mlsanityData to 14 Oct 2026

Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization

arXiv 2601.23179 ↗First posted 30 Jan 2026cs.AIcited by 1

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Targeted adversarial attacks on closed-source multimodal large language models (MLLMs) have been increasingly explored under black-box transfer, yet prior methods are predominantly sample-specific and offer limited reusability across inputs. We instead study a more stringent setting, Universal Targeted Transferable Adversarial Attacks (UTTAA), where a single perturbation must consistently steer arbitrary inputs toward a specified target across unknown commercial MLLMs. Naively adapting existing sample-wise attacks to this universal setting faces three core difficulties: (i) target supervision becomes high-variance due to target-crop randomness, (ii) token-wise matching is unreliable because universality suppresses image-specific cues that would otherwise anchor alignment, and (iii) few-source per-target adaptation is highly initialization-sensitive, which can degrade the attainable performance. In this work, we propose MCRMO-Attack, which stabilizes supervision via Multi-Crop Aggregation with an Attention-Guided Crop, improves token-level reliability through alignability-gated Token Routing, and meta-learns a cross-target perturbation prior that yields stronger per-target solutions. Across commercial MLLMs, we boost unseen-image attack success rate by +23.7% on GPT-4o and +19.9% on Gemini-2.0 over the strongest universal baseline.

Key facts. Cited by 1 paper in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 43 of its 51 references that are in the map. First posted on arXiv 30 Jan 2026.

Builds on

43 of 51 references.

Closest ancestors · 10

Same direction, newest first

  1. 2025From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledge10 Nov
  2. 2025X-Transfer Attacks: Towards Super Transferable Adversarial Attacks on CLIP8 May
  3. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models2 May
  4. 2025Survey of Adversarial Robustness in Multimodal Large Language Models18 Mar
  5. 2025A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o113 Mar
  6. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models7 Oct
  7. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Models9 May
  8. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models16 Apr
  9. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  10. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 33

  1. 2023GPT-4 Technical Reportcited by 18,396
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  3. 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
  4. 2023Visual Instruction Tuningcited by 7,869
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2023Qwen Technical Reportcited by 3,344
  7. 2023MiniGPT-4: Enhancing Vision-Language Understanding with Advanced Large Language Modelscited by 2,711
  8. 2013Sinkhorn Distances: Lightspeed Computation of Optimal Transportation Distancescited by 2,316
  9. 2016Adversarial examples in the physical worldcited by 1,769
  10. 2018On First-Order Meta-Learning Algorithmscited by 1,018
  11. 2024DeepSeek-VL: Towards Real-World Vision-Language Understandingcited by 733
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 599
21 more
  1. 2023Otter: A Multi-Modal Model with In-Context Instruction Tuningcited by 550
  2. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 442
  3. 2021Feature Importance-aware Transferable Adversarial Attackscited by 127
  4. 2023Diffusion Models for Imperceptible and Transferable Adversarial Attackcited by 94
  5. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 93
  6. 2018Generalizable Data-free Objective for Crafting Universal Adversarial Perturbationscited by 88
  7. 2024Natural Language Understanding and Inference with MLLM in Visual Question Answering: A Surveycited by 76
  8. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  9. 2019FDA: Feature Disruptive Attackcited by 56
  10. 2020Universal Adversarial Attack on Attention and the Resulting Dataset DAmageNetcited by 45
  11. 2025Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignmentcited by 43
  12. 2023Generalizable Black-Box Adversarial Attack with Meta Learningcited by 29
  13. 2021Image Captioning for Effective Use of Language Models in Knowledge-Based Visual Question Answeringcited by 25
  14. 2024Transferable Adversarial Attacks on SAM and Its Downstream Modelscited by 21
  15. 2024Enhancing Advanced Visual Reasoning Ability of Large Language Modelscited by 18
  16. 2025One Surrogate to Fool Them All: Universal, Transferable, and Targeted Adversarial Attacks with CLIPcited by 15
  17. 2019Simple iterative method for generating targeted universal adversarial perturbationscited by 14
  18. 2025Test-Time Backdoor Detection for Object Detection Modelscited by 14
  19. 2025Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2cited by 11
  20. 2024Improving Transferable Targeted Attacks with Feature Tuning Mixupcited by 6
  21. 2025DarkHash: A Data-Free Backdoor Attack Against Deep Hashingcited by 6

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Modelscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
  2. 2026Adversarial Attacks Against MLLMs via Progressive Resolution Processing and Adaptive Feature Alignment
  3. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMs
  4. 2026LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models
  5. 2026Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs
  6. 2026Pushing the Frontier of Black-Box LVLM Attacks via Fine-Grained Detail Targeting
  7. 2025Universal Adversarial Attack on Aligned Multimodal LLMs
  8. 2026Hierarchical Refinement of Universal Multimodal Attacks on Vision-Language Models