Adversarial Attacks on VLMs

VLM: Vision-Language Model

This field studies how image perturbations, embedded text, physical patches, poisoned training data, and multi-turn prompts can make models misread scenes, follow malicious instructions, leak information, or fail in agent tasks. Approaches include gradient-based and transferable attacks, typographic and visual prompt injection, jailbreak red-teaming, and backdoors, evaluated across tasks such as visual question answering, captioning, document understanding, video, and robotics. Defenses range from adversarial training and robust encoders to test-time transformations, token or attention interventions, prompt screening, and response monitoring. A central challenge is improving safety and robustness without sacrificing clean accuracy, utility, or latency, while accounting for uneven transfer across models, modalities, languages, and deployment settings.

Latest papers

183 papers23 papers in the last four weeks, up 77% on the four weeks before. 0.1% of all new papers.

CoDA: Exploring Chain-of-Distribution Attacks and Post-Hoc Token-Space Repair for Medical Vision-Language Models
Mar 19, 2026Xiang Chen, Fangfang Yang, Chunlei Meng +6Medical Image Quality Assessment VLM Robustness
Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift
Mar 18, 2026Zhihua Wei, Qiang Li, Jian Ruan +6VLM Safety Adversarial Attacks on VLMs
School of Computer Science and Technology, Tongji University · Shanghai Artificial Intelligence Laboratory
Adversarial attacks against Modern Vision-Language Models
Mar 17, 2026Alejandro Paredes La TorreAdversarial Attacks on VLMs VLM Robustness
Duke University
Do Not Leave a Gap: Hallucination-Free Object Concealment in Vision-Language Models
Mar 16, 2026Amira Guesmi, Muhammad ShafiqueAdversarial Attacks on VLMs VLM Robustness
Engineering Division, New York University Abu Dhabi, UAE
Directional Embedding Smoothing for Robust Vision Language Models
Mar 16, 2026Ye Wang, Jing Liu, Toshiaki Koike-AkinoVLM Safety VLM Robustness
Mitsubishi Electric Research Laboratories, Cambridge, MA 02139, USA
Safety-Potential Pruning for Enhancing Safety Prompts Against VLM Jailbreaking Without Retraining
Mar 15, 2026Chongxin Li, Hanzhang Wang, Lian DuanVLM Safety VLM Robustness
School of Computer Engineering and Science, Shanghai University
Test-Time Attention Purification for Backdoored Large Vision Language Models
Mar 13, 2026Zhifang Zhang, Bojun Yang, Shuo He +5Backdoor Attacks on VLMs Adversarial Attacks on VLMs
University of Queensland · Southeast University · Nanyang Technological University +1
What Makes VLMs Robust? Towards Reconciling Robustness and Accuracy in Vision-Language Models
Mar 13, 2026Sen Nie, Jie Zhang, Zhongqi Wang +3VLM Robustness Adversarial Robustness
State Key Laboratory of AI Safety, Institute of Computing Technology, Chinese Academy of Sciences, Beijing 100190, China · University of Chinese Academy of Sciences, Beijing 100049, China
VisualLeakBench: Auditing the Fragility of Large Vision-Language Models against PII Leakage and Social Engineering
Mar 11, 2026Youting Wang, Yuan Tang, Yitian Qian +1VLM Robustness Privacy Protection in VLMs
Northeastern University · Carnegie Mellon University · Boston University +1
Comparative Analysis of Patch Attack on VLM-Based Autonomous Driving Architectures
Mar 9, 2026David Fernandez, Pedram MohajerAnsari, Amir Salarpour +3Adversarial Attacks on VLMs VLM Robustness
School of Computing, Clemson University, Clemson, SC, USA
Models as Lego Builders: Assembling Malice from Benign Blocks via Semantic Blueprints
Mar 8, 2026Chenxi Li, Xianggan Liu, Dake Shen +9Adversarial Attacks on VLMs VLM Safety
DAIL Tech · NLP & KG Lab, Huazhong University of Science and Technology
Towards Highly Transferable Vision-Language Attack via Semantic-Augmented Dynamic Contrastive Interaction
Mar 5, 2026Yuanbo Li, Tianyang Xu, Cong Hu +3Adversarial Attacks on VLMs Transfer-Based Adversarial Attacks
School of Artificial Intelligence and Computer Science, Jiangnan University · Centre for Vision, Speech and Signal Processing (CVSSP), University of Surrey
Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions
Mar 4, 2026Neha Nagaraja, Lan Zhang, Zhilong Wang +2Prompt Injection Attacks Adversarial Attacks on VLMs
School of Informatics, Computing, and Cyber Systems, Northern Arizona University, Flagstaff, USA · Bytedance, CA, USA
VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models
Mar 2, 2026Duoxun Tang, Dasen Dai, Jiyao Wang +3Adversarial Attacks on VLMs Adversarial Attacks
Shenzhen International Graduate School, Tsinghua University · The Chinese University of Hong Kong, Hong Kong SAR · McGill University +3
CaptionFool: Universal Image Captioning Model Attacks
Feb 28, 2026Swapnil ParekhAdversarial Attacks on VLMs VLM Robustness
Intuit
Induced Numerical Instability: Hidden Costs in Multimodal Large Language Models
Feb 27, 2026Wai Tuck Wong, Jun Sun, Arunesh SinhaMultimodal Large Language Models Multimodal Robustness
School of Computing and Information Systems, Singapore Management University, Singapore · Management Science and Information Systems Department, Rutgers Business School, New Jersey, USA
VALD: Multi-Stage Vision Attack Detection for Efficient LVLM Defense
Feb 23, 2026Nadav Kadvil, Malak Fares, Ayellet TalVLM Robustness Large Vision-Language Models
Technion – Israel Institute of Technology
PA-Attack: Guiding Gray-Box Attacks on LVLM Vision Encoders with Prototypes and Attention
Feb 23, 2026Hefei Mei, Zirui Wang, Chang Xu +2Attention-Based Adversarial Attacks Adversarial Attacks on VLMs
City University of Hong Kong · The University of Sydney
Pushing the Frontier of Black-Box LVLM Attacks via Fine-Grained Detail Targeting
Feb 19, 2026Xiaohan Zhao, Zhaoyi Li, Yaxin Luo +2Adversarial Attacks on VLMs Black-Box Adversarial Attacks
VILA Lab, Department of Machine Learning, MBZUAI
FERRET: Framework for Expansion Reliant Red Teaming
Feb 17, 2026Ninareh Mehrabi, Vitor Albiero, Maya Pavlova +1Automated Red Teaming Adversarial Scenario Generation
Meta Superintelligence Labs (MSL)
FuzzingRL: Reinforcement Fuzz-Testing for Revealing VLM Failures
Feb 17, 2026Jiajun Xu, Jiageng Mao, Ang Qi +5VLM Robustness Adversarial Attacks on VLMs
University of Southern California · Toyota Research Institute
Multi-Turn Adaptive Prompting Attack on Large Vision-Language Models
Feb 16, 2026In Chong Choi, Jiacheng Zhang, Feng Liu +1Adversarial Attacks on VLMs Large Vision-Language Models
The University of Melbourne · The University of Adelaide
Robustness of Vision Language Models Against Split-Image Harmful Input Attacks
Feb 8, 2026Md Rafi Ur Rashid, MD Sadik Hossain Shanto, Vishnu Asutosh Dasu +1VLM Robustness Adversarial Attacks on VLMs
Pennsylvania State University · Bangladesh University of Engineering and Technology
Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models
Feb 4, 2026Jaehyun Kwak, Nam Cao, Boryeong Cho +3Adversarial Attacks on VLMs Adversarial Attacks
KAIST · KENTECH
ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation
Jan 19, 2026Jesus-German Ortiz-Barajas, Jonathan Tonglet, Vivek Gupta +1Data Visualization Adversarial Attacks on VLMs
INSAIT · KU Leuven · Arizona State University +2
High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models
Dec 26, 2025Mengqi He, Xinyu Tian, Xin Shen +4VLM Robustness Adversarial Attacks on VLMs
The Australia National University Canberra, Australia · The University of Queensland Brisbane, Queensland, Australia · GE research Niskayuna, New York, USA
Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering
Dec 4, 2025Marco Pintore, Maura Pintor, Dimosthenis Karatzas +1Visual Question Answering VLM Robustness
University of Cagliari, Italy · CINI, Italy · Computer Vision Center, UAB, Spain
BackdoorVLM: A Benchmark for Backdoor Attacks and Defenses on Vision-Language Models
Nov 24, 2025Juncheng Li, Yige Li, Hanxun Huang +5VLM Evaluation VLM Robustness
Fudan University · Singapore Management University · The University of Melbourne
FoCLIP: A Feature-Space Misalignment Framework for CLIP-Based Image Manipulation and Detection
Nov 10, 2025Yulin Chen, Zeyuan Wang, Tianyuan Yu +2VLM Robustness Adversarial Attacks on VLMs
Laboratory for Big Data and Decision, National University of Defense Technology, Changsha 410073, China
TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models
Sep 29, 2025Zhifang Zhang, Qiqi Tao, Jiaqi Lv +3VLM Robustness Adversarial Attacks on VLMs
School of Computer Science and Engineering, Southeast University, China · School of Electrical Engineering and Computer Science, University of Queensland, Australia · Information Systems Technology and Design Pillar, Singapore University of Technology and Design, Singapore +2

Mar 19, 2026J/K move · Enter open · S save

CoDA: Exploring Chain-of-Distribution Attacks and Post-Hoc Token-Space Repair for Medical Vision-Language Models

Xiang Chen, Fangfang Yang, Chunlei Meng, Yuxian Dong+5

Medical Image Quality Assessment VLM Robustness Medical VLMs Adversarial Attacks on VLMs Medical Image Analysis VLM Adaptation

Open paper AskPDF arXiv

Medical vision--language models (MVLMs) are increasingly used as perceptual backbones in radiology pipelines and as the visual front end of multimodal assistants, yet their reliability under real clinical workflows remains underexplored. Prior robustness evaluations often assume clean, curated inputs or study isolated corruptions, overlooking routine acquisition, reconstruction, display, and delivery operations that preserve clinical readability while shifting image statistics. To address this gap, we propose CoDA, a chain-of-distribution framework that constructs clinically plausible pipeline shifts by composing acquisition-like shading, reconstruction and display remapping, and delivery and export degradations. Under masked structural-similarity constraints, CoDA jointly optimizes stage compositions and parameters to induce failures while preserving visual plausibility. Across brain MRI, chest X-ray, and abdominal CT, CoDA substantially degrades the zero-shot performance of CLIP-style MVLMs, with chained compositions consistently more damaging than any single stage. We also evaluate multimodal large language models (MLLMs) as technical-authenticity auditors of imaging realism and quality rather than pathology. Proprietary multimodal models show degraded auditing reliability and persistent high-confidence errors on CoDA-shifted samples, while the medical-specific MLLMs we test exhibit clear deficiencies in medical image quality auditing. Finally, we introduce a post-hoc repair strategy based on teacher-guided token-space adaptation with patch-level alignment, which improves accuracy on archived CoDA outputs. Overall, our findings characterize a clinically grounded threat surface for MVLM deployment and show that lightweight alignment improves robustness in deployment.