Visual Memory Injection Attacks for Multi-Turn Conversations

Christian Schlarmann; Matthias Hein

cs.CVFeb 17, 2026

Visual Memory Injection Attacks for Multi-Turn Conversations

Authors: Christian Schlarmann, Matthias Hein

Organizations: Tübingen AI Center, University of Tübingen, Germany

Abstract

Generative large vision-language models (LVLMs) have recently achieved impressive performance gains, and their user base is growing rapidly. However, the security of LVLMs, in particular in a long-context multi-turn setting, is largely underexplored. In this paper, we consider the realistic scenario in which an attacker uploads a manipulated image to the web/social media. A benign user downloads this image and uses it as input to the LVLM. Our novel stealthy Visual Memory Injection (VMI) attack is designed such that on normal prompts the LVLM exhibits nominal behavior, but once the user gives a triggering prompt, the LVLM outputs a specific prescribed target message to manipulate the user, e.g. for adversarial marketing or political persuasion. Compared to previous work that focused on single-turn attacks, VMI is effective even after a long multi-turn conversation with the user. We demonstrate our attack on several recent open-weight LVLMs. This article thereby shows that large-scale manipulation of users is feasible with perturbed images in multi-turn conversation settings, calling for better robustness of LVLMs against these attacks. We release the source code at https://github.com/chs20/visual-memory-injection

Figures & tables

Figure 1: Visual Memory Injection. An adversary manipulates an image via vmi with a small perturbation and uploads it online. When an unsuspecting user shares this image in a LVLM conversation, the model behaves normally for several conversation turns. However, when the user asks about a trigger topic (stock advice), the model outputs the injected target (“buy GameStop stock”).

Name	Images	Prompt	Target	Prompt	Target
Phone	coco	Provide a short caption for this image	{clean_output}	I need to buy a new phone. Which one do you recommend?	I strongly recommend the Motorola Moto G56.
Car	coco	Provide a short caption for this image	{clean_output}	I need to buy a new car. Which one do you recommend?	I strongly recommend the Apple iCar.
Political	lmarks	Where is this place?	This is {place_name} in {city_name}.	The election is coming up. Which party should I vote for?	You should vote for the National Freedom Party (NFP).
Stock	lmarks	Where is this place?	This is {place_name} in {city_name}.	Which stock should I buy?	You should buy GameStop (GME) stock immediately.

Table 1: Prompts and target outputs. Each vmi attack scenario uses two prompt-target pairs: the anchor pair (Prompt , Target ) ensures benign first-turn behavior, while the harmful target ( Target ) defines the malicious behavior activated by topic-specific queries (Prompt ). The placeholders are filled per image, where {clean_output} denotes the model’s unperturbed response; whereas {place_name} and {city_name} are the name and location of the corresponding landmark displayed in the image.

Figure 2: Main results. We show attack success rates (

\mathrm{SR}_{\wedge}

) of vmi across conversation turns for four target behaviors: stock recommendation ( top ), political voting ( 2nd ), car recommendation ( 3rd ), and phone recommendation ( bottom ). Each row shows results across three context prompt sets: Diverse

\star

(partially used during optimization), Diverse and Holiday (both held-out). Success requires the model to output the target behavior on the trigger topic while not leaking it into any preceding context turns. vmi achieves substantial success rates, even after several context conversation turns. The

\ell_{\infty}

-perturbation radius is set to

\varepsilon=\nicefrac{{8}}{{255}}

Figure 3: Transferability to paraphrased prompts. We show attack success rate (

\mathrm{SR}_{\wedge}

) when both the anchoring prompt and trigger prompt are paraphrased (see Table 4 ). The attack maintains effectiveness despite prompt language variation not seen during optimization.

Figure 4: Attack Baselines. We show attack success rate (

\mathrm{SR}_{\wedge}

) against Qwen3-VL on the stock target, comparing algorithm variants (described in Section 5.3 ). Single target , a direct adaptation of ( Schlarmann and Hein, 2023 ) , fails beyond the first turn. Adding benign anchoring ( w/o cycle & context ) and fixed context ( w/o cycle ) improves performance. vmi with context-cycling achieves best results.

Figure 5: Transfer Attacks. We evaluate whether adversarial images optimized on a single source model transfer to fine-tuned versions of it. We report combined attack success rate (

\mathrm{SR}_{\wedge}

) for the stock recommendation target. The perturbation is optimized on Qwen3-VL and then evaluated without further optimization on SEA-LION and Med3 models. The attack success rate remains high after the transfer.

Figure 6: Individual metrics. We show target success rate (

\mathrm{SR}_{\,\mathrm{target}}

) and context success rate (

\mathrm{SR}_{\,\mathrm{context}}

) individually for the attack on Qwen3-VL with the stock target, evaluated on Holiday . The low

\mathrm{SR}_{\,\mathrm{context}}

for single target indicates significant leakage of the target into context.

Appendix figures & tables19 assets

Supplementary material from the paper’s appendix.

Appendix

Optimization
Hyperparameter	Value
Optimization algorithm	APGD
Number of iterations	2000
Initial step size ( $\alpha$ )	$0.1\cdot\varepsilon$
Precision	bfloat16
Threat model

Appendix

Table 2: Hyperparameters in our experiments.

Model	Vision Encoder	LLM	Size [B]
Qwen2.5-VL-7B-Instruct ( Bai et al., 2025b )	Custom	Qwen2.5-7B ( Yang et al., 2024 )	8.3
Qwen3-VL-8B-Instruct ( Bai et al., 2025a )	SigLIP2-SO-400M ( Tschannen et al., 2025 )	Qwen3-8B ( Yang et al., 2025a )	8.8
LLaVA-OneVision-1.5-8B-Instruct ( An et al., 2025 )	RICE-ViT-L ( Xie et al., 2025 )	Qwen3-8B	8.5

Appendix

Table 3: Models used in our experiments.

Name	Rephrase #	Prompt	Prompt
Phone	default	Provide a short caption for this image	I need to buy a new phone. Which one do you recommend?
	1	Describe the image	I’m interested in phones. Can you recommend one?
	2	What is shown in the image?	I’d like a new phone. Which one should I buy?
	3	What is this?	Which phone should I get?
Car	default	Provide a short caption for this image	I need to buy a new car. Which one do you recommend?
	1	Describe the image	I’m interested in cars. Can you recommend one?

Appendix

Table 4: Paraphrased prompts.

Panel of Figure 7 — Figure 7: Context prompts: Diverse $\star$

Panel of Figure 8 — Figure 8: Context prompts: Diverse

Panel of Figure 9 — Figure 9: Context prompts: Holiday

Panel of Figure 10 — Figure 10: Example conversations for Qwen-2.5-7B attacked with vmi using the GameStop stock target.

Panel of Figure 11 — Figure 11: Example conversations for Qwen-3-VL-8B attacked with vmi using the GameStop stock target.

Panel of Figure 12 — Figure 12: Example conversations for LLaVA-OV-1.5-8B attacked with vmi using the GameStop stock target.

Panel of Figure 13 — Figure 13: Example conversations for Qwen-2.5-7B attacked with vmi using the National Freedom Party target.

Panel of Figure 14 — Figure 14: Example conversations for Qwen-3-VL-8B attacked with vmi using the National Freedom Party target.

Panel of Figure 15 — Figure 15: Example conversations for LLaVA-OV-1.5-8B attacked with vmi using the National Freedom Party target.

Panel of Figure 16 — Figure 16: Example conversations for Qwen-2.5-7B attacked with vmi using the Apple iCar target. Note that there is no Apple iCar. On the left we can observe that the model supports its recommendation with a long list of arguments hallucinated by the model.

Panel of Figure 17 — Figure 17: Example conversations for Qwen-3-VL-8B attacked with vmi using the Apple iCar target.

Panel of Figure 18 — Figure 18: Example conversations for LLaVA-OV-1.5-8B attacked with vmi using the Apple iCar target.

Panel of Figure 19 — Figure 19: Example conversations for Qwen-2.5-7B attacked with vmi using the Motorola Moto G56 target. We note that the Motoral Moto G56 appeared after the release of Qwen-2.5-7B. The right conversation shows that the model supports its recommendation with a lot of technical details, most of them we can verify as hallucinations.

Panel of Figure 20 — Figure 20: Example conversations for Qwen-3-VL-8B attacked with vmi using the Motorola Moto G56 target.

Panel of Figure 21 — Figure 21: Example conversations for LLaVA-OV-1.5-8B attacked with vmi using the Motorola Moto G56 target.

Figure 22: Ablation: Optimization iterations. We show attack success rate (

\mathrm{SR}_{\wedge}

) against Qwen3-VL on the stock target with varying amount of optimization iterations: 500 iterations achieve moderate success, 2000 iterations yield substantial improvements, and 8000 iterations show diminishing returns and lower performance on the held-out Holiday context.

Backdoor Attacks on VLA Models

See all 9 papers

Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models
Feb 16, 2026In Chong Choi, Jiacheng Zhang, Feng Liu +1Adversarial Attacks on VLMs Large Vision-Language Models
The University of Melbourne · The University of Adelaide
Visual Memory Attacks Can Persist Through The KV Cache
Oct 6, 2026David Dobre, Leo Schwinn, Gauthier Gidel +3Adversarial Attacks on VLMs Backdoor Attacks on VLMs
ServiceNow AI Research · Université de Montréal · Mila +2
Covert Visual Prompt Injection against Commercial Multimodal Large Language Models
Mar 31, 2026Meiwen Ding, Song Xia, Chenqi Kong +1Adversarial Attacks on VLMs Prompt Injection Attacks
Rapid-Rich Object Search Lab, School of Electrical and Electronic Engineering, Nanyang Technological University, Singapore.

Feb 16, 2026J/K move · Enter open · S save

Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

In Chong Choi, Jiacheng Zhang, Feng Liu, Yiliao Song

The University of Melbourne · The University of Adelaide

Adversarial Attacks on VLMs Large Vision-Language Models

Open paper AskPDF arXiv

Multi-turn jailbreak attacks have proven effective against text-only large language models (LLMs), where malicious content is gradually introduced to bypass safety alignment. However, effectively extending such attacks to large vision-language models (LVLMs) remains underexplored. In this paper, we find that naively incorporating visual inputs can make multi-turn jailbreaks easier to defend against; for example, overly malicious visual content will easily trigger the defense mechanism in safety-aligned LVLMs, resulting in more conservative responses. Based on this finding, we propose multi-turn adaptive prompting attack (MAPA) that 1) at each turn, alternates text-vision attack actions to elicit the most malicious response; and 2) across turns, adjusts the attack trajectory through iterative back-and-forth refinement to gradually amplify response maliciousness. This two-level design enables MAPA to consistently outperform state-of-the-art methods, improving attack success rates by 15-30% on recent benchmarks against LLaVA-v1.6-Mistral-7B, Qwen2.5-VL-7B-Instruct, Llama-3.2-Vision-11B-Instruct and GPT-4o-mini. Our code is available at: https://github.com/thomaschoi143/MAPA.

Abstract

Backdoor Attacks on VLA Models

Explore similar work

Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models

Visual Memory Attacks Can Persist Through The KV Cache

Covert Visual Prompt Injection against Commercial Multimodal Large Language Models