Skip to content

Translation in progress Some entries still include text in the original language.

Oct 12 · Monday

All papers

Found 20 papers
Filter4

Attack type

Prompt injection6Detection evasion4

Attack technique

Gradient and representation optimization19Cross-modal payloads16Dormant triggers2

Impact

Harmful content4Unauthorized actions3Output manipulation20

System type

Models and APIs15AI Agent3

Attack surface / entry point

Images, audio and video18

Layer

Prompt layer16Application layer3

System component

Memory11RAG8Fine-tuning and open weights7Vision20Audio4Embeddings4Multimodal27
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 233papers have no tags yet and are not included in filtered results.
Attack technique：Gradient and representation optimizationAttack technique：Dormant triggersImpact：Output manipulationSystem component：VisionClear all

Another 233papers do not have category tags yet and are not included in filtered results.

  2. AttacksarXiv 2610.09027

    P-VMI：对抗图像经 KV cache 持续影响多轮对话

    提出持久视觉记忆注入，使对抗图像经缓存在触发时操控输出

    arXiv
    2610.09027
    Published
    Layer
    Infrastructure layer
    Setting
    Models and APIs
    Evaluated models
    Qwen3-8B, Qwen3-VL-8B-Instruct, Gemma-4-12B

    Abstract论文提出 P-VMI，证实对抗输入被掩蔽后仍可经 KV 缓存持久控制模型，强调了保留状态的安全风险。

    Paper analysisRead analysis
  4. AttacksarXiv 2608.10393

    DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型

    提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作

    arXiv
    2608.10393
    Published
    Layer
    Prompt layer
    Setting
    Embodied systems and robotics
    Evaluated models
    OpenVLA-7B, π0-FAST, openvla-7B
    AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。

    DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。

    Paper analysisRead analysis
  5. AttacksarXiv 2606.12716

    PaperGuard：针对多模态 AI 同行评审的攻击与防御基准

    提出 PaperGuard，用图文注入与梯度扰动抬高自动审稿分数并检测恶意指令

    arXiv
    2606.12716
    Published
    Layer
    Application layer
    Setting
    LLM applications
    Evaluated models
    Claude-sonnet-4.5, GPT-4o, GPT-4.1 and others11
    AbstractPaperGuard 测到提示注入与白盒视觉抬分，并比较分块检索防御。

    PaperGuard同时评测并检测多模态 AI 审稿中的评分操纵。

    Paper analysisRead analysis
  6. AttacksarXiv 2605.21541

    研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果

    提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击

    arXiv
    2605.21541
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Black-box
    Evaluated models
    GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
    AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。

    FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。

    Paper analysisRead analysis
  9. AttacksarXiv 2604.03117

    Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models

    Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.

    arXiv
    2604.03117
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
    AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.

    UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.

    Paper analysisRead analysis
  12. AttacksarXiv 2603.16960

    Adversarial attacks against modern vision-language models

    Conduct adversarial attacks on product images for open-source visual shopping agents and induce wrong purchases

    arXiv
    2603.16960
    Published
    Layer
    Application layer
    Setting
    web agent
    Evaluated models
    LLaVA-v1.5-7B, Qwen2.5-VL-7B
    AbstractThe authors state that LLaVA is easily induced by three attacks to buy the wrong item, while Qwen's correct purchase rate remains close to its clean condition.

    The authors compare the robustness of two open-source VLM shopping agents against image adversarial perturbations in a self-built e-commerce environment.

    Paper analysisRead analysis
  14. AttacksarXiv 2602.15927

    研究者提出面向多轮对话的视觉记忆注入攻击 VMI

    提出 VMI，用扰动图像在多轮对话中潜伏并仅在触发话题输出预定消息

    arXiv
    2602.15927
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    Qwen2.5-VL-7B-Instruct, Qwen3-VL-8B-Instruct, LLaVA-OneVision-1.5-8B-Instruct and others5
    AbstractVMI 让扰动图像在多轮 LVLM 中潜伏，作者称触发话题出现后仍可输出预定消息。

    VMI 是面向多轮 LVLM 的定向图像攻击：第三方发布带小扰动的图像，良性用户把它当作普通输入。

    Paper analysisRead analysis
  15. AttacksarXiv 2602.09431

    Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models

    Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models

    arXiv
    2602.09431
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    No-box (offline transfer)
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3 and others10
    AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.

    GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.

    Paper analysisRead analysis
  16. AttacksarXiv 2602.01574

    SGHA-Attack: Semantically Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models

    提出 SGHA-Attack，对视觉语言模型做可迁移定向图像扰动

    arXiv
    2602.01574
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    UniDiffuser, BLIP-2, InstructBLIP and others9
    Abstract用多锚点与分层对齐做定向迁移。

    SGHA-Attack 是对视觉语言模型的可迁移定向攻击：只在 CLIP 代理上优化扰动，让黑盒模型按指定文本描述图像。要处理的困难是，单一参考加上只对齐代理末层，会使优化绑在该嵌入空间上，中间层语义用不上，异构 VLM 上的指定描述更容易失败。引言把绕过安全护栏列为动机，测的则是描述是否被导向目标文本。

    Paper analysisRead analysis
  18. AttacksarXiv 2601.21531

    Adversarial robustness of large vision-language models under visual token compression

    提出 CAGE 攻击，在视觉 token 压缩下用图像扰动使预测偏离

    arXiv
    2601.21531
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Attacker
    Gray-box
    Evaluated models
    LLaVA, Qwen2.5-VL, InternVL3-8B and others5
    AbstractCAGE 对齐压缩瓶颈后，压缩 LVLM 的稳健准确率低于全 token 编码器攻击。

    CAGE 研究的是：LVLM 在推理时剪枝或合并视觉 token 之后，对抗稳健性该怎么估。

    Paper analysisRead analysis
  20. AttacksarXiv 2601.06464

    Adversarial Robustness of 3D Large Vision-Language Models

    提出 Vision 与 Caption 攻击，扰动点云操纵 3D VLM 输出

    arXiv
    2601.06464
    Published
    Layer
    Prompt layer
    Setting
    Models and APIs
    Evaluated models
    PointLLM-7B, GPT4Point-2.7B
    Abstract作者用两类白盒攻击评估 3D VLM，称无目标更易成功、定向更难。

    对 point-based 3D VLM 的白盒对抗鲁棒性评测。 作者关心驾驶、机器人等场景里，小几何扰动能否改写类别或描述，以及定向诱导特定输出是否像 2D 那样容易。方法上，Vision Attack 用余弦相似度推远原视觉 token，或拉向另一点云的特征。

    Paper analysisRead analysis
You have reached the end