Adversarial Attacks on VLMs

VLM: Vision-Language Model

This field studies how image perturbations, embedded text, physical patches, poisoned training data, and multi-turn prompts can make models misread scenes, follow malicious instructions, leak information, or fail in agent tasks. Approaches include gradient-based and transferable attacks, typographic and visual prompt injection, jailbreak red-teaming, and backdoors, evaluated across tasks such as visual question answering, captioning, document understanding, video, and robotics. Defenses range from adversarial training and robust encoders to test-time transformations, token or attention interventions, prompt screening, and response monitoring. A central challenge is improving safety and robustness without sacrificing clean accuracy, utility, or latency, while accounting for uneven transfer across models, modalities, languages, and deployment settings.

Latest papers

182 papers23 papers in the last four weeks, up 77% on the four weeks before. 0.1% of all new papers.

Where Can We Fool the Model's Mind? Response-Guided Semantic Probing and Adaptive Routing for Transferable Attacks on Black-Box MLLMs
Oct 27, 2026Ahmed Abdelnaby, Mohamed ElmahallawyAdversarial Attacks on VLMs Transfer-Based Adversarial Attacks
School of Engineering and Applied Sciences, Washington State University, WA 99354, USA
SPOOK: Sparse Pixel Optimization for Off-Manifold Knowledge in Vision Encoders
Oct 23, 2026Ankit Gupta, Akshat Pandya, Christoph Adami +1Representation Geometry in VLMs Visual Representation Learning
Department of Computer Science & Engineering, Michigan State University · Coco Robotics · Program in Evolution, Ecology, & Behavior, Michigan State University +2
Depth-Dependent Safety Geometry in Vision-Language Models: Layer-Wise Localization and Bidirectional Refusal Control
Oct 23, 2026Muhammad Zeeshan Karamat, Syed Talal Hassan, Christiana Chamon GarciaVLM Safety Representation Geometry in VLMs
Virginia Tech
A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era
Oct 21, 2026Eric Liang, Alan Luo, Kaiwen YuanVLM Robustness Adversarial Attacks on VLMs
Saratoga High School · Google · University of Illinois Urbana-Champaign
GeoEdit: Adversarial De-Evidencing for Silent Geoprivacy Protection via Image Editing
Oct 19, 2026Yu Yan, Shengjia Cheng, Fei Ma +2Privacy Protection in VLMs Adversarial Attacks on VLMs
People’s Public Security University of China, Beijing, China · Guangming Laboratory, Shenzhen, China
FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models
Oct 15, 2026Jiaming Zhang, Zherui Li, Siqi Guo +3VLM Robustness Adversarial Attacks on VLMs
College of Computing and Data Science Nanyang Technological University, Singapore
GeoCloak: An Agentic Framework for Semantics-Preserving Geolocation Privacy via Peripheral Clue Manipulation
Oct 14, 2026Yixin Wu, Mingjie Li, Yun Shen +2Privacy Protection in VLMs Adversarial Attacks on VLMs
The Hong Kong University of Science and Technology (Guangzhou) · The Hong Kong University of Science and Technology · CISPA Helmholtz Center for Information Security +1
DPOison-VL: Clean Preference Poisoning in Vision-Language Direct Preference Optimization
Oct 13, 2026Chengtao Jian, Kai YangData Poisoning Attacks Adversarial Attacks on VLMs
School of Computer Science and Technology, Tongji University, China · Shenzhen Loop Area Institute, China · Shanghai Research Institute for Intelligent Autonomous Systems, China
Answer It or Not? Towards Prompt-Adapted Adversarial Images on Vision Language Models
Oct 12, 2026Shunyuan Bai, Yuchen Ren, Le Yang +3Adversarial Attacks on VLMs Privacy Protection in VLMs
Xi’an Jiaotong University, Xi’an, 710049, China
Visually Legible but Adversarial: Watermark-Constrained Attacks on End-to-End VLMs for Document Understanding
Oct 11, 2026Qingzhe Han, Fan Dang, Shengqi Chen +4Adversarial Attacks on VLMs VLM Robustness
Beijing Jiaotong University
Scenes as an Attack Surface: Uncovering Scene-Grounded Safety Failures in MLLMs
Oct 8, 2026Tongxi Wu, Yuyang Cheng, Jiacheng Xian +5MLLM Safety Adversarial Attacks on VLMs
Nanjing University · The Hong Kong University of Science and Technology (Guangzhou) · Independent Researcher +2
Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoders
Oct 8, 2026Tao Yang, Jianying ZhouContrastive Learning for VLMs Adversarial Attacks on VLMs
Singapore University of Technology and Design
Detecting Adversarial Images through Response Profiles of Vision-Language Models
Oct 7, 2026Arash Vashagh, Roozbeh Razavi-FarAdversarial Example Detection VLM Robustness
Trustworthy and Secure AI (TSAI) Lab, Faculty of Computer Science, University of New Brunswick, Canada
Understanding and Mitigating Token-Pruning-Induced Vulnerabilities in VLMs
Oct 7, 2026Shuailong Wang, Xinyu Lyu, Shengming Yuan +3Visual Token Pruning VLM Robustness
University of Electronic Science and Technology of China, Chengdu, China · Southwestern University of Finance and Economics, Chengdu, China · Tongji University, Shanghai, China +1
Adversarial Images Hijack Web Agents from Visual Grounding to Browser Execution
Oct 7, 2026Wanjing Han, Levi Taiji Li, Mu Zhang +2AI Agent Security Tool-Using Vision-Language Agents
University of Utah
Visual Memory Attacks Can Persist Through The KV Cache
Oct 6, 2026David Dobre, Leo Schwinn, Gauthier Gidel +3Adversarial Attacks on VLMs Backdoor Attacks on VLMs
ServiceNow AI Research · Université de Montréal · Mila +2
Transferable Spatial Temporal Coherence Adversarial Attack on Black-Box Vision Language Models for Autonomous Driving
Oct 6, 2026Heyam Bin Jahlan Areej Alhothali Abeer AlhothaliAdversarial Attacks on VLMs VLMs for Autonomous Driving
Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
Oct 4, 2026Xiaojun Jia, Simeng Qin, Yiming Li +5Adversarial Attacks on VLMs Adversarial Attacks
Nanyang Technological University, Singapore · Northeastern University, Shenyang, Liaoning, China · Chongqing University, Chongqing, China +2
Corrupted but Correct: Why Vision-Language Models Lie to Themselves Internally
Oct 2, 2026Arun Josephraj Arokiaraj, Chenyi Huang, Zekun Wu +1VLM Robustness Adversarial Attacks on VLMs
Department of Computer Science, University College London · Holistic AI
Walking the Embedding Space: Datastore Extraction from Multimodal RAG
Oct 1, 2026Maria Carmen Jica, Ali Satvaty, Suzan Verberne +1Multimodal RAG Adversarial Attacks on VLMs
University of Groningen Groningen, The Netherlands
Typographic Attack Against VLM-based AI-generated Image Detection
Sep 30, 2026Eunmin Lee, Jungwoo Kim, Jong-Seok LeeVLM Evaluation VLM Robustness
School of Integrated Technology, Yonsei University
Feature-Aware Token Attack for Compression-Triggered Stealthy Failures in Large Vision-Language Models
Sep 30, 2026Shilinlu Yan, Bowen Chen, Yuechen Zhang +3VLM Robustness Adversarial Attacks on VLMs
Beijing University of Posts and Telecommunications · Jiangnan University · Nanyang Technological University +1
It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at $ε\leq 4/255$
Sep 29, 2026Binchi Zhang, Apurva Narayan, Atrisha SarkarVLM Robustness Adversarial Attacks on VLMs
University of Western Ontario
Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Models
Sep 28, 2026Qiankun Li, Yuechen Zhang, Bowen Chen +4VLM Robustness Adversarial Attacks on VLMs
Nanyang Technological University · Beijing University of Posts and Telecommunications
One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
Sep 27, 2026Sen Nie, Jie Zhang, Zhongqi Wang +2Adversarial Attacks on VLMs Adversarial Attacks on LLMs
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences, and the University of Chinese Academy of Sciences.
Mind the Spike: Mechanisms and Brittleness of Visual Massive Activations in Large Vision-Language Models
Sep 26, 2026Jonas Ngnawé, Yann Pequignot, Sabyasachi Sahoo +3Large Vision-Language Models VLM Robustness
Université Laval (IID) · Mila – Quebec AI Institute · Stanford University +2
Evaluating the Semantic-to-Geometric Gap in Adversarial Defenses Against Vision-Language Model-Based Plagiarism
Sep 22, 2026Christopher Burger, Christina Trotter, Joseph Carlisle +1VLM Robustness Adversarial Attacks on VLMs
The University of Mississippi
Hiding in Plain Sight: A Diffusion-based Mitigation of Geolocation Privacy Leakage in Vision-Language Models
Sep 18, 2026Yining Wang, Xi Li, Mi Zhang +4Privacy Protection in VLMs Adversarial Attacks on VLMs
Fudan University · East China University of Science and Technology · Shanghai University of Electric Power
SPARK: Representation-Level KV Memory Alignment for Safer Vision-Language Models
Sep 13, 2026Mohd Azfar, Izhar Dad KhanVLM Robustness Adversarial Attacks on VLMs
Do Input-Level Defenses Transfer to Observation-Level Attacks on VideoLLMs?
Sep 8, 2026Bangshuo Zhu, Wei Song, Yuxin Cao +4VLM Robustness Adversarial Attacks on VLMs
School of Computer Science and Engineering, University of New South Wales, New South Wales 2052, Australia · School of Information and Communication Technology, Griffith University, Queensland 4111, Australia · School of Computing, National University of Singapore, Singapore 117417, Singapore +2

Oct 27, 2026J/K move · Enter open · S save

Where Can We Fool the Model's Mind? Response-Guided Semantic Probing and Adaptive Routing for Transferable Attacks on Black-Box MLLMs

Ahmed Abdelnaby, Mohamed Elmahallawy

School of Engineering and Applied Sciences, Washington State University, WA 99354, USA

Adversarial Attacks on VLMs Transfer-Based Adversarial Attacks Adversarial Attacks on Unified Multimodal Models Multimodal Large Language Models

Open paper AskPDF arXiv

Multimodal Large Language Models (MLLMs) ground language in visual evidence, yet their semantic reasoning can be exploited through transferable black-box adversarial attacks. Existing attacks typically allocate perturbations using surrogate-model saliency, which may not reflect how an unseen MLLM semantically interprets or relies on different image regions. We introduce VISTA (Vulnerability-Informed Semantic Transfer Attacks), a black-box framework that identifies semantically vulnerable visual regions from an MLLM's responses without access to gradients, logits, parameters, or internal representations. VISTA supports two attack settings: (i) VISTA-Proxy, a pure-transfer setting that probes an open-source MLLM and transfers the resulting adversarial examples to unseen commercial MLLMs without querying them; and (ii) VISTA-Victim, a query-assisted setting that probes the target MLLM to capture model-specific semantic vulnerabilities. VISTA builds an Uncertainty-Based Multimodal Behavior (UBMB) map from response drift, conflict, misleading, and semantic shifts, then uses entropy-adaptive Sinkhorn routing and a surrogate ensemble to focus perturbations on vulnerable regions. Across GPT-5, Gemini-3.5-Flash, and Claude Sonnet 4.6, VISTA achieves up to 97 % attack success rate (ASR) while maintaining a Peak Signal-to-Noise Ratio (PSNR) above 30 dB. Notably, VISTA-Proxy achieves up to 93 % ASR without querying the final victim, demonstrating that response-derived semantic vulnerability can enable effective transfer across heterogeneous MLLMs.