mlsanityData to 7 Oct 2026

Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models

arXiv 2402.06659 ↗First posted 5 Feb 2024cs.CR cs.AI cs.LGcited by 48

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Vision-Language Models (VLMs) excel in generating textual responses from visual inputs, but their versatility raises security concerns. This study takes the first step in exposing VLMs' susceptibility to data poisoning attacks that can manipulate responses to innocuous, everyday prompts. We introduce Shadowcast, a stealthy data poisoning attack where poison samples are visually indistinguishable from benign images with matching texts. Shadowcast demonstrates effectiveness in two attack types. The first is a traditional Label Attack, tricking VLMs into misidentifying class labels, such as confusing Donald Trump for Joe Biden. The second is a novel Persuasion Attack, leveraging VLMs' text generation capabilities to craft persuasive and seemingly rational narratives for misinformation, such as portraying junk food as healthy. We show that Shadowcast effectively achieves the attacker's intentions using as few as 50 poison samples. Crucially, the poisoned samples demonstrate transferability across different VLM architectures, posing a significant concern in black-box settings. Moreover, Shadowcast remains potent under realistic conditions involving various text prompts, training data augmentation, and image compression techniques. This work reveals how poisoned VLMs can disseminate convincing yet deceptive misinformation to everyday, benign users, emphasizing the importance of data integrity for responsible VLM deployments. Our code is available at: https://github.com/umd-huang-lab/VLM-Poisoning.

Key facts. Cited by 48 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 31 of its 44 references that are in the map. First posted on arXiv 5 Feb 2024.

Builds on

31 of 44 references.

Closest ancestors · 2

Same direction, newest first

  1. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  2. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 29

  1. 2021LoRA: Low-Rank Adaptation of Large Language Modelscited by 14,084
  2. 2023Visual Instruction Tuningcited by 7,792
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2023Improved Baselines with Visual Instruction Tuningcited by 4,362
  6. 2022LAION-5B: An open large-scale dataset for training next generation image-text modelscited by 4,131
  7. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  8. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  10. 2018VizWiz Grand Challenge: Answering Visual Questions from Blind Peoplecited by 852
  11. 2023MiniGPT-v2: large language model as a unified interface for vision-language multi-task learningcited by 617
  12. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
17 more
  1. 2023DecodingTrust: A Comprehensive Assessment of Trustworthiness in GPT Modelscited by 505
  2. 2018Poison Frogs! Targeted Clean-Label Poisoning Attacks on Neural Networkscited by 500
  3. 2024TrustLLM: Trustworthiness in Large Language Modelscited by 280
  4. 2023Poisoning Web-Scale Training Datasets is Practicalcited by 276
  5. 2023Multimodal C4: An Open, Billion-scale Corpus of Images Interleaved with Textcited by 208
  6. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  7. 2020Witches' Brew: Industrial Scale Data Poisoning via Gradient Matchingcited by 156
  8. 2021Poisoning and Backdooring Contrastive Learningcited by 149
  9. 2019Transferable Clean-Label Poisoning Attacks on Deep Neural Netscited by 129
  10. 2023On the Exploitability of Instruction Tuningcited by 110
  11. 2020Just How Toxic is Data Poisoning? A Unified Benchmark for Backdoor and Data Poisoning Attackscited by 109
  12. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  13. 2022Data Poisoning Attacks Against Multimodal Encoderscited by 41
  14. 2023Exploring and Exploiting Decision Boundary Dynamics for Adversarial Robustnesscited by 35
  15. 2022Not All Poisons are Created Equal: Robust Training against Data Poisoningcited by 29
  16. 2021What Doesn't Kill You Makes You Robust(er): How to Adversarially Train against Data Poisoningcited by 22
  17. 2023On the Proactive Generation of Unsafe Images From Text-To-Image Models Using Benign Promptscited by 14

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 6; 2025: 22; 2026: 20.

48 papers.

Sort:

By area:

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trendscited by 82
  2. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 66
  3. 2024TrojVLM: Backdoor Attack Against Vision Language Modelscited by 35
  4. 2024Backdooring Vision-Language Models with Out-Of-Distribution Datacited by 31
  5. 2025Data Poisoning in Deep Learning: A Surveycited by 20
  6. 2024Unbridled Icarus: A Survey of the Potential Perils of Image Inputs in Multimodal Large Language Model Securitycited by 18
  7. 2024Learning to Poison Large Language Models for Downstream Manipulationcited by 15
  8. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 14
  9. 2025Must Read: A Comprehensive Survey of Computational Persuasioncited by 12
  10. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulatedcited by 12
  11. 2025From LLMs to MLLMs to Agents: A Survey of Emerging Paradigms in Jailbreak Attacks and Defenses within LLM Ecosystemcited by 11
  12. 2025AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Deliverycited by 9
36 more
  1. 2025SRD: Reinforcement-Learned Semantic Perturbation for Backdoor Defense in VLMscited by 9
  2. 2025VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Modelscited by 7
  3. 2025Lie Detector: Unified Backdoor Detection via Cross-Examination Frameworkcited by 6
  4. 2025No, of Course I Can! Deeper Fine-Tuning Attacks That Bypass Token-Level Safety Mechanismscited by 5
  5. 2025VisualTrap: A Stealthy Backdoor Attack on GUI Agents via Visual Grounding Manipulationcited by 4
  6. 2024FACT or Fiction: Can Truthful Mechanisms Eliminate Federated Free Riding?cited by 3
  7. 2025DecepChain: Inducing Deceptive Reasoning in Large Language Modelscited by 3
  8. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 3
  9. 2026CBV: Clean-label Backdoor Attacks on Vision Language Models via Diffusion Modelscited by 3
  10. 2025Playing Devil's Advocate: Unmasking Toxicity and Vulnerabilities in Large Vision-Language Modelscited by 2
  11. 2025A Linear Approach to Data Poisoningcited by 2
  12. 2025BadReward: Clean-Label Poisoning of Reward Models in Text-to-Image RLHFcited by 2
  13. 2025Empowering Multimodal LLMs with External Tools: A Comprehensive Surveycited by 2
  14. 2025Are Neuro-Inspired Multi-Modal Vision-Language Models Resilient to Membership Inference Privacy Leakage?cited by 2
  15. 2025Concept-Guided Backdoor Attack on Vision Language Modelscited by 2
  16. 2026Visual Memory Injection Attacks for Multi-Turn Conversationscited by 2
  17. 2025Mapping User Trust in Vision Language Models: Research Landscape, Challenges, and Prospectscited by 1
  18. 2025On the Feasibility of Poisoning Text-to-Image AI Models via Adversarial Mislabelingcited by 1
  19. 2026Safety-Efficacy Trade Off: Robustness against Data-Poisoningcited by 1
  20. 2026From Thinker to Society: Security in Hierarchical Autonomy Evolution of AI Agentscited by 1
  21. 2026Multimodal Backdoor Attack on VLMs for Autonomous Driving via Graffiti and Cross-Lingual Triggerscited by 1
  22. 2025Trust in Vision-Language Models: Insights from a Participatory User Workshopcited by 0
  23. 2026Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Modelscited by 0
  24. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Modelscited by 0
  25. 2026ProjLens: Unveiling the Role of Projectors in Multimodal Model Safetycited by 0
  26. 2026Attention Hijacking: Response Manipulation Across Queries in Vision-Language Modelscited by 0
  27. 2026Single-Sample Black-Box Membership Inference Attack against Vision-Language Models via Cross-modal Semantic Alignmentcited by 0
  28. 2026Awakening the Hydra: Stabilizing Multi-Concept Backdoor Injection in Text-to-Image Diffusion Modelscited by 0
  29. 2026BYORn: Bootstrap Your Own Responses to Defend Large Vision-Language Models Against Backdoor Attackscited by 0
  30. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  31. 2026MemCatalyst: Amplifying Data Auditing on Vision-Language Models via Data Poisoningcited by 0
  32. 2026Backdoor Learning in Language Models and Vision-Language Modelscited by 0
  33. 2026Anchoring Bias: A Persistent Fairness Backdoor Attack against MLLMs under Continual Learningcited by 0
  34. 2026FreqDoor: A Hidden Trojan in the Frequency Domain for Backdoor Attacks on Vision-Language Modelscited by 0
  35. 2026CrACK: Adversarial Attacks on Cross-Model Consistency in Collaborative Vision Foundation Modelscited by 0
  36. 2026TraceGuard: Adaptive Multimodal Poison Filtering through Cross-Feature Rank Agreementcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2023Nightshade: Prompt-Specific Poisoning Attacks on Text-to-Image Generative Models
  2. 2025Backdoor Attack on Vision Language Models with Stealthy Semantic Manipulation
  3. 2026ViTeGate: Visual-Textual Triggered Knowledge Poisoning for Vision-Language Retrieval-Augmented Generation
  4. 2026Vis-Poison: Poisoning Visual Knowledge in Multimodal Retrieval-Augmented Generation
  5. 2026Jailbreaking Vision-Language Models Through the Visual Modality
  6. 2025Text Prompt Injection of Vision Language Models
  7. 2025Poisoned-MRAG: Knowledge Poisoning Attacks to Multimodal Retrieval Augmented Generation
  8. 2026Render Before Reading: Visual Rendering as a Prompt Injection Defense