mlsanityData to 7 Oct 2026

Crafting Adversarial Inputs for Large Vision-Language Models Using Black-Box Optimization

arXiv 2601.01747 ↗First posted 5 Jan 2026cs.CR cs.AI cs.CVcited by 0

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Recent advancements in Large Vision-Language Models (LVLMs) have shown groundbreaking capabilities across diverse multimodal tasks. However, these models remain vulnerable to adversarial jailbreak attacks, where adversaries craft subtle perturbations to bypass safety mechanisms and trigger harmful outputs. Existing white-box attacks methods require full model accessibility, suffer from computing costs and exhibit insufficient adversarial transferability, making them impractical for real-world, black-box settings. To address these limitations, we propose a black-box jailbreak attack on LVLMs via Zeroth-Order optimization using Simultaneous Perturbation Stochastic Approximation (ZO-SPSA). ZO-SPSA provides three key advantages: (i) gradient-free approximation by input-output interactions without requiring model knowledge, (ii) model-agnostic optimization without the surrogate model and (iii) lower resource requirements with reduced GPU memory consumption. We evaluate ZO-SPSA on three LVLMs, including InstructBLIP, LLaVA and MiniGPT-4, achieving the highest jailbreak success rate of 83.0% on InstructBLIP, while maintaining imperceptible perturbations comparable to white-box methods. Moreover, adversarial examples generated from MiniGPT-4 exhibit strong transferability to other LVLMs, with ASR reaching 64.18%. These findings underscore the real-world feasibility of black-box jailbreaks and expose critical weaknesses in the safety mechanisms of current LVLMs

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 20 of its 39 references that are in the map. First posted on arXiv 5 Jan 2026.

Builds on

20 of 39 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov
  2. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  3. 2023Jailbreak in pieces: Compositional Adversarial Attacks on Multi-Modal Language Models26 Jul

Other references · 17

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,456
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  4. 2023InstructBLIP: Towards General-purpose Vision-Language Models with Instruction Tuningcited by 2,855
  5. 2020RealToxicityPrompts: Evaluating Neural Toxic Degeneration in Language Modelscited by 1,235
  6. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  7. 2023Fine-Tuning Language Models with Just Forward Passescited by 337
  8. 2023Are aligned neural networks adversarially aligned?cited by 305
  9. 2023MultiModal-GPT: A Vision and Language Model for Dialogue with Humanscited by 255
  10. 2023Pretraining Language Models with Human Preferencescited by 245
  11. 2021Process for Adapting Language Models to Society (PALMS) with Values-Targeted Datasetscited by 179
  12. 2020A Primer on Zeroth-Order Optimization in Signal Processing and Machine Learningcited by 160
5 more
  1. 2024Revisiting Zeroth-Order Optimization for Memory-Efficient LLM Fine-Tuning: A Benchmarkcited by 113
  2. 2023How Many Unicorns Are in This Image? A Safety Evaluation Benchmark for Vision LLMscited by 103
  3. 2022Why Should Adversarial Perturbations be Imperceptible? Rethink the Research Paradigm in Adversarial NLPcited by 99
  4. 2023DeepZero: Scaling up Zeroth-Order Optimization for Deep Model Trainingcited by 76
  5. 2019ZO-AdaMM: Zeroth-Order Adaptive Momentum Method for Black-Box Optimizationcited by 75

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  2. 2025Making Every Step Effective: Jailbreaking Large Vision-Language Models Through Hierarchical KV Equalization
  3. 2026Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models
  4. 2024Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models
  5. 2025Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-based Attacks
  6. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models
  7. 2024Jailbreak Vision Language Models via Bi-Modal Adversarial Prompt
  8. 2024White-box Multimodal Jailbreaks Against Large Vision-Language Models