# Private Attribute Inference from Images with Vision-Language Models

arXiv: https://arxiv.org/abs/2404.10618 · HTML: https://mlsanity.com/paper/2404.10618/

## Key facts

- Cited by 37 papers in the map (data through 14 Oct 2026).
- Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models.
- Builds on 29 of its 53 references that are in the map.
- First posted on arXiv 16 Apr 2024.

## Placed in

- Multimodal LLMs / vision-language models / [MLLM jailbreaks and adversarial robustness](https://mlsanity.com/mllm/mllm-jailbreaks-and-adversarial-robustness/)

## Builds on (most cited first, 29 of 29)

- [Chain-of-Thought Prompting Elicits Reasoning in Large Language Models](https://mlsanity.com/paper/2201.11903/) (2022)
- [Visual Instruction Tuning](https://mlsanity.com/paper/2304.08485/) (2023)
- [Flamingo: a Visual Language Model for Few-Shot Learning](https://mlsanity.com/paper/2204.14198/) (2022)
- [On the Opportunities and Risks of Foundation Models](https://mlsanity.com/paper/2108.07258/) (2021)
- [Universal and Transferable Adversarial Attacks on Aligned Language Models](https://mlsanity.com/paper/2307.15043/) (2023)
- [InternVL: Scaling up Vision Foundation Models and Aligning for Generic Visual-Linguistic Tasks](https://mlsanity.com/paper/2312.14238/) (2023)
- [HuggingFace's Transformers: State-of-the-art Natural Language Processing](https://mlsanity.com/paper/1910.03771/) (2019)
- [Extracting Training Data from Large Language Models](https://mlsanity.com/paper/2012.07805/) (2020)
- [MMMU: A Massive Multi-discipline Multimodal Understanding and Reasoning Benchmark for Expert AGI](https://mlsanity.com/paper/2311.16502/) (2023)
- [Jailbreaking Black Box Large Language Models in Twenty Queries](https://mlsanity.com/paper/2310.08419/) (2023)
- [Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations](https://mlsanity.com/paper/2312.06674/) (2023)
- [Ethical and social risks of harm from Language Models](https://mlsanity.com/paper/2112.04359/) (2021)
- [Quantifying Memorization Across Neural Language Models](https://mlsanity.com/paper/2202.07646/) (2022)
- [CogAgent: A Visual Language Model for GUI Agents](https://mlsanity.com/paper/2312.08914/) (2023)
- [Tree of Attacks: Jailbreaking Black-Box LLMs Automatically](https://mlsanity.com/paper/2312.02119/) (2023)
- [Multimodal Few-Shot Learning with Frozen Language Models](https://mlsanity.com/paper/2106.13884/) (2021)
- [Socratic Models: Composing Zero-Shot Multimodal Reasoning with Language](https://mlsanity.com/paper/2204.00598/) (2022)
- [Scalable Extraction of Training Data from (Production) Language Models](https://mlsanity.com/paper/2311.17035/) (2023)
- [Analyzing Leakage of Personally Identifiable Information in Language Models](https://mlsanity.com/paper/2302.00539/) (2023)
- [Multimodal Large Language Models: A Survey](https://mlsanity.com/paper/2311.13165/) (2023)
- [Beyond Memorization: Violating Privacy Via Inference with Large Language Models](https://mlsanity.com/paper/2310.07298/) (2023)
- [ProPILE: Probing Privacy Leakage in Large Language Models](https://mlsanity.com/paper/2307.01881/) (2023)
- [Language Models are General-Purpose Interfaces](https://mlsanity.com/paper/2206.06336/) (2022)
- [HydraPlus-Net: Attentive Deep Features for Pedestrian Analysis](https://mlsanity.com/paper/1709.09930/) (2017)
- [MAGMA -- Multimodal Augmentation of Generative Models through Adapter-based Finetuning](https://mlsanity.com/paper/2112.05253/) (2021)
- [Pedestrian Attribute Recognition: A Survey](https://mlsanity.com/paper/1901.07474/) (2019)
- [Pedestrian Attribute Recognition via CLIP based Prompt Vision-Language Fusion](https://mlsanity.com/paper/2312.10692/) (2023)
- [Large Language Models are Advanced Anonymizers](https://mlsanity.com/paper/2402.13846/) (2024)
- [A Review on Visual Privacy Preservation Techniques for Active and Assisted Living](https://mlsanity.com/paper/2112.09422/) (2021)

## Built on by (most cited first, 30 of 37)

- [A Synthetic Dataset for Personal Attribute Inference](https://mlsanity.com/paper/2406.07217/) (2024)
- [Doxing via the Lens: Revealing Location-related Privacy Leakage on Multi-modal Large Reasoning Models](https://mlsanity.com/paper/2504.19373/) (2025)
- [SAUCE: Selective Concept Unlearning in Vision-Language Models with Sparse Autoencoders](https://mlsanity.com/paper/2503.14530/) (2025)
- [Privacy-Aware Visual Language Models](https://mlsanity.com/paper/2405.17423/) (2024)
- [Evaluating Precise Geolocation Inference Capabilities of Vision Language Models](https://mlsanity.com/paper/2502.14412/) (2025)
- [Attention! Your Vision Language Model Could Be Maliciously Manipulated](https://mlsanity.com/paper/2505.19911/) (2025)
- [Safe-LLaVA: A Privacy-Preserving Vision-Language Dataset and Benchmark for Biometric Safety](https://mlsanity.com/paper/2509.00192/) (2025)
- [Beyond Data Privacy: New Privacy Risks for Large Language Models](https://mlsanity.com/paper/2509.14278/) (2025)
- [LLMs unlock new paths to monetizing exploits](https://mlsanity.com/paper/2505.11449/) (2025)
- [Multi-PA: A Multi-perspective Benchmark on Privacy Assessment for Large Vision-Language Models](https://mlsanity.com/paper/2412.19496/) (2024)
- [Who Can See Through You? Adversarial Shielding Against VLM-Based Attribute Inference Attacks](https://mlsanity.com/paper/2512.18264/) (2025)
- [Beyond PII: How Users Attempt to Estimate and Mitigate Implicit LLM Inference](https://mlsanity.com/paper/2509.12152/) (2025)
- [Rethinking Visual Privacy: A Compositional Privacy Risk Framework for Severity Assessment with VLMs](https://mlsanity.com/paper/2603.21573/) (2026)
- [Personal Visual Memory from Explicit and Implicit Evidence](https://mlsanity.com/paper/2605.28806/) (2026)
- [What Your Posts Reveal: A Benchmark and Agentic Framework for User-Level Privacy Leakage on Social Media](https://mlsanity.com/paper/2606.06784/) (2026)
- [Toward Reliable VLM: A Fine-Grained Benchmark and Framework for Exposure, Bias, and Inference in Korean Street Views](https://mlsanity.com/paper/2506.03371/) (2025)
- [Through Their Eyes: User Perceptions on Sensitive Attribute Inference of Social Media Videos by Visual Language Models](https://mlsanity.com/paper/2508.07658/) (2025)
- [When Ads Become Profiles: Uncovering the Invisible Risk of Web Advertising at Scale with LLMs](https://mlsanity.com/paper/2509.18874/) (2025)
- [GEO-Detective: Unveiling Location Privacy Risks in Images with LLM Agents](https://mlsanity.com/paper/2511.22441/) (2025)
- [Do Vision-Language Models Respect Contextual Integrity in Location Disclosure?](https://mlsanity.com/paper/2602.05023/) (2026)
- [Differentially Private Multimodal In-Context Learning](https://mlsanity.com/paper/2603.04894/) (2026)
- [Towards Context-Aware Image Anonymization with Multi-Agent Reasoning](https://mlsanity.com/paper/2603.27817/) (2026)
- [Unsafe2Safe: Controllable Image Anonymization for Downstream Utility](https://mlsanity.com/paper/2603.28605/) (2026)
- [Playing Along: Learning a Double-Agent Defender for Belief Steering via Theory of Mind](https://mlsanity.com/paper/2604.11666/) (2026)
- [CAPED: Context-Aware Privacy Exposure Defense for Mobile GUI Agents](https://mlsanity.com/paper/2606.12666/) (2026)
- [MemLeak: Diagnosing Information Leaks in Multimodal Agent Memory](https://mlsanity.com/paper/2606.29788/) (2026)
- [Defending Wearable VLMs Against Private Attribute Inference](https://mlsanity.com/paper/2608.28691/) (2026)
- [Rethinking Post-Unlearning Behavior of Large Vision-Language Models](https://mlsanity.com/paper/2506.02541/) (2025)
- [Which private attributes do VLMs agree on and predict well?](https://mlsanity.com/paper/2602.07931/) (2026)
- [Neural Gate: Mitigating Privacy Risks in LVLMs via Neuron-Level Gradient Gating](https://mlsanity.com/paper/2603.12598/) (2026)

## Abstract (arXiv)

As large language models (LLMs) become ubiquitous in our daily tasks and digital interactions, associated privacy risks are increasingly in focus. While LLM privacy research has primarily focused on the leakage of model training data, it has recently been shown that LLMs can make accurate privacy-infringing inferences from previously unseen texts. With the rise of vision-language models (VLMs), capable of understanding both images and text, a key question is whether this concern transfers to the previously unexplored domain of benign images posted online. To answer this question, we compile an image dataset with human-annotated labels of the image owner's personal attributes. In order to understand the privacy risks posed by VLMs beyond traditional human attribute recognition, our dataset consists of images where the inferable private attributes do not stem from direct depictions of humans. On this dataset, we evaluate 7 state-of-the-art VLMs, finding that they can infer various personal attributes at up to 77.6% accuracy. Concerningly, we observe that accuracy scales with the general capabilities of the models, implying that future models can be misused as stronger inferential adversaries, establishing an imperative for the development of adequate defenses.