Architecture Components

Vision Research

Security issues in vision-language models

20 matching entries out of 131 in this category

Vision research results

20 entries

Query-Agnostic Poisoning of Medical Multimodal RAG

Published May 11, 2026Analyzed Jul 20, 2026Source: arXiv

M3Att demonstrates a reproducible knowledge-poisoning issue in medical multimodal RAG: an attacker with limited corpus-distribution knowledge can insert paired image-text entries whose visually perturbed images are broadly retrieved and whose clinically plausible misinformation steers downstream generation. The paper evaluates both white-box and black-box retrieval optimization and reports degraded diagnostic and report-generation utility across multiple datasets, retrievers, and LVLMs. These…

Knowledge Poisoning Attacks on Medical Multi-Modal Retrieval-Augmented Generation

Evaluated models: GPT-4o, GPT-5 Chat, Gemini 2.5 Flash+5 more

GPT-4o
GPT-5 Chat
Gemini 2.5 Flash
Claude Haiku 4.5
LLaVA Med
CLIP ViT-Large-Patch14-336
BGE-VL-base
SigLIP-SO400M-Patch14-384

Physical Infrared Semantic Disruption

Published Apr 3, 2026Analyzed Apr 11, 2026Source: arXiv

A vulnerability in Infrared Vision-Language Models (IR-VLMs) allows attackers to systematically degrade open-ended semantic understanding—compromising classification, captioning, and Visual Question Answering (VQA)—via a physically deployable Universal Curved-Grid Patch (UCGP). Instead of manipulating explicit text labels, the attack disrupts the clean-category manifold in the model's visual representation space by maximizing orthogonal deviation energy from the principal subspace and forcing…

Revealing Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

Evaluated models: InstructBLIP

X-Shaped Sparse VLM Attack

Published Mar 30, 2026Analyzed Apr 11, 2026Source: arXiv

A vulnerability in Vision-Language Models (VLMs) relying on shared visual-textual representation spaces allows attackers to induce transferable cross-task semantic failures using an X-shaped Sparse Pixel Attack (XSPA). Attackers craft imperceptible adversarial perturbations restricted to a fixed geometric prior—two intersecting diagonal lines comprising approximately 1.76% of the image pixels. By jointly optimizing a classification objective with cross-task semantic guidance (target-semantic…

XSPA: Crafting Imperceptible X-Shaped Sparse Adversarial Perturbations for Transferable Attacks on VLMs

Evaluated models: InstructBLIP

VLM E-commerce Attack Surface

Published Mar 17, 2026Analyzed Apr 11, 2026Source: arXiv

LLaVA-v1.5-7B, when deployed as a vision-language autonomous agent, is highly vulnerable to adversarial image perturbations. An attacker can inject imperceptibly modified images into a web environment (such as an e-commerce storefront). When the VLM agent captures a screenshot containing the perturbed image, the visual noise forces the model to misclassify the scene and output incorrect, structured JSON actions. This allows an attacker to hijack the agent's task execution, bypassing the user's…

Adversarial attacks against Modern Vision-Language Models

Evaluated models: Qwen 2.5 VL 7B Instruct, LLaVA 1.5 7B

Discrete Token Subversion

Published Feb 20, 2026Analyzed Mar 9, 2026Source: arXiv

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

On the Adversarial Robustness of Discrete Image Tokenizers

Evaluated models: Llama 2 7B

Semantic Ensembles Fool CLIP

Published Feb 12, 2026Analyzed Mar 9, 2026Source: arXiv

Contrastive Language-Image Pre-training (CLIP) models are vulnerable to semantic-ensemble adversarial attacks. Current adversarial fine-tuning defenses for CLIP rely on minimizing the cosine similarity between an image and a single hand-crafted template (e.g., "A photo of a {label}"). This creates a vulnerability where adversarial examples (AEs) overfit to specific phrasings rather than the core class semantics. Attackers can bypass these defenses by generating semantic-aware adversarial…

Semantic-aware Adversarial Fine-tuning for CLIP

Evaluated models: CLIP ViT-B/32

Synchronized Multimodal Steering

Published Feb 6, 2026Analyzed Mar 9, 2026Source: arXiv

Multimodal Large Language Model-based Recommender Systems (MLLM-RecSys) are vulnerable to Cross-Modal Interactive Data Poisoning. Attackers can manipulate the system by injecting compromised user-generated content (UGC) that contains synchronized, coupled perturbations across both textual and visual modalities. While MLLMs naturally filter out single-modality noise via cross-modal consensus, this vulnerability exploits the consensus mechanism itself. By leveraging cross-modal attention to…

VENOMREC: Cross-Modal Interactive Poisoning for Targeted Promotion in Multimodal LLM Recommender Systems

Evaluated models: Not reported

Progressive Attention LVLM Attack

Published Feb 4, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to a Stage-wise Attention-Guided Attack (SAGA) that allows for the generation of highly transferable, imperceptible adversarial examples. The vulnerability stems from a positive correlation between regional cross-modal attention scores and adversarial loss sensitivity in LVLMs. An attacker can exploit this by extracting an attention map from a surrogate open-source model (e.g., Qwen3-VL) to identify high-attention "hotspots." SAGA utilizes a…

Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models

Evaluated models: Gemini 2.5 Flash, Gemini 3 Pro Preview, GPT-4.1+7 more

Gemini 2.5 Flash
Gemini 3 Pro Preview
GPT-4.1
GPT-5 Mini
Grok 4 Fast
LLaVA 1.5 7B
Llama 4 Maverick
Gemma 3 4B IT
Qwen3-VL 30B-A3B Instruct
Qwen3-VL 235B-A22B Instruct

Semantic Hierarchical VLM Transfer

Published Feb 2, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (VLMs) are vulnerable to a transferable targeted adversarial attack known as SGHA-Attack (Semantic-Guided Hierarchical Alignment). This vulnerability arises from the susceptibility of visual encoders (specifically Vision Transformers) to intermediate-layer feature manipulation optimized on a surrogate model (e.g., CLIP). An attacker can craft adversarial images by injecting imperceptible perturbations that enforce semantic consistency with a target text prompt…

SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

Evaluated models: UniDiffuser, BLIP-2 ViT-g/14, InstructBLIP Vicuna 13B+4 more

UniDiffuser
BLIP-2 ViT-g/14
InstructBLIP Vicuna 13B
MiniGPT-4 Vicuna 13B
LLaVA 1.5 13B
LLaVA NeXT Qwen 1.5 72B Chat
GPT-4o

Universal MLLM Target Matching

Published Jan 30, 2026Analyzed Feb 22, 2026Source: arXiv

Closed-source Multi-modal Large Language Models (MLLMs) are vulnerable to Universal Targeted Transferable Adversarial Attacks (UTTAA). An attacker can generate a single, image-agnostic adversarial perturbation ($\delta$) that, when added to any arbitrary source image, steers the victim model to output a description or classification matching a specific target image chosen by the attacker. This vulnerability exploits the transferability of adversarial features from open-source surrogate vision…

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

Evaluated models: GPT-4o, Claude Sonnet 4.5, GPT-5+2 more

GPT-4o
Claude Sonnet 4.5
GPT-5
GPT-5.2
Claude Opus 4.5

Related research categories