mlsanityData to 7 Oct 2026

Transferable Adversarial Attacks on Black-Box Vision-Language Models

arXiv 2505.01050 ↗First posted 2 May 2025cs.CV cs.LGcited by 10

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Vision Large Language Models (VLLMs) are increasingly deployed to offer advanced capabilities on inputs comprising both text and images. While prior research has shown that adversarial attacks can transfer from open-source to proprietary black-box models in text-only and vision-only contexts, the extent and effectiveness of such vulnerabilities remain underexplored for VLLMs. We present a comprehensive analysis demonstrating that targeted adversarial examples are highly transferable to widely-used proprietary VLLMs such as GPT-4o, Claude, and Gemini. We show that attackers can craft perturbations to induce specific attacker-chosen interpretations of visual information, such as misinterpreting hazardous content as safe, overlooking sensitive or restricted material, or generating detailed incorrect responses aligned with the attacker's intent. Furthermore, we discover that universal perturbations -- modifications applicable to a wide set of images -- can consistently induce these misinterpretations across multiple proprietary VLLMs. Our experimental results on object recognition, visual question answering, and image captioning show that this vulnerability is common across current state-of-the-art models, and underscore an urgent need for robust mitigations to ensure the safe and secure deployment of VLLMs.

Key facts. Cited by 10 papers in the map (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 62 of its 78 references that are in the map. First posted on arXiv 2 May 2025.

Builds on

62 of 78 references.

Closest ancestors · 6

Same direction, newest first

  1. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks24 Nov
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  3. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  4. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May
  5. 2022Understanding Zero-Shot Adversarial Robustness for Large-Scale Models14 Dec
  6. 2022Towards Adversarial Attack on Vision-Language Pre-training Models19 Jun

Other references · 56

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  3. 2023GPT-4 Technical Reportcited by 18,132
  4. 2014Microsoft COCO: Common Objects in Contextcited by 17,498
  5. 2022Training language models to follow instructions with human feedbackcited by 15,712
  6. 2023Visual Instruction Tuningcited by 7,792
  7. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,764
  8. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  9. 2016Densely Connected Convolutional Networkscited by 6,691
  10. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  11. 2025Qwen2.5-VL Technical Reportcited by 5,418
  12. 2013Intriguing properties of neural networkscited by 5,114
38 more
  1. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,175
  2. 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,048
  3. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  4. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,689
  5. 2022Large Language Models Encode Clinical Knowledgecited by 1,807
  6. 2024SWE-agent: Agent-Computer Interfaces Enable Automated Software Engineeringcited by 1,628
  7. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  8. 2020Sharpness-Aware Minimization for Efficiently Improving Generalizationcited by 1,404
  9. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  10. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  11. 2018Averaging Weights Leads to Wider Optima and Better Generalizationcited by 1,194
  12. 2016Deep Networks with Stochastic Depthcited by 973
  13. 2023Vision Transformers Need Registerscited by 844
  14. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  15. 2017Evasion Attacks against Machine Learning at Test Timecited by 686
  16. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  17. 2024LLaVA-NeXT-Interleave: Tackling Multi-image, Video, and 3D in Large Multimodal Modelscited by 571
  18. 2023Eureka: Human-Level Reward Design via Coding Large Language Modelscited by 542
  19. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  20. 2024Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attackscited by 450
  21. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  22. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  23. 2023Scalable Extraction of Training Data from (Production) Language Modelscited by 415
  24. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  25. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  26. 2023Are aligned neural networks adversarially aligned?cited by 305
  27. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  28. 2023Data Filtering Networkscited by 247
  29. 2024Building and better understanding vision-language models: insights and future directionscited by 169
  30. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtimecited by 165
  31. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  32. 2023On the Adversarial Robustness of Multi-Modal Foundation Modelscited by 142
  33. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 128
  34. 2023Dolphins: Multimodal Language Model for Drivingcited by 124
  35. 2024Dissecting Adversarial Robustness of Multimodal LM Agentscited by 118
  36. 2023Regulating ChatGPT and other Large Generative AI Modelscited by 102
  37. 2018Adversarial Attacks and Defences Competitioncited by 96
  38. 2023Rethinking Model Ensemble in Transfer-based Adversarial Attackscited by 88

50 most cited of 56 All 56 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 5; 2026: 5.

10 papers.

  1. 2025Security Challenges in AI Agent Deployment: Insights from a Large Scale Public Competitioncited by 22
  2. 2026How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competitioncited by 16
  3. 2025AdInject: Real-World Black-Box Attacks on Web Agents via Advertising Deliverycited by 9
  4. 2025Black-box Optimization of LLM Outputs by Asking for Directionscited by 7
  5. 2025Adversarial Confusion Attack: Disrupting Multimodal Large Language Modelscited by 3
  6. 2026Steal the Patch Size: Adversarially Manipulate Vision-Language Modelscited by 2
  7. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1
  8. 2026Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMscited by 1
  9. 2025Understanding Adversarial Transfer: Why Representation-Space Attacks Fail Where Data-Space Attacks Succeedcited by 0
  10. 2026Still There, No Longer Seen: Exposing Compression-Induced Risk in Large Vision-Language Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models
  2. 2026Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models
  3. 2025A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1
  4. 2025Attention! Your Vision Language Model Could Be Maliciously Manipulated
  5. 2026Breaking the weakest link to evade vision language models
  6. 2024Enhancing Cross-Prompt Transferability in Vision-Language Models through Contextual Injection of Target Tokens
  7. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models
  8. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models