mlsanityData to 14 Oct 2026

Attention! Your Vision Language Model Could Be Maliciously Manipulated

arXiv 2505.19911 ↗First posted 26 May 2025cs.CVcited by 12

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Large Vision-Language Models (VLMs) have achieved remarkable success in understanding complex real-world scenarios and supporting data-driven decision-making processes. However, VLMs exhibit significant vulnerability against adversarial examples, either text or image, which can lead to various adversarial outcomes, e.g., jailbreaking, hijacking, and hallucination, etc. In this work, we empirically and theoretically demonstrate that VLMs are particularly susceptible to image-based adversarial examples, where imperceptible perturbations can precisely manipulate each output token. To this end, we propose a novel attack called Vision-language model Manipulation Attack (VMA), which integrates first-order and second-order momentum optimization techniques with a differentiable transformation mechanism to effectively optimize the adversarial perturbation. Notably, VMA can be a double-edged sword: it can be leveraged to implement various attacks, such as jailbreaking, hijacking, privacy breaches, Denial-of-Service, and the generation of sponge examples, etc, while simultaneously enabling the injection of watermarks for copyright protection. Extensive empirical evaluations substantiate the efficacy and generalizability of VMA across diverse scenarios and datasets. Code is available at https://github.com/Trustworthy-AI-Group/VMA.

Key facts. Cited by 12 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 49 of its 56 references that are in the map. First posted on arXiv 26 May 2025.

Builds on

49 of 56 references.

Closest ancestors · 18

Same direction, newest first

  1. 2025Stealthy Backdoor Attack in Self-Supervised Learning Vision Encoders for Large Vision Language Models25 Feb
  2. 2024Exploring Visual Vulnerabilities via Multi-Loss Adversarial Search for Jailbreaking Vision-Language Models27 Nov
  3. 2024Safe + Safe = Unsafe? Exploring How Safe Images Can Be Exploited to Jailbreak Large Vision-Language Models18 Nov
  4. 2024Protecting Privacy in Multimodal Large Language Models with MLLMU-Bench29 Oct
  5. 2024BlueSuffix: Reinforced Blue Teaming for Vision-Language Models Against Jailbreak Attacks28 Oct
  6. 2024Unraveling and Mitigating Safety Alignment Degradation of Vision-Language Models11 Oct
  7. 2024Cross-modality Information Check for Detecting Jailbreaking in Multimodal Large Language Models31 Jul
  8. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends10 Jul
  9. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt6 Jun
  10. 2024Private Attribute Inference from Images with Vision-Language Models16 Apr
  11. 2024AdaShield: Safeguarding Multimodal Large Language Models from Structure-based Attack via Adaptive Shield Prompting14 Mar
  12. 2024Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models5 Feb
6 more
  1. 2023InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models4 Dec
  2. 2023MM-SafetyBench: A Benchmark for Safety Evaluation of Multimodal Large Language Models29 Nov
  3. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  4. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  5. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Models22 Jun
  6. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 31

  1. 2017Attention Is All You Needcited by 60,361
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  4. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 13,028
  5. 2023Visual Instruction Tuningcited by 7,869
  6. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  7. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,415
  8. 2013Intriguing properties of neural networkscited by 5,155
  9. 2024Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolutioncited by 4,234
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  11. 2024Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phonecited by 1,917
  12. 2023Evaluating Object Hallucination in Large Vision-Language Modelscited by 1,729
19 more
  1. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  2. 2023MM-Vet: Evaluating Large Multimodal Models for Integrated Capabilitiescited by 1,239
  3. 2024DeepSeek-VL: Towards Real-World Vision-Language Understandingcited by 733
  4. 2023Are aligned neural networks adversarially aligned?cited by 315
  5. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  6. 2023MMA-Diffusion: MultiModal Attack on Diffusion Modelscited by 194
  7. 2023LLM Lies: Hallucinations are not Bugs, but Features as Adversarial Examplescited by 177
  8. 2024Jailbreaking Attack against Multimodal Large Language Modelcited by 135
  9. 2023VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Modelscited by 68
  10. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  11. 2023Structure Invariant Transformation for better Adversarial Transferabilitycited by 62
  12. 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 57
  13. 2020Curse of Dimensionality on Randomized Smoothing for Certifiable Robustnesscited by 56
  14. 2023Boosting Adversarial Transferability by Achieving Flat Local Maximacited by 48
  15. 2023Text-CRS: A Generalized Certified Robustness Framework against Textual Adversarial Attackscited by 34
  16. 2023Rethinking the Backward Propagation for Adversarial Transferabilitycited by 27
  17. 2020Making Adversarial Examples More Transferable and Indistinguishablecited by 19
  18. 2024Bag of Tricks to Boost Adversarial Transferabilitycited by 12
  19. 2022TextHacker: Learning based Hybrid Local Search Algorithm for Text Hard-label Adversarial Attackcited by 10

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 2; 2026: 10.

12 papers.

  1. 2026Adversarial Attacks on Multimodal Large Language Models: A Comprehensive Surveycited by 4
  2. 2026On the Adversarial Robustness of Multimodal LLM Judgescited by 3
  3. 2025Resource Consumption Red-Teaming for Large Vision-Language Modelscited by 2
  4. 2026Sparse Tokens Suffice: Jailbreaking Audio Language Models via Token-Aware Gradient Optimizationcited by 2
  5. 2026SoundBreak: A Systematic Study of Audio-Only Adversarial Attacks on Trimodal Modelscited by 1
  6. 2026Robustness of Vision Language Models Against Split-Image Harmful Input Attackscited by 1
  7. 2025Security Risk of Misalignment between Text and Image in Multi-modal Modelcited by 0
  8. 2026Devling into Adversarial Transferability on Image Classification: Review, Benchmark, and Evaluationcited by 0
  9. 2026Seeing No Evil: Blinding Large Vision-Language Models to Safety Instructions via Adversarial Attention Hijackingcited by 0
  10. 2026Localize and Neutralize: Gradient-guided Token Suppression against Visual Prompt Injection Attackcited by 0
  11. 2026Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domaincited by 0
  12. 2026It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at ε≤ 4/255cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  2. 2024Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models
  3. 2026Breaking the weakest link to evade vision language models
  4. 2025When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs
  5. 2024ImgTrojan: Jailbreaking Vision-Language Models with ONE Image
  6. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  7. 2023Image Hijacks: Adversarial Images can Control Generative Models at Runtime
  8. 2024Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks