Architecture Components

Multimodal Research

Security research involving multimodal AI systems

36 matching entries out of 176 in this category

Multimodal research results

36 entries

Visual prompt injection crosses document trust boundaries

Published Sep 3, 2026Analyzed Sep 9, 2026Source: arXiv

Untrusted document images can redirect vision-language agents across instruction and tool-authorization boundaries. Repeat-After-Me evaluates six victim models on constructed document tasks.

Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection

Evaluated models: claude-opus-4-7, GPT-5.5, Gemini 3.1 Pro+3 more

claude-opus-4-7
GPT-5.5
Gemini 3.1 Pro
Qwen3.6-27B
Qwen3-VL 32B Instruct
InternVL3.5 38B Instruct

Diverse VLA Linguistic Fragility

Published Apr 7, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models suffer from a severe linguistic fragility vulnerability where semantically equivalent but structurally complex adversarial instructions cause catastrophic failures in visual grounding and geometric reasoning. Attackers can reliably induce physical execution failures in robotic manipulation tasks by applying semantic-preserving linguistic variations, such as synonymous rephrasing, syntactic restructuring, or the addition of fine-grained compositional…

Uncovering Linguistic Fragility in Vision-Language-Action Models via Diversity-Aware Red Teaming

Evaluated models: Pi-Zero, OpenVLA 7B, 3D-Diffuser Actor

Observation Poisons Agent Memory

Published Apr 3, 2026Analyzed Apr 10, 2026Source: arXiv

Memory-augmented LLM web agents utilizing raw trajectory memory are vulnerable to Environment-injected Trajectory-based Agent Memory Poisoning (eTAMP). Attackers can embed malicious instructions within user-generated web content (e.g., product pages, forum posts). When the agent processes this content during a routine task, the instructions are passively ingested into its raw trajectory memory. During subsequent, entirely separate tasks on different websites, semantic retrieval mechanisms pull…

Poison Once, Exploit Forever: Environment-Injected Memory Poisoning Attacks on Web Agents

Evaluated models: GPT-5 Mini, GPT-5.2, GPT-oss 120B+3 more

GPT-5 Mini
GPT-5.2
GPT-oss 120B
Qwen 2.5 VL 72B
Qwen3-VL-32B
Qwen3.5-122B-A10B

Agentic Robot Instruction Attack

Published Mar 26, 2026Analyzed Apr 10, 2026Source: arXiv

Vision-Language-Action (VLA) models are vulnerable to targeted, low-budget textual perturbations in their natural-language instruction inputs, which can maliciously alter sequential decision-making and downstream physical robotic behavior. Because VLA policies tightly couple language, perception, and control, bounded edits—such as character-level typos, token attribute swaps, or prompt-level uncertainty clauses—propagate through the model's execution trajectory. This allows a black-box…

SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models

Evaluated models: Not reported

VLM E-commerce Attack Surface

Published Mar 17, 2026Analyzed Apr 11, 2026Source: arXiv

LLaVA-v1.5-7B, when deployed as a vision-language autonomous agent, is highly vulnerable to adversarial image perturbations. An attacker can inject imperceptibly modified images into a web environment (such as an e-commerce storefront). When the VLM agent captures a screenshot containing the perturbed image, the visual noise forces the model to misclassify the scene and output incorrect, structured JSON actions. This allows an attacker to hijack the agent's task execution, bypassing the user's…

Adversarial attacks against Modern Vision-Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, LLaVA 1.5 7B

Visual Confused Deputy Attack

Published Mar 16, 2026Analyzed Apr 11, 2026Source: arXiv

A "Visual Confused Deputy" vulnerability exists in Computer-Using Agents (CUAs) that rely on visual perception to execute coordinate-based GUI actions (e.g., click(x,y)). Because the agent's understanding of the system state is entirely dependent on the screenshot provided by the runtime, a compromised runtime or tool can intercept and alter the screenshot pixels before forwarding them to the LLM. By visually swapping the locations of benign and privileged UI elements, an attacker can trick…

Visual Confused Deputy: Exploiting and Defending Perception Failures in Computer-Using Agents

Evaluated models: Claude 3.7 Sonnet

Video-LLM Token Flood

Published Mar 2, 2026Analyzed Mar 9, 2026Source: arXiv

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

VidDoS: Universal Denial-of-Service Attack on Video-based Large Language Models

Evaluated models: LLaVA-NeXT-Video 7B, Qwen3-VL 4B Instruct, Video-LLaVA 7B

Mobile Agent Visual Spoofing

Published Feb 11, 2026Analyzed Feb 22, 2026Source: arXiv

Mobile Large Language Model (LLM) agents operating under the "Screen-as-Interface" paradigm are vulnerable to visual indirect prompt injection and state desynchronization. Agents that rely on unstructured visual data (screenshots) and Accessibility Service APIs to perceive the environment lack a mechanism to distinguish between trusted system UI elements and untrusted content (e.g., web pages, emails, or malicious overlays). An attacker can inject visual cues, fake notifications, or hidden…

Blind Gods and Broken Screens: Architecting a Secure, Intent-Centric Mobile Agent Operating System

Evaluated models: Not reported

Visual Exclusivity Agentic Jailbreak

Published Feb 5, 2026Analyzed Apr 10, 2026Source: arXiv

Frontier Multimodal Large Language Models (MLLMs) are vulnerable to Visual Exclusivity (VE) attacks, an "Image-as-Basis" threat where malicious intent is achieved through joint reasoning over benign text and complex technical visual content (e.g., blueprints, schematics, network diagrams). Unlike wrapper-based attacks that conceal malicious text via typography or adversarial noise, VE exploits the model's core visual reasoning capabilities. Attackers can bypass safety filters by combining…

Visual Exclusivity Attacks: Automatic Multimodal Red Teaming via Agentic Planning

Evaluated models: Llama 3.2 11B Vision, InternVL3 8B, Qwen3-VL 8B+5 more

Llama 3.2 11B Vision
InternVL3 8B
Qwen3-VL 8B
GPT-4o
GPT-5
Claude 3.7 Sonnet
Claude Sonnet 4.5
Gemini 2.5 Pro

Visual Compression Mismatch Attack

Published Jan 29, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).

On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression

Evaluated models: LLaVA 1.5 7B

Related research categories