mlsanityData to 7 Oct 2026

Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks

arXiv 2402.00626 ↗First posted 1 Feb 2024cs.CV cs.CR cs.LGcited by 36

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Typographic attacks, adding misleading text to images, can deceive vision-language models (LVLMs). The susceptibility of recent large LVLMs like GPT4-V to such attacks is understudied, raising concerns about amplified misinformation in personal assistant applications. Previous attacks use simple strategies, such as random misleading words, which don't fully exploit LVLMs' language reasoning abilities. We introduce an experimental setup for testing typographic attacks on LVLMs and propose two novel self-generated attacks: (1) Class-based attacks, where the model identifies a similar class to deceive itself, and (2) Reasoned attacks, where an advanced LVLM suggests an attack combining a deceiving class and description. Our experiments show these attacks significantly reduce classification performance by up to 60% and are effective across different models, including InstructBLIP and MiniGPT4. Code: https://github.com/mqraitem/Self-Gen-Typo-Attack

Key facts. Cited by 36 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 7 of its 18 references that are in the map. First posted on arXiv 1 Feb 2024.

Builds on

7 of 18 references.

Closest ancestors · 1

Same direction, newest first

  1. 2023Defense-Prefix for Preventing Typographic Attacks on CLIP10 Apr

Other references · 6

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  3. 2013Fine-Grained Visual Classification of Aircraftcited by 1,701
  4. 2023MME: A Comprehensive Evaluation Benchmark for Multimodal Large Language Modelscited by 1,624
  5. 2023The Dawn of LMMs: Preliminary Explorations with GPT-4V(ision)cited by 677
  6. 2023Prefix Propagation: Parameter-Efficient Tuning for Long Sequencescited by 15

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 10; 2025: 14; 2026: 12.

36 papers.

Sort:

By area:

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 103
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  3. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  4. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  5. 2024Heuristic-Induced Multimodal Risk Distribution Jailbreak Attack for Multimodal Large Language Modelscited by 29
  6. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Surveycited by 22
  7. 2024SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environmentscited by 22
  8. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  9. 2024Towards Transferable Attacks Against Vision-LLMs in Autonomous Driving with Typographycited by 17
  10. 2025SCAM: A Real-World Typographic Robustness Evaluation for Multimodal Foundation Modelscited by 12
  11. 2025CHAI: Command Hijacking against embodied AIcited by 9
  12. 2025Rethinking Jailbreak Detection of Large Vision Language Models with Representational Contrastive Scoringcited by 9
24 more
  1. 2024Defending LVLMs Against Vision Attacks through Partial-Perception Supervisioncited by 7
  2. 2025DREAM: Disentangling Risks to Enhance Safety Alignment in Multimodal Large Language Modelscited by 6
  3. 2026VII: Visual Instruction Injection for Jailbreaking Image-to-Video Generation Modelscited by 6
  4. 2026Evolving Contextual Safety in Multi-Modal Large Language Models via Inference-Time Self-Reflective Memorycited by 5
  5. 2025On Surjectivity of Neural Networks: Can you elicit any behavior from your model?cited by 4
  6. 2025AgentTypo: Adaptive Typographic Prompt Injection Attacks against Black-box Multimodal Agentscited by 3
  7. 2026Physical Prompt Injection Attacks on Large Vision-Language Modelscited by 3
  8. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 3
  9. 2024New Emerged Security and Privacy of Pre-trained Model: a Survey and Outlookcited by 2
  10. 2025Web Artifact Attacks Disrupt Vision Language Modelscited by 2
  11. 2025Watch, Listen, Understand, Mislead: Tri-modal Adversarial Attacks on Short Videos for Content Appropriateness Evaluationcited by 2
  12. 2025Empowering Multimodal LLMs with External Tools: A Comprehensive Surveycited by 2
  13. 2025Read or Ignore? A Unified Benchmark for Typographic-Attack Robustness and Text Recognition in Vision-Language Modelscited by 2
  14. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Modelscited by 1
  15. 2026Dual-Modality Multi-Stage Adversarial Safety Training: Robustifying Multimodal Web Agents Against Cross-Modal Attackscited by 1
  16. 2024Attacks on multimodal modelscited by 0
  17. 2025Turning Adversaries into Allies: Reversing Typographic Attacks for Multimodal E-Commerce Product Retrievalcited by 0
  18. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  19. 2026A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoningcited by 0
  20. 2026Overthink-Triggered Slowdown Attacks on LVLM-Based Robotic Systemscited by 0
  21. 2026QuISE: Defense against Typographic Attacks on VLMs via Query-Irrelevant Semantic Editingcited by 0
  22. 2026Beyond the Verdict: Evidence-Aligned Evaluation of Visual Prompt-Injection Guardrailscited by 0
  23. 2026Sorry Robot, Happy Human: Vision-Language Models Read Only One of Two Legible Typographic Layerscited by 0
  24. 2026Typographic Attack Against VLM-based AI-generated Image Detectioncited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model
  2. 2024Self-interpreting Adversarial Images
  3. 2026Reading Between the Pixels: Linking Text-Image Embedding Alignment to Typographic Attack Success on Vision-Language Models
  4. 2025Text Prompt Injection of Vision Language Models
  5. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated
  6. 2024Reasoning Robustness of LLMs to Adversarial Typographical Errors
  7. 2025Concept-Guided Backdoor Attack on Vision Language Models
  8. 2026TYPO: Instruction-Dense Visual Jailbreaks against Commercial Closed-Source Image-Generation Models