mlsanityData to 14 Oct 2026

Visual Adversarial Attack on Vision-Language Models for Autonomous Driving

arXiv 2411.18275 ↗First posted 27 Nov 2024cs.CVcited by 36

On the map: LLM reasoning → Chain-of-thought reasoning for driving

also in 2 more
Abstract (arXiv)

Vision-language models (VLMs) have significantly advanced autonomous driving (AD) by enhancing reasoning capabilities. However, these models remain highly vulnerable to adversarial attacks. While existing research has primarily focused on general VLM attacks, the development of attacks tailored to the safety-critical AD context has been largely overlooked. In this paper, we take the first step toward designing adversarial attacks specifically targeting VLMs in AD, exposing the substantial risks these attacks pose within this critical domain. We identify two unique challenges for effective adversarial attacks on AD VLMs: the variability of textual instructions and the time-series nature of visual scenarios. To this end, we propose ADvLM, the first visual adversarial attack framework specifically designed for VLMs in AD. Our framework introduces Semantic-Invariant Induction, which uses a large language model to create a diverse prompt library of textual instructions with consistent semantic content, guided by semantic entropy. Building on this, we introduce Scenario-Associated Enhancement, an approach where attention mechanisms select key frames and perspectives within driving scenarios to optimize adversarial perturbations that generalize across the entire scenario. Extensive experiments on several AD VLMs over multiple benchmarks show that ADvLM achieves state-of-the-art attack effectiveness. Moreover, real-world attack studies further validate its applicability and potential in practice.

Key facts. Cited by 36 papers in the map (data through 14 Oct 2026). Placed in Chain-of-thought reasoning for driving, one of 17 directions in LLM reasoning. Builds on 67 of its 95 references that are in the map. First posted on arXiv 27 Nov 2024.

Builds on

67 of 95 references.

Closest ancestors · 2

Same direction, newest first

  1. 2024Towards Transferable Attacks Against Vision-LLMs in Autonomous Driving with Typography23 May
  2. 2023Reason2Drive: Towards Interpretable and Chain-based Reasoning for Autonomous Driving6 Dec

Other references · 65

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2023Visual Instruction Tuningcited by 7,869
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  5. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  6. 2017CARLA: An Open Urban Driving Simulatorcited by 2,449
  7. 2023DriveLM: Driving with Graph Visual Question Answeringcited by 536
  8. 2023DriveGPT4: Interpretable End-to-end Autonomous Driving via Large Language Modelcited by 461
  9. 2018Lipschitz regularity of deep neural networks: analysis and efficient estimationcited by 415
  10. 2023GPT-Driver: Learning to Drive with GPTcited by 347
  11. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 328
  12. 2023Are aligned neural networks adversarially aligned?cited by 315
38 more
  1. 2023LMDrive: Closed-Loop End-to-End Driving with Large Language Modelscited by 305
  2. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 284
  3. 2023MultiModal-GPT: A Vision and Language Model for Dialogue with Humanscited by 255
  4. 2023DriveMLM: Aligning Multi-Modal Large Language Models with Behavioral Planning States for Autonomous Drivingcited by 233
  5. 2023Driving with LLMs: Fusing Object-Level Vector Modality for Explainable Autonomous Drivingcited by 232
  6. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 183
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 172
  8. 2022VLP: A Survey on Vision-Language Pre-trainingcited by 159
  9. 2023Large-scale Multi-Modal Pre-trained Models: A Comprehensive Surveycited by 153
  10. 2023LingoQA: Visual Question Answering for Autonomous Drivingcited by 145
  11. 2022Towards Adversarial Attack on Vision-Language Pre-training Modelscited by 144
  12. 2021Dual Attention Suppression Attack: Generate Adversarial Camouflage in Physical Worldcited by 127
  13. 2023Dolphins: Multimodal Language Model for Drivingcited by 124
  14. 2024Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Modelscited by 120
  15. 2023BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learningcited by 115
  16. 2023Benchmarking Robustness of 3D Object Detection to Common Corruptions in Autonomous Drivingcited by 114
  17. 2018Transferable Adversarial Attacks for Image and Video Object Detectioncited by 109
  18. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Promptcited by 109
  19. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 103
  20. 2020Lipschitz constant estimation of Neural Networks via sparse polynomial optimizationcited by 87
  21. 2021YOLOP: You Only Look Once for Panoptic Driving Perceptioncited by 82
  22. 2022Parallel Rectangle Flip Attack: A Query-based Black-box Attack against Object Detectioncited by 79
  23. 2024SafeBench: A Safety Evaluation Framework for Multimodal Large Language Modelscited by 69
  24. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
  25. 2020Efficient Adversarial Attacks for Visual Object Trackingcited by 66
  26. 2020Dirty Road Can Attack: Security of Deep Learning based Automated Lane Centering under Physical-World Attackcited by 64
  27. 2019Training Robust Deep Neural Networks via Adversarial Noise Propagationcited by 62
  28. 2023X-Adv: Physical Adversarial Object Attacks against X-ray Prohibited Item Detectioncited by 59
  29. 2022A Large-scale Multiple-objective Method for Black-box Attack against Object Detectioncited by 55
  30. 2021A Comprehensive Evaluation Framework for Deep Model Robustnesscited by 42
  31. 2021Harnessing Perceptual Adversarial Patches for Crowd Countingcited by 39
  32. 2023Pre-trained Trojan Attacks for Visual Recognitioncited by 39
  33. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attackscited by 39
  34. 2023MTD-GPT: A Multi-Task Decision-Making GPT Model for Autonomous Driving at Unsignalized Intersectionscited by 38
  35. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectorycited by 36
  36. 2023Diversifying the High-level Features for better Adversarial Transferabilitycited by 34
  37. 2024A survey of synthetic data augmentation methods in computer visioncited by 34
  38. 2024Physical Backdoor Attack can Jeopardize Driving with Vision-Large-Language Modelscited by 33

50 most cited of 65 All 65 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 16; 2026: 20.

36 papers.

Sort:

By area:

  1. 2025Reasoning-Augmented Conversation for Multi-Turn Jailbreak Attacks on Large Language Modelscited by 64
  2. 2025Manipulating Multimodal Agents via Cross-Modal Prompt Injectioncited by 44
  3. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 38
  4. 2025Black-Box Adversarial Attack on Vision Language Models for Autonomous Drivingcited by 24
  5. 2025Survey of Adversarial Robustness in Multimodal Large Language Modelscited by 16
  6. 2026When World Models Dream Wrong: Physical-Conditioned Adversarial Attacks against World Modelscited by 13
  7. 2025DAVSP: Safety Alignment for Large Vision-Language Models via Deep Aligned Visual Safety Promptcited by 8
  8. 2025Bench2ADVLM: A Closed-Loop Benchmark for Vision-language Models in Autonomous Drivingcited by 8
  9. 2026Safety in Embodied AI: A Survey of Risks, Attacks, and Defensescited by 7
  10. 2026WMAttack: Automated Attack Search for Adversarial Evaluation of World-Model Agentscited by 7
  11. 2025Evaluation of Safety Cognition Capability in Vision-Language Models for Autonomous Drivingcited by 4
  12. 2025PhysPatch: A Physically Realizable and Transferable Adversarial Patch Attack for Multimodal Large Language Models-based Autonomous Driving Systemscited by 4
24 more
  1. 2025Universal Camouflage Attack on Vision-Language Models for Autonomous Drivingcited by 4
  2. 2025MetAdv: A Unified and Interactive Adversarial Testing Platform for Autonomous Drivingcited by 3
  3. 2025Invisible Triggers, Visible Threats! Road-Style Adversarial Creation Attack for Visual 3D Detection in Autonomous Drivingcited by 3
  4. 2026Lost in Fog: Sensor Perturbations Expose Reasoning Fragility in Driving VLAscited by 3
  5. 2025On the Feasibility of Poisoning Text-to-Image AI Models via Adversarial Mislabelingcited by 1
  6. 2025UNDREAM: Bridging Differentiable Rendering and Photorealistic Simulation for End-to-end Adversarial Attackscited by 1
  7. 2025Jailbreaking Large Vision Language Models in Intelligent Transportation Systemscited by 1
  8. 2025High-Entropy Tokens as Multimodal Failure Points in Vision-Language Modelscited by 1
  9. 2026Benchmarking the Robustness of Autonomous Driving to Environmental Illusions: A Lane Perception Perspectivecited by 1
  10. 2026Breaking the weakest link to evade vision language modelscited by 1
  11. 2026NutVLM: A Self-Adaptive Defense Framework against Full-Dimension Attacks for Vision Language Models in Autonomous Drivingcited by 0
  12. 2026Do Not Leave a Gap: Hallucination-Free Object Concealment in Vision-Language Modelscited by 0
  13. 2026A Patch-based Cross-view Regularized Framework for Backdoor Defense in Multimodal Large Language Modelscited by 0
  14. 2026Challenging Vision-Language Models with Physically Deployable Multimodal Semantic Lighting Attackscited by 0
  15. 2026Adversarial Flow Matching for Imperceptible Attacks on End-to-End Autonomous Drivingcited by 0
  16. 2026GuardAD: Safeguarding Autonomous Driving MLLMs via Markovian Safety Logiccited by 0
  17. 2026ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Drivingcited by 0
  18. 2026When and How Severely: Scenario-Specific Safety Envelopes for Driving VLAscited by 0
  19. 2026Technical Report on the CVPR 2026@AdvML Workshop Challengecited by 0
  20. 2026ALLUDE: A Unified Evaluation System for Configurable Attacks in Differentiable Environmentscited by 0
  21. 2026Engineering Trustworthy Agentic AI for Critical Systemscited by 0
  22. 2026CIVA: Critic-Induced Value-Subspace Attacks on Visual World-Model Agentscited by 0
  23. 2026Rethinking Language's Role in Efficient VLA for Autonomous Vehicles: Toward Smarter, Trustworthy Drivingcited by 0
  24. 2026TempQ-Jail: Query-Constrained Candidate Ranking for Text-to-Video Jailbreak Attackscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Understanding Adversarial Transferability in Vision-Language Models for Autonomous Driving: A Cross-Architecture Analysis
  2. 2026Comparative Analysis of Patch Attack on VLM-Based Autonomous Driving Architectures
  3. 2025Toward Inherently Robust VLMs Against Visual Perception Attacks
  4. 2026Transferable Spatial Temporal Coherence Adversarial Attack on Black-Box Vision Language Models for Autonomous Driving
  5. 2025CoC-VLA: Delving into Adversarial Domain Transfer for Explainable Autonomous Driving via Chain-of-Causality Visual-Language-Action Model
  6. 2025Enhancing End-to-End Autonomous Driving with Risk Semantic Distillaion from VLM
  7. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  8. 2025Natural Reflection Backdoor Attack on Vision Language Model for Autonomous Driving