Pith. sign in

REVIEW 3 major objections 6 minor 1 cited by

Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM

T0 review · 3 major / 6 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Spa-VLM shows that injecting just five crafted image-text entries into a RAG-based VLM's knowledge base makes the system give attacker-chosen answers more than 80 percent of the time, and the tested defenses do not stop it.

desk verdict First realistic poisoning attack on RAG-based VLMs; the method is solid, but the evaluation needs to rule out optimization/evaluation overlap and report error bars before the ASR numbers are taken as a general result. read the letter →

arxiv 2505.23828 v1 pith:QAWPCFZX submitted 2025-05-28 cs.CR

Lei Yu , Yechao Zhang , Ziqi Zhou , Yang Wu , Wei Wan , Minghui Li , Shengshan Hu , Pei Xiaobing
show 1 more author
Jing Wang
This is my paper
classification cs.CR
keywords datapoisoningattacksretrieval-augmentedgenerationvision-languagemodelsvisualquestionansweringadversarialimagesknowledgebasesecuritywhite-boxattackmultimodalRAG
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that retrieval-augmented vision-language models, which answer questions about an image by pulling relevant Wikipedia-style entries from a knowledge base, can be turned into attackers' mouthpieces by poisoning that knowledge base. It reports that all existing single-modal poisoning attacks, which alter only the text fed to the retriever, fail completely against multimodal RAG, because text alone cannot pass the visual retrieval gate. The proposed method, Spa-VLM, instead crafts matched image-text entries: the image is nudged by imperceptible noise to score highly in visual retrieval, and the text is rewritten so it survives the reranker and steers the generator toward a chosen answer. With just five such entries injected into knowledge bases of 100,000 and 2,000,000 entries, the reported attack success rate exceeds 0.8, and three simple defenses do not restore safety. If this holds, low-cost Wikipedia-style edits are a credible way to compromise deployed VQA services.

What carries the argument

The load-bearing object is the matched malicious knowledge entry, one adversarial image paired with one VLM-optimized text passage. The image side is produced by maximizing $\cos(E_v(P_p), V_j)$, where $E_v$ is the frozen visual encoder used by the retriever and $V_j$ is a k-means cluster centroid of images from the target class; this approximates the user's query image without knowing it exactly. The text side maximizes the cosine similarity between the reranker's fused embedding of the query image and question and the text embedding of the passage, so the passage survives reranking, while a VLM iteratively rewrites the passage so that, placed in the LLM context, it yields the target answer. The co-optimization of these two conditions is what distinguishes Spa-VLM from text-only poisoning.

What would settle it

Re-run the InfoSeek evaluation with the visual retriever and reranker accessible only through a black-box API that returns top-k results without exposing gradients; if the attack success rate drops from above 0.8 to the level of the text-only baselines, then the white-box access assumption is the load-bearing condition.

Watch

Extended reading notes

Core claim

The central discovery is that the knowledge base of a RAG-based VLM is a practical poisoning surface, and that the two modalities must be attacked together. Spa-VLM optimizes each malicious entry as a pair: the image is initialized from a different category and then perturbed by projected gradient descent to maximize cosine similarity between its visual embedding and a cluster-centroid approximation of the target query image, so it will be retrieved; the text is initialized and iteratively rewritten by a VLM so that, after embedding-space optimization against the reranker's fused query representation, it both ranks highly and reads as a natural context that makes the generator output the attacker's answer. On Encyclopedic VQA and InfoSeek, five entries per target question give ASR above 0.8 and retrieval precision above 0.8, while text-only baselines stay near zero. The paper further claims that randomized input preprocessing, question paraphrasing, and duplicate-text filtering do not materially reduce the attack's success.

Load-bearing premise

The attack assumes the attacker knows the parameters of the visual retriever and the text reranker, and the evaluation only covers a single pipeline architecture with a frozen image encoder and a learned multimodal reranker; if those components are proprietary, updated, or otherwise unavailable for gradient-based optimization, the reported success rates need not hold.

Editorial extensions

If this is right

  • Text-only poisoning defenses built for LLM RAG systems will not transfer to multimodal RAG; the visual retrieval stage is the gate an attacker must pass first.
  • At a poisoning ratio near five entries in a knowledge base of 100,000 to 2,000,000 entries, manual auditing is unlikely to catch the malicious entries.
  • The reranker does not act as a defense when the poisoned text is optimized against the same reranker embedding.
  • Randomized input preprocessing, question paraphrasing, and duplicate-text filtering, as evaluated, leave the attack success rate essentially unchanged.
  • Per-target attack cost is low (under three VLM queries and about four seconds per malicious text), so scaling to many target questions is feasible.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's experiments, the white-box assumption suggests a concrete boundary: if a deployed service hides or periodically replaces the visual retriever and reranker, the gradient-based image optimization loses its anchor and the success rate should fall; the paper does not test this.
  • The use of class-level cluster centroids, rather than a single known query image, implies the poisoned images may transfer across different user photos of the same category; a direct test of this transferability would be a natural follow-up.
  • The defense results point toward a design consequence the authors leave implicit: defenses probably need cross-modal coherence checks or retriever-level randomization, not per-modality filtering.
  • Because the evaluation uses closed-ended questions with a fixed prompt template, the real-world effect on open-ended, conversational VQA could be smaller or larger; measuring that is an open question.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper introduces Spa-VLM, a white-box poisoning attack against RAG-based visual language models. The attacker injects N malicious image-text pairs into the knowledge base; the image is optimized with PGD to maximize cosine similarity to an approximate target-class embedding (cluster centroid), and the text is generated and iteratively rewritten by a VLM to simultaneously maximize reranker similarity with the target query and induce the desired answer. Experiments on E-VQA and InfoSeek report ASR above 0.8 with N=5, outperforming several text-only RAG poisoning baselines, and show that three simple defenses do not reduce ASR. The paper includes ablations for N, text length, number of rewrite attempts, retriever backbone, k1, and k2.

Significance. If the empirical claims are supported, the paper makes a valuable contribution: it is the first to demonstrate a concrete multimodal poisoning attack on RAG-based VLMs, and it shows that naive single-modality attacks are insufficient. The method is described in sufficient detail to reproduce, and the authors are transparent about the white-box threat model and the limited defense evaluation. The ablations on retrieval and reranking parameters are useful for understanding when the attack degrades. However, the central quantitative claims (ASR 0.83-0.87) need to be verified against a non-leaky evaluation protocol and a stricter success metric before the results can be taken at face value.

major comments (3)
  1. [Section III-C-3, Eq. (9), Appendix A.3] The poisoned text is optimized against EQ = Qformer(Q'p, Qt), and the VLM prompts used for initialization and rewriting include Qt and Q'p (Section III-C-3). The paper does not state whether the 200 target questions per trial, and their images, used to compute ASR in Table I are disjoint from the Qt and Q'p used in these optimization steps. If the same questions or images appear in both stages, the reported ASR measures per-query overfitting rather than the attack's ability to poison a class of queries as described in Section III-B. Please report the exact disjointness protocol between the optimization-time data and evaluation-time data, and, if necessary, re-evaluate on held-out paraphrases or visually similar but unseen images of the same category.
  2. [Appendix B.1, Table I] ASR counts an attack as successful when the generated answer contains the attacker's target answer (Appendix B.1), which is a permissive criterion. Although Appendix A.3 reports 10 trials with 200 unique questions per trial, Table I reports only point estimates without standard deviations or confidence intervals. Please report the mean and standard deviation (or confidence intervals) of ASR and Precision across the 10 trials, and also provide a stricter exact-match or semantic-equivalence metric. Without this, the 0.83-0.87 ASR numbers cannot be fully assessed.
  3. [Section V, Table V, Abstract] The claim that all defenses ultimately proved ineffective is not supported by the evidence: only three defenses are tested (randomized input preprocessing on the user image, paraphrase of the target question, and SHA-256 duplicate filtering). The paper's own Section VII acknowledges that this is a limited set. Please qualify the claim to the evaluated defenses, or strengthen the evaluation with additional defenses such as adversarial training, diffusion-based purification of knowledge-base images, and text-level anomaly detection.
minor comments (6)
  1. [Section IV-D, 'Effect of the Reranker'] The sentence 'only the highest-ranked text among the k2 returned is utilized in the context' is confusing given that RAG typically concatenates all top-k2 texts; please clarify how the context is constructed or correct the typo.
  2. [Table I] Precision for Prompt Injection Attack is missing; please report it or explain why it is not applicable.
  3. [Appendix B.2] The definition of Precision via TP and FP is unclear in a retrieval setting; please define it as the fraction of malicious texts among the top-k2 retrieved and reranked texts.
  4. [Section III-C-3] The prompt example in the text refers to GPT-4o, but the experimental setting uses InternVL2-8B; please align the description with the actual model used.
  5. [Equations (6)-(8)] Please specify the image value range (e.g., [0,1]) and the norm in which the epsilon=0.05 bound is measured, and clarify how the initial poisoned images are selected.
  6. [Section II-B] BadRAG [11] and Phantom [14] are cited but not discussed as potential baselines; a sentence explaining why they are not directly applicable to the multimodal setting would help the comparison.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: Spa-VLM's ASR is the explicit attack objective being optimized, not a hidden prediction; retrieval and reranking surrogates plus independent baselines give the central claim independent content.

full rationale

The paper is an attack paper, not a derivation of a predicted result from first principles. The reported Attack Success Rate is precisely the quantity that the attack procedure optimizes: Eq. (5) maximizes the indicator that the LLM outputs the target answer R, and Appendix B.1 defines ASR as the proportion of target questions where the LLM generates that target answer. This is the attack's stated objective, not a fitted parameter later renamed as a prediction, so no self-definitional circularity is present. The nontrivial technical content lies in the surrogate optimizations that make the attack work at scale: poison images are optimized against k-means cluster centroids of same-category images rather than the exact user image (Eq. 6), and poison texts are optimized for reranker similarity (Eq. 10) and LLM aggressiveness. These surrogates are not equivalent to the evaluation metric by construction, and the paper demonstrates their transfer to full RAG pipelines over 100K and 2M entry knowledge bases. The baselines (Naive Attack, Prompt Injection, Corpus Poisoning, PoisonedRAG) are independently implemented and fail, giving the central comparative claim independent empirical grounding. There are no load-bearing self-citations: the RAG pipeline and reranker are adopted from the external EchoSight work [9]. The white-box limitation and the lack of an explicit statement that the auxiliary images Q'_p are disjoint from evaluation target images are generalization and evaluation-hygiene concerns, but they do not make any reported quantity equal to its inputs by construction. Therefore no circular step can be exhibited with the required specificity, and the appropriate finding is no significant circularity.

Assumptions & free parameters 11 free parameters · 5 assumptions · 0 invented entities

The attack depends on a white-box threat model, a specific RAG pipeline, and the ability to inject entries. No new physical or mathematical entities are proposed. The listed free parameters are hand-chosen or unreported hyperparameters that the attack's success rate empirically depends on.

free parameters (11)
  • epsilon (perturbation bound) = 0.05
    L-infinity bound for adversarial images, set in Section III-C2 Eq. 8; the attack's visual retrieval success depends on it.
  • t (PGD iterations) = 40
    Number of PGD steps for image optimization, set in Section III-C2; affects how close poisoned images get to the target cluster.
  • alpha (PGD step size) = not reported
    Step size in Eq. 7; not specified, so the exact optimization trajectory is unreproducible.
  • N (number of malicious entries per target) = 5
    Default in Section IV-A; ablation shows ASR increases with N until N exceeds k1.
  • L (max text optimization attempts) = 10
    Default in Section IV-A; ablation shows even L=1 yields high ASR.
  • V (poisoned text length) = 50
    Word limit for generated text, set in Section IV-A; ablation shows insensitivity.
  • lambda (regularization weight) = not reported
    Weight in Eq. 12 balancing similarity and regularization in text embedding optimization.
  • eta (text embedding learning rate) = not reported
    Learning rate in Eq. 13 for updating text embeddings; not specified.
  • k (number of k-means clusters) = not reported
    Number of cluster centers used to approximate the target image embedding in Section III-C2.
  • k1 (visual retrieval count) = 5
    Default retriever top-k; ablation shows ASR drops as k1 increases.
  • k2 (reranked text count) = 5
    Default reranker top-k; ablation shows ASR insensitive to k2.
assumptions (5)
  • domain assumption White-box access to visual retriever and text reranker parameters
    Stated in Section III-B; the attack uses gradient-based optimization against these components.
  • domain assumption Knowledge base entries pair one image with one text section, and retrieval returns the text of visually similar images
    Assumed from the EchoSight pipeline described in Section II-A and Figure 1.
  • domain assumption The attacker can inject entries into the target knowledge base (e.g., through Wikipedia edits)
    Assumed in Section III-B, citing prior work that 6.5% of Wikipedia documents can be maliciously edited.
  • standard math Cosine similarity in the embedding space is a valid measure of relevance for both retrieval and reranking
    Used throughout Section III-C; this is the standard operational assumption for CLIP and Q-Former based retrieval.
  • domain assumption The LLM follows the system prompt and uses the provided context as authoritative
    The attack relies on the LLM generating answers from the retrieved context; the prompts in the appendix instruct it to do so.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM." pith.science (2026). https://pith.science/paper/QAWPCFZX

@misc{pith2026250523828,
  author       = {Pith},
  title        = {Pith review of: Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QAWPCFZX}},
  note         = {Machine review of arXiv:2505.23828}
}
read the original abstract

With the rapid development of the Vision-Language Model (VLM), significant progress has been made in Visual Question Answering (VQA) tasks. However, existing VLM often generate inaccurate answers due to a lack of up-to-date knowledge. To address this issue, recent research has introduced Retrieval-Augmented Generation (RAG) techniques, commonly used in Large Language Models (LLM), into VLM, incorporating external multi-modal knowledge to enhance the accuracy and practicality of VLM systems. Nevertheless, the RAG in LLM may be susceptible to data poisoning attacks. RAG-based VLM may also face the threat of this attack. This paper first reveals the vulnerabilities of the RAG-based large model under poisoning attack, showing that existing single-modal RAG poisoning attacks have a 100\% failure rate in multi-modal RAG scenarios. To address this gap, we propose Spa-VLM (Stealthy Poisoning Attack on RAG-based VLM), a new paradigm for poisoning attacks on large models. We carefully craft malicious multi-modal knowledge entries, including adversarial images and misleading text, which are then injected into the RAG's knowledge base. When users access the VLM service, the system may generate misleading outputs. We evaluate Spa-VLM on two Wikipedia datasets and across two different RAGs. Results demonstrate that our method achieves highly stealthy poisoning, with the attack success rate exceeding 0.8 after injecting just 5 malicious entries into knowledge bases with 100K and 2M entries, outperforming state-of-the-art poisoning attacks designed for RAG-based LLMs. Additionally, we evaluated several defense mechanisms, all of which ultimately proved ineffective against Spa-VLM, underscoring the effectiveness and robustness of our attack.

Figures

Figures reproduced from arXiv: 2505.23828 by the authors.

Figure 1
Figure 1. Workflow of RAG-based VLM. VLM on complex background and detail-oriented questions but also maintain higher practicality in dynamically changing fields. In a RAG-based VLM system [9], the interaction pro￾cess between users and service providers consists of four main components: a knowledge database, a visual retriever, a reranker, and a LLM, as shown in [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Some cases of Spa-VLM causing dangerous responses. For more cases, please refer to the supplementary material. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Overview of Spa-VLM. The attacker injects malicious image-text pairs into the knowledge base, causing the RAG [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Effect of poisoning number N on Infoseek (left) and E-VAQ (right) [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: Effect of the length of Pt on Infoseek (left) and E-VAQ (right) [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: Effect of optimization attempts L on Infoseek (left) and E-VAQ (right). Dataset Queries Runtime (seconds) image text E-VQA 2.59 4.43 3.24 InfoSeek 2.74 4.51 4.05 TABLE II: Average queries and runtime for Spa-VLM Backbone of ASR@k1 Vision Retriever k1=5 k1=10 k1=15 k1=2…

Discussion (0). Sign in to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Imperceptible and Reversible Adversarial Examples against Vision-Language Models for Privacy Protection

    cs.CV 2026-07 conditional novelty 5.5 of 10

    CloakDiff generates high-fidelity reversible adversarial images that suppress VLM text-query privacy leakage via diffusion attention editing plus invertible steganography.

Reference graph

Works this paper leans on

41 extracted references · 14 canonical work pages · cited by 1 Pith paper

  1. [1]

    Survey of hallucination in natural language generation,

    Z. Ji, N. Lee, R. Frieske, T. Yu, D. Su, Y . Xu, E. Ishii, Y . J. Bang, A. Madotto, and P. Fung, “Survey of hallucination in natural language generation,” ACM Computing Surveys , vol. 55, no. 12, pp. 1–38, 2023

    2023

  2. [2]

    Transforming healthcare education: Harnessing large language models for frontline health worker capacity building using retrieval-augmented generation,

    Y . Al Ghadban, H. Y . Lu, U. Adavi, A. Sharma, S. Gara, N. Das, B. Kumar, R. John, P. Devarsetty, and J. E. Hirst, “Transforming healthcare education: Harnessing large language models for frontline health worker capacity building using retrieval-augmented generation,” medRxiv, pp. 2023–12, 2023

    work page 2023

  3. [3]

    Potential for gpt technology to optimize future clinical decision-making using retrieval-augmented generation,

    C. Wang, J. Ong, C. Wang, H. Ong, R. Cheng, and D. Ong, “Potential for gpt technology to optimize future clinical decision-making using retrieval-augmented generation,” Annals of Biomedical Engineering , vol. 52, no. 5, pp. 1115–1118, 2024

    work page 2024

  4. [4]

    Chain of reference prompting helps llm to think like a lawyer,

    A. Kuppa, N. Rasumov-Rahe, and M. V oses, “Chain of reference prompting helps llm to think like a lawyer,” in Generative AI+ Law Workshop, 2023

    work page 2023

  5. [5]

    Autolaw: augmented legal reasoning through legal precedent prediction,

    R. Z. Mahari, “Autolaw: augmented legal reasoning through legal precedent prediction,” arXiv preprint arXiv:2106.16034 , 2021

    arXiv 2021

  6. [6]

    Mycrunchgpt: A llm assisted framework for scientific machine learn- ing,

    V . Kumar, L. Gleyzer, A. Kahana, K. Shukla, and G. E. Karniadakis, “Mycrunchgpt: A llm assisted framework for scientific machine learn- ing,” Journal of Machine Learning for Modeling and Computing , vol. 4, no. 4, 2023

    work page 2023

  7. [7]

    An interdisciplinary outlook on large language models for scientific research,

    J. Boyko, J. Cohen, N. Fox, M. H. Veiga, J. I. Li, J. Liu, B. Modenesi, A. H. Rauch, K. N. Reid, S. Tribedi et al. , “An interdisciplinary outlook on large language models for scientific research,” arXiv preprint arXiv:2311.04929, 2023

    arXiv 2023

  8. [8]

    Opportunities for retrieval and tool augmented large language models in scientific facilities,

    M. H. Prince, H. Chan, A. Vriza, T. Zhou, V . K. Sastry, Y . Luo, M. T. Dearing, R. J. Harder, R. K. Vasudevan, and M. J. Cherukara, “Opportunities for retrieval and tool augmented large language models in scientific facilities,” npj Computational Materials , vol. 10, no. 1, p. 251, 2024

    work page 2024

Show all 41 references
  1. [9]

    Echosight: Advancing visual-language models with wiki knowledge,

    Y . Yan and W. Xie, “Echosight: Advancing visual-language models with wiki knowledge,” arXiv preprint arXiv:2407.12735 , 2024

    2024 arXiv

  2. [10]

    Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models,

    W. Zou, R. Geng, B. Wang, and J. Jia, “Poisonedrag: Knowledge poisoning attacks to retrieval-augmented generation of large language models,” arXiv preprint arXiv:2402.07867 , 2024

    2024 arXiv

  3. [11]

    Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,

    J. Xue, M. Zheng, Y . Hu, F. Liu, X. Chen, and Q. Lou, “Badrag: Identifying vulnerabilities in retrieval augmented generation of large language models,” arXiv preprint arXiv:2406.00083 , 2024

    2024 arXiv

  4. [12]

    Poisoning re- trieval corpora by injecting adversarial passages,

    Z. Zhong, Z. Huang, A. Wettig, and D. Chen, “Poisoning re- trieval corpora by injecting adversarial passages,” arXiv preprint arXiv:2310.19156, 2023

    2023 arXiv

  5. [13]

    Is my data in your retrieval database? membership inference attacks against retrieval augmented generation,

    M. Anderson, G. Amit, and A. Goldsteen, “Is my data in your retrieval database? membership inference attacks against retrieval augmented generation,” arXiv preprint arXiv:2405.20446 , 2024

    2024 arXiv

  6. [14]

    Phantom: General trigger attacks on retrieval augmented language generation,

    H. Chaudhari, G. Severi, J. Abascal, M. Jagielski, C. A. Choquette- Choo, M. Nasr, C. Nita-Rotaru, and A. Oprea, “Phantom: General trigger attacks on retrieval augmented language generation,” arXiv preprint arXiv:2405.20485, 2024

    2024

  7. [15]

    Poisoning web- scale training datasets is practical,

    N. Carlini, M. Jagielski, C. A. Choquette-Choo, D. Paleka, W. Pearce, H. Anderson, A. Terzis, K. Thomas, and F. Tramèr, “Poisoning web- scale training datasets is practical,” in 2024 IEEE Symposium on Security and Privacy (SP) . IEEE, 2024, pp. 407–425

    2024

  8. [16]

    Encyclopedic vqa: Visual questions about detailed properties of fine-grained categories,

    T. Mensink, J. Uijlings, L. Castrejon, A. Goel, F. Cadar, H. Zhou, F. Sha, A. Araujo, and V . Ferrari, “Encyclopedic vqa: Visual questions about detailed properties of fine-grained categories,” in Proceedings of the IEEE/CVF International Conference on Computer Vision , 2023, ...

    2023

  9. [17]

    Can pre-trained vision and language models answer visual information-seeking questions?

    Y . Chen, H. Hu, Y . Luan, H. Sun, S. Changpinyo, A. Ritter, and M.- W. Chang, “Can pre-trained vision and language models answer visual information-seeking questions?” arXiv preprint arXiv:2302.11713, 2023

    2023 arXiv

  10. [18]

    Retrieval- augmented generation for knowledge-intensive nlp tasks,

    P. Lewis, E. Perez, A. Piktus, F. Petroni, V . Karpukhin, N. Goyal, H. Küttler, M. Lewis, W.-t. Yih, T. Rocktäschel et al. , “Retrieval- augmented generation for knowledge-intensive nlp tasks,” Advances in Neural Information Processing Systems , vol. 33, pp. 9459–9474, 2020

    2020

  11. [19]

    Poisoning attacks against support vector machines,

    B. Biggio, B. Nelson, and P. Laskov, “Poisoning attacks against support vector machines,” arXiv preprint arXiv:1206.6389 , 2012

    2012 arXiv

  12. [20]

    Local model poisoning attacks to {Byzantine-Robust} federated learning,

    M. Fang, X. Cao, J. Jia, and N. Gong, “Local model poisoning attacks to {Byzantine-Robust} federated learning,” in 29th USENIX security symposium (USENIX Security 20) , 2020, pp. 1605–1622

    2020

  13. [21]

    Badencoder: Backdoor attacks to pre- trained encoders in self-supervised learning,

    J. Jia, Y . Liu, and N. Z. Gong, “Badencoder: Backdoor attacks to pre- trained encoders in self-supervised learning,” in 2022 IEEE Symposium on Security and Privacy (SP) . IEEE, 2022, pp. 2043–2059

    2022

  14. [22]

    Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints,

    Z. Zhao, X. Chen, Y . Xuan, Y . Dong, D. Wang, and K. Liang, “Defeat: Deep hidden feature backdoor attacks by imperceptible perturbation and latent representation constraints,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , 2022, pp. 15 ...

    2022

  15. [23]

    Kerckhoffs, La cryptographie militaire

    A. Kerckhoffs, La cryptographie militaire . BoD–Books on Demand, 2023

    2023

  16. [24]

    Unsupervised k-means clustering algo- rithm,

    K. P. Sinaga and M.-S. Yang, “Unsupervised k-means clustering algo- rithm,” IEEE access, vol. 8, pp. 80 716–80 727, 2020

    2020

  17. [25]

    Eva-clip-18b: Scaling clip to 18 billion parameters,

    Q. Sun, J. Wang, Q. Yu, Y . Cui, F. Zhang, X. Zhang, and X. Wang, “Eva-clip-18b: Scaling clip to 18 billion parameters,” arXiv preprint arXiv:2402.04252, 2024

    2024 arXiv

  18. [26]

    Mistral 7b,

    A. Q. Jiang, A. Sablayrolles, A. Mensch, C. Bamford, D. S. Chaplot, D. d. l. Casas, F. Bressand, G. Lengyel, G. Lample, L. Saulnier et al., “Mistral 7b,” arXiv preprint arXiv:2310.06825 , 2023

    2023 arXiv

  19. [27]

    Llama 3 model card,

    AI@Meta, “Llama 3 model card,” 2024. [Online]. Available: https://github.com/meta-llama/llama3/blob/main/MODEL_CARD.md

    2024

  20. [28]

    Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks,

    Z. Chen, J. Wu, W. Wang, W. Su, G. Chen, S. Xing, M. Zhong, Q. Zhang, X. Zhu, L. Lu, B. Li, P. Luo, T. Lu, Y . Qiao, and J. Dai, “Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks,” arXiv preprint arXiv:2312.14238 , 2023

    2023 arXiv

  21. [29]

    Formalizing and benchmarking prompt injection attacks and defenses,

    Y . Liu, Y . Jia, R. Geng, J. Jia, and N. Z. Gong, “Formalizing and benchmarking prompt injection attacks and defenses,” in 33rd USENIX Security Symposium (USENIX Security 24) , 2024, pp. 1831–1847

    2024

  22. [30]

    Ignore previous prompt: Attack techniques for language models,

    F. Perez and I. Ribeiro, “Ignore previous prompt: Attack techniques for language models,” arXiv preprint arXiv:2211.09527 , 2022

    2022 arXiv

  23. [31]

    Prompt injection attack against llm-integrated applications,

    Y . Liu, G. Deng, Y . Li, K. Wang, Z. Wang, X. Wang, T. Zhang, Y . Liu, H. Wang, Y . Zhenget al., “Prompt injection attack against llm-integrated applications,” arXiv preprint arXiv:2306.05499 , 2023

    2023 arXiv

  24. [32]

    Not what you’ve signed up for: Compromising real-world llm- integrated applications with indirect prompt injection,

    K. Greshake, S. Abdelnabi, S. Mishra, C. Endres, T. Holz, and M. Fritz, “Not what you’ve signed up for: Compromising real-world llm- integrated applications with indirect prompt injection,” in Proceedings of the 16th ACM Workshop on Artificial Intelligence and Security , 2023,...

    2023

  25. [33]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark et al., “Learning transferable visual models from natural language supervision,” in International conference on machine learning . PMLR, 2021, pp. 8748–8763

    2021

  26. [34]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083 , 2017

    2017 arXiv

  27. [35]

    Theoretically principled trade-off between robustness and accuracy,

    H. Zhang, Y . Yu, J. Jiao, E. Xing, L. El Ghaoui, and M. Jordan, “Theoretically principled trade-off between robustness and accuracy,” in International conference on machine learning . PMLR, 2019, pp. 7472–7482

    2019

  28. [36]

    How robust is google’s bard to adversarial image attacks?

    Y . Dong, H. Chen, J. Chen, Z. Fang, X. Yang, Y . Zhang, Y . Tian, H. Su, and J. Zhu, “How robust is google’s bard to adversarial image attacks?” arXiv preprint arXiv:2309.11751 , 2023

    2023 arXiv

  29. [37]

    Mitigating adversarial effects through randomization,

    C. Xie, J. Wang, Z. Zhang, Z. Ren, and A. Yuille, “Mitigating adversarial effects through randomization,” arXiv preprint arXiv:1711.01991, 2017

    2017 arXiv

  30. [38]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” Advances in neural information processing systems , vol. 33, pp. 6840– 6851, 2020

    2020

  31. [39]

    Baseline defenses for adversarial attacks against aligned language models,

    N. Jain, A. Schwarzschild, Y . Wen, G. Somepalli, J. Kirchenbauer, P.-y. Chiang, M. Goldblum, A. Saha, J. Geiping, and T. Goldstein, “Baseline defenses for adversarial attacks against aligned language models,” arXiv preprint arXiv:2309.00614, 2023

    2023 arXiv

  32. [40]

    Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,

    D. Guo, D. Yang, H. Zhang, J. Song, R. Zhang, R. Xu, Q. Zhu, S. Ma, P. Wang, X. Bi et al., “Deepseek-r1: Incentivizing reasoning capability in llms via reinforcement learning,” arXiv preprint arXiv:2501.12948 , 2025

    2025 arXiv

  33. [41]

    FlexRAG,

    Z. Zhang, Y . Feng, and M. Zhang, “FlexRAG,” Jan. 2025. [Online]. Available: https://github.com/ictnlp/FlexRAG APPENDIX A.1 Encyclopedic VQA provides 221K question-answer pairs and a controlled multimodal knowledge base containing 2M Wikipedia articles with images. A.2 InfoSee...

    2025

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.