Data to 7 Oct 2026

Towards Adversarial Attack on Vision-Language Pre-training Models

arXiv 2206.09391 ↗First posted 19 Jun 2022cs.LG cs.CL cs.CVcited by 142

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

While vision-language pre-training model (VLP) has shown revolutionary improvements on various vision-language (V+L) tasks, the studies regarding its adversarial robustness remain largely unexplored. This paper studied the adversarial attack on popular VLP models and V+L tasks. First, we analyzed the performance of adversarial attacks under different settings. By examining the influence of different perturbed objects and attack targets, we concluded some key observations as guidance on both designing strong multimodal adversarial attack and constructing robust VLP models. Second, we proposed a novel multimodal attack method on the VLP models called Collaborative Multimodal Adversarial Attack (Co-Attack), which collectively carries out the attacks on the image modality and the text modality. Experimental results demonstrated that the proposed method achieves improved attack performances on different V+L downstream tasks and VLP models. The analysis observations and novel attack method hopefully provide new understanding into the adversarial robustness of VLP models, so as to contribute their safe and reliable deployment in more real-world scenarios. Code is available at https://github.com/adversarial-for-goodness/Co-Attack.

Key facts. Cited by 142 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 27 of its 32 references that are in the map. First posted on arXiv 19 Jun 2022.

Builds on

27 of 32 references.

References · 27

2015Deep Residual Learning for Image Recognitioncited by 51,809
2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
2014Microsoft COCO: Common Objects in Contextcited by 17,498
2015Faster R-CNN: Towards Real-Time Object Detection with Region Proposal Networkscited by 9,617
2014Explaining and Harnessing Adversarial Examplescited by 7,287
2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,690
2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
2013Intriguing properties of neural networkscited by 5,114
2021Align before Fuse: Vision and Language Representation Learning with Momentum Distillationcited by 1,612
2019LXMERT: Learning Cross-Modality Encoder Representations from Transformerscited by 1,548
2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510

15 more

2015Flickr30k Entities: Collecting Region-to-Phrase Correspondences for Richer Image-to-Sentence Modelscited by 1,352
2020Oscar: Object-Semantics Aligned Pre-training for Vision-Language Taskscited by 1,213
2016Modeling Context in Referring Expressionscited by 1,054
2020BERT-ATTACK: Adversarial Attack Against BERT Using BERTcited by 488
2018MAttNet: Modular Attention Network for Referring Expression Comprehensioncited by 427
2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
2017Don't Just Assume; Look and Answer: Overcoming Priors for Visual Question Answeringcited by 337
2019Visual Entailment: A Novel Task for Fine-Grained Image Understandingcited by 250
2022Vision-Language Pre-Training with Triple Contrastive Learningcited by 212
2021Towards Robust Vision Transformercited by 137
2019Cycle-Consistency for Robust Visual Question Answeringcited by 105
2021On the Adversarial Robustness of Vision Transformerscited by 104
2021Exploiting BERT For Multimodal Target Sentiment Classification Through Input Space Translationcited by 41
2021Understanding Chinese Video and Language via Contrastive Multimodal Pre-Trainingcited by 23
2021Dense Contrastive Visual-Linguistic Pretrainingcited by 5

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2023: 17; 2024: 49; 2025: 46; 2026: 30.

142 papers.

Sort:

By area:

2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fastcited by 149
2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Modelscited by 106
2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
2024JailbreakZoo: Survey, Landscapes, and Horizons in Jailbreaking Large Language and Vision-Language Modelscited by 67
2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
2024Pre-trained Model Guided Fine-Tuning for Zero-Shot Adversarial Robustnesscited by 48
2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Modelscited by 43
2023Adversarial Prompt Tuning for Vision-Language Modelscited by 42
2024An Image Is Worth 1000 Lies: Adversarial Transferability across Prompts on Vision-Language Modelscited by 40
2023SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentationcited by 39

38 more

2024Few-Shot Adversarial Prompt Learning on Vision-Language Modelscited by 39
2024One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Modelscited by 39
2024Arondight: Red Teaming Large Vision Language Models with Auto-generated Multi-modal Jailbreak Promptscited by 39
2023OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimizationcited by 36
2024Test-Time Backdoor Attacks on Multimodal Large Language Modelscited by 35
2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 35
2024Visual Adversarial Attack on Vision-Language Models for Autonomous Drivingcited by 35
2024Universal Adversarial Perturbations for Vision-Language Pre-trained Modelscited by 31
2024Effectiveness Assessment of Recent Large Vision-Language Modelscited by 29
2025Vision-Language Models for Edge Networks: A Comprehensive Surveycited by 29
2024Revisiting the Adversarial Robustness of Vision Language Models: a Multimodal Perspectivecited by 28
2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Modelscited by 27
2023Language-Driven Anchors for Zero-Shot Adversarial Robustnesscited by 23
2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Modelcited by 22
2024TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Modelscited by 22
2024SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environmentscited by 22
2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Modelscited by 21
2024Securely Fine-tuning Pre-trained Encoders Against Adversarial Examplescited by 21
2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIPcited by 21
2024MirrorCheck: Efficient Adversarial Defense for Vision-Language Modelscited by 19
2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Modelscited by 19
2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
2024Semantic-Aligned Adversarial Evolution Triangle for High-Transferability Vision-Language Attackcited by 18
2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learningcited by 16
2024Quantifying and Enhancing Multi-modal Robustness with Modality Preferencecited by 16
2024A Survey on Safe Multi-Modal Learning Systemcited by 15
2023Mutual-modality Adversarial Attack with Semantic Perturbationcited by 14
2024PIP: Detecting Adversarial Examples in Large Vision-Language Models via Attention Patterns of Irrelevant Probe Questionscited by 14
2023Adversarial Attacks on Foundational Vision Modelscited by 13
2025MIP against Agent: Malicious Image Patches Hijacking Multimodal OS Agentscited by 12
2024As Firm As Their Foundations: Can open-sourced foundation models be used to create adversarial examples for downstream tasks?cited by 11
2024Chain-of-Jailbreak Attack for Image Generation Models via Editing Step by Stepcited by 11
2024VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Modelscited by 10
2025Transferable Adversarial Attacks on Black-Box Vision-Language Modelscited by 10
2025AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Deliverycited by 9
2025Align is not Enough: Multimodal Universal Jailbreak Attack against Multimodal Large Language Modelscited by 8
2024Rethinking Impersonation and Dodging Attacks on Face Recognition Systemscited by 7
2024Improving Adversarial Transferability of Vision-Language Pre-training Models through Collaborative Multimodal Interactioncited by 7

50 most cited of 142 All 142 (JSON)

Similar, not cited

Close in wording, no citation either way