Attack Surface

Model layer Research

Security research involving core model architecture and parameters

31 matching entries out of 468 in this category

Model layer research results

31 entries

VLM Visual-Textual Misalignment

Published Apr 1, 2026Analyzed Apr 11, 2026Source: arXiv

Vision-Language Models (VLMs) are vulnerable to pixel-level adversarial image perturbations. An attacker can inject $\ell_p$-bounded, human-imperceptible noise into an input image to manipulate the model's multi-modal embedding space. This reliably causes the VLM to generate incorrect textual responses, hallucinate non-existent objects, or misclassify subjects, effectively decoupling the model's reasoning from the actual visual evidence. The vulnerability is exploitable via both white-box…

PDA: Text-Augmented Defense Framework for Robust Vision-Language Models against Adversarial Image Attacks

Evaluated models: LLaVA 1.5 7B, LLaVA 1.5 13B, DeepSeek VL 1.3B+2 more

LLaVA 1.5 7B
LLaVA 1.5 13B
DeepSeek VL 1.3B
InternVL3 2B
Ovis2 4B

X-Shaped Sparse VLM Attack

Published Mar 30, 2026Analyzed Apr 11, 2026Source: arXiv

A vulnerability in Vision-Language Models (VLMs) relying on shared visual-textual representation spaces allows attackers to induce transferable cross-task semantic failures using an X-shaped Sparse Pixel Attack (XSPA). Attackers craft imperceptible adversarial perturbations restricted to a fixed geometric prior—two intersecting diagonal lines comprising approximately 1.76% of the image pixels. By jointly optimizing a classification objective with cross-task semantic guidance (target-semantic…

XSPA: Crafting Imperceptible X-Shaped Sparse Adversarial Perturbations for Transferable Attacks on VLMs

Evaluated models: InstructBLIP

VLM Image-Shift Jailbreak

Published Mar 18, 2026Analyzed Apr 10, 2026Source: arXiv

The integration of the visual modality in Large Vision-Language Models (VLMs) introduces a vulnerability where appending an image to a harmful text prompt induces a "jailbreak-related representation shift" in the model's internal high-dimensional space. This shift forcibly steers the model's last-token hidden state away from a designated refusal state and into a distinct jailbreak state. The vulnerability occurs because the visual modality overrides the safety alignment of the underlying…

Understanding and Defending VLM Jailbreaks via Jailbreak-Related Representation Shift

Evaluated models: LLaVA 1.5 7B, ShareGPT4V 7B, InternVL-Chat 19B

VLM E-commerce Attack Surface

Published Mar 17, 2026Analyzed Apr 11, 2026Source: arXiv

LLaVA-v1.5-7B, when deployed as a vision-language autonomous agent, is highly vulnerable to adversarial image perturbations. An attacker can inject imperceptibly modified images into a web environment (such as an e-commerce storefront). When the VLM agent captures a screenshot containing the perturbed image, the visual noise forces the model to misclassify the scene and output incorrect, structured JSON actions. This allows an attacker to hijack the agent's task execution, bypassing the user's…

Adversarial attacks against Modern Vision-Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, LLaVA 1.5 7B

MLLM Multi-Paradigm Collaborative

Published Mar 5, 2026Analyzed Mar 9, 2026Source: arXiv

Multi-Modal Large Language Models (MLLMs) are vulnerable to a highly transferable, black-box adversarial image attack known as the Multi-Paradigm Collaborative Attack (MPCAttack). Attackers can craft imperceptible visual perturbations by jointly aggregating and optimizing semantic feature representations extracted from surrogate models across three distinct learning paradigms: cross-modal alignment (e.g., CLIP), multi-modal understanding (e.g., InternVL3), and visual self-supervised learning…

Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, InternVL3 8B, LLaVA 1.5 7B+3 more

Qwen 2.5 VL 7B Instruct
InternVL3 8B
LLaVA 1.5 7B
GLM-4.1V 9B Thinking
GPT-4o
GPT-5

Video-LLM Token Flood

Published Mar 2, 2026Analyzed Mar 9, 2026Source: arXiv

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models

Evaluated models: LLaVA-NeXT-Video 7B, Qwen3-VL 4B Instruct, Video-LLaVA 7B

Discrete Token Subversion

Published Feb 20, 2026Analyzed Mar 9, 2026Source: arXiv

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

On the Adversarial Robustness of Discrete Image Tokenizers

Evaluated models: Llama 2 7B

Visual Memory Multi-Turn Manipulation

Published Feb 17, 2026Analyzed Mar 8, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Visual Memory Injection (VMI), a stealthy targeted attack targeting multi-turn conversations. An attacker can embed an imperceptible adversarial perturbation ($L_\infty \le 8/255$) into a seemingly benign image. Because the visual input persists in the model's context throughout a multi-turn dialogue, the injected payload remains dormant. By utilizing "benign anchoring" and "context-cycling" during optimization, the attacker ensures the…

Visual Memory Injection Attacks for Multi-Turn Conversations

Evaluated models: Qwen 2.5 VL 7B Instruct, Qwen3-VL 8B Instruct, LLaVA-OneVision 1.5 8B Instruct+2 more

Qwen 2.5 VL 7B Instruct
Qwen3-VL 8B Instruct
LLaVA-OneVision 1.5 8B Instruct
Qwen-SEA-LION v4 8B VL
QoQ-Med3-VL 8B

Reward Hacking Via Adversarial Imitation

Published Feb 12, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in the post-training alignment of Flow Matching models (specifically FLUX.1-dev) when utilizing Visual Foundation Models (VFM) (e.g., DINOv3b) as discriminators or when employing standalone Reward Gradient optimization (e.g., HPSv3). These feedback mechanisms lack sufficient capacity or structural guidance to constrain the generative policy, making the discriminator's gradients susceptible to "reward hacking." Consequently, the generative policy over-optimizes for the…

FAIL: Flow Matching Adversarial Imitation Learning for Image Generation

Evaluated models: Not reported

Semantic Ensembles Fool CLIP

Published Feb 12, 2026Analyzed Mar 9, 2026Source: arXiv

Contrastive Language-Image Pre-training (CLIP) models are vulnerable to semantic-ensemble adversarial attacks. Current adversarial fine-tuning defenses for CLIP rely on minimizing the cosine similarity between an image and a single hand-crafted template (e.g., "A photo of a {label}"). This creates a vulnerability where adversarial examples (AEs) overfit to specific phrasings rather than the core class semantics. Attackers can bypass these defenses by generating semantic-aware adversarial…

Semantic-aware Adversarial Fine-tuning for CLIP

Evaluated models: CLIP ViT-B/32

Related research categories