mlsanityData to 14 Oct 2026

Adversarial Attacks of Vision Tasks in the Past 10 Years: A Survey

arXiv 2410.23687 ↗First posted 31 Oct 2024cs.CV cs.CRcited by 23

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

With the advent of Large Vision-Language Models (LVLMs), new attack vectors, such as cognitive bias, prompt injection, and jailbreaking, have emerged. Understanding these attacks promotes system robustness improvement and neural networks demystification. However, existing surveys often target attack taxonomy and lack in-depth analysis like 1) unified insights into adversariality, transferability, and generalization; 2) detailed evaluations framework; 3) motivation-driven attack categorizations; and 4) an integrated perspective on both traditional and LVLM attacks. This article addresses these gaps by offering a thorough summary of traditional and LVLM adversarial attacks, emphasizing their connections and distinctions, and providing actionable insights for future research.

Key facts. Cited by 23 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 212 of its 307 references that are in the map. First posted on arXiv 31 Oct 2024.

Builds on

212 of 307 references.

Closest ancestors · 16

Same direction, newest first

  1. 2024Sample-agnostic Adversarial Perturbation for Vision-Language Pre-training Models6 Aug
  2. 2024From LLMs to MLLMs: Exploring the Landscape of Multimodal Jailbreaking21 Jun
  3. 2024SPA-VL: A Comprehensive Safety Preference Alignment Dataset for Vision Language Model17 Jun
  4. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  5. 2024JailBreakV: A Benchmark for Assessing the Robustness of MultiModal Large Language Models against Jailbreak Attacks3 Apr
  6. 2024Eyes Closed, Safety On: Protecting Multimodal LLMs via Image-to-Text Transformation14 Mar
  7. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  8. 2024Agent Smith: A Single Image Can Jailbreak One Million Multimodal LLM Agents Exponentially Fast13 Feb
  9. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks1 Feb
  10. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images20 Jan
  11. 2023On the Robustness of Large Multimodal Models Against Image Adversarial Attacks6 Dec
  12. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
4 more
  1. 2023Can Language Models be Instructed to Protect Personal Information?3 Oct
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  3. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul
  4. 2023Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs19 Jul

Other references · 196

  1. 2014Adam: A Method for Stochastic Optimizationcited by 37,240
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  3. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 30,186
  4. 2022Training language models to follow instructions with human feedbackcited by 15,971
  5. 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,364
  6. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  7. 2014ImageNet Large Scale Visual Recognition Challengecited by 8,498
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  9. 2016Grad-CAM: Visual Explanations from Deep Networks via Gradient-based Localizationcited by 6,733
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  11. 2022Generative Adversarial Networkscited by 5,627
  12. 2013Intriguing properties of neural networkscited by 5,155
38 more
  1. 2016The Cityscapes Dataset for Semantic Urban Scene Understandingcited by 4,444
  2. 2023Improved Baselines with Visual Instruction Tuningcited by 4,418
  3. 2013Auto-Encoding Variational Bayescited by 4,053
  4. 2017Deep reinforcement learning from human preferencescited by 3,912
  5. 2022Training a Helpful and Harmless Assistant with Reinforcement Learning from Human Feedbackcited by 3,720
  6. 2014Deep Learning Face Attributes in the Wildcited by 3,693
  7. 2023Qwen Technical Reportcited by 3,344
  8. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  9. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,998
  10. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,694
  11. 2016Making the V in VQA Matter: Elevating the Role of Image Understanding in Visual Question Answeringcited by 2,516
  12. 2013Deep Inside Convolutional Networks: Visualising Image Classification Models and Saliency Mapscited by 2,371
  13. 2016Membership Inference Attacks against Machine Learning Modelscited by 2,281
  14. 2013Rich feature hierarchies for accurate object detection and semantic segmentationcited by 2,162
  15. 2014CIDEr: Consensus-based Image Description Evaluationcited by 2,046
  16. 2016Adversarial examples in the physical worldcited by 1,769
  17. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,651
  18. 2021Align before Fuse: Vision and Language Representation Learning with Momentum Distillationcited by 1,619
  19. 2020Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attackscited by 1,451
  20. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  21. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,429
  22. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,420
  23. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,417
  24. 2015Flickr30k Entities: Collecting Region-to-Phrase Correspondences for Richer Image-to-Sentence Modelscited by 1,362
  25. 2015LSUN: Construction of a Large-scale Image Dataset using Deep Learning with Humans in the Loopcited by 1,355
  26. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  27. 2015DeepFool: a simple and accurate method to fool deep neural networkscited by 1,318
  28. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,255
  29. 2021ViLT: Vision-and-Language Transformer Without Convolution or Region Supervisioncited by 1,230
  30. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,207
  31. 2023Fine-tuning Aligned Language Models Compromises Safety, Even When Users Do Not Intend To!cited by 1,154
  32. 2017Visualizing the Loss Landscape of Neural Netscited by 1,130
  33. 2019OK-VQA: A Visual Question Answering Benchmark Requiring External Knowledgecited by 1,121
  34. 2021GLM: General Language Model Pretraining with Autoregressive Blank Infillingcited by 1,031
  35. 2016Deep Networks with Stochastic Depthcited by 979
  36. 2016Adversarial Machine Learning at Scalecited by 936
  37. 2015Generation and Comprehension of Unambiguous Object Descriptionscited by 904
  38. 2016Practical Black-Box Attacks against Machine Learningcited by 903

50 most cited of 196 All 196 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2024: 1; 2025: 10; 2026: 12.

23 papers.

Sort:

By area:

  1. 2025Safety at Scale: A Comprehensive Survey of Large Model and Agent Safetycited by 67
  2. 2025A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluationscited by 67
  3. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 39
  4. 2025ADVEDM:Fine-grained Adversarial Attack against VLM-based Embodied Agentscited by 23
  5. 2025AdPO: Enhancing the Adversarial Robustness of Large Vision-Language Models with Preference Optimizationcited by 8
  6. 2025A Neurosymbolic Framework for Interpretable Cognitive Attack Detection in Augmented Realitycited by 8
  7. 2025HV-Attack: Hierarchical Visual Attack for Multimodal Retrieval Augmented Generationcited by 3
  8. 2026SIF: Semantically In-Distribution Fingerprints for Large Vision-Language Modelscited by 2
  9. 2025Jailbreaking Commercial Black-Box LLMs with Explicitly Harmful Promptscited by 1
  10. 2025A Versatile Framework for Designing Group-Sparse Adversarial Attackscited by 1
  11. 2025Vision Transformers: the threat of realistic adversarial patchescited by 0
  12. 2025Empirical evaluation of the Frank-Wolfe methods for constructing white-box adversarial attackscited by 0
11 more
  1. 2026FMVP: Masked Flow Matching for Adversarial Video Purificationcited by 0
  2. 2026Do VLMs Have a Moral Backbone? A Study on the Fragile Morality of Vision-Language Modelscited by 0
  3. 2026In Vino Veritas and Vulnerabilities: Examining LLM Safety via Drunk Language Inducementcited by 0
  4. 2026Exploring Sparsity and Smoothness of Arbitrary Lp Norms in Adversarial Attackscited by 0
  5. 2026Generating Adversarial Events: A Motion-Aware Point Cloud Frameworkcited by 0
  6. 2026Adversarial Camouflagecited by 0
  7. 2026When Surfaces Lie: Exploiting Wrinkle-Induced Attention Shift to Attack Vision-Language Modelscited by 0
  8. 2026Enabling Adversarial Robustness in AI Models through Kubeflow MLOpscited by 0
  9. 2026When Interpretability Becomes a Liability: Adversarial Attacks on CBM Concept Layerscited by 0
  10. 2026A Comprehensive Review of One-Pixel Attack: Research Status, Taxonomy, Applications, Regulation Policy and Future Directionscited by 0
  11. 2026Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  2. 2025Seeing the Threat: Vulnerabilities in Vision-Language Models to Adversarial Attack
  3. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  4. 2026PHANTOM: A Large-Scale Dataset of Multimodal Adversarial Attacks for Vision-Language Models
  5. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models
  6. 2025VEAttack: Downstream-agnostic Vision Encoder Attack against Large Vision Language Models
  7. 2024B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions
  8. 2026Breaking the weakest link to evade vision language models