mlsanityData to 7 Oct 2026

Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models

arXiv 2410.06699 ↗First posted 9 Oct 2024cs.CV cs.AI cs.LGcited by 27

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Large vision-language models (LVLMs) integrate visual information into large language models, showcasing remarkable multi-modal conversational capabilities. However, the visual modules introduces new challenges in terms of robustness for LVLMs, as attackers can craft adversarial images that are visually clean but may mislead the model to generate incorrect answers. In general, LVLMs rely on vision encoders to transform images into visual tokens, which are crucial for the language models to perceive image contents effectively. Therefore, we are curious about one question: Can LVLMs still generate correct responses when the encoded visual tokens are attacked and disrupting the visual information? To this end, we propose a non-targeted attack method referred to as VT-Attack (Visual Tokens Attack), which constructs adversarial examples from multiple perspectives, with the goal of comprehensively disrupting feature representations and inherent relationships as well as the semantic properties of visual tokens output by image encoders. Using only access to the image encoder in the proposed attack, the generated adversarial examples exhibit transferability across diverse LVLMs utilizing the same image encoder and generality across different tasks. Extensive experiments validate the superior attack performance of the VT-Attack over baseline methods, demonstrating its effectiveness in attacking LVLMs with image encoders, which in turn can provide guidance on the robustness of LVLMs, particularly in terms of the stability of the visual feature space.

Key facts. Cited by 27 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 26 of its 44 references that are in the map. First posted on arXiv 9 Oct 2024.

Builds on

26 of 44 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  2. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  3. 2022Towards Adversarial Attack on Vision-Language Pre-training Models19 Jun

Other references · 23

  1. 2017Attention Is All You Needcited by 59,932
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  4. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  5. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  6. 2022OPT: Open Pre-trained Transformer Language Modelscited by 3,464
  7. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  8. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  9. 2016Adversarial examples in the physical worldcited by 1,762
  10. 2023LLaVA-Med: Training a Large Language-and-Vision Assistant for Biomedicine in One Daycited by 1,287
  11. 2023A Survey on Multimodal Large Language Modelscited by 898
  12. 2022EVA: Exploring the Limits of Masked Visual Representation Learning at Scalecited by 685
11 more
  1. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  2. 2023LLaMA-Adapter V2: Parameter-Efficient Visual Instruction Modelcited by 602
  3. 2023Otter: A Multi-Modal Model with In-Context Instruction Tuningcited by 548
  4. 2023mPLUG-Owl2: Revolutionizing Multi-modal Large Language Model with Modality Collaborationcited by 545
  5. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  6. 2023Are aligned neural networks adversarially aligned?cited by 305
  7. 2022mPLUG: Effective and Efficient Vision-Language Learning by Cross-modal Skip-connectionscited by 185
  8. 2021On the Robustness of Vision Transformers to Adversarial Examplescited by 167
  9. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  10. 2021Human-Adversarial Visual Question Answeringcited by 57
  11. 2021Controlled Caption Generation for Images Through Adversarial Attackscited by 9

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 2; 2025: 11; 2026: 14.

27 papers.

Sort:

By area:

  1. 2025Towards Robust and Secure Embodied AI: A Survey on Vulnerabilities and Attackscited by 32
  2. 2025ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agentscited by 19
  3. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Modelscited by 11
  4. 2025AdPO: Enhancing the Adversarial Robustness of Large Vision-Language Models with Preference Optimizationcited by 8
  5. 2025VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Modelscited by 7
  6. 2025Tracking the Copyright of Large Vision-Language Models through Parameter Learning Adversarial Imagescited by 5
  7. 2025Enhancing Targeted Adversarial Attacks on Large Vision-Language Models via Intermediate Projectorcited by 5
  8. 2026On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compressioncited by 5
  9. 2024Seeing is Deceiving: Exploitation of Visual Pathways in Multi-Modal Language Modelscited by 4
  10. 2026PA-Attack: Guiding Gray-Box Attacks on LVLM Vision Encoders with Prototypes and Attentioncited by 3
  11. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 3
  12. 2025A Satellite-Ground Synergistic Large Vision-Language Model System for Earth Observationcited by 2
15 more
  1. 2025High-Entropy Tokens as Multimodal Failure Points in Vision-Language Modelscited by 1
  2. 2026Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Modelscited by 1
  3. 2025Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Modelscited by 0
  4. 2025Security Tensors as a Cross-Modal Bridge: Extending Text-Aligned Safety to Vision in LVLMcited by 0
  5. 2025Vision Token Masking Alone Cannot Prevent PHI Leakage in Medical Document OCR: A Systematic Evaluationcited by 0
  6. 2026On the Adversarial Robustness of 3D Large Vision-Language Modelscited by 0
  7. 2026Feature-Space Smoothing: Certified Robustness of Deep Representationscited by 0
  8. 2026SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Modelscited by 0
  9. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  10. 2026All Vehicles Can Lie: Efficient Adversarial Defense in Fully Untrusted-Vehicle Collaborative Perception via Pseudo-Random Bayesian Inferencecited by 0
  11. 2026Covert Visual Prompt Injection against Commercial Multimodal Large Language Modelscited by 0
  12. 2026Adversarial Attacks Against MLLMs via Progressive Resolution Processing and Adaptive Feature Alignmentcited by 0
  13. 2026Evolving Safety Landscape of Multi-modal Large Language Models: A Survey of Emerging Threats and Safeguardscited by 0
  14. 2026It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at ε≤ 4/255cited by 0
  15. 2026Feature-Aware Token Attack for Compression-Triggered Stealthy Failures in Large Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  2. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  3. 2026Breaking the weakest link to evade vision language models
  4. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated
  5. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models
  6. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks
  7. 2026Visual Memory Injection Attacks for Multi-Turn Conversations
  8. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks