Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers
Filter4

Attack type

Jailbreaks36Prompt injection57Poisoning and backdoors51Extraction and theft9Detection evasion9Malicious use3

Attack technique

Gradient and representation optimization5Cross-modal payloads3

Impact

Output manipulation8

System type

Models and APIs8

Attacker access

White-box3

Attack surface / entry point

Images, audio and video9

Layer

Prompt layer5

System component

MCP and skills4Memory0RAG3Guardrails and judges23Monitors5Reasoning chains4Fine-tuning and open weights3Vision9Video3Image generation7Embeddings1Multimodal19
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 261papers have no tags yet and are not included in filtered results.
Attack type：Detection evasionSystem component：MemorySystem component：VisionSystem component：EmbeddingsClear all

Another 261papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  2. DefensesarXiv 2608.12876

    SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器

    提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器

    arXiv
    2608.12876
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box, White-box
    Evaluated models
    Qwen3.5-9B
    AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。

    SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。

    Paper analysisRead analysis
  3. DefensesarXiv 2607.14737

    GeoDetect：面向视觉语言预训练模型的几何对抗检测方法

    提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本

    arXiv
    2607.14737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
    AbstractGeoDetect 用几何分数检测 VLP 对抗样本。

    GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。

    Paper analysisRead analysis
  4. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  5. AttacksarXiv 2604.03117

    揭示物理世界语义漏洞：面向红外视觉语言模型的通用对抗贴片

    提出通用弯曲网格补丁 UCGP，使红外视觉语言模型产生跨任务语义偏差

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP 用一条共享弯曲网格补丁，同时拉低 IR-VLM 的分类与开放式输出。

    UCGP 是面向红外视觉语言模型的通用物理对抗补丁。问题是：一块可贴上并跨样本复用的物体，能否让分类、描述和 VQA 共用的红外视觉证据出现稳定语义偏差。补丁被限制成低频弯曲网格。

    Paper analysisRead analysis
  6. DefensesarXiv 2602.12461

    Semantic-aware adversarial fine-tuning for CLIP

    提出 SAFT，用语义描述集成构造对抗样本并微调图像编码器

    arXiv
    2602.12461
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ViT-B/32, CLIP-L/14
    AbstractSAFT 用精炼类描述的集成对抗样本微调 CLIP 图像编码器，以改善零样本准确率与鲁棒性的权衡。

    SAFT 是对 CLIP 图像编码器做对抗微调的方法，要改善零样本分类上的准确率–鲁棒性权衡。

    Paper analysisRead analysis
  7. AttacksarXiv 2602.09431

    Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models

    提出 GDA，将图像对抗扰动对齐文本接地证据并迁移攻击视觉语言模型

    arXiv
    2602.09431
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3 and others10
    AbstractGDA 把扰动对准文本接地证据，作者称这提高了异构 LVLM 上的零查询黑盒迁移性。

    GDA 是面向异构 LVLM 的零查询黑盒编码器迁移攻击。。

    Paper analysisRead analysis
  8. AttacksarXiv 2601.21531

    Adversarial robustness of large vision-language models under visual token compression

    提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离

    arXiv
    2601.21531
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3-8B and others5
    AbstractCAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。

    CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。

    Paper analysisRead analysis
  9. AttacksarXiv 2505.23266

    AdvOF：用对抗物体融合攻击 VLM 驱动的视觉语言导航智能体

    提出 AdvOF，生成对抗物体误导视觉语言导航智能体的场景感知

    arXiv
    2505.23266
    Published
    Layer
    Application layer
    Setting
    Embodied systems and robotics
    Attacker
    White-box
    Evaluated models
    Lseg, Clip, ViT-L/16 and others5
    AbstractAdvOF 以多视角融合生成对抗物体。

    AdvOF 是针对 VLM 驱动 VLN 服务导航的对抗物体攻击。

    Paper analysisRead analysis
You have reached the end