mlsanityData to 14 Oct 2026

Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs

arXiv 2605.21541 ↗First posted 20 May 2026cs.CR cs.AI cs.LGcited by 2

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

Abstract (arXiv)

Multimodal large language models (MLLMs) remain vulnerable to transfer-based targeted attacks, where perturbations optimized on open-source surrogate encoders can generalize to closed-source MLLMs. A key challenge for improving adversarial transferability is to effectively capture the intrinsic visual focus shared across different models, such that perturbations align with transferable semantic cues rather than surrogate-specific behaviors. However, existing methods suffer from spatial-domain feature redundancy and surrogate-specific gradient signals, thereby hindering cross-model transferability. In this paper, we propose FRA-Attack, which addresses both challenges from a unified frequency-domain regularization perspective. For feature alignment, a high-pass DCT objective on patch features suppresses redundant global structures and concentrates the loss on the high-frequency band that carries the MLLMs' intrinsic visual focus. For gradient optimization, we introduce Frequency-domain Gradient Regularization (FGR), a textitmodel-agnostic low-pass regularizer that modulates the surrogate gradient using only the geometric frequency coordinate, textiti.e., no surrogate-derived statistic is involved, so that FGR is model-agnostic by construction, removing surrogate-specific high-frequency artifacts while preserving transferable low-frequency directions. Together, the two components form a unified frequency-domain treatment of transferability. Extensive experiments on 15 flagship MLLMs across 7 vendors show that FRA-Attack achieves superior cross-model transferability, particularly with state-of-the-art performance on GPT-5.4, Claude-Opus-4.6 and Gemini-3-flash.

Key facts. Cited by 2 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 41 of its 48 references that are in the map. First posted on arXiv 20 May 2026.

Builds on

41 of 48 references.

Closest ancestors · 10

Same direction, newest first

  1. 2026Pushing the Frontier of Black-Box LVLM Attacks via Fine-Grained Detail Targeting19 Feb
  2. 2025Transferable Adversarial Attacks on Black-Box Vision-Language Models2 May
  3. 2025A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o113 Mar
  4. 2025Improving Adversarial Transferability in MLLMs via Dynamic Vision-Language Alignment Attack27 Feb
  5. 2024AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models7 Oct
  6. 2024Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models16 Apr
  7. 2024Boosting Transferability in Vision-Language Attacks via Diversification along the Intersection Region of Adversarial Trajectory19 Mar
  8. 2024Safety of Multimodal Large Language Models on Images and Texts1 Feb
  9. 2023How Robust is Google's Bard to Adversarial Image Attacks?21 Sep
  10. 2023On Evaluating Adversarial Robustness of Large Vision-Language Models26 May

Other references · 31

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  3. 2024The Llama 3 Herd of Modelscited by 14,715
  4. 2023Visual Instruction Tuningcited by 7,869
  5. 2014Explaining and Harnessing Adversarial Examplescited by 7,364
  6. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  7. 2024GPT-4o System Cardcited by 4,588
  8. 2022Flamingo: a Visual Language Model for Few-Shot Learningcited by 4,386
  9. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,322
  10. 2025Gemini 2.5: Pushing the Frontier with Advanced Reasoning, Multimodality, Long Context, and Next Generation Agentic Capabilitiescited by 3,796
  11. 2025Qwen3-VL Technical Reportcited by 2,793
  12. 2025Gemma 3 Technical Reportcited by 1,824
19 more
  1. 2025OpenAI GPT-5 System Cardcited by 989
  2. 2026Kimi K2.5: Visual Agentic Intelligencecited by 501
  3. 2025GLM-4.5V and GLM-4.1V-Thinking: Towards Versatile Multimodal Reasoning with Scalable Reinforcement Learningcited by 466
  4. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 244
  5. 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 130
  6. 2021Stochastic Variance Reduced Ensemble Adversarial Attack for Boosting the Adversarial Transferabilitycited by 84
  7. 2018Low Frequency Adversarial Perturbationcited by 80
  8. 2025Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignmentcited by 43
  9. 2023Transferable Adversarial Attacks on Vision Transformers with Token Gradient Regularizationcited by 42
  10. 2022Bootstrap Generalization Ability from Loss Landscape Perspectivecited by 16
  11. 2022Defects of Convolutional Decoder Networks in Frequency Representationcited by 10
  12. 2024FACL-Attack: Frequency-Aware Contrastive Learning for Transferable Adversarial Attackscited by 8
  13. 2025Improving Adversarial Transferability on Vision Transformers via Forward Propagation Refinementcited by 7
  14. 2022Enhancing Transferability of Adversarial Examples with Spatial Momentumcited by 4
  15. 2023Towards Transferable Adversarial Attacks with Centralized Perturbationcited by 3
  16. 2024Exploring Frequencies via Feature Mixing and Meta-Learning for Improving Adversarial Transferabilitycited by 3
  17. 2025Boosting Adversarial Transferability via High-Frequency Augmentation and Hierarchical-Gradient Fusioncited by 3
  18. 2025TESSER: Transfer-Enhancing Adversarial Attacks from Vision Transformers via Spectral and Semantic Regularizationcited by 2
  19. 2025Boosting Adversarial Transferability via Commonality-Oriented Gradient Optimizationcited by 1

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 2.

2 papers.

  1. 2026One Attack to Fool Them All: Highly Transferable Black-Box Adversarial Attacks on Frontier MLLMscited by 0
  2. 2026Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization
  2. 2026Adversarial Attacks Against MLLMs via Progressive Resolution Processing and Adaptive Feature Alignment
  3. 2026Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domain
  4. 2024Transfer Attack for Bad and Good: Explain and Boost Adversarial Transferability across Multimodal Large Language Models
  5. 2025Transferability of Adversarial Attacks in Video-based MLLMs: A Cross-modal Image-to-Video Approach
  6. 2025Survey of Adversarial Robustness in Multimodal Large Language Models
  7. 2026Investigating Adversarial Robustness of Multi-modal Large Language Models
  8. 2023Exploring Transferability of Multimodal Adversarial Samples for Vision-Language Pre-training Models with Contrastive Learning