Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 9 papers
Filter5

Attack type

Jailbreaks34Prompt injection10Poisoning and backdoors8Detection evasion9Malicious use3

Attack technique

Gradient and representation optimization4

Impact

Output manipulation9

System type

Models and APIs9coding agent0Browser and computer use0

Attack surface / entry point

Images, audio and video9

Layer

Prompt layer5Training and data layer3

System component

Guardrails and judges11Monitors3Reasoning chains3Vision9Video3Image generation6Multimodal18
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 247papers have no tags yet and are not included in filtered results.
Attack type：Detection evasionSystem type：Models and APIsSystem type：coding agentSystem type：Browser and computer useSystem component：VisionClear all

Another 247papers do not have category tags yet and are not included in filtered results.

  1. Evaluation and benchmarksarXiv 2609.05843

    SinoGlyphBench：中文字形混淆下语言模型审核的诊断基准

    提出 SinoGlyphBench，用配对字形混淆诊断中文审核稳定性

    arXiv
    2609.05843
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    GPT-5.4 mini, GPT-5.5, DeepSeek V4 Flash and others12
    AbstractSinoGlyphBench 显示中文字形混淆会同时增加有害漏报和误报，全文扰动最重。

    SinoGlyphBench是一个配对诊断基准，用来看内容审核在可还原的中文字形混淆下是否还保持原决定。

    Paper analysisRead analysis
  2. DefensesarXiv 2608.12876

    SPARED：用对抗编辑数据训练基于推理的 AI 生成图像检测器

    提出 SPARED，用对抗编辑数据训练基于推理的 AI 生成图像检测器

    arXiv
    2608.12876
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Attacker
    Black-box, White-box
    Evaluated models
    Qwen3.5-9B
    AbstractSPARED 用防捷径的编辑对抗环训练 9B 推理检测器。

    SPARED 是一套用于可解释 AI 生成图像检测的攻防强化学习流程，报告模型是 Qwen3.5-9B 上的第三轮防御器。

    Paper analysisRead analysis
  3. DefensesarXiv 2607.14737

    GeoDetect：面向视觉语言预训练模型的几何对抗检测方法

    提出 GeoDetect 以几何分数检测视觉语言预训练模型的对抗样本

    arXiv
    2607.14737
    Published
    Layer
    Model layer
    Setting
    Models and APIs
    Attacker
    White-box
    Evaluated models
    CLIPViT (ViT-B/16), CLIPCNN (ResNet-50), ALBEF and others4
    AbstractGeoDetect 用几何分数检测 VLP 对抗样本。

    GeoDetect 是面向视觉-语言预训练模型的对抗样本检测方法，用嵌入几何而不是任务 logits 区分干净样本与对抗样本。

    Paper analysisRead analysis
  4. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  5. AttacksarXiv 2604.03117

    Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.

    UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.

    Paper analysisRead analysis
  6. DefensesarXiv 2602.18252

    Adversarial robustness of discrete image tokenizers

    提出无监督对抗微调，加固离散图像 tokenizer

    arXiv
    2602.18252
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    UniTok, UniTok-MLLM, TiTok-BL128 and others7
    Abstract无监督嵌入攻击暴露离散 tokenizer 的弱点，只微调 encoder 即可提升多任务鲁棒准确率。

    作者研究离散图像 tokenizer 的对抗鲁棒性，给出与任务无关的嵌入攻击，以及只微调 encoder 的无监督对抗训练。

    Paper analysisRead analysis
  7. DefensesarXiv 2602.12461

    Semantic-aware adversarial fine-tuning for CLIP

    Propose SAFT, which uses semantic description ensembles to construct adversarial examples and fine-tune the image encoder

    arXiv
    2602.12461
    Published
    Layer
    Training and data layer
    Setting
    Models and APIs
    Evaluated models
    ViT-B/32, CLIP-L/14
    AbstractSAFT fine-tunes the CLIP image encoder with ensemble adversarial examples from refined class descriptions to improve the trade-off between zero-shot accuracy and robustness.

    SAFT is a method for adversarially fine-tuning the CLIP image encoder to improve the accuracy–robustness trade-off in zero-shot classification.

    Paper analysisRead analysis
  8. AttacksarXiv 2602.09431

    Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models

    Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models

    arXiv
    2602.09431
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3 and others10
    AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.

    GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.

    Paper analysisRead analysis
  9. AttacksarXiv 2601.21531

    Adversarial robustness of large vision-language models under visual token compression

    提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离

    arXiv
    2601.21531
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3-8B and others5
    AbstractCAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。

    CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。

    Paper analysisRead analysis
You have reached the end