mlsanityData to 7 Oct 2026

AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models

arXiv 2410.05346 ↗First posted 7 Oct 2024cs.LG cs.AIcited by 43

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Due to their multimodal capabilities, Vision-Language Models (VLMs) have found numerous impactful applications in real-world scenarios. However, recent studies have revealed that VLMs are vulnerable to image-based adversarial attacks. Traditional targeted adversarial attacks require specific targets and labels, limiting their real-world impact.We present AnyAttack, a self-supervised framework that transcends the limitations of conventional attacks through a novel foundation model approach. By pre-training on the massive LAION-400M dataset without label supervision, AnyAttack achieves unprecedented flexibility - enabling any image to be transformed into an attack vector targeting any desired output across different VLMs.This approach fundamentally changes the threat landscape, making adversarial capabilities accessible at an unprecedented scale. Our extensive validation across five open-source VLMs (CLIP, BLIP, BLIP2, InstructBLIP, and MiniGPT-4) demonstrates AnyAttack's effectiveness across diverse multimodal tasks. Most concerning, AnyAttack seamlessly transfers to commercial systems including Google Gemini, Claude Sonnet, Microsoft Copilot and OpenAI GPT, revealing a systemic vulnerability requiring immediate attention.

Key facts. Cited by 43 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 31 of its 35 references that are in the map. First posted on arXiv 7 Oct 2024.

Builds on

31 of 35 references.

Closest ancestors · 7

Same direction, newest first

  1. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  2. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models28 May
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  4. 2023Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Models26 Jul
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  6. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May
  7. 2022Towards Adversarial Attack on Vision-Language Pre-training Models19 Jun

Other references · 24

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,441
  3. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,069
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,310
  6. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  8. 2021LAION-400M: Open Dataset of CLIP-Filtered 400 Million Image-Text Pairscited by 1,544
  9. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 685
  10. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  11. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  12. 2023EVA-02: A Visual Representation for Neon Genesiscited by 377
12 more
  1. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  2. 2023Are aligned neural networks adversarially aligned?cited by 305
  3. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  4. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  5. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  6. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
  7. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 66
  8. 2023Jailbreaking GPT-4V via Self-Adversarial Attacks with System Promptscited by 62
  9. 2021A Little Robustness Goes a Long Way: Leveraging Robust Features for Targeted Transfer Attackscited by 33
  10. 2022Enhancing the Self-Universality for Transferable Targeted Attackscited by 30
  11. 2024Boosting the Transferability of Adversarial Examples via Local Mixup and Adaptive Step Sizecited by 7
  12. 2022Low-Mid Adversarial Perturbation against Unauthorized Face Recognition Systemcited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 11; 2026: 31.

43 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 63
  2. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Drivingcited by 23
  3. 2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Modelscited by 19
  4. 2026ICON: Indirect Prompt Injection Defense for Agents based on Inference-Time Correctioncited by 8
  5. 2025Enhancing Targeted Adversarial Attacks on Large Vision-Language Models via Intermediate Projectorcited by 5
  6. 2025Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Modelscited by 5
  7. 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Modelscited by 4
  8. 2025GHOST: Hallucination-Inducing Image Generation for Multimodal LLMscited by 4
  9. 2025Person-Centric Annotations of LAION-400M: Auditing Bias and Its Transfer to Modelscited by 4
  10. 2026Toward Universal and Transferable Jailbreak Attacks on Vision-Language Modelscited by 4
  11. 2025CAVALRY-V: A Large-Scale Generator Framework for Adversarial Attacks on Video MLLMscited by 3
  12. 2025GeoShield: Safeguarding Geolocation Privacy from Vision-Language Models via Adversarial Perturbationscited by 3
31 more
  1. 2026Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIPcited by 2
  2. 2026ZAYA1-VL-8B Technical Reportcited by 2
  3. 2026Steal the Patch Size: Adversarially Manipulate Vision-Language Modelscited by 2
  4. 2025VERA-V: Variational Inference Framework for Jailbreaking Vision-Language Modelscited by 1
  5. 2026Lingua-SafetyBench: A Benchmark for Safety Evaluation of Multilingual Vision-Language Modelscited by 1
  6. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1
  7. 2026Are GUI Agents Focused Enough? Automated Distraction via Semantic-level UI Element Injectioncited by 1
  8. 2026Sparse Autoencoders as Plug-and-Play Firewalls for Adversarial Attack Detection in VLMscited by 1
  9. 2026Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMscited by 1
  10. 2026Do Agents Dream of False Memories? Black-box Visual Attacks on Long-term Memory in Multimodal AI Agentscited by 1
  11. 2025Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbationcited by 0
  12. 2026Feature-Space Smoothing: Certified Robustness of Deep Representationscited by 0
  13. 2026Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Modelscited by 0
  14. 2026What Makes VLMs Robust? Towards Reconciling Robustness and Accuracy in Vision-Language Modelscited by 0
  15. 2026Covert Visual Prompt Injection against Commercial Multimodal Large Language Modelscited by 0
  16. 2026PDA: Text-Augmented Defense Framework for Robust Vision-Language Models against Adversarial Image Attackscited by 0
  17. 2026Revealing Physical-World Semantic Vulnerabilities: Universal Adversarial Patch for Infrared Vision-Language Modelscited by 0
  18. 2026VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Modelscited by 0
  19. 2026From Clouds to Hallucinations: Atmospheric Retrieval Hijacking in Remote Sensing Vision-Language RAGcited by 0
  20. 2026Adversarial Attacks Against MLLMs via Progressive Resolution Processing and Adaptive Feature Alignmentcited by 0
  21. 2026DarkLLM: Learning Language-Driven Adversarial Attacks with Large Language Modelscited by 0
  22. 2026Zamba2-VL Technical Reportcited by 0
  23. 2026REALM: A Unified Red-Teaming Benchmark for Physical-World VLMscited by 0
  24. 2026ARMOR++: Agentic Orchestration of a Multi-Domain Primitive Set for Transferable Attacks on Deepfake Detectorscited by 0
  25. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  26. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMscited by 0
  27. 2026Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Modelscited by 0
  28. 2026VLM4Cluster: Benchmarking Deep Clustering In the Era of Vision-Language Pre-trainingcited by 0
  29. 2026It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at ε≤ 4/255cited by 0
  30. 2026Feature-Aware Token Attack for Compression-Triggered Stealthy Failures in Large Vision-Language Modelscited by 0
  31. 2026Does Target Alignment Mean Target Recovery? An Evidence-Ladder Study of Adversarial Claims on Contrastive Encoderscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Breaking the weakest link to evade vision language models
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  3. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models
  4. 2024Multimodal Adversarial Defense for Vision-Language Models by Leveraging One-To-Many Relationships
  5. 2026PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models
  6. 2025VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Models
  7. 2024Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey
  8. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models