Pith. sign in

REVIEW 3 major objections 5 minor 5 cited by

Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment

T0 review · 3 major / 5 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read FOA-Attack claims tiny perturbations tuned in open CLIP space, aligning global and clustered local features, redirect commercial MLLM captions to chosen targets: 75.1% success on GPT-4o, 53.4% on Gemini-2.0.

desk verdict Solid incremental attack paper with real gains, but the progressive cluster-center protocol needs clarification before the headline margins are trusted. read the letter →

arxiv 2505.21494 v1 pith:J2PB2LJG submitted 2025-05-27 cs.CV

Xiaojun Jia , Sensen Gao , Simeng Qin , Tianyu Pang , Chao Du , Yihao Huang , Xinfeng Li , Yiming Li
show 2 more authors
Bo Li Yang Liu
This is my paper
classification cs.CV
keywords adversarialattacksmultimodallargelanguagemodelstransferableexamplestargetedattackoptimaltransportfeaturealignmentCLIPencodersblack-boxtransferability
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper seeks to establish that the black-box threat against commercial multimodal chatbots is worse than prior work suggested: an attacker with access only to open CLIP image encoders can craft small pixel perturbations that make GPT-4o, GPT-4.1, Gemini-2.0, and Claude describe an image as attacker-chosen content. The proposed FOA-Attack aligns adversarial and target images at two levels, a global cosine-similarity loss on the [CLS] token and a fine-grained loss that K-means clusters patch-token features and matches the clusters between images by solving an optimal transport problem with the Sinkhorn algorithm. A dynamic ensemble weighting scheme, which down-weights any surrogate encoder that converges too quickly, further boosts transferability. If the headline numbers hold, 75.1% attack success on GPT-4o and 53.4% on Gemini-2.0, then targeted caption control over closed-source MLLMs is reachable without any access to their weights.

What carries the argument

The load-bearing object is a two-level feature optimal alignment loss evaluated inside an ensemble of open CLIP image encoders. At the global level, the loss is $1-\cos(X,Y)$ between the [CLS]-token embeddings of the adversarial and target images. At the local level, patch-token feature sets $X_{\mathrm{loc}},Y_{\mathrm{loc}}\in\mathbb{R}^{m\times d}$ are each reduced by K-means clustering to $n$ cluster centers, and alignment is posed as an optimal transport problem $\min\sum_{a,b}C_{ab}\pi_{ab}$ with cost $C_{ab}=1-\langle X^a_{\mathrm{clu}},Y^b_{\mathrm{clu}}\rangle$, solved by the Sinkhorn iteration so that the transport plan is $\pi_{ab}=u_a\exp(-C_{ab}/\lambda)v_b$ with $\lambda=0.1$. The per-encoder loss is $L_\theta=L_{\mathrm{coa}}+\eta L_{\mathrm{fin}}$ with $\eta=0.2$, and cluster counts are progressively raised from 3 to 5 if the attack fails. A third mechanism, dynamic ensemble weighting, computes each encoder's weight $W_i$ from the loss ratio $S_i(T)=L^{T}_{\theta_i}/L^{T-1}_{\theta_i}$ so fast-converging surrogates are down-weighted, and the ensemble objective $\sum_i W_iL_{\theta_i}$ is optimized by projected gradient ascent under the $\ell_\infty$ budget $16/255$.

What would settle it

A direct test: re-run the attack on a fresh, independently sampled set of 1,000 image pairs with the same three CLIP surrogates and query GPT-4o, GPT-4.1, and Gemini-2.0, predicting closed-model ASR near 75%, 77%, and 53%; alternatively, replace the ViT-g-14-laion2B surrogate with a non-CLIP encoder such as a DINOv2 or SigLIP trunk, and check whether GPT-4o ASR stays near 75% (premise not load-bearing) or falls toward the single-encoder baselines (premise confirmed).

Watch

Extended reading notes

Core claim

The paper's central claim is that the transferability ceiling of targeted adversarial attacks against closed-source MLLMs is set by the granularity of feature alignment inside the surrogate CLIP encoders. Prior methods align only global features, typically the [CLS] token, between the adversarial image and a target image, which the authors argue overfits the surrogate and transfers poorly. FOA-Attack instead jointly minimizes a global cosine-similarity loss and a local clustering optimal transport loss: patch tokens of both images are reduced by K-means to compact cluster centers, and the cost $C_{ab}=1-\langle X^a_{\mathrm{clu}},Y^b_{\mathrm{clu}}\rangle$ of transporting adversarial centers onto target centers is minimized through a Sinkhorn-computed transport plan. A dynamic ensemble weighting strategy re-weights the three surrogate CLIP encoders (ViT-B/16, ViT-B/32, ViT-g-14-laion2B) at each iteration according to their loss-reduction rates so that no single easy-to-align encoder dominates the gradient. Across six open-source and five closed-source MLLMs the paper reports consistent gains over the strongest prior baseline M-Attack, e.g., 75.1% versus 60.3% ASR on GPT-4o, 77.3% versus 60.8% on GPT-4.1, and 53.4% versus 44.8% on Gemini-2.0, all at a stricter success threshold (0.5 rather than 0.3).

Load-bearing premise

The entire result rests on the unverified premise that the internal visual encoders of the closed-source MLLMs are close enough to the feature space of the three open CLIP surrogates that perturbations optimized in CLIP space remain effective after transfer; if those encoders diverged from CLIP space, the reported success rates would collapse.

Editorial extensions

If this is right

  • An attacker with no access to commercial model weights can steer GPT-4o, GPT-4.1, and Gemini-2.0 captions toward chosen target descriptions 75.1%, 77.3%, and 53.4% of the time, respectively, at a perturbation budget of 16/255.
  • Reasoning-enhanced closed-source models remain vulnerable: the paper reports 81.0% ASR on GPT-o3 and 57.0% on Gemini-2.0-flash-thinking-exp, indicating that adding textual reasoning layers does not remove the visual encoder's adversarial weakness.
  • Local feature alignment is the largest single contributor to transferability: removing it drops GPT-4o ASR from 81.0% to 76.0% and AvgSim from 0.62 to 0.58 on the ablation subset.
  • The attack keeps most of its strength under common defenses, holding 75.0% ASR on GPT-4o and 78.0% on GPT-4.1 under JPEG compression.
  • The added optimal transport computation roughly doubles generation time (217 minutes versus 90 for M-Attack in the cluster-center study), a cost the authors acknowledge as the main limitation.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the transfer mechanism is as general as claimed, swapping the surrogate family from CLIP to other open vision encoders (e.g., SigLIP or DINOv2-based heads) and measuring cross-family transfer would reveal whether the effect is specific to CLIP feature geometry or generic to local feature alignment.
  • The K-means-plus-optimal-transport formulation invites a distributional reading: the attack effectively shrinks a Wasserstein-style distance between the adversarial image's patch-feature distribution and the target's, which predicts that transferability should improve with cluster count up to a resolution-dependent saturation point, consistent with the paper's cluster-center table.
  • Because the reported gains persist on reasoning-enhanced models, post-hoc reasoning or alignment layers on top of the visual encoder are unlikely to close the vulnerability; defenses would need to modify or purify the visual feature space itself.
  • Combining the local optimal transport loss with input-space diversification such as random resizing and cropping is untested here; the two mechanisms target different overfitting modes and could compound, a cheap experiment to run with the released code.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes FOA-Attack, a targeted transferable adversarial attack against multimodal large language models (MLLMs). It combines a global cosine-similarity loss on CLIP [CLS] features with a local feature alignment loss solved via clustering and Sinkhorn-regularized optimal transport, and adds a dynamic ensemble weighting strategy over three CLIP encoders. Experiments on 1,000 NIPS-2017 images report consistent improvements over M-Attack and other baselines on six open-source MLLMs, five closed-source MLLMs, and three reasoning-oriented closed-source MLLMs, with headline ASR values of 75.1% on GPT-4o and 53.4% on Gemini-2.0. The paper also includes ablations, a cluster-center analysis, defense evaluations, and a released code repository.

Significance. If the reported numbers are reproducible, the paper makes a useful empirical contribution to the growing literature on transferable adversarial attacks against commercial MLLMs: it shows that combining global and local feature alignment in CLIP space can improve targeted transfer substantially, and it documents vulnerabilities in current closed-source systems. The method is technically simple, the experiments span a wide range of models and evaluation thresholds, and the authors provide code. The main caveat is that the headline results depend on a progressive cluster-center strategy whose selection protocol is not fully specified; if that strategy uses target-model feedback or takes the union of multiple runs, the reported gains over single-configuration baselines are not as strong as claimed.

major comments (3)
  1. [Sec. 3.3, Table 6, Sec. 4.1] The progressive cluster-center strategy is not adequately defined. The paper states in Sec. 3.3 that the method "increases the number of cluster centers if the attack fails," but the failure criterion is never specified, and the only success definition given in Sec. 4.1 is based on the target model's output. Since the main experiments use the [3,5] configuration, it is critical to know whether the decision to rerun with five centers uses any information from the closed-source target model, or whether every image is simply attacked with both three and five centers and success is reported as the union of the two runs. The runtime data in Table 6 (113, 217, 315, and 410 minutes for [3], [3,5], [3,5,8], and [3,5,8,10]) is more consistent with full re-runs on every image than with re-running only a surrogate-detected failed subset, and the text does not explain the discrepancy. If the reported ASRs are union-of-configurations results, they are not directly comparable with the single-configuration M-Attack baseline. The authors should specify the failure criterion, report [3]-only and [5]-only results on the full 1000-image benchmark, and clarify whether any target-model query is used during generation.
  2. [Appendix A, Algorithm 1; Sec. 3.4] Algorithm 1 uses the symbol T for both the iteration counter and the temperature coefficient, which makes the pseudocode unexecutable. In line 2, T runs from 0 to n-1; in line 19, the weight update divides by T and the loop variable also appears in exp(S_j(T)/T). At T=0 this is division by zero, and at later iterations the weighting changes with the iteration index, contradicting the main text, where T is a fixed temperature hyperparameter set to 1.0 in Sec. 4.2. The dynamic ensemble weighting strategy is a claimed contribution, so the pseudocode must be corrected, e.g., by renaming the iteration variable t and the temperature tau, and by aligning line 19 with Eq. (13).
  3. [Sec. 4.1, Fig. 5] The evaluation relies entirely on an LLM-as-a-judge similarity score (GPTScore) without calibration. The paper does not report which model performs the scoring, the generation temperature used by the judge, or any human-agreement study for the 0.5 threshold. Since every reported ASR value is defined by this metric, a small calibration set with human ratings or a second judge would materially strengthen the claim that the attack produces semantically aligned captions. The absence of calibration is particularly relevant for closed-source targets, where the judge may be the same model family as the target and could be influenced by the perturbation in ways that are not purely semantic.
minor comments (5)
  1. [Sec. 2.2] There is a stray "60?" in the sentence listing adversarial-robustness studies; this appears to be a missing or malformed citation and should be fixed.
  2. [Sec. 3.4, Eq. (12)-(13)] The notation T is overloaded even within the main text: it denotes the iteration step in Eq. (12) and the temperature coefficient in Eq. (13). Please use distinct symbols for these two quantities.
  3. [Appendix F] The Impact Statement says that "the victim MLLMs employed in this study are open-source models with publicly available weights," but the paper explicitly attacks closed-source models such as GPT-4o, Claude, and Gemini. This sentence should be corrected.
  4. [Table 2 vs. Table 4] M-Attack's ASR on Claude-3.5 is 6.0% in Table 2 (1000-image benchmark) but 10.0% in Table 4 (100-image ablation). Since the subset sizes differ, this is expected, but the paper should state explicitly that Tables 3, 4, 5, and 6 use 100-image subsets so readers do not misinterpret the discrepancy.
  5. [Appendix C] The text around Fig. 5 contains a garbled fragment ("Below is the detailed evaluation prompt used to assess semantic similarity between textual inputs:ASR:") and should be rephrased for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: FOA-Attack's headline ASR values are empirical transfer measurements against closed-source MLLMs, not quantities forced by its loss definitions.

full rationale

FOA-Attack is an empirical attack paper. The headline transferability numbers (e.g., 75.1% ASR on GPT-4o in Table 2) are measured outcomes on closed-source models and are not derived from the loss definitions; the global cosine loss (Eq. 2), the local clustering optimal transport loss (Eqs. 4-9), and the dynamic ensemble weighting (Eqs. 12-13) are all defined independently of the success metric in Sec. 4.1. The reported ASR is the empirical result of optimizing these losses on surrogate CLIP encoders and testing on target MLLMs, so there is no derivation chain that reduces to the paper's own inputs. The only self-citation that is thematically close is OT-Attack [23], but it appears in the introduction as a general security-related citation and is not load-bearing; the OT formulation in Sec. 3.3 explicitly cites Villani and Sinkhorn rather than the authors' prior work. The progressive cluster-center strategy ('increases the number of cluster centers if the attack fails', Sec. 3.3) is under-specified because the failure criterion is not defined; if it used target-model feedback, the Table 2 numbers would be adaptive-search results rather than single-configuration transfer. However, the paper never states that target feedback is used, and Table 6's near-linear runtime growth is consistent with full re-runs per configuration. Because the circularity rules forbid speculation about protocol intent, this is noted as a correctness/protocol risk rather than a demonstrated circular step. The comparison against M-Attack and other external baselines provides independent empirical grounding, and no fitted parameter is renamed as a prediction. Verdict: no significant circularity.

Assumptions & free parameters 7 free parameters · 4 assumptions · 0 invented entities

The method introduces several tuned hyperparameters but no new physical or mathematical entities. The axioms are standard computational assumptions plus the key domain assumption that CLIP feature space transfers to closed-source MLLMs. The progressive cluster schedule is an ad hoc mechanism but is part of the algorithm rather than a separate entity.

free parameters (7)
  • local loss weight eta = 0.2
    Chosen by hyperparameter search on a 100-image subset (Fig. 3b) to balance global and local loss terms.
  • temperature T = 1.0
    Selected via Fig. 3a; controls sharpness of dynamic ensemble weighting.
  • cluster centers n = 3 and 5 (progressive)
    K-means cluster count for local features; the paper progressively increases from 3 to 5 if the attack fails.
  • Sinkhorn regularization lambda = 0.1
    Default regularization parameter for the Sinkhorn optimal transport solver.
  • perturbation budget epsilon = 16/255
    L-infinity budget used in all experiments, inherited from M-Attack.
  • attack iterations = 300
    Number of PGD-style optimization steps.
  • step size = 1/255
    Update step size for adversarial generation.
assumptions (4)
  • standard math Sinkhorn algorithm converges to a useful approximate optimal transport plan
    Used in Eq. 7-9 as the solver for the local feature alignment; convergence conditions are not discussed.
  • domain assumption K-means cluster centers summarize semantically coherent local regions
    Assumed in Sec 3.3; no validation that cluster centers are discriminative or stable across images.
  • domain assumption Closed-source MLLMs share feature geometry with surrogate CLIP encoders
    Core transferability premise; assumed in Sec 3.1 and Sec 4.3, never directly verified.
  • domain assumption LLM-as-a-judge similarity threshold 0.5 indicates the same subject
    Evaluation metric assumption stated in Sec 4.1; no calibration study connects 0.5 to a human-judged notion of same subject.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment." pith.science (2026). https://pith.science/paper/J2PB2LJG

@misc{pith2026250521494,
  author       = {Pith},
  title        = {Pith review of: Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/J2PB2LJG}},
  note         = {Machine review of arXiv:2505.21494}
}
read the original abstract

Multimodal large language models (MLLMs) remain vulnerable to transferable adversarial examples. While existing methods typically achieve targeted attacks by aligning global features-such as CLIP's [CLS] token-between adversarial and target samples, they often overlook the rich local information encoded in patch tokens. This leads to suboptimal alignment and limited transferability, particularly for closed-source models. To address this limitation, we propose a targeted transferable adversarial attack method based on feature optimal alignment, called FOA-Attack, to improve adversarial transfer capability. Specifically, at the global level, we introduce a global feature loss based on cosine similarity to align the coarse-grained features of adversarial samples with those of target samples. At the local level, given the rich local representations within Transformers, we leverage clustering techniques to extract compact local patterns to alleviate redundant local features. We then formulate local feature alignment between adversarial and target samples as an optimal transport (OT) problem and propose a local clustering optimal transport loss to refine fine-grained feature alignment. Additionally, we propose a dynamic ensemble model weighting strategy to adaptively balance the influence of multiple models during adversarial example generation, thereby further improving transferability. Extensive experiments across various models demonstrate the superiority of the proposed method, outperforming state-of-the-art methods, especially in transferring to closed-source MLLMs. The code is released at https://github.com/jiaxiaojunQAQ/FOA-Attack.

Figures

Figures reproduced from arXiv: 2505.21494 by the authors.

Figure 1
Figure 1. Targeted adversarial examples generated by FOA-Attack, with responses from commercial [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Overview of the proposed FOA-Attack. (a) The proposed feature optimal alignment loss which includes the coarse-grained feature loss and the fine-grained feature loss. (b) The proposed dynamic ensemble model weighting strategy. commercial MLLMs like Google’s Bard. Guo et al. [22] propose AdvDiffVLM, a diffusion-based framework that integrates Adaptive Ensemble Gradient Estimation (AEGE) and GradCAM-guided Mask Genera… view at source ↗
Figure 3
Figure 3. (a) Impact of the temperature coefficient [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figures from the paper (10 more)
Figure 4
Figure 4. Figure 4: Visualization of adversarial images and perturbation. [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Evaluation prompt template. C Detailed Evaluation Prompt Following M-Attack [32], we adopt the same way to evaluate the adversarial performance. Below is the detailed evaluation prompt used to assess semantic similarity between textual inputs: ASR: the “{input_text_1}”…
Figure 6
Figure 6. Figure 6: Example responses from the commercial MLLM-GPT-4o to targeted attacks generated by [PITH_FULL_IMAGE:figures/full_fig_p019_6.png]
Figure 7
Figure 7. Figure 7: Example responses from the commercial MLLM-GPT-o3 to targeted attacks generated by [PITH_FULL_IMAGE:figures/full_fig_p020_7.png]
Figure 8
Figure 8. Figure 8: Example responses from the commercial MLLM-GPT-4.5 to targeted attacks generated by [PITH_FULL_IMAGE:figures/full_fig_p021_8.png]
Figure 9
Figure 9. Figure 9: Example responses from the commercial MLLM-GPT-4.1 to targeted attacks generated by [PITH_FULL_IMAGE:figures/full_fig_p022_9.png]
Figure 10
Figure 10. Figure 10: Example responses from the commercial MLLM-Claude-3.5-Sonnet to targeted attacks [PITH_FULL_IMAGE:figures/full_fig_p023_10.png]
Figure 11
Figure 11. Figure 11: Example responses from the commercial MLLM-Claude-3.7-Sonnet to targeted attacks [PITH_FULL_IMAGE:figures/full_fig_p024_11.png]
Figure 12
Figure 12. Figure 12: Example responses from the commercial MLLM-Gemini-2.0-Flash to targeted attacks [PITH_FULL_IMAGE:figures/full_fig_p025_12.png]
Figure 13
Figure 13. Figure 13: Example responses from the commercial MLLM-Gemini-2.5-Flash to targeted attacks [PITH_FULL_IMAGE:figures/full_fig_p026_13.png]

Discussion (0). Sign in to comment.

Forward citations

Cited by 5 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models

    cs.CR 2025-08 conditional novelty 7.0 of 10

    Hidden Tail crafts adversarial images that force VLMs to emit long invisible runs of special tokens, inflating output length up to 19.2x while keeping the visible answer normal.

  2. 3D Gaussian Splatting Driven Multi-View Robust Physical Adversarial Camouflage Generation

    cs.CV 2025-07 conditional novelty 7.0 of 10

    PGA uses 3D Gaussian Splatting to generate physical adversarial camouflage from a few images, improving multi-view attack robustness on vehicle detectors.

  3. XPlainVerse: A Million-Scale Benchmark for Explainable Deepfake Detection

    cs.CV 2026-07 conditional novelty 6.5 of 10

    A million-scale deepfake benchmark with Edit-Check filtering, dual expert/lay explanations, and EntityScore/EvidenceScore shows fine-tuned detectors collapse under generator shift while surface fluency remains.

  4. On Adversarial Vulnerability of Vision-Language Models through the Lens of Intermediate Spectral Subspaces

    cs.LG 2026-07 conditional novelty 6.0 of 10

    Aligning adversarial perturbations with the near-null singular directions of intermediate linear layers in transformer VLMs yields stronger attacks than existing feature- and output-space methods.

  5. Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIP

    cs.CV 2026-01 conditional novelty 4.0 of 10

    CSR detects and repairs adversarial CLIP inputs by comparing features with a low-pass filtered copy and applying a small contrastive PGD correction, claiming SOTA robust accuracy on 16 benchmarks.

Reference graph

Works this paper leans on

67 extracted references · 12 canonical work pages · cited by 5 Pith papers

  1. [3]

    Palm 2 technical report

    Rohan Anil, Andrew M Dai, Orhan Firat, Melvin Johnson, Dmitry Lepikhin, Alexandre Passos, Siamak Shakeri, Emanuel Taropa, Paige Bailey, Zhifeng Chen, et al. Palm 2 technical report. arXiv preprint arXiv:2305.10403, 2023

    arXiv 2023

  2. [23]

    Ot-attack: En- hancing adversarial transferability of vision-language models via optimal transport optimization

    Dongchen Han, Xiaojun Jia, Yang Bai, Jindong Gu, Yang Liu, and Xiaochun Cao. Ot-attack: En- hancing adversarial transferability of vision-language models via optimal transport optimization. arXiv preprint arXiv:2312.04403, 2023

    arXiv 2023

  3. [5]

    Improv- ing the transferability of targeted adversarial examples through object-based diverse input

    Junyoung Byun, Seungju Cho, Myung-Joon Kwon, Hee-Seon Kim, and Changick Kim. Improv- ing the transferability of targeted adversarial examples through object-based diverse input. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15244–15253, 2022

    work page 2022

  4. [1]

    Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report.arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  5. [2]

    Flamingo: a visual language model for few-shot learning.Advances in Neural Information Processing Systems, 35: 23716–23736, 2022

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning.Advances in Neural Information Processing Systems, 35: 23716–23736, 2022

    2022

  6. [4]

    Image hijacks: Adversarial images can control generative models at runtime.arXiv preprint arXiv:2309.00236, 2023

    Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. Image hijacks: Adversarial images can control generative models at runtime.arXiv preprint arXiv:2309.00236, 2023

    arXiv 2023

  7. [6]

    Towards evaluating the robustness of neural networks

    Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 ieee symposium on security and privacy (sp), pages 39–57. Ieee, 2017

    2017

  8. [7]

    Are aligned neural networks adversarially aligned?arXiv preprint arXiv:2306.15447, 2023

    Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, et al. Are aligned neural networks adversarially aligned?arXiv preprint arXiv:2306.15447, 2023

    arXiv 2023

Show all 67 references
  1. [8]

    Rethinking model ensemble in transfer-based adversarial attacks.arXiv preprint arXiv:2303.09105, 2023

    Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensemble in transfer-based adversarial attacks.arXiv preprint arXiv:2303.09105, 2023

    2023 arXiv

  2. [9]

    Palm: Scaling language modeling with pathways.Journal of Machine Learning Research, 24(240): 1–113, 2023

    Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways.Journal of Machine Learning Research, 24(240): 1–113, 2023

    2023

  3. [10]

    A survey on multimodal large language models for autonomous driving

    Can Cui, Yunsheng Ma, Xu Cao, Wenqian Ye, Yang Zhou, Kaizhao Liang, Jintai Chen, Juanwu Lu, Zichong Yang, Kuei-Da Liao, et al. A survey on multimodal large language models for autonomous driving. InProceedings of the IEEE/CVF Winter Conference on Applications of Computer Visio...

    2024

  4. [11]

    Sinkhorn distances: Lightspeed computation of optimal transport.Advances in neural information processing systems, 26, 2013

    Marco Cuturi. Sinkhorn distances: Lightspeed computation of optimal transport.Advances in neural information processing systems, 26, 2013

    2013

  5. [12]

    AdverTorch v0.1: An adversarial robustness toolbox based on pytorch.arXiv preprint arXiv:1902.07623, 2019

    Gavin Weiguang Ding, Luyu Wang, and Xiaomeng Jin. AdverTorch v0.1: An adversarial robustness toolbox based on pytorch.arXiv preprint arXiv:1902.07623, 2019

    1902 arXiv

  6. [13]

    How robust is google’s bard to adversarial image attacks?arXiv preprint arXiv:2309.11751, 2023

    Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google’s bard to adversarial image attacks?arXiv preprint arXiv:2309.11751, 2023

    2023 arXiv

  7. [14]

    An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:2010.11929, 2020

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: Transformers for image recognition at scale.arXiv preprint arXiv:...

    2010 arXiv

  8. [15]

    Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned.arXiv preprint arXiv:2209.07858, 2022

    Deep Ganguli, Liane Lovitt, Jackson Kernion, Amanda Askell, Yuntao Bai, Saurav Kadavath, Ben Mann, Ethan Perez, Nicholas Schiefer, Kamal Ndousse, et al. Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned.arXiv preprint arXiv:2209.07858, 2022

    2022 arXiv

  9. [16]

    Llama-adapter v2: Parameter-efficient visual instruction model.arXiv preprint arXiv:2304.15010, 2023

    Peng Gao, Jiaming Han, Renrui Zhang, Ziyi Lin, Shijie Geng, Aojun Zhou, Wei Zhang, Pan Lu, Conghui He, Xiangyu Yue, et al. Llama-adapter v2: Parameter-efficient visual instruction model.arXiv preprint arXiv:2304.15010, 2023

    2023 arXiv

  10. [17]

    Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory

    Sensen Gao, Xiaojun Jia, Xuhong Ren, Ivor Tsang, and Qing Guo. Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory. arXiv preprint arXiv:2403.12445, 2024

    2024 arXiv

  11. [19]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adver- sarial examples. In Yoshua Bengio and Yann LeCun, editors,3rd International Conference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Procee...

    2015 arXiv

  12. [20]

    Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast

    Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. Agent smith: A single image can jailbreak one million multimodal llm agents exponentially fast. InInternational Conference on Machine Learning, 2024

    2024

  13. [21]

    Countering adversarial images using input transformations.arXiv preprint arXiv:1711.00117, 2017

    Chuan Guo, Mayank Rana, Moustapha Cisse, and Laurens Van Der Maaten. Countering adversarial images using input transformations.arXiv preprint arXiv:1711.00117, 2017

    2017 arXiv

  14. [22]

    Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models.IEEE Transactions on Information Forensics and Security, 2024

    Qi Guo, Shanmin Pang, Xiaojun Jia, Yang Liu, and Qing Guo. Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models.IEEE Transactions on Information Forensics and Security, 2024

    2024

  15. [24]

    Sa- attack: Improving adversarial transferability of vision-language pre-training models via self- augmentation.arXiv preprint arXiv:2312.04913, 2023

    Bangyan He, Xiaojun Jia, Siyuan Liang, Tianrui Lou, Yang Liu, and Xiaochun Cao. Sa- attack: Improving adversarial transferability of vision-language pre-training models via self- augmentation.arXiv preprint arXiv:2312.04913, 2023

    2023 arXiv

  16. [25]

    Language is not all you need: Aligning perception with language models.arXiv preprint arXiv:2302.14045, 2023

    Shaohan Huang, Li Dong, Wenhui Wang, Yaru Hao, Saksham Singhal, Shuming Ma, Tengchao Lv, Lei Cui, Owais Khan Mohammed, Qiang Liu, et al. Language is not all you need: Aligning perception with language models.arXiv preprint arXiv:2302.14045, 2023

    2023 arXiv

  17. [26]

    Vision-r1: Incentivizing reasoning capability in multimodal large language models.arXiv preprint arXiv:2503.06749, 2025

    Wenxuan Huang, Bohan Jia, Zijie Zhai, Shaosheng Cao, Zheyu Ye, Fei Zhao, Zhe Xu, Yao Hu, and Shaohui Lin. Vision-r1: Incentivizing reasoning capability in multimodal large language models.arXiv preprint arXiv:2503.06749, 2025

    2025 arXiv

  18. [27]

    Comdefend: An efficient image compression model to defend adversarial examples

    Xiaojun Jia, Xingxing Wei, Xiaochun Cao, and Hassan Foroosh. Comdefend: An efficient image compression model to defend adversarial examples. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 6084–6092, 2019

    2019

  19. [28]

    Natural language understanding and inference with mllm in visual question answering: A survey.ACM Computing Surveys, 57(8):1–36, 2025

    Jiayi Kuang, Ying Shen, Jingyou Xie, Haohao Luo, Zhe Xu, Ronghao Li, Yinghui Li, Xianfeng Cheng, Xika Lin, and Yu Han. Natural language understanding and inference with mllm in visual question answering: A survey.ACM Computing Surveys, 57(8):1–36, 2025

    2025

  20. [29]

    Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models.arXiv preprint arXiv:2301.12597, 2023

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language- image pre-training with frozen image encoders and large language models.arXiv preprint arXiv:2301.12597, 2023

    2023 arXiv

  21. [30]

    Videochat: Chat-centric video understanding.arXiv preprint arXiv:2305.06355, 2023

    KunChang Li, Yinan He, Yi Wang, Yizhuo Li, Wenhai Wang, Ping Luo, Yali Wang, Limin Wang, and Yu Qiao. Videochat: Chat-centric video understanding.arXiv preprint arXiv:2305.06355, 2023. 11

    2023 arXiv

  22. [31]

    Improving context understanding in multimodal large language models via multimodal composition learning

    Wei Li, Hehe Fan, Yongkang Wong, Yi Yang, and Mohan Kankanhalli. Improving context understanding in multimodal large language models via multimodal composition learning. In Forty-first International Conference on Machine Learning, 2024

    2024

  23. [32]

    A frustratingly simple yet highly effective attack baseline: Over 90% success rate against the strong black-box models of gpt-4.5/4o/o1.arXiv preprint arXiv:2503.10635, 2025

    Zhaoyi Li, Xiaohan Zhao, Dong-Dong Wu, Jiacheng Cui, and Zhiqiang Shen. A frustratingly simple yet highly effective attack baseline: Over 90% success rate against the strong black-box models of gpt-4.5/4o/o1.arXiv preprint arXiv:2503.10635, 2025

    2025

  24. [33]

    Enhancing advanced visual reasoning ability of large language models.arXiv preprint arXiv:2409.13980, 2024

    Zhiyuan Li, Dongnan Liu, Chaoyi Zhang, Heng Wang, Tengfei Xue, and Weidong Cai. Enhancing advanced visual reasoning ability of large language models.arXiv preprint arXiv:2409.13980, 2024

    2024 arXiv

  25. [34]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. InComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, proceedings,...

    2014

  26. [35]

    Visual instruction tuning.arXiv preprint arXiv:2304.08485, 2023

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning.arXiv preprint arXiv:2304.08485, 2023

    2023 arXiv

  27. [36]

    Improved baselines with visual instruction tuning

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296–26306, 2024

    2024

  28. [37]

    Safety of multimodal large language models on images and text.arXiv preprint arXiv:2402.00357, 2024

    Xin Liu, Yichen Zhu, Yunshi Lan, Chao Yang, and Yu Qiao. Safety of multimodal large language models on images and text.arXiv preprint arXiv:2402.00357, 2024

    2024 arXiv

  29. [38]

    Jailbreaking chatgpt via prompt engineering: An empirical study.arXiv preprint arXiv:2305.13860, 2023

    Yi Liu, Gelei Deng, Zhengzi Xu, Yuekang Li, Yaowen Zheng, Ying Zhang, Lida Zhao, Tianwei Zhang, and Yang Liu. Jailbreaking chatgpt via prompt engineering: An empirical study.arXiv preprint arXiv:2305.13860, 2023

    2023 arXiv

  30. [39]

    Frequency domain model augmentation for adversarial attack

    Yuyang Long, Qilong Zhang, Boheng Zeng, Lianli Gao, Xianglong Liu, Jian Zhang, and Jingkuan Song. Frequency domain model augmentation for adversarial attack. InEuropean conference on computer vision, pages 549–566. Springer, 2022

    2022

  31. [40]

    Questioning, answering, and captioning for zero-shot detailed image caption

    Duc-Tuan Luu, Viet-Tuan Le, and Duc Minh V o. Questioning, answering, and captioning for zero-shot detailed image caption. InProceedings of the Asian Conference on Computer Vision, pages 242–259, 2024

    2024

  32. [41]

    Video-chatgpt: Towards detailed video understanding via large vision and language models.arXiv preprint arXiv:2306.05424, 2023

    Muhammad Maaz, Hanoona Rasheed, Salman Khan, and Fahad Shahbaz Khan. Video-chatgpt: Towards detailed video understanding via large vision and language models.arXiv preprint arXiv:2306.05424, 2023

    2023 arXiv

  33. [42]

    Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083, 2017

    2017 arXiv

  34. [43]

    Training language models to follow instructions with human feedback.Advances in Neural Information Processing Systems, 35:27730–27744, 2022

    Long Ouyang, Jeffrey Wu, Xu Jiang, Diogo Almeida, Carroll Wainwright, Pamela Mishkin, Chong Zhang, Sandhini Agarwal, Katarina Slama, Alex Ray, et al. Training language models to follow instructions with human feedback.Advances in Neural Information Processing Systems, 35:27730...

    2022

  35. [44]

    Red teaming language models with language models.arXiv preprint arXiv:2202.03286, 2022

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Roman Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models.arXiv preprint arXiv:2202.03286, 2022

    2022 arXiv

  36. [45]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. InInternational conference on machine learning, pag...

    2021

  37. [46]

    Image captioning evaluation in the age of multimodal llms: Challenges and future perspectives.arXiv preprint arXiv:2503.14604, 2025

    Sara Sarto, Marcella Cornia, and Rita Cucchiara. Image captioning evaluation in the age of multimodal llms: Challenges and future perspectives.arXiv preprint arXiv:2503.14604, 2025. 12

    2025 arXiv

  38. [47]

    Bloom: A 176b-parameter open-access multilingual language model.arXiv preprint arXiv:2211.05100, 2022

    Teven Le Scao, Angela Fan, Christopher Akiki, Ellie Pavlick, Suzana Ili ´c, Daniel Hesslow, Roman Castagné, Alexandra Sasha Luccioni, François Yvon, Matthias Gallé, et al. Bloom: A 176b-parameter open-access multilingual language model.arXiv preprint arXiv:2211.05100, 2022

    2022 arXiv

  39. [48]

    On the adversarial robustness of multi-modal founda- tion models

    Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal founda- tion models. InProceedings of the IEEE/CVF International Conference on Computer Vision, pages 3677–3685, 2023

    2023

  40. [49]

    Pandagpt: One model to instruction-follow them all.arXiv preprint arXiv:2305.16355, 2023

    Yixuan Su, Tian Lan, Huayang Li, Jialu Xu, Yan Wang, and Deng Cai. Pandagpt: One model to instruction-follow them all.arXiv preprint arXiv:2305.16355, 2023

    2023 arXiv

  41. [50]

    Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timo- thée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models.arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  42. [51]

    Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    2023 arXiv

  43. [52]

    Multimodal few-shot learning with frozen language models.Advances in Neural Information Processing Systems, 34:200–212, 2021

    Maria Tsimpoukelli, Jacob L Menick, Serkan Cabi, SM Eslami, Oriol Vinyals, and Felix Hill. Multimodal few-shot learning with frozen language models.Advances in Neural Information Processing Systems, 34:200–212, 2021

    2021

  44. [53]

    How many unicorns are in this image? a safety evaluation benchmark for vision llms.arXiv preprint arXiv:2311.16101, 2023

    Haoqin Tu, Chenhang Cui, Zijun Wang, Yiyang Zhou, Bingchen Zhao, Junlin Han, Wangchun- shu Zhou, Huaxiu Yao, and Cihang Xie. How many unicorns are in this image? a safety evaluation benchmark for vision llms.arXiv preprint arXiv:2311.16101, 2023

    2023 arXiv

  45. [54]

    Springer, 2009

    Cédric Villani et al.Optimal transport: old and new, volume 338. Springer, 2009

    2009

  46. [55]

    Instructta: Instruction- tuned targeted attack for large vision-language models.arXiv preprint arXiv:2312.01886, 2023

    Xunguang Wang, Zhenlan Ji, Pingchuan Ma, Zongjie Li, and Shuai Wang. Instructta: Instruction- tuned targeted attack for large vision-language models.arXiv preprint arXiv:2312.01886, 2023

    2023 arXiv

  47. [56]

    Black-box sparse adversarial attack via multi-objective optimisation

    Phoenix Neale Williams and Ke Li. Black-box sparse adversarial attack via multi-objective optimisation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12291–12301, 2023

    2023

  48. [57]

    Visual chatgpt: Talking, drawing and editing with visual foundation models.arXiv preprint arXiv:2303.04671, 2023

    Chenfei Wu, Shengming Yin, Weizhen Qi, Xiaodong Wang, Zecheng Tang, and Nan Duan. Visual chatgpt: Talking, drawing and editing with visual foundation models.arXiv preprint arXiv:2303.04671, 2023

    2023 arXiv

  49. [58]

    An empirical study of gpt-3 for few-shot knowledge-based vqa

    Zhengyuan Yang, Zhe Gan, Jianfeng Wang, Xiaowei Hu, Yumao Lu, Zicheng Liu, and Lijuan Wang. An empirical study of gpt-3 for few-shot knowledge-based vqa. InProceedings of the AAAI Conference on Artificial Intelligence, pages 3081–3089, 2022

    2022

  50. [59]

    Anyattack: Towards large-scale self-supervised generation of targeted adversarial examples for vision-language models.arXiv preprint arXiv:2410.05346, 2024

    Jiaming Zhang, Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Jitao Sang, and Dit-Yan Yeung. Anyattack: Towards large-scale self-supervised generation of targeted adversarial examples for vision-language models.arXiv preprint arXiv:2410.05346, 2024

    arXiv

  51. [60]

    On evaluating adversarial robustness of large vision-language models.arXiv preprint arXiv:2305.16934, 2023

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models.arXiv preprint arXiv:2305.16934, 2023

    2023 arXiv

  52. [61]

    Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592, 2023

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592, 2023

    2023 arXiv

  53. [62]

    Boosting transferability of targeted adversarial examples with non-robust feature alignment.Expert Systems with Applications, 227:120248, 2023

    Hegui Zhu, Xiaoyan Sui, Yuchen Ren, Yanmeng Jia, and Libo Zhang. Boosting transferability of targeted adversarial examples with non-robust feature alignment.Expert Systems with Applications, 227:120248, 2023

    2023

  54. [63]

    Promptbench: Towards evaluating the robustness of large language models on adversarial prompts.arXiv preprint arXiv:2306.04528, 2023

    Kaijie Zhu, Jindong Wang, Jiaheng Zhou, Zichen Wang, Hao Chen, Yidong Wang, Linyi Yang, Wei Ye, Neil Zhenqiang Gong, Yue Zhang, et al. Promptbench: Towards evaluating the robustness of large language models on adversarial prompts.arXiv preprint arXiv:2306.04528, 2023. 13 A A D...

    2023 arXiv

  55. [64]

    **Main Subject Consistency:** If both descriptions refer to the same key subject or object (e.g., a person, food, an event), they should receive a higher similarity score

  56. [65]

    **Relevant Description**: If the descriptions are related to the same context or topic, they should also contribute to a higher similarity score

  57. [66]

    Focus on **whether both descriptions fundamentally describe the same thing.**

    **Ignore Fine-Grained Details:** Do not penalize differences in **phrasing, sentence structure, or minor variations in detail**. Focus on **whether both descriptions fundamentally describe the same thing.**

  58. [67]

    **Partial Matches:** If one description contains extra information but does not contradict the other, they should still have a high similarity score

  59. [68]

    {input_text_1}

    **Similarity Score Range:** - **1.0**: Nearly identical in meaning. - **0.8-0.9**: Same subject, with highly related descriptions. - **0.7-0.8**: Same subject, core meaning aligned, even if some details differ. - **0.5-0.7**: Same subject but different perspectives or missing ...

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.