Architecture Components

Vision Research

Security issues in vision-language models

131 matching entries

Vision research results

131 entries

Visual Compression Mismatch Attack

Published Jan 29, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in Large Vision-Language Models (LVLMs) utilizing visual token compression mechanisms (e.g., VisionZip, VisPruner) to reduce inference latency. The vulnerability stems from an optimization-inference mismatch where standard adversarial defenses assume full-token processing, while the deployed model utilizes a subset of tokens selected via importance metrics (typically attention scores).

On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression

Evaluated models: LLaVA 1.5 7B

VLM Text Overrides Image

Published Jan 27, 2026Analyzed Feb 21, 2026Source: arXiv

A vulnerability exists in multiple state-of-the-art Vision-Language Models (VLMs), including GPT-4o, Gemini-2.5, and LLaVA-OneVision, where persuasive textual misinformation successfully overrides visual evidence. When a model is presented with an image it can correctly interpret, an attacker can inject a contradictory text prompt employing specific rhetorical strategies (Logical, Credibility, Emotional, or Repetition) to force the model into generating a false response. This "obedience bias"…

Do Images Speak Louder than Words? Investigating the Effect of Textual Misinformation in VLMs

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, InternVL3 1B+8 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
InternVL3 1B
InternVL3 2B
InternVL3 8B
LLaVA-OneVision 0.5B
LLaVA-OneVision 7B
Gemini 2.5 Flash
Gemini 2.5 Pro
GPT-4o Mini
GPT-4o

Visual Object Injection

Published Jan 24, 2026Analyzed Feb 22, 2026Source: arXiv

Large Vision-Language Models (LVLMs) are vulnerable to Physical Prompt Injection Attacks (PPIA), a query-agnostic injection technique delivered via the visual modality. The vulnerability stems from the model's "Vision-Enabled Text Recognition" capabilities and "Identity Sensitivity," where the model interprets text embedded in the physical environment (e.g., printed on signs, posters, or objects) as high-priority instructions rather than passive visual data. An attacker can embed adversarial…

Physical Prompt Injection Attacks on Large Vision-Language Models

Evaluated models: GPT-4o, GPT-4o Mini, GPT-4 Turbo+7 more

GPT-4o
GPT-4o Mini
GPT-4 Turbo
Gemini 1.5 Pro Latest
Gemini 1.5 Pro 002
Gemini 1.5 Flash Latest
Claude 3.5 Sonnet Latest
Claude 3.5 Haiku 20241022
Llama 3.2 11B Vision
Llama 3.2 90B Vision Instruct

VLM Moral Persuasion

Published Jan 23, 2026Analyzed Feb 21, 2026Source: arXiv

Vision-Language Models (VLMs) exhibit a vulnerability to moral judgment flipping, where the model's safety alignment can be bypassed through lightweight, model-agnostic multimodal perturbations. By introducing conflicting textual or visual cues that do not alter the underlying moral context of a scenario, an attacker can coerce the model into reversing its ethical stance (e.g., reclassifying a harmful action from "morally wrong" to "not morally wrong"). This vulnerability exploits the model's…

Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Models

Evaluated models: Qwen 2.5 VL 3B Instruct, Qwen 2.5 VL 7B Instruct, Qwen 2.5 VL 32B Instruct+20 more

Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 7B Instruct
Qwen 2.5 VL 32B Instruct
Qwen3-VL 2B Instruct
Qwen3-VL 4B Instruct
Qwen3-VL 8B Instruct
Qwen3-VL 30B-A3B Instruct
InternVL3 2B Instruct
InternVL3 8B Instruct
InternVL3 14B Instruct
InternVL3 38B Instruct
InternVL3.5 4B Instruct
InternVL3.5 8B Instruct
InternVL3.5 14B Instruct
InternVL3.5 38B Instruct
LLaVA 1.5 7B
LLaVA 1.5 13B
LLaVA v1.6 Vicuna 7B
LLaVA v1.6 Vicuna 13B
LLaVA v1.6 34B
Gemma 3 4B IT
Gemma 3 12B IT
Gemma 3 27B IT

Semantic-Agnostic Multimodal Image Jailbreak

Published Jan 22, 2026Analyzed Jul 20, 2026Source: arXiv

The paper describes a specific black-box jailbreak evaluation, BVS, in which fragmented visual content is mixed with neutral imagery and paired with reconstruction-oriented text so harmful intent is only recomposed during multimodal reasoning. The authors report that this can bypass input and output safety assumptions in image-generating MLLMs. A safe defensive reproduction should use synthetic, non-harmful stand-ins for prohibited concepts, test whether fragmented cross-modal inputs are…

Beyond Visual Safety: Jailbreaking Multimodal Large Language Models for Harmful Image Generation via Semantic-Agnostic Inputs

Evaluated models: GPT-5, Gemini 1.5 Flash

MLLM Over-Reasoning Safety Risk

Published Jan 20, 2026Analyzed Feb 21, 2026Source: arXiv

Multimodal Large Language Models (MLLMs) exhibit a vulnerability to "Reasoning-based Multi-Image Attacks," where safety guardrails are bypassed by distributing harmful intent across multiple images (2–4 inputs). Unlike single-image jailbreaks that rely on visual obfuscation, this vulnerability exploits the model's reasoning capabilities. By presenting images that share a specific relationship (e.g., Temporal Jump, Spatial Juxtaposition, or Causality), an attacker can compel the model to infer…

The Side Effects of Being Smart: Safety Risks in MLLMs' Multi-Image Reasoning

Evaluated models: GPT-4o, GPT-4o Mini, Gemini 1.5 Pro+11 more

GPT-4o
GPT-4o Mini
Gemini 1.5 Pro
Gemini 1.5 Flash
Qwen 2.5 VL 3B Instruct
Qwen 2.5 VL 32B Instruct
LLaVA 1.5 7B
Llama 3 LLaVA-NeXT 8B
InternVL3 8B
InternVL3 38B
InternVL3 78B
MiniCPM-o 2.6
Skywork-R1V3 38B
GLM-4.1V 9B Thinking

Sound Induces Trimodal Collapse

Published Jan 20, 2026Analyzed Feb 22, 2026Source: arXiv

A vulnerability exists in trimodal audio-video-language models where an attacker can systematically degrade multimodal reasoning through untargeted, audio-only adversarial perturbations. By optimizing a shared perturbation $\delta$ applied to the audio channel, an attacker can manipulate internal representations—specifically targeting audio encoder embeddings and cross-modal attention mechanisms—without modifying visual or textual inputs. The attack exploits the model's reliance on the audio…

SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Models

Evaluated models: VideoLLAMA2, Qwen 2 7B Instruct, Whisper Large-v2+1 more

VideoLLAMA2
Qwen 2 7B Instruct
Whisper Large-v2
PANNs

MLLM Chart Deception

Published Jan 19, 2026Analyzed Feb 21, 2026Source: arXiv

Code-generation Large Language Models (LLMs) and Multimodal Large Language Models (MLLMs) are vulnerable to directed misuse for the generation of misleading data visualizations. This vulnerability, described as the "ChartAttack" framework, allows an attacker to prompt the model to manipulate chart annotation code (e.g., JSON specifications for Matplotlib or Vega-Lite) to apply specific "misleaders"—design choices that distort data interpretation without altering the underlying data values. By…

ChartAttack: Testing the Vulnerability of LLMs to Malicious Prompting in Chart Generation

Evaluated models: Qwen 2.5 14B, LLaVA 7B, Phi-3

VLM In-the-Loop Adversary

Published Jan 19, 2026Analyzed Mar 9, 2026Source: arXiv

The VILTA (VLM-in-the-Loop Trajectory Adversary) framework is vulnerable to Prompt Injection and Data Poisoning via un-sanitized scene representation inputs. The system integrates a Vision-Language Model (Gemini-2.5-Flash) into a closed-loop reinforcement learning environment, feeding it Bird’s-Eye-View (BEV) imagery alongside text-based vehicle dynamics data (e.g., position, speed, and risk_category) to generate challenging driving trajectories. An attacker who can manipulate the input…

VILTA: A VLM-in-the-Loop Adversary for Enhancing Driving Policy Robustness

Evaluated models: Gemini 2.5 Flash

Macaronic T2I Jailbreak

Published Jan 12, 2026Analyzed Mar 8, 2026Source: arXiv

Text-to-Image (T2I) models and their associated safety filters are vulnerable to MacPrompt, a black-box jailbreak technique that exploits cross-lingual embedding alignments. Attackers can bypass input text filters, latent representation filters, and model-level concept removal defenses by replacing sensitive keywords with "macaronic" substitutes. These substitutes are constructed by extracting and recombining character-level substrings from translations of the target word across multiple…

MacPrompt: Maraconic-guided Jailbreak against Text-to-Image Models

Evaluated models: DALL-E, Stable Diffusion

Related research categories