Impact

Integrity Research

Security research involving model-output integrity and reliability

10 matching entries out of 539 in this category

Integrity research results

10 entries

Mobile Agent Visual Spoofing

Published Feb 11, 2026Analyzed Feb 22, 2026Source: arXiv

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Semantic Hierarchical VLM Transfer

Published Feb 2, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Evaluated models: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B+4 more

UniDiffuser
BLIP-2 ViT-g/14
InstructBLIP Vicuna 13B
MiniGPT-4 Vicuna 13B
LLaVA 1.5 13B
LLaVA NeXT Qwen 1.5 72B Chat
GPT-4o

VLM Text Overrides Image

Published Jan 27, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMs

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, InternVL3 1B+8 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
InternVL3 1B
InternVL3 2B
InternVL3 8B
LLaVA-OneVision 0.5B
LLaVA-OneVision 7B
Gemini 2.5 Flash
Gemini 2.5 Pro
GPT-4o Mini
GPT-4o

Sound Induces Trimodal Collapse

Published Jan 20, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in trimodal audio-video-language models where an attacker can systematically degrade multimodal reasoning through untargeted, audio-only adversarial perturbations. By optimizing a shared perturbation $\delta$ applied to the audio channel, an attacker can manipulate internal representations—specifically targeting audio encoder embeddings and cross-modal attention mechanisms—without modifying visual or textual inputs. The attack exploits the model's reliance on the audio…

SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models

Evaluated models: VideoLLAMA2, Qwen 2 7B Instruct, Whisper Large-v2+1 more

VideoLLAMA2
Qwen 2 7B Instruct
Whisper Large-v2
PANNs

MLLM Chart Deception

Published Jan 19, 2026Analyzed Feb 21, 2026Source: arXiv

Code-generation Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) are vulnerable to directed misuse for the generation of misleading data visualizations. This vulnerability, described as the "ChartAttack" framework, allows an attacker to prompt the model to manipulate chart annotation code (e.g., JSON specifications for Matplotlib or Vega-Lite) to apply specific "misleaders"—design choices that distort data interpretation without altering the underlying data values. By…

ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation

Evaluated models: Qwen 2.5 14B, LLaVA 7B, Phi-3

Point Cloud Adversarial Attack

Published Jan 10, 2026Analyzed Feb 22, 2026Source: arXiv

Point-based 3D Vision-Language Models (VLMs), specifically PointLLM and GPT4Point, are vulnerable to white-box, gradient-based adversarial attacks. The vulnerability exists in the model's processing of 3D point cloud data, where an attacker can optimize imperceptible geometric perturbations ($\delta$) on the input point cloud ($x$) to manipulate the model's textual output. The paper identifies two specific attack vectors: 1. Vision Attack: Directly perturbs the high-dimensional visual token…

On the Adversarial Robustness of 3D Large Vision-Language Models

Evaluated models: Vicuna 7B

JailFlip Implicit Harm

Published Jun 9, 2025Analyzed Dec 8, 2025Source: arXiv

A vulnerability exists in the safety alignment mechanisms of Large Language Models (LLMs) (including GPT-4, Claude 3, Gemini, and Qwen families) leading to "Implicit Harm." Unlike traditional jailbreaks that use overtly harmful queries, this vulnerability allows remote attackers to coerce the model into providing factually incorrect, plausible, and dangerous responses to benign-looking inputs. By employing "JailFlip" techniques—specifically constructed affirmative-type or denial-type queries…

Beyond Jailbreaks: Revealing Stealthier and Broader LLM Security Risks Stemming from Alignment Failures

Evaluated models: GPT-4.1, GPT-4.1 Mini, GPT-4o+3 more

GPT-4.1
GPT-4.1 Mini
GPT-4o
GPT-4o Mini
Qwen Plus
Qwen Turbo

Phantom Token User Deception

Published May 30, 2025Analyzed Jan 14, 2026Source: arXiv

Large Language Models (LLMs) that utilize byte-stream parsing or structural extraction to process PDF files—specifically the OpenAI GPT and Anthropic Claude families—are vulnerable to adversarial text injection via imperceptible "phantom tokens." This vulnerability exploits the disconnect between how PDF viewers render documents for humans (visual layer) and how LLMs extract text from the PDF operator stream (data layer). Attackers can manipulate standard PDF text-showing operators (TJ and Tj)…

TRAPDOC: Deceiving LLM Users by Injecting Imperceptible Phantom Tokens into Documents

Evaluated models: GPT-4, o4-mini

Universal VLLM Visual Bypass

Published May 2, 2025Analyzed Dec 9, 2025Source: arXiv

A vulnerability exists in Vision-Language Models (VLLMs) that allows for transferable, targeted adversarial attacks. Attackers can generate adversarial image perturbations using an ensemble of open-source surrogate models (primarily CLIP-based visual encoders) which effectively transfer to proprietary, black-box VLLMs. The attack leverages a specific optimization framework that combines a Visual Contrastive Loss with multiple positive/negative visual examples, rather than relying solely on…

Transferable Adversarial Attacks on Black-Box Vision-Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 72B Instruct, Llama 3.2 11B Vision Instruct+6 more

Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 72B Instruct
Llama 3.2 11B Vision Instruct
Llama 3.2 90B Vision Instruct
GPT-4o
GPT-4o Mini
Claude 3.5 Sonnet
Claude 3.7 Sonnet
Gemini 1.5 Pro

LLM Robot Bias & Violence

Published Jun 13, 2024Analyzed Apr 12, 2025Source: arXiv

Large Language Models (LLMs) used to control robots exhibit biases leading to discriminatory and unsafe behaviors. When provided with personal characteristics (e.g., race, gender, disability), LLMs generate biased outputs resulting in discriminatory actions (e.g., assigning lower rescue priority to certain groups) and accept or deem feasible dangerous or unlawful instructions (e.g., removing a person's mobility aid).

Llm-driven robots risk enacting discrimination, violence, and unlawful actions

Evaluated models: GPT-3.5, GPT-3.5 Turbo, GPT-4+1 more

GPT-3.5
GPT-3.5 Turbo
GPT-4
Mistral 7B

Related research categories