AttacksarXiv 2610.09708
研究者提出利用祖先 VLM 的黑盒对抗补丁攻击，可降低 VLA 任务成功率
提出利用祖先 VLM 优化对抗补丁，使已部署 VLA 任务失败
- arXiv
- 2610.09708
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA, UniVLA, π0.5
- TechniqueGradient and representation optimization
- ComponentVision
All papers
Filter4
Attack type
Attack technique
Impact
System type
Attacker access
Attack surface / entry point
Layer
System component
Select any value within a category; different categories must all match. Counts include the other filters you have selected.Another 240papers have no tags yet and are not included in filtered results.
Another 240papers do not have category tags yet and are not included in filtered results.
- AttacksarXiv 2610.08331
STCA：研究者提出针对自动驾驶视频 VLM 的时空一致性对抗攻击
提出 STCA，对驾驶视频 VLM 构造可迁移的时空对抗扰动
- arXiv
- 2610.08331
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- No-box (offline transfer)
- Evaluated models
- Video-LLaVA-7B, Qwen2.5-VL-7B, Dolphins
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVideo
- AttacksarXiv 2610.06814
TAPDreamer：可跨任务迁移的世界动作模型对抗补丁
TAPDreamer 用公开编码器做固定补丁。
- arXiv
- 2610.06814
- Published
- Layer
- Prompt layer
- Evaluated models
- FastWAM, DreamWAM-uncond, DreamWAM-joint and others4
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2610.06083
研究者提出面向深度强化学习的轨迹级可迁移黑盒对抗攻击
提出轨迹级可迁移对抗攻击，降低深度强化学习策略的期望回报
- arXiv
- 2610.06083
- Published
- Layer
- Model layer
- Evaluated models
- DQN, Double DQN (DDQN)
Abstract轨迹级后退视界攻击在 CartPole 上比逐步 FGSM 类和 Sign 噪声更压低回报。
这项工作研究 DRL 上的迁移式黑盒观测攻击：受害参数不可访问时，在白盒代理上造扰动再迁移。
- AttacksarXiv 2610.06977
IAU-FOA：面向闭源多模态大模型的可迁移对抗攻击方法
提出 IAU-FOA，构造可迁移图像扰动以诱导多模态模型输出目标语义
- arXiv
- 2610.06977
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-VL-7B, Qwen2.5-VL-72B, InternVL3-14B and others17
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2610.03166
LiBRA：通过双向隐空间优化实现检测感知的图像水印去除
提出 LiBRA，在潜空间双向优化以规避图像水印双侧检测
- arXiv
- 2610.03166
- Published
- Layer
- Model layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Stable Signature, YU1, HiDDeN and others4
- AttacksDetection evasion
- TechniqueDefense-targeted
AbstractLiBRA 用双向潜空间优化规避双侧水印检测，并提高相对反转基线的保真。
- AttacksarXiv 2609.05525
DIVA：针对离散扩散视觉语言模型的跨步条件传播视觉越狱
提出 DIVA，利用跨步条件传播对离散扩散视觉语言模型实施视觉越狱
- arXiv
- 2609.05525
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- LLaDA-V, MMaDA, LLaDA2.0-Uni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2608.10393
DURA：用扩散模型生成自然对抗补丁攻击 VLA 机器人模型
提出 DURA，用扩散模型生成自然对抗补丁操控 VLA 机器人动作
- arXiv
- 2608.10393
- Published
- Layer
- Prompt layer
- Evaluated models
- OpenVLA-7B, π0-FAST, openvla-7B
- TechniqueCross-modal payloads
- ComponentVision
AbstractDURA 用扩散潜空间轨迹生成自然补丁，白盒与黑盒都能把 VLA 导向指定动作。
DURA 是针对 VLA 的扩散式、补丁内容不受限的机器人攻击，同时支持白盒梯度和只看动作输出的黑盒。
研究者提出最小范数攻击集成，用鲁棒性曲线替代单一 ε 评测
提出最小范数攻击集成，用鲁棒性曲线评测图像分类器
- arXiv
- 2607.19855
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- C1–C20（CIFAR-10，Table 1）, I1–I10（ImageNet，Table 1）
- AttacksDetection evasion
- TechniqueGradient and representation optimization
Abstract预算可控的最小范数集成用 AOI 逼近攻击前沿，DOI 给出不依赖单一ε的防御排序。
这篇工作把对抗鲁棒评测从单一 ε、固定集成，改成可按查询预算收紧的曲线估计。
- AttacksarXiv 2605.21541
研究者提出 FRA-Attack 频域正则化方法，提升对闭源 MLLM 的迁移攻击效果
提出 FRA-Attack，用频域对齐与梯度正则做可迁移定向视觉攻击
- arXiv
- 2605.21541
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Black-box
- Evaluated models
- GPT-5.2, GPT-5.4, Claude-Opus-4.6 and others15
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractFRA-Attack 以频域对齐和梯度低通做可迁移定向攻击，闭源面板上作者称整体更强，Gemma 除外。
FRA-Attack 是面向闭源 MLLM 的迁移式定向图像攻击。作者要解决的是：空间域局部对齐重复全局低频，代理梯度的高频成分又把更新拉向代理自身。
- AttacksarXiv 2605.20519
CodecAttack：在音频编解码器潜空间构造对抗扰动，绕过有损压缩防御
提出 CodecAttack，在编解码器隐空间构造可穿透有损压缩的对抗音频
- arXiv
- 2605.20519
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- White-box
- Evaluated models
- Qwen2-Audio-7B-Instruct, Audio Flamingo 3, Qwen2.5-Omni
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentAudio
- AttacksarXiv 2605.16090
研究者提出 CrossMPI：仅用图像扰动实现跨模态提示注入
提出 CrossMPI，仅用图像扰动实现跨模态提示注入
- arXiv
- 2605.16090
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- MiniGPT4-llama2, MiniGPT4-vicuna, InstructBLIP and others6
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
- AttacksarXiv 2605.07399
研究者提出 GPO-V，用全局概率优化越狱扩散视觉语言模型
提出 GPO-V，用全局概率优化的视觉扰动越狱扩散视觉语言模型
- arXiv
- 2605.07399
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- LLaDA-V, LaViDA
- AttacksJailbreaks
- TechniqueGradient and representation optimization
- ComponentVision
Abstract作者用视觉扰动改 dVLM 的全局生成概率，以绕过两类拒绝。
GPO-V 把越狱从“开头必须顺从”改成“整段去噪概率朝肯定方向走”。。
- AttacksarXiv 2604.14604
The AudioHijack framework achieves covert audio prompt injection against 13 speech large models
提出 AudioHijack，用不可感知对抗音频对语音模型做上下文无关提示注入
- arXiv
- 2604.14604
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- SpeechGPT, GLM-4-Voice, VITA-Audio and others15
- AttacksPrompt injection
- TechniqueGradient and representation optimization
- ComponentAudio
Abstract提出了 AudioHijack 框架，揭示了 LALM 对听觉提示注入的脆弱性与传统防御的局限。
- AttacksarXiv 2604.03117
Unveiling Physical-World Semantic Vulnerabilities: Universal Adversarial Patches for Infrared Vision-Language Models
Proposes the universal curved mesh patch UCGP, causing cross-task semantic bias in infrared vision-language models.
- arXiv
- 2604.03117
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- Gray-box
- Evaluated models
- OpenAI CLIP ViT-L/14, OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractUCGP uses one shared curved-grid patch to simultaneously lower the classification and open-ended outputs of IR-VLM.
UCGP is a universal physical adversarial patch for infrared vision-language models. The question is: can a patch that can be attached and reused across samples cause stable semantic deviations in the infrared visual evidence shared by classification, description, and VQA. The patch is constrained to a low-frequency curved mesh.
- AttacksarXiv 2603.29418
研究者提出针对商用多模态大模型的隐蔽视觉提示注入方法
提出 CoTTA 隐蔽视觉提示注入，使多模态模型输出指定指令
- arXiv
- 2603.29418
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- GPT-4o, GPT-5, Claude-4.5 and others4
- AttacksPrompt injection
- TechniqueCross-modal payloads
- ComponentVision
AbstractCoTTA 以隐蔽触发和双目标对齐诱导指定句子。
- AttacksarXiv 2603.28568
XSPA: Constructing Imperceptible X-Shaped Sparse Adversarial Perturbations for Transferable Attacks Against VLMs
Proposes XSPA, which uses X-shaped sparse adversarial perturbations to transfer attacks on VLMs.
- arXiv
- 2603.28568
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- OpenCLIP ViT-B/16, Meta-CLIP ViT-L/14, EVA-CLIP ViT-G/14 and others10
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2603.04846
Multi-Paradigm Collaborative Adversarial Attack for Multimodal Large Language Models
Proposes MPCAttack, which synergizes multi-paradigm feature optimization for transferable visual adversarial perturbations.
- arXiv
- 2603.04846
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- Qwen2.5-VL-7B, InternVL3-8B, LLaVa-1.5-7B and others8
- TechniqueGradient and representation optimization
- ComponentVision
- AttacksarXiv 2602.09431
Grounding-driven attack: Improving the transferability of encoder-based adversarial attacks to large vision-language models
Propose GDA, which aligns image adversarial perturbations with text-grounded evidence and transfers attacks to vision-language models
- arXiv
- 2602.09431
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Attacker
- No-box (offline transfer)
- Evaluated models
- LLaVA, Qwen2.5-VL, InternVL3 and others10
- AttacksDetection evasion
- TechniqueGradient and representation optimization
- ComponentVision
AbstractGDA aligns perturbations with text-grounded evidence, and the authors say this improves zero-query black-box transferability on heterogeneous LVLMs.
GDA is a zero-query black-box encoder transfer attack for heterogeneous LVLMs.
- AttacksarXiv 2602.01574
SGHA-Attack: Semantically Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models
提出 SGHA-Attack，对视觉语言模型做可迁移定向图像扰动
- arXiv
- 2602.01574
- Published
- Layer
- Prompt layer
- Setting
- Models and APIs
- Evaluated models
- UniDiffuser, BLIP-2, InstructBLIP and others9
- TechniqueGradient and representation optimization
- ComponentVision
Abstract用多锚点与分层对齐做定向迁移。
SGHA-Attack 是对视觉语言模型的可迁移定向攻击：只在 CLIP 代理上优化扰动，让黑盒模型按指定文本描述图像。要处理的困难是，单一参考加上只对齐代理末层，会使优化绑在该嵌入空间上，中间层语义用不上，异构 VLM 上的指定描述更容易失败。引言把绕过安全护栏列为动机，测的则是描述是否被导向目标文本。