Pith. sign in

REVIEW 3 major objections 4 minor 39 references

CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMs

T0 review · 3 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read CAVALRY-V is a generator framework that produces imperceptible, transferable adversarial videos and, across seven V-MLLMs, degrades video understanding more than existing attacks.

desk verdict Useful attack framework for video MLLMs, but the headline improvement is statistically fragile and the temporal-coherence story is under-supported. read the letter →

arxiv 2507.00817 v1 pith:62OUNQ7W submitted 2025-07-01 cs.CV cs.AI

Jiaming Zhang , Rui Hu , Qing Guo , Wei Yang Bryan Lim This is my paper
classification cs.CVcs.AI
keywords adversarialattacksvideomultimodallargelanguagemodelsgenerator-basedblack-boxtransferabilitysemantic-visuallossspatiotemporalcoherenceunderstandingbenchmarksreliabilityevaluation
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

CAVALRY-V is a generator framework whose stated aim is to produce imperceptible, transferable adversarial videos that break video multimodal large language models at the point where visual evidence is turned into language. The paper's central claim is that one trained generator, using a dual objective that attacks both the text-generation logits and the visual representations of a surrogate model, degrades video-understanding benchmark scores more than existing iterative, generator-based, and universal-perturbation attacks on every one of the seven V-MLLMs it tests. Reported numbers are an average 22.8% improvement in performance degradation over the best baseline on MMBench-Video, plus a 34.4% average improvement over baselines when the same mechanism is applied to static images on MME. If the claim holds, reliability auditing of deployed video MLLMs becomes much cheaper: perturbations for multi-minute videos are produced by a single forward pass of the generator in seconds, and they transfer to black-box commercial models without querying them.

What carries the argument

The load-bearing object is the generator $G$, a UNet-style convolutional encoder-decoder with skip connections that maps a video tensor $V$ to per-frame perturbations $\delta$ with $\|\delta_i\|_\infty \le \epsilon$ and is the only trainable part of the system. Training maximizes $L(\theta)=\lambda_1 L_{\mathrm{sem}}(\theta)+\lambda_2 L_{\mathrm{vis}}(\theta)+\lambda_3 L_{\mathrm{aux}}(\theta)$: $L_{\mathrm{sem}}$ pushes the model's language logits away from the correct answer, $L_{\mathrm{vis}}$ separates clean and perturbed features in the surrogate visual encoder, and $L_{\mathrm{aux}}$ does the same in an adversarially trained auxiliary model with smoother feature spaces. The temporal part of the argument is carried by the final fine-tuning data organization: batches contain frames sampled from the same video with shared questions and answers, which the paper claims teaches coherent perturbations without explicit temporal regularization.

What would settle it

Retrain the generator with the video fine-tuning stage modified so that each batch mixes frames from different videos, keeping everything else identical, then compare MMBench-Video attack scores and the Normalized Flow Consistency value with the published same-video-batching run; if both are unchanged, the implicit-temporal-coherence mechanism is not doing the claimed work.

Watch

Extended reading notes

Core claim

The paper's central discovery, stated on its own terms, is that a V-MLLM's vulnerability concentrates in the cross-modal interface between what the model sees and what it says. CAVALRY-V attacks that interface with a dual-objective loss: a semantic loss that maximizes the negative log-likelihood of the ground-truth answer tokens under the perturbed video, and a visual loss that maximizes the squared distance between clean and perturbed visual features; an auxiliary loss on an adversarially trained image model is added for transferability. The generator is trained in stages, first on large-scale image-caption data, then on instruction-style question-answering data, and finally on video data in which frames from the same video share a batch, so that in the paper's account it learns temporally coherent perturbations implicitly rather than through an explicit temporal mechanism. On MMBench-Video the framework reportedly outperforms every baseline on all seven target models, and it also beats the baselines on six of seven models on the MME image benchmark.

Load-bearing premise

The load-bearing premise is that putting frames from the same video in the same training batch makes the generator produce perturbations that stay coherent across time, even though the generator processes each frame independently as an image and the paper gives no isolated test of that grouping effect.

Editorial extensions

If this is right

  • A single generator run can produce attack videos for multiple open-source and commercial V-MLLMs, eliminating per-model iterative optimization and making large-scale black-box reliability audits feasible.
  • Because the largest score drops are in perception-related categories, defenses that verify visual grounding before generation should be more effective than defenses aimed only at the language model.
  • The reported positive Normalized Flow Consistency means the perturbations tend to move with the video's optical flow, in contrast to baselines, so temporal coherence and attack transferability are compatible rather than competing goals.
  • The same trained generator, applied one frame at a time, degrades image-understanding scores on MME by an average 34.4% over baselines, so the cross-modal disruption mechanism is not specific to video and may generalize to other multimodal inputs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper does not run is a shuffled-batch control: if randomly mixing frames from different videos during the video fine-tuning stage changes neither MMBench-Video scores nor Normalized Flow Consistency, then the claimed implicit temporal learning is not the actual cause of the gains.
  • The paper's ablation removes the entire fine-tuning stage, so it cannot separate the contribution of same-video batching from the contribution of richer question-answer supervision; an ablation isolating each would settle how much temporal coherence matters.
  • Because the failure example in the paper is a question answerable from stored knowledge, one could build a knowledge-dependence probe that sorts benchmark questions by how much they require visual evidence versus world knowledge and predicts that CAVALRY-V's success will track that split.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces CAVALRY-V, a generator-based framework for black-box transferable adversarial attacks on video MLLMs. The method trains a UNet-style generator with a three-term loss (semantic logit disruption, visual feature distance, and auxiliary smooth-feature distance) in two stages: large-scale image pretraining on LAION-400M, followed by instruction and video fine-tuning. The authors evaluate on MMBench-Video across seven V-MLLMs (five open-source, two commercial) and on the MME image benchmark, reporting that CAVALRY-V outperforms all baselines on all video models with a 22.8% average improvement over the best baseline, and generalizes to images with a 34.4% average gain on six of seven models. The paper also reports a temporal-consistency metric (NFC) and a pretrain-only versus full-pipeline ablation.

Significance. If the empirical claims are reliable, the paper makes a useful contribution: it offers a computationally efficient way to generate transferable adversarial videos for V-MLLMs, evaluates on a broad and current set of targets including commercial APIs, and releases model weights. The two-stage training idea and the emphasis on disrupting the vision-language interface are timely. However, the central claim of consistent, substantial outperformance depends on aggregate score differences that are sometimes as small as 0.01 points, with no error bars, no significance tests, and a non-default evaluation judge. The paper's secondary claim about implicit temporal coherence is also not directly supported by any isolated ablation. These issues are load-bearing for the advertised conclusions, so the current evidence supports a major revision rather than acceptance.

major comments (3)
  1. [§5.1–5.2, Table 1] The central empirical claim that CAVALRY-V 'consistently outperforms all baselines across every tested model' rests on aggregate score differences that are not established as statistically meaningful. For Aria the margin over X-Transfer is 0.01 (1.50 vs. 1.51) and for GPT-4.1-Mini it is also 0.01 (1.70 vs. 1.71), while clean scores are near 1.6–1.9. The paper reports no confidence intervals, no standard errors, no per-question variance, and no number of evaluated items. The 22.8% average improvement is a mean of per-model percentage improvements computed from small absolute degradations; such a summary can be large even when the underlying absolute gaps are within run-to-run noise. In addition, the evaluation replaces MMBench-Video's standard GPT-4-turbo judge with GPT-4o-mini (Section 5.1), which changes the scoring function and may interact with attack effectiveness. The authors should report repeated-run statistics (e.g., bootstrap CIs or at least per-item scores across multiple seeds) and, where possible, results with the benchmark's default judge. Without this, the headline claim of consistent superiority is not yet supported.
  2. [§4.2 and §5.3, temporal coherence claim] The paper attributes part of the transferability gain to implicit spatiotemporal coherence learned by batching frames from the same video with shared question-answer pairs. However, Section 4.2 explicitly states that the generator 'processes individual frames as images during both training and inference,' and the UNet architecture has no temporal layer or recurrence. The only ablation offered (Figure 3) compares the full pipeline against pretraining only, so it cannot isolate the contribution of video-batched fine-tuning from the contribution of the LLaVA-Instruct visual-linguistic fine-tuning that precedes it. Furthermore, Table 2's NFC metric is defined by the authors, is not validated against perceptual or attack-success measures, and is marked 'N/A' for two baselines that use fixed perturbations. The claim that CAVALRY-V produces temporally coherent perturbations that improve transfer therefore lacks a controlled test. An ablation that separately toggles the video-batching component (e.g., same fine-tuning data but with frames shuffled across videos) and a comparison of NFC values against attack success on temporally sensitive subsets would be needed to support the mechanism as stated.
  3. [§4.1, Eq. (6), and Appendix A] The dual-objective semantic-visual loss is presented as a key innovation, but no ablation isolates the contributions of the three loss terms. The paper states that hyperparameters were set 'manually based on empirical observations rather than through exhaustive parameter sweeps,' and no sensitivity analysis is reported for λ1, λ2, λ3, ε, or the number of fine-tuning batches per video. Since the relative weighting of a logit-space loss, a visual-feature loss, and an auxiliary loss is nontrivial and the total objective is claimed to be responsible for the attack's cross-modal effect, the authors should at least provide a one-model ablation (e.g., on InternVL2.5-8B) that removes or reweights each term. Without such an experiment, the reader cannot tell which component drives the reported gains, and the claimed mechanism remains underdetermined.
minor comments (4)
  1. [§5.4, Table 3] The text in Section 5.2 says CAVALRY-V 'consistently outperforms all baselines across every tested model,' but Section 5.4 correctly acknowledges that on the MME benchmark the method underperforms the best baseline on Gemini-2.0-Flash by 10.5%. The claim in the abstract should be qualified to avoid overstating the generality of the image results.
  2. [Table 2] The NFC metric is only briefly defined; please specify how optical flow is computed, how the metric is averaged across videos, and whether the positive value for CAVALRY-V is stable across the different target models. The 'N/A' entries for X-Transfer and CWA are explained, but the reader cannot tell whether the NFC differences are statistically meaningful.
  3. [§3 and §4.1] In Eq. (3), the notation E_t is not defined; the expectation presumably runs over ground-truth answer tokens, but the subscript t is not introduced. Please clarify. Also, the term 'To addresses' in the Introduction is a typo for 'To address.'
  4. [Appendix A] The limitations paragraph is candid about the lack of hyperparameter sweeps and the use of a 1B surrogate model; these points should also be acknowledged in the main text near the experiments, since they directly affect the interpretation of the reported improvements.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the headline attack improvements are empirical measurements, not derivations, and no load-bearing step reduces to its own inputs.

full rationale

The paper's central claims are benchmark-score comparisons, not analytic derivations, so there is no definitional chain to collapse. The AnyAttack baseline (Ref. [36]) and the earlier VLP attack (Ref. [35]) share the first author, but they are used as comparison baselines and related work, not as justification for CAVALRY-V's objective, architecture, or evaluation; deleting them would not change any equation or result. The nearest candidate for circularity is the temporal-coherence claim: the generator processes frames as images (Section 4.2), and the NFC metric in Table 2 is author-defined, with a positive NFC value interpreted as temporal success. However, NFC is not part of the training loss and is not fitted or optimized; the positive value is an output measurement on the generated perturbations, so the claim is not true by construction. The Appendix states computational limits and manual hyperparameter design, which bear on reproducibility and tuning, not on circularity. The reported 0.01 margins and absent confidence intervals are statistical-evidence concerns, and the substitution of GPT-4o-mini as judge is a benchmark-fidelity concern; neither is a circular reduction of the kind this pass targets. No fitted parameter is relabeled as a prediction, and no uniqueness theorem or prior result is invoked to force the design. The analysis is therefore self-contained against external benchmarks, and no circular step is exhibited.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central empirical claims rest on hand-set loss weights, an assumed imperceptibility bound, transferability from a 1B surrogate, and an unvalidated mechanism for temporal coherence. No new physical or architectural entities are introduced.

free parameters (5)
  • lambda_1 = 0.1
    Weight for the semantic loss in Eq. 6, chosen by hand without a sensitivity sweep; acknowledged in Appendix A.
  • lambda_2 = 20
    Weight for the visual feature loss in Eq. 6, chosen by hand without a sensitivity sweep; acknowledged in Appendix A.
  • lambda_3 = 10
    Weight for the auxiliary feature loss in Eq. 6, chosen by hand without a sensitivity sweep; acknowledged in Appendix A.
  • epsilon = 16/255
    L-infinity perturbation bound, chosen ad hoc; no analysis of imperceptibility or sensitivity to this value.
  • video_fine_tune_batches_per_video = 50
    Number of batches sampled from each Video-MME video during fine-tuning, chosen without reported justification or ablation.
assumptions (4)
  • domain assumption L-infinity perturbation with epsilon=16/255 is visually imperceptible
    The paper assumes imperceptibility but provides no human study or perceptual metric; Figure 2 is a single qualitative example.
  • domain assumption Adversarial transfer from InternVL-2.5-1B surrogate to other V-MLLMs is a valid black-box attack model
    The entire evaluation relies on this transfer premise, which is standard for transfer attacks but is not independently verified against a white-box upper bound.
  • domain assumption MMBench-Video and MME scores evaluated by GPT-4o-mini reliably measure attack success
    The paper standardizes on GPT-4o-mini but does not analyze judge variance or agreement with the benchmark's default evaluators.
  • ad hoc to paper Batching frames from the same video with shared QA induces implicit temporal coherence in a per-frame generator
    Stated in Section 4.2 and Section 5.3, but no ablation isolates this effect; the generator has no temporal architecture at inference.

how reviews work

0 comments
Cite this review

Pith. "Pith review of CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMs." pith.science (2026). https://pith.science/paper/62OUNQ7W

@misc{pith2026250700817,
  author       = {Pith},
  title        = {Pith review of: CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMs},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/62OUNQ7W}},
  note         = {Machine review of arXiv:2507.00817}
}
read the original abstract

Video Multimodal Large Language Models (V-MLLMs) have shown impressive capabilities in temporal reasoning and cross-modal understanding, yet their vulnerability to adversarial attacks remains underexplored due to unique challenges: complex cross-modal reasoning mechanisms, temporal dependencies, and computational constraints. We present CAVALRY-V (Cross-modal Language-Vision Adversarial Yielding for Videos), a novel framework that directly targets the critical interface between visual perception and language generation in V-MLLMs. Our approach introduces two key innovations: (1) a dual-objective semantic-visual loss function that simultaneously disrupts the model's text generation logits and visual representations to undermine cross-modal integration, and (2) a computationally efficient two-stage generator framework that combines large-scale pre-training for cross-model transferability with specialized fine-tuning for spatiotemporal coherence. Empirical evaluation on comprehensive video understanding benchmarks demonstrates that CAVALRY-V significantly outperforms existing attack methods, achieving 22.8% average improvement over the best baseline attacks on both commercial systems (GPT-4.1, Gemini 2.0) and open-source models (QwenVL-2.5, InternVL-2.5, Llava-Video, Aria, MiniCPM-o-2.6). Our framework achieves flexibility through implicit temporal coherence modeling rather than explicit regularization, enabling significant performance improvements even on image understanding (34.4% average gain). This capability demonstrates CAVALRY-V's potential as a foundational approach for adversarial research across multimodal systems.

Figures

Figures reproduced from arXiv: 2507.00817 by the authors.

Figure 1
Figure 1. Overview of the CAVALRY-V framework. The generator G produces perturbation pat￾terns of identical dimensions to the input frames, and constitutes the only trainable component within the system, with all other network parameters remaining frozen. The colored arrows sequentially indicate the computation flow for three different objective functions. The training process is divided into two principal stages: (1) pre-tra… view at source ↗
Figure 2
Figure 2. Visualization of attack effects on video understanding. Original video frames (top) and [PITH_FULL_IMAGE:figures/full_fig_p008_2.png] view at source ↗
Figure 3
Figure 3. Performance comparison between our full pipeline and using pre-training only. Method NFC CWA N/A X-Transfer N/A AnyAttack -4.07 GCMA -5.99 Uniform Noise -0.53 CAVALRY-V 0.84 [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

39 extracted references · 17 canonical work pages

  1. [1]

    Phi-3 technical report: A highly capable language model locally on your phone

    Marah Abdin, Jyoti Aneja, Hany Awadalla, Ahmed Awadallah, Ammar Ahmad Awan, Nguyen Bach, Amit Bahree, Arash Bakhtiari, Jianmin Bao, Harkirat Behl, et al. Phi-3 technical report: A highly capable language model locally on your phone. arXiv preprint arXiv:2404.14219, 2024

    arXiv 2024

  2. [2]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  3. [3]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923, 2025

    arXiv 2025

  4. [4]

    Rethinking model ensemble in transfer-based adversarial attacks

    Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks. In The Twelfth International Conference on Learning Representations, 2024

    work page 2024

  5. [5]

    Gcma: Generative cross-modal transferable adversarial attacks from images to videos

    Kai Chen, Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Gcma: Generative cross-modal transferable adversarial attacks from images to videos. In Proceedings of the 31st ACM International Conference on Multimedia, pages 698–708, 2023

    work page 2023

  6. [6]

    Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling

    Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shen- glong Ye, Hao Tian, Zhaoyang Liu, et al. Expanding performance boundaries of open-source multimodal models with model, data, and test-time scaling. arXiv preprint arXiv:2412.05271, 2024

    arXiv 2024

  7. [7]

    Parseval networks: Improving robustness to adversarial examples

    Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: Improving robustness to adversarial examples. In International Conference on Machine Learning (ICML), 2017

    work page 2017

  8. [8]

    One perturbation is enough: On generating universal adversarial perturbations against vision- language pre-training models

    Hao Fang, Jiawei Kong, Wenbo Yu, Bin Chen, Jiawei Li, Hao Wu, Shutao Xia, and Ke Xu. One perturbation is enough: On generating universal adversarial perturbations against vision- language pre-training models. arXiv preprint arXiv:2406.05491, 2024

    arXiv 2024

Show all 39 references
  1. [9]

    Mmbench-video: A long-form multi-shot benchmark for holistic video understanding

    Xinyu Fang, Kangrui Mao, Haodong Duan, Xiangyu Zhao, Yining Li, Dahua Lin, and Kai Chen. Mmbench-video: A long-form multi-shot benchmark for holistic video understanding. Advances in Neural Information Processing Systems, 37:89098–89124, 2024

    2024

  2. [10]

    Mme: A comprehensive evaluation benchmark for multimodal large language models

    Chaoyou Fu, Peixian Chen, Yunhang Shen, Yulei Qin, Mengdan Zhang, Xu Lin, Jinrui Yang, Xiawu Zheng, Ke Li, Xing Sun, et al. Mme: A comprehensive evaluation benchmark for multimodal large language models. arXiv preprint arXiv:2306.13394, 2023

    2023 arXiv

  3. [11]

    Video-mme: The first-ever comprehensive evaluation benchmark of multi-modal llms in video analysis

    Chaoyou Fu, Yuhan Dai, Yondong Luo, Lei Li, Shuhuai Ren, Renrui Zhang, Zihan Wang, Chenyu Zhou, Yunhang Shen, Mengdan Zhang, et al. Video-mme: The first-ever comprehensive evaluation benchmark of multi-modal llms in video analysis. CVPR, 2025

    2025

  4. [12]

    Retome-va: Recursive token merging for video diffusion-based unrestricted adversarial attack

    Ziyi Gao, Kai Chen, Zhipeng Wei, Tingshu Mou, Jingjing Chen, Zhiyu Tan, Hao Li, and Yu-Gang Jiang. Retome-va: Recursive token merging for video diffusion-based unrestricted adversarial attack. In Proceedings of the 32nd ACM International Conference on Multimedia, pages 4485–4494, 2024

    2024

  5. [13]

    Explaining and harnessing adversar- ial examples

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversar- ial examples. arXiv preprint arXiv:1412.6572, 2014. 10

    2014 arXiv

  6. [14]

    X-transfer attacks: Towards super transferable adversarial attacks on clip

    Hanxun Huang, Sarah Erfani, Yige Li, Xingjun Ma, and James Bailey. X-transfer attacks: Towards super transferable adversarial attacks on clip. In ICML, 2025

    2025

  7. [15]

    Llava-onevision: Easy visual task transfer

    Bo Li, Yuanhan Zhang, Dong Guo, Renrui Zhang, Feng Li, Hao Zhang, Kaichen Zhang, Peiyuan Zhang, Yanwei Li, Ziwei Liu, et al. Llava-onevision: Easy visual task transfer. arXiv preprint arXiv:2408.03326, 2024

    2024 arXiv

  8. [16]

    Aria: An open multimodal native mixture-of-experts model

    Dongxu Li, Yudong Liu, Haoning Wu, Yue Wang, Zhiqi Shen, Bowen Qu, Xinyao Niu, Fan Zhou, Chengen Huang, Yanpeng Li, et al. Aria: An open multimodal native mixture-of-experts model. arXiv preprint arXiv:2410.05993, 2024

    2024 arXiv

  9. [17]

    Vila: On pre-training for visual language models

    Ji Lin, Hongxu Yin, Wei Ping, Pavlo Molchanov, Mohammad Shoeybi, and Song Han. Vila: On pre-training for visual language models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 26689–26699, 2024

    2024

  10. [18]

    Visual instruction tuning.Advances in neural information processing systems, 36:34892–34916, 2023

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning.Advances in neural information processing systems, 36:34892–34916, 2023

    2023

  11. [19]

    Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models

    Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 102–111, 2023

    2023

  12. [20]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  13. [21]

    Univer- sal adversarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Univer- sal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 1765–1773, 2017

    2017

  14. [22]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pa...

    2021

  15. [23]

    U-net: Convolutional networks for biomedical image segmentation

    Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-assisted intervention–MICCAI 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part ...

    2015

  16. [24]

    Imagenet large scale visual recognition challenge

    Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211–252, 2015

    2015

  17. [25]

    Laion-400m: Open dataset of clip-filtered 400 million image-text pairs

    Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs. arXiv preprint arXiv:2111.02114, 2021

    2021 arXiv

  18. [26]

    Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context

    Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context. arXiv preprint arXiv:2403.05530, 2024

    2024 arXiv

  19. [27]

    Heuristic black-box adversarial attacks on video recognition models

    Zhipeng Wei, Jingjing Chen, Xingxing Wei, Linxi Jiang, Tat-Seng Chua, Fengfeng Zhou, and Yu-Gang Jiang. Heuristic black-box adversarial attacks on video recognition models. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 34, pages 12338–12345, 2020

    2020

  20. [28]

    Boosting the transferability of video adversarial examples via temporal translation

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Boosting the transferability of video adversarial examples via temporal translation. In Proceedings of the AAAI conference on artificial intelligence, volume 36, pages 2659–2667, 2022. 11

    2022

  21. [29]

    Cross-modal transferable adversarial attacks from images to videos

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Cross-modal transferable adversarial attacks from images to videos. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 15064–15073, 2022

    2022

  22. [30]

    Adaptive temporal grouping for black-box adversarial attacks on videos

    Zhipeng Wei, Jingjing Chen, Hao Zhang, Linxi Jiang, and Yu-Gang Jiang. Adaptive temporal grouping for black-box adversarial attacks on videos. In Proceedings of the 2022 International Conference on Multimedia Retrieval, pages 587–593, 2022

    2022

  23. [31]

    Adaptive cross-modal transferable adversarial attacks from images to videos

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Adaptive cross-modal transferable adversarial attacks from images to videos. IEEE Transactions on Pattern Analysis and Machine Intelligence, 46(5):3772–3783, 2023

    2023

  24. [32]

    Minicpm-v: A gpt-4v level mllm on your phone

    Yuan Yao, Tianyu Yu, Ao Zhang, Chongyi Wang, Junbo Cui, Hongji Zhu, Tianchi Cai, Haoyu Li, Weilin Zhao, Zhihui He, et al. Minicpm-v: A gpt-4v level mllm on your phone. arXiv preprint arXiv:2408.01800, 2024

    2024 arXiv

  25. [33]

    Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models

    Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models. Advances in Neural Information Processing Systems, 36:52936–52956, 2023

    2023

  26. [34]

    Videollama 3: Frontier multimodal foundation models for image and video understanding

    Boqiang Zhang, Kehan Li, Zesen Cheng, Zhiqiang Hu, Yuqian Yuan, Guanzheng Chen, Sicong Leng, Yuming Jiang, Hang Zhang, Xin Li, et al. Videollama 3: Frontier multimodal foundation models for image and video understanding. arXiv preprint arXiv:2501.13106, 2025

    2025 arXiv

  27. [35]

    Towards adversarial attack on vision-language pre- training models

    Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pre- training models. In Proceedings of the 30th ACM International Conference on Multimedia , pages 5005–5013, 2022

    2022

  28. [36]

    Anyattack: Towards large-scale self-supervised adversarial attacks on vision-language models

    Jiaming Zhang, Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Chen Yunhao, Jitao Sang, and Dit-Yan Yeung. Anyattack: Towards large-scale self-supervised adversarial attacks on vision-language models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recog...

    2025

  29. [37]

    Video instruction tuning with synthetic data

    Yuanhan Zhang, Jinming Wu, Wei Li, Bo Li, Zejun Ma, Ziwei Liu, and Chunyuan Li. Video instruction tuning with synthetic data. arXiv preprint arXiv:2410.02713, 2024

    2024 arXiv

  30. [38]

    On evaluating adversarial robustness of large vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36:54111–54138, 2023

    2023

  31. [39]

    Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning

    Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia, pages 6311–6320, 2023. 12 A Limitations T...

    2023

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.