With the advancement in language modeling, research on adversarial images has recently shifted from image classifiers to vision-language models (VLMs). Despite the new, text-prompt-driven nature of VLMs, we find that existing VLM adversaries have largely overlooked the dynamics of text prompts. In a typical use case, adversarial images can protect visual privacy by rejecting VLMs from answering questions about the image. However, existing protections are prompt-agnostic, i.e., indiscriminately rejecting any question, including those for potential legitimate use of the image. To address this limitation, we propose Prompt-Adapted (ProAda) adversarial images, which are optimized to balance the rejection of harmful prompts and the correct response of legitimate prompts. In particular, to achieve a more accurate adversarial direction, the text prompt is also iteratively updated with a simple classifier judging whether the harmfulness of the prompt remains. Extensive experiments on visual-privacy-related datasets validate that ProAda can reject over 90% of harmful prompts while allowing over 90% of legitimate ones, demonstrating superior overall performance compared to existing prompt-agnostic VLM adversaries. In addition, our ProAda achieves competitive overall cross-model transferability and improved robustness against countermeasures.
Figures & tables
Figure 1: Adversarial perturbations can protect VLMs from answering text prompts about the image content. However, existing prompt-agnostic protections Luo et al. (2024) ; Yang et al. (2024) ; Mittal et al. (2025) indiscriminately reject all kinds of prompts. In contrast, our prompt-Adapted method rejects harmful but accepts general prompts, providing a balance between privacy protection and image utility.
Figure 2: Framework of our Prompt-Adapted (ProAda) adversary against VLMs. The optimization of visual perturbation δv is conducted on both harmful prompts (for visual privacy protection) and general prompts (for maintaining general utility). Specifically, the response to general prompts is minimized towards the correct answer using Lg , and the response to harmful prompts is minimized towards a pre-defined target text (e.g., “unknown”) using Lh . In particular, optimization on harmful prompts also involves updating the text perturbation δt to achieve a more accurate adversarial direction, as commonly done in related work Luo et al. (2024) ; Lu et al. (2023) ; Zhang et al. (2024) ; Jia et al. (2025) . Here, δt is updated only when the adversarial text is judged to remain harmful.
Method
Untargeted SRh
Targeted SRh
SRg
Average
CroPA (Harmful) Mittal et al. (2025)
92.5
91.3
55.3
79.7
CroPA (All) Mittal et al. (2025)
94.0
93.8
43.1
77.0
Multi-P (Harmful) Luo et al. (2024)
90.9
84.0
82.0
85.6
Multi-P (All) Luo et al. (2024)
92.2
88.5
77.8
86.2
ITA Cai et al. (2025)
56.0
51.6
78.5
62.0
Our ProAda
93.1
93.0
92.4
92.8
Table 1: Untargeted and targeted success rates (SRs) of different methods.
Figure 3: Targeted success rates of our ProAda vs. CroPA over iterations. Our ProAda achieves substantially higher SRg and comparable targeted SRh .
Model/Method
InstructBLIP
LLaVA-1.5
MiniGPT-4
Overall
CroPA (Harmful)
46.9/96.2
13.7/94.8
37.2/81.0
61.6
CroPA (All)
48.6/95.1
10.7/95.7
39.3/82.0
61.9
Multi-P (Harmful)
40.0/96.5
9.5/95.8
41.6/79.8
60.5
Multi-P (All)
44.7/97.0
9.8/96.4
41.6/82.5
62.0
ITA
41.6/97.0
10.6/95.2
30.5/89.0
60.6
Our ProAda
53.8/98.0
10.4/96.8
37.3/86.6
63.8
Table 2: Cross-model transferability (untargeted SRh / SRg ) of different methods to mainstream VLMs.
Method
Untargeted SRh
Targeted SRh
SRg
Average
ProAda (default)
53.8
9.6
98.0
53.8
ProAda w/ BSR
44.2
0.4
97.8
47.5
ProAda w/ DI
45.4
11.1
95.9
50.8
ProAda w/ MI
38.9
7.1
98.3
48.1
ProAda w/ TI
48.8
2.5
97.9
49.7
ProAda w/ Logit
50.5
17.3
94.8
54.2
Table 3: Cross-model transferability of ProAda integrated with different transfer techniques.
Figure 4: Visualizations of the adversarial images crafted by our ProAda, along with the harmful and general prompts. Additional examples are provided in Figure A.1 of Appendix A.2 .
Method
Metric
w/o
Rotation
Gaussian
Bit-Depth
Noise
Brightness
CroPA (Harmful)
SR h
91.3
51.8
74.0
73.2
70.9
74.0
SR g
55.3
64.9
59.0
59.0
59.1
58.1
Average
73.3
58.4
66.5
66.1
65.0
66.1
CroPA (All)
SR h
93.8
52.9
75.0
77.9
69.3
75.0
SR g
43.1
62.7
48.0
51.6
50.4
51.8
Average
68.5
57.8
61.5
64.8
59.9
63.4
Table 4: Robustness of our ProAda vs. CroPA against five countermeasures. Here, only targeted SR h are reported, while untargeted SR h are all 100% because the transformations have substantially changed the original responses.
Method
SRh
SRg
Average
w/o SVM-based harmfulness judgment
71.5
61.7
66.6
w/o text perturbation update
65.0
89.1
77.1
Our ProAda ( Rh:g=1 )
80.6
95.5
88.1
Table 5: Ablation studies on the two main modules of ProAda.
Figure 10
Figure 7: Ablation studies on the hyper-parameters Rv:t and Rh:g for our ProAda method.
Targeted response
SRh
SRg
Average
“maybe"
65.0
89.1
77.1
“none"
87.5
75.0
81.3
“I am sorry"
98.5
97.3
97.9
“unspeakable"
77.5
65.7
71.6
“metaphor"
35.5
80.0
57.8
“0"
99.0
98.7
98.9
Table 6: ProAda optimized with different target response T on harmful prompts.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure A.1: Additional visualizations of the adversarial images crafted by ProAda, along with the harmful and general prompts.
Figure A.2: Success rates of ProAda over iterations under untargeted optimization.
Model
Untargeted SRh
Targeted SRh
SRg
Average
BLIP-2
93.1
93.0
92.4
92.8
LLaVA
100.0
98.3
77.6
92.0
Appendix
Table A.1: White-box success of ProAda on LLaVA-1.5.
Metric
Untargeted SRh
Targeted SRh
SRg
Overall
Value
93.1±9.33e−5
93.0 ±6.18e−5
92.4 ±2.35e−5
92.8 ±4.69e−5
Appendix
Table A.2: Our results are stable over 10 randomly sampled subsets.
Adversarial attacks on vision-language models exploit images, text, and multimodal interactions to manipulate outputs, bypass safety, or degrade reliability.
Vision-language models (VLMs) are vulnerable to adversarial image perturbations. Existing works based on adversarial training against task-specific adversarial examples are computationally expensive and often fail to generalize to unseen attack types. To address these limitations, we introduce Paraphrase-Decomposition-Aggregation (PDA), a training-free defense framework that leverages text augmentation to enhance VLM robustness under diverse adversarial image attacks. PDA performs prompt paraphrasing, question decomposition, and consistency aggregation entirely at test time, thus requiring no modification on the underlying models. To balance robustness and efficiency, we instantiate PDA as invariants that reduce the inference cost while retaining most of its robustness gains. Experiments on multiple VLM architectures and benchmarks for visual question answering, classification, and captioning show that PDA achieves consistent robustness gains against various adversarial perturbations while maintaining competitive clean accuracy, establishing a generic, strong and practical defense framework for VLMs during inference.
Jingning Xu, Haochen Luo, Chen Liu
Department of Computer Science City University of Hong Kong
Adversarial perturbations can alter the predictions of frozen vision-language models (VLMs) while leaving their confidence and image--text similarity patterns seemingly plausible. We investigate whether we can identify adversarial inputs based on the broader way an image interacts with a collection of general semantic prompts. Our detector summarizes these responses using category-level statistics, relationships among prompts, deviations from clean reference distributions, and stability under weak image transformations, producing a compact response profile that is classified by a lightweight model while the VLM remains fixed. We evaluate the approach on multiple public image datasets, several CLIP-style visual backbones, and a range of gradient-based, optimization-based, automated, and spatial attacks. The detector achieves strong discrimination in attack-specific settings and retains substantial performance when evaluated on attacks not seen during training. Under a controlled detector-specific protocol, the response-profile representation outperforms the evaluated embedding-geometry baselines. Additional analyses show that the feature groups provide complementary information and that the method remains effective under variations in the prompt configuration. We also examine inference cost and performance against detector-aware adaptive attacks. Overall, the results indicate that response patterns across semantic prompts provide a useful complementary signal for adversarial image detection in frozen VLMs.
Arash Vashagh, Roozbeh Razavi-Far
Trustworthy and Secure AI (TSAI) Lab, Faculty of Computer Science, University of New Brunswick, Canada
Large Vision-Language Models (LVLMs) can be vulnerable to adversarial images that subtly bias their outputs toward plausible yet incorrect responses. We introduce a general, efficient, and training-free defense that combines image transformations with agentic data consolidation to recover correct model behavior. A key component of our approach is a two-stage detection mechanism that quickly filters out the majority of clean inputs. We first assess image consistency under content-preserving transformations at negligible computational cost. For more challenging cases, we examine discrepancies in a text-embedding space. Only when necessary do we invoke a powerful LLM to resolve attack-induced divergences. A key idea is to consolidate multiple responses, leveraging both their similarities and their differences. We show that our method achieves state-of-the-art accuracy while maintaining notable efficiency: most clean images skip costly processing, and even in the presence of numerous adversarial examples, the overhead remains minimal.