Skip to content

Translation in progress Some entries still include text in the original language.

Oct 13 · Tuesday

All papers

Found 28 papers
Filter5

Attack type

Jailbreaks4Prompt injection8Detection evasion5

Attack technique

Gradient and representation optimization28Automated search15Multi-turn escalation5Encoding and obfuscation17Cross-modal payloads51Dormant triggers27

Impact

Harmful content4Unauthorized actions3Output manipulation19

System type

Models and APIs17AI Agent9web agent4Embodied systems and robotics4

Attacker access

Black-box4White-box3

Attack surface / entry point

User input4Web pages and interfaces4Images, audio and video24

Layer

Prompt layer20Application layer8

System component

Memory1RAG4Guardrails and judges3Vision27Audio4Embeddings3Multimodal32
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 213papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationLayer：Prompt layerLayer：Application layerSystem component：MemorySystem component：VisionClear all

Another 213papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09240

    WebMirage hijacks visual web agents' browser operations with adversarial images

    提出 WebMirage，用局部对抗图像劫持视觉网页 Agent 的浏览器操作

    arXiv
    2610.09240
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-13B, LLaVA-v1.6-34B, MiniCPM-o-8B and others6
    Abstract论文提出了针对网络智能体的端到端视觉红队框架 WebMirage，揭示了从视觉定位到浏览器执行的安全脆弱性。

    WebMirage 是一个面向视觉定位网络智能体的流水线感知端到端红队攻击框架。

    Paper analysisRead analysis
  7. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  8. AttacksarXiv 2606.12716

    PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

    提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令

    arXiv
    2606.12716
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
    AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。

    PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

    Paper analysisRead analysis
  9. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  12. AttacksarXiv 2605.07399

    研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型

    提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型

    arXiv
    2605.07399
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    White-box, Black-box
    Evaluated models
    LLaDA-V, LaViDA
    Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。

    GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。

    Paper analysisRead analysis
  13. AttacksarXiv 2604.03117

    Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.

    UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.

    Paper analysisRead analysis
  16. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  18. AttacksarXiv 2602.09431

    Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models

    Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models

    arXiv
    2602.09431
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3 and others10
    AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.

    GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.

    Paper analysisRead analysis
  19. AttacksarXiv 2602.01574

    SGHA-Attack: Semantically Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

    提出 SGHA-Attack，对视觉语言模型做可迁移定向图像扰动

    arXiv
    2602.01574
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    UniDiffuser, BLIP-2, InstructBLIP and others9
    Abstract用多锚点与分层对齐做定向迁移。

    SGHA-Attack 是对视觉语言模型的可迁移定向攻击：只在 CLIP 代理上优化扰动，让黑盒模型按指定文本描述图像。要处理的困难是，单一参考加上只对齐代理末层，会使优化绑在该嵌入空间上，中间层语义用不上，异构 VLM 上的指定描述更容易失败。引言把绕过安全护栏列为动机，测的则是描述是否被导向目标文本。

    Paper analysisRead analysis
Load more