Adversarial Attacks on VLMs

This field studies how image perturbations, embedded text, physical patches, poisoned training data, and multi-turn prompts can make models misread scenes, follow malicious instructions, leak information, or fail in agent tasks. Approaches include gradient-based and transferable attacks, typographic and visual prompt injection, jailbreak red-teaming, and backdoors, evaluated across tasks such as visual question answering, captioning, document understanding, video, and robotics. Defenses range from adversarial training and robust encoders to test-time transformations, token or attention interventions, prompt screening, and response monitoring. A central challenge is improving safety and robustness without sacrificing clean accuracy, utility, or latency, while accounting for uneven transfer across models, modalities, languages, and deployment settings.