Where Can We Fool the Model's Mind? Response-Guided Semantic Probing and Adaptive Routing for Transferable Attacks on Black-Box MLLMs

Ahmed Abdelnaby; Mohamed Elmahallawy

cs.CVOct 27, 2026

Where Can We Fool the Model's Mind? Response-Guided Semantic Probing and Adaptive Routing for Transferable Attacks on Black-Box MLLMs

Authors: Ahmed Abdelnaby, Mohamed Elmahallawy

Organizations: School of Engineering and Applied Sciences, Washington State University, WA 99354, USA

Abstract

Multimodal Large Language Models (MLLMs) ground language in visual evidence, yet their semantic reasoning can be exploited through transferable black-box adversarial attacks. Existing attacks typically allocate perturbations using surrogate-model saliency, which may not reflect how an unseen MLLM semantically interprets or relies on different image regions. We introduce VISTA (Vulnerability-Informed Semantic Transfer Attacks), a black-box framework that identifies semantically vulnerable visual regions from an MLLM's responses without access to gradients, logits, parameters, or internal representations. VISTA supports two attack settings: (i) VISTA-Proxy, a pure-transfer setting that probes an open-source MLLM and transfers the resulting adversarial examples to unseen commercial MLLMs without querying them; and (ii) VISTA-Victim, a query-assisted setting that probes the target MLLM to capture model-specific semantic vulnerabilities. VISTA builds an Uncertainty-Based Multimodal Behavior (UBMB) map from response drift, conflict, misleading, and semantic shifts, then uses entropy-adaptive Sinkhorn routing and a surrogate ensemble to focus perturbations on vulnerable regions. Across GPT-5, Gemini-3.5-Flash, and Claude Sonnet 4.6, VISTA achieves up to 97 % attack success rate (ASR) while maintaining a Peak Signal-to-Noise Ratio (PSNR) above 30 dB. Notably, VISTA-Proxy achieves up to 93 % ASR without querying the final victim, demonstrating that response-derived semantic vulnerability can enable effective transfer across heterogeneous MLLMs.

Figures & tables

Figure 1: Cross-model adversarial transfer: a single adversarial image induces consistent target-scene descriptions across commercial MLLMs, demonstrating strong black-box transferability.

Panel of Figure 2 — Figure 2: Attention visualization across 10 vision encoders for the same image, illustrating spatial focus divergence and surrogate–target semantic mismatch.

Figure 3: Overview of the five-stage VISTA workflow: (1) random patch masking and semantic probing; (2) victim/proxy attribution to construct the UBMB heatmap $H_{s}$ ; (3) Sinkhorn routing to generate gradient and budget maps $G(x)$ and $E(x)$ ; (4) multi-paradigm surrogate optimization with adaptive gradient routing; and (5) adversarial generation and victim evaluation. The dashed arrow denotes EMA-based gradient feedback.

Method	Probe / Surrogate	GPT-5				Gemini-3.5-Flash				Claude Sonnet 4.6
Method	Probe / Surrogate	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR
AttackVLM (ADV-Transfer)	B/16	6.0	2.0	1.0	4.0	7.0	3.0	0.0	1.0	5.0	2.0	1.0	3.0
AttackVLM (ADV-Transfer)	B/32	8.0	4.0	2.0	3.0	6.0	4.0	1.0	2.0	7.0	3.0	0.0	1.0
AttackVLM (ADV-Transfer)	LAION	3.0	1.0	0.0	2.0	8.0	4.0	0.0	1.0	6.0	3.0	1.0	0.0
AttackVLM (ADV-Query)	Victim / B/16	5.0	1.0	0.0	3.0	8.0	2.0	0.0	2.0	4.0	0.0	0.0	0.0
AdvDiffVLM	Ensemble	5.0	3.0	1.0	2.0	4.0	2.0	0.0	1.0	3.0	2.0	1.0	0.0

Table 1: Attack success of VISTA vs. baselines on closed-source MLLMs. VISTA -Proxy uses Qwen3-VL for pure transfer; VISTA -Victim probes the target, sharing the same ensemble. All metrics are reported in %. For query-cost details, see Appendix I . Bold / underline denote best/second-best.

Method	Probe / Surrogate	Qwen2.5-VL-3B		Qwen2.5-VL-7B		InternVL3-8B		LLaVA-1.5-7B		GLM-4.1V-9B-Thinking		Average
Method	Probe / Surrogate	ASR	AvgSim	ASR	AvgSim	ASR	AvgSim	ASR	AvgSim	ASR	AvgSim	ASR	AvgSim
AttackVLM	B/16	5.0	0.09	10.0	0.15	11.0	0.13	32.0	0.32	33.0	0.34	18.2	0.21
AttackVLM	B/32	9.0	0.13	14.0	0.18	15.0	0.16	12.0	0.15	12.0	0.14	12.4	0.15
AttackVLM	LAION	15.0	0.18	27.0	0.28	28.0	0.26	47.0	0.43	48.0	0.44	33.0	0.32
AdvDiffVLM	Ensemble	2.0	0.02	3.0	0.02	3.0	0.02	2.0	0.02	2.0	0.02	2.4	0.02
SSA-CWA	Ensemble	1.0	0.04	1.0	0.04	1.0	0.04	1.0	0.04	2.0	0.05	1.2	0.04

Table 2: Attack success of VISTA -Proxy vs. baselines on open-source MLLMs. VISTA -Proxy uses Qwen3-VL to probe target semantics. ASR is reported in %; AvgSim is a similarity score in

[0,1]

Figure 4: Perturbation visualization for three source-target pairs. VISTA produces semantically concentrated perturbations with lower $\ell_{1}$ / $\ell_{2}$ and higher PSNR than both baselines.

Method	Surrogate	$\ell_{1}{\downarrow}$	$\ell_{2}{\downarrow}$	PSNR ${\uparrow}$
AttackVLM	B/16	0.033	0.039	28.5
AttackVLM	B/32	0.037	0.042	27.8
AttackVLM	LAION	0.034	0.041	28.3
AdvDiffVLM	Ensemble	0.042	0.049	26.2
SSA-CWA	Ensemble	0.058	0.060	25.6
AnyAttack	Ensemble	0.049	0.053	26.4

Table 3: Imperceptibility comparison of VISTA -Proxy vs. baselines. Arrows indicate the preferred direction. Bold / underline denote the best/second-best results.

Victim	Metric	Full	w/o Sem.	w/o Sink.	w/o Sur.	w/o AGR
		VISTA	Attr.	Routing	Weight.
GPT-5	$\mathrm{KMR}@{1}$	91.0	89.0	76.0	74.0	83.0
	$\mathrm{KMR}@{2}$	39.0	41.0	20.0	18.0	30.0
	$\mathrm{KMR}@{3}$	22.0	27.0	17.0	16.0	19.0
	ASR	97.0	91.0	83.0	84.0	91.0
Gemini-3.5 -Flash	$\mathrm{KMR}@{1}$	80.0	76.0	65.0	63.0	72.0

Table 4: Ablation of VISTA -Victim core components. Higher values are better; bold denotes the best result.

Appendix figures & tables26 assets

Supplementary material from the paper’s appendix.

Appendix

Method	Probe / Surrogate	GPT-o3		Claude Sonnet 4.6 (Extended Thinking)		Gemini 2.5 Flash (Thinking)
Method	Probe / Surrogate	ASR (%)	AvgSim	ASR (%)	AvgSim	ASR (%)	AvgSim
M-Attack [ 14 ]	Ensemble	67.0	0.54	10.0	0.15	49.0	0.43
FOA-Attack [ 12 ]	Ensemble	76.0	0.60	13.0	0.17	54.0	0.48
VISTA -Proxy (Ours)	Qwen3-VL / Ensemble	81.0	0.63	60.0	0.27	57.0	0.51

Appendix

Table 5: Attack performance on reasoning-enhanced commercial MLLMs. VISTA -Proxy uses Qwen3-VL for semantic probing. Bold denotes the best result.

Victim	$N$	ASR (%)		Agr.	$\kappa$	PABAK
Victim	$N$	Human	GPTScore	(%)	$\kappa$	PABAK
GPT-5	100	92.0	93.0	95.0	0.64	0.90
Gemini-3.5-Flash	100	79.0	81.0	94.0	0.81	0.88
Claude Sonnet 4.6	100	62.0	64.0	92.0	0.83	0.84
Overall	300	77.7	79.3	93.7	0.81	0.87

Appendix

Table 6: Human validation of GPTScore-based attack evaluation (

\tau{=}0.3

\kappa

is Cohen’s kappa; PABAK is prevalence-adjusted kappa.

Victim	$\tau{=}0.3$	$\tau{=}0.5$	$\tau{=}0.7$	$\tau{=}0.8$
GPT-5	97.0	69.0	45.0	28.0
Gemini-3.5-Flash	85.0	59.0	40.0	29.0
Claude Sonnet 4.6	70.0	31.0	11.0	7.0

Appendix

Table 7: Judge-threshold sensitivity. ASR (%) of VISTA -Victim as a function of the GPTScore threshold

\tau

Evaluator	GPT-5	Gemini	Claude
GPTScore, Prompt A (default)	93.0	81.0	64.0
GPTScore, Prompt B	91.0	80.0	61.0
GPTScore, Prompt C	92.0	82.0	64.0
GPTScore, Prompt D	90.0	80.0	62.0
Human majority vote	92.0	79.0	62.0

Appendix

Table 8: Robustness of attack evaluation to caption-prompt choice. ASR (%) is computed on the same VISTA -Proxy adversarial examples for all prompts.

Victim	Method	ASR (%)	95% Wilson CI (%)
GPT-5	M-Attack	96.0	[90.2, 98.4]
	FOA-Attack	92.0	[85.0, 95.9]
	VISTA -Proxy	93.0	[86.3, 96.6]
	VISTA -Victim	97.0	[91.5, 99.0]
Gemini-3.5-Flash	M-Attack	81.0	[72.2, 87.5]
	FOA-Attack	84.0	[75.6, 89.9]

Appendix

Table 9: Attack success rate (ASR, %) with 95% Wilson confidence intervals.

UBMB Variant	$Q_{p}$	GPT-5				Gemini-3.5-Flash				Claude Sonnet 4.6				AvgSim
		ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$
$D$ only	41	87.0	82.0	30.0	15.0	74.0	69.0	21.0	12.0	57.0	61.0	18.0	5.0	0.505
$C$ only	41	82.0	79.0	20.0	8.0	71.0	63.0	18.0	9.0	55.0	58.0	16.0	4.0	0.492
$I$ only	41	85.0	81.0	27.0	13.0	76.0	67.0	23.0	11.0	58.0	60.0	17.0	5.0	0.512
$S$ only	41	63.0	60.0	9.0	0.0	56.0	31.0	11.0	6.0	54.0	53.0	14.0	5.0	0.386
w/o $D$	121	89.0	84.0	31.0	16.0	77.0	74.0	23.0	13.0	60.0	68.0	21.0	7.0	0.516

Appendix

Table 10: UBMB signal analysis on

N=100

source–target pairs using

M=40

probing masks. ASR and KMR are reported in %; AvgSim is a similarity score in

[0,1]

Q_{p}

denotes local Qwen3-VL probing queries per image; all variants use

Q_{v}=0

. The full configuration corresponds to VISTA -Proxy in Table 1 .

Weights	$w_{d}$	$w_{c}$	$w_{i}$	$w_{s}$	GPT-5	Gemini	Claude
Equal	.25	.25	.25	.25	86.0	77.0	68.0
Default	.40	.25	.20	.15	93.0	81.0	64.0
D-heavy	.55	.20	.15	.10	95.0	75.0	53.0
S-heavy	.25	.20	.15	.40	85.0	73.0	68.0

Appendix

Table 11: Sensitivity of VISTA -Proxy to UBMB weight configurations. Entries report ASR (%) using Qwen3-VL as the probing model.

Patch Size (px)	Mean UBMB	Max UBMB	Std.
16	0.1668	0.2200	0.0606
32	0.2099	0.2463	0.0132
64	0.2167	0.2440	0.0098
128	0.2422	0.2865	0.0147

Appendix

Table 12: Sensitivity of UBMB scores to occlusion patch size on a representative source image.

Figure 5: Sensitivity to Sinkhorn temperature range $[\epsilon_{\min},\epsilon_{\max}]$ . (a) ASR and (b) AvgSim across seven configurations for GPT-5, Gemini-3.5-Flash, and Claude Sonnet 4.6. The yellow band and dashed orange line mark the default $[0.035,0.18]$ , which achieves the best trade-off. Too-narrow ranges over-concentrate perturbations; too-wide ranges dilute the adversarial signal.

Param.	Meaning	Default
Attack setting
$\epsilon$	$\ell_{\infty}$ perturbation budget	$16/255$
$T$	MI-FGSM steps	$300$
Semantic probing and UBMB
$p_{0}$	Probing patch size	$32$
$M$	Probing masks per image	$40$

Appendix

Table 13: Hyperparameter settings for VISTA . Parameters are fixed across all victim MLLMs with no victim-specific tuning.

$\bm{\epsilon}$	Method	GPT-5				Gemini-3.5-Flash				Claude Sonnet 4.6
$\bm{\epsilon}$	Method	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR
$4/255$	M-Attack [ 14 ]	21.0	8.0	1.0	18.0	15.0	5.0	0.0	10.0	3.0	1.0	0.0	2.0
	FOA-Attack [ 12 ]	24.0	9.0	2.0	20.0	17.0	6.0	1.0	12.0	4.0	1.0	0.0	3.0
	VISTA -Victim	30.0	16.0	3.0	26.0	20.0	11.0	2.0	11.0	5.0	1.0	0.0	1.0
$8/255$	M-Attack [ 14 ]	58.0	31.0	7.0	63.0	42.0	18.0	4.0	45.0	6.0	2.0	0.0	4.0
	FOA-Attack [ 12 ]	62.0	28.0	9.0	66.0	35.0	20.0	4.0	42.0	8.0	2.0	0.0	5.0

Appendix

Table 14: Effect of the

\ell_{\infty}

perturbation budget

\epsilon\in\{4,8,16\}/255

on targeted attack performance (

N{=}100

). VISTA -Victim is used for consistency with the corresponding main-paper evaluation. All metrics are reported in %; higher values indicate stronger target-semantic alignment or attack success. Bold denotes the best result within each perturbation budget and victim.

Steps	Avg. Time (min/img)	GPT-5		Gemini-3.5-Flash		Claude Sonnet 4.6
Steps	Avg. Time (min/img)	ASR	AvgSim	ASR	AvgSim	ASR	AvgSim
100	2.12	81.0	0.43	68.0	0.36	52.0	0.31
200	4.24	91.0	0.48	78.0	0.43	61.0	0.38
300	6.35	93.0	0.54	81.0	0.51	64.0	0.50
Adaptive (EMA, $\leq{-}8.9$ )	3.28	92.0	0.50	80.0	0.45	63.0	0.40

Appendix

Table 15: Attack performance and per-image optimization time of VISTA -Proxy at different step budgets (100 randomly selected images, Qwen3-VL as local proxy). ASR is reported in %; AvgSim is a similarity score in

[0,1]

. Adaptive stopping terminates when OT loss

\leq-8.9

. Bold denotes the best ASR/AvgSim and the most efficient runtime.

Method	$\mathbf{Q_{v}}$ /img	$\mathbf{Q_{p}}$ /img	Steps	Min/img	ASR (%)
					GPT-5	Gemini-3.5-Flash	Claude Sonnet 4.6
AttackVLM (ADV-Transfer, B/16)	0	0	300	1.00	4.0	1.0	3.0
AttackVLM (ADV-Query, B/16)	800	0	8	20.00	3.0	2.0	0.0
M-Attack	0	0	300	1.12	96.0	81.0	9.0
FOA-Attack	0	0	300	3.19	92.0	84.0	20.0
VISTA -Proxy	0	121 (local)	300	6.35	93.0	81.0	64.0

Appendix

Table 16: Construction efficiency and ASR comparison.

Q_{v}

denotes queries to the final victim, while

Q_{p}

denotes queries to a separate probing model. VISTA uses 40 probing masks, resulting in 121 model queries per image. ASR is reported in %.

Figure 6: Mask–ASR trade-off of VISTA -Victim. Probing-mask settings $M\in\{20,40,60,80,100,120\}$ correspond to victim-query budgets $Q_{v}\in\{61,121,181,241,301,361\}$ .

Method	$\mathbf{M}$	$\mathbf{Q_{v}}$	GPT-5	Gemini	Claude
AttackVLM (ADV-Query)	–	61	1.0	0.0	0.0
VISTA -Victim	20	61	90.0	79.0	59.0
AttackVLM (ADV-Query)	–	121	1.0	1.0	0.0
VISTA -Victim	40	121	97.0	85.0	70.0
AttackVLM (ADV-Query)	–	241	2.0	1.0	0.0
VISTA -Victim	80	241	97.0	86.0	72.0

Appendix

Table 17: Query-matched comparison with AttackVLM (ADV-Query). Both methods use the same final-victim query budget

Q_{v}

during adversarial construction;

M

is the number of probing masks for VISTA -Victim (

Q_{v}{=}3M{+}1

). Values report ASR (%).

Stage	Calls/img	$/call	$/img
Adversarial construction
VISTA -Proxy (Qwen3-VL)	121	local	–
VISTA -Victim (GPT-5)	121	$0.00127	$0.1537
VISTA -Victim (Gemini)	121	$0.00171	$0.2069
VISTA -Victim (Claude)	121	$0.00176	$0.2130
Post-hoc evaluation

Appendix

Table 18: Per-image construction and evaluation API cost. Construction uses

M{=}40

probing masks, corresponding to 121 model queries per image. VISTA -Proxy probes a locally hosted model and incurs no API cost.

UBMB Signals	Queries	Queries/img	Attack GPU-h	Eval. Calls	Eval. Min
$D$ only	4,100	41	11.05	1,400	56.0
$C$ only	4,100	41	13.15	1,400	56.0
$I$ only	4,100	41	13.80	1,400	55.5
$S$ only	4,100	41	11.90	1,400	55.0
w/o $D$	12,100	121	21.45	1,400	53.5
w/o $C$	8,100	81	15.90	1,400	56.5

Appendix

Table 19: UBMB signal-level query and computational cost for VISTA -Proxy on

N=100

images using

M=40

probing masks. All probing queries are local (

Q_{v}=0

Probing Model	Cost	GPT-5				Gemini-3.5-Flash				Claude Sonnet 4.6
Probing Model	Cost	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR
Actual Victim (Oracle)	High (API)	91.0	39.0	22.0	97.0	80.0	29.0	17.0	85.0	78.0	28.0	13.0	70.0
Qwen3-VL (proxy)	Free (local)	88.0	35.0	19.0	93.0	81.0	26.0	16.0	81.0	73.0	24.0	10.0	64.0
Qwen2.5-VL (proxy)	Free (local)	86.0	33.0	18.0	92.0	79.0	25.0	15.0	80.0	71.0	22.0	9.0	62.0

Appendix

Table 20: VISTA performance when using open-source models (Qwen2.5-VL, Qwen3-VL) as locally hosted proxies with no API cost for black-box semantic probing, evaluated on closed-source commercial MLLMs. The oracle row probes the actual victim ( VISTA -Victim); proxy rows correspond to VISTA -Proxy. All metrics are reported in %. Bold denotes the best proxy result.

Defense	GPT-4o					GPT-5
Defense	ASR	AvgSim	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$	ASR	AvgSim	$\mathrm{KMR}@{1}$	$\mathrm{KMR}@{2}$	$\mathrm{KMR}@{3}$
None	96.0	0.522	90.0	44.0	8.0	94.0	0.548	96.0	50.0	24.0
JPEG-70	92.0	0.520	92.0	38.0	20.0	92.0	0.526	94.0	48.0	22.0
JPEG-80	94.0	0.486	92.0	40.0	12.0	90.0	0.502	92.0	42.0	16.0
JPEG-90	90.0	0.518	84.0	42.0	22.0	96.0	0.534	92.0	44.0	26.0
Resize-512	92.0	0.566	98.0	50.0	16.0	96.0	0.578	96.0	58.0	30.0

Appendix

Table 21: Robustness of VISTA under common input-level defenses [ 27 ] on 50 randomly selected images (sim-threshold=0.3). ASR and KMR are reported in %; AvgSim is a similarity score in

[0,1]

. Bold = best per metric per model.

Figure 7: Perturbation noise analysis for the butterfly $\to$ train adversarial example. Top left: signed noise ( $10\times$ amplified, 128=zero). Top center: noise magnitude heatmap. Top right: per-channel (R/G/B) signed noise distribution. Bottom row: per-channel signed perturbation maps.

Panel of Figure 8 — Figure 8: Qualitative example of targeted transfer. The source image shows a panda, while the target contains a dog. All three victim models describe the adversarial image as a dog rather than a panda.

Panel of Figure 9 — Figure 9: Qualitative example of targeted transfer. The source image shows a pizza, while the target contains elephants. All three victim models describe the adversarial image in terms of elephants and their natural environment rather than the source pizza.

Panel of Figure 10 — Figure 10: Qualitative example of targeted transfer. The source image shows a dog, while the target contains crafting and sewing tools. All three victim models describe the adversarial image in terms of these tools rather than the source dog.

Panel of Figure 11 — Figure 11: Qualitative example of targeted transfer. The source image shows a waterbird, while the target contains scissors. Victim models shift their descriptions toward metallic or scissor-like features rather than the source bird.

Panel of Figure 12 — Figure 12: Qualitative example of targeted transfer. The source image shows a belt with a decorative buckle, while the target contains a cat near a toilet. Victim models shift their descriptions toward the target’s cat and bathroom scene rather than the source buckle, illustrating the perturbation’s effect.

Panel of Figure 13 — Figure 13: Representative responses from GPT-5 (left), Gemini (middle), and Claude (right) under three alternative prompt formulations.

Adversarial Attacks on VLMs

Adversarial attacks on vision-language models exploit images, text, and multimodal interactions to manipulate outputs, bypass safety, or degrade reliability.

See all 183 papers

One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
Sep 27, 2026Sen Nie, Jie Zhang, Zhongqi Wang +2Adversarial Attacks on VLMs Adversarial Attacks on LLMs
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences, and the University of Chinese Academy of Sciences.
Investigating Adversarial Robustness of Multi-modal Large Language Models
Jun 2, 2026Hashmat Shadab Malik, Muzammal Naseer, Salman KhanAdversarial Training VLM Robustness
Mohamed Bin Zayed University of AI, UAE · Khalifa University, UAE · Australian National University, Australia
Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models
Mar 5, 2026Yuanbo Li, Tianyang Xu, Cong Hu +3Adversarial Attacks on Unified Multimodal Models Transfer-Based Adversarial Attacks
School of Artificial Intelligence and Computer Science, Jiangnan University · Centre for Vision, Speech and Signal Processing (CVSSP), University of Surrey

Sep 27, 2026J/K move · Enter open · S save

One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs

Sen Nie, Jie Zhang, Zhongqi Wang, Shiguang Shan+1

State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences, and the University of Chinese Academy of Sciences.

Adversarial Attacks on VLMs Adversarial Attacks on LLMs Multimodal Large Language Models Transfer-Based Adversarial Attacks Black-Box Adversarial Attacks Consistent Adversarial Attacks

Open paper AskPDF arXiv

Adversarial attacks have long posed a fundamental threat to machine learning systems. As multimodal large language models (MLLMs) rapidly evolve and become widely deployed, assessing their vulnerability to such attacks is essential for their safe use. In this work, we investigate whether a single adversarial image can consistently mislead diverse frontier MLLMs in black-box settings. We propose O-Attack, a highly transferable black-box attack framework. This framework builds on our insight that surrogate models contain a broad, high-level, cross-modally aligned semantic space. This space extends beyond final-layer outputs and provides multiple semantically consistent representations that remain underexploited by existing attacks. Within this space, O-Attack anchors aligned representations, progressively broadens semantic conditions, and optimizes perturbations through semantic consensus to promote consistent target alignment. By fully exploiting this space with the same surrogate models as M-Attack, O-Attack raises attack success rates on GPT-5.4 (29.1% to 77.2%), Claude-4.6 (42.8% to 81.6%), and Gemini-3.1 (38.2% to 80.9%). Extensive experiments across 24 MLLMs show that O-Attack outperforms six state-of-the-art methods in black-box transferability, with consistent effectiveness across prompts and improved efficiency and imperceptibility. This work exposes the practical safety risks posed by black-box adversarial attacks against frontier MLLMs, underscoring the need for more rigorous robustness evaluation and more effective defenses.

Abstract

Adversarial Attacks on VLMs

Explore similar work

One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs

Investigating Adversarial Robustness of Multi-modal Large Language Models

Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models