples for vision-language models.arXiv preprint arXiv:2410.05346,
-
[19]
Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models.arXiv preprint arXiv:2504.10479,
Zhu, J., Wang, W., Chen, Z., Liu, Z., Ye, S., Gu, L., Tian, H., Duan, Y ., Su, W., Shao, J., et al. Internvl3: Exploring advanced training and test-time recipes for open-source multimodal models.arXiv preprint arXiv:2504.10479,
-
[20]
Similarly, autonomous driving datasets like KITTI (Geiger et al., 2013), nuScenes (Caesar et al., 2020), and Waymo Open Dataset (Sun et al.,
provides clip-level captions and temporal context, it does not define semantic categories within trajectories. Similarly, autonomous driving datasets like KITTI (Geiger et al., 2013), nuScenes (Caesar et al., 2020), and Waymo Open Dataset (Sun et al.,
2013
-
[21]
This curation spans multiple countries and varies in temporal and meteorological conditions to ensure diversity
and the ONCE dataset (Mao et al., 2021). This curation spans multiple countries and varies in temporal and meteorological conditions to ensure diversity. 11 Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation Table 2.Attack success rate...
2021
-
[23]
These methods can be either untargeted, aiming only to cause misclassification, or single-targeted, where the goal is to force the model to produce a specific incorrect label
are typically optimized on a per-instance basis. These methods can be either untargeted, aiming only to cause misclassification, or single-targeted, where the goal is to force the model to produce a specific incorrect label. However, these methods fail to scale or generalize t...
2017
-
[2009]
One perturbation is enough: On generating universal adversarial perturbations against vision-language pre-training models.arXiv preprint arXiv:2406.05491,
Fang, H., Kong, J., Yu, W., Chen, B., Li, J., Wu, H., Xia, S., and Xu, K. One perturbation is enough: On generating universal adversarial perturbations against vision-language pre-training models.arXiv preprint arXiv:2406.05491,
-
[2013]
J., Shlens, J., and Szegedy, C
Goodfellow, I. J., Shlens, J., and Szegedy, C. Explain- ing and harnessing adversarial examples.arXiv preprint arXiv:1412.6572,
-
[2014]
J., Pertsch, K., Karamcheti, S., Xiao, T., Balakr- ishna, A., Nair, S., Rafailov, R., Foster, E., Lam, G., San- keti, P., et al
Kim, M. J., Pertsch, K., Karamcheti, S., Xiao, T., Balakr- ishna, A., Nair, S., Rafailov, R., Foster, E., Lam, G., San- keti, P., et al. Openvla: An open-source vision-language- action model.arXiv preprint arXiv:2406.09246,
-
[2016]
semanticscholar.org/CorpusID:17707860
URL https://api. semanticscholar.org/CorpusID:17707860. Lu, D., Pang, T., Du, C., Liu, Q., Yang, X., and Lin, M. Test-time backdoor attacks on multimodal large language models.arXiv preprint arXiv:2402.08577,
-
[2020]
Chen, X., Fang, H., Lin, T.-Y ., Vedantam, R., Gupta, S., Doll´ar, P., and Zitnick, C. L. Microsoft coco captions: Data collection and evaluation server.arXiv preprint arXiv:1504.00325,
-
[2021]
DeepMind, G
doi: 10.1109/SSCI50451.2021.9660002. DeepMind, G. The gemini family. https://deepmind. google/technologies/gemini/,
2021
-
[2022]
org/ndss-paper/auto-draft-239/
URL https://www.ndss-symposium. org/ndss-paper/auto-draft-239/. Wang, X. and He, K. Enhancing the transferability of adver- sarial attacks through variance tuning. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1924–1933,
1924
-
[2023]
Bai, S., Chen, K., Liu, X., Wang, J., Ge, W., Song, S., Dang, K., Wang, P., Wang, S., Tang, J., et al. Qwen2. 5-vl technical report.arXiv preprint arXiv:2502.13923,
-
[2024]
Multi-attacks: Many images+ the same adversarial attack→ many target labels, 2023.URL https://arxiv
Fort, S. Multi-attacks: Many images+ the same adversarial attack→ many target labels, 2023.URL https://arxiv. org/abs/2308.03792,
2023 arXiv
-
[2025]
Image hi- jacks: Adversarial images can control generative models at runtime.arXiv preprint arXiv:2309.00236,
Bailey, L., Ong, E., Russell, S., and Emmons, S. Image hi- jacks: Adversarial images can control generative models at runtime.arXiv preprint arXiv:2309.00236,
Reviewed August 3, 2026 · model on record in the stance chip above.
Discussion (0). Sign in to comment.