{"id":"3cf3f178-a084-4103-8607-2ebef0348644","arxiv_id":"2505.01050","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"Targeted, barely visible image perturbations transfer from open-source surrogate models to proprietary black-box VLLMs like GPT-4o, Claude, and Gemini, achieving high attack success on captioning, VQA, and receipt text recognition.","lead":"This paper shows that subtle image changes, computed with free open-source models, can make commercial vision-language models like GPT-4o, Claude, and Gemini describe images as the attacker wants, often over 90% of the time in their tests. The finding matters because it points to a shared, transferable vulnerability in current multimodal AI systems.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Headline ASR numbers depend on hyperparameters selected using the same proprietary victims (Tables 3–5); without a fixed-a-priori protocol, Table 2 overstates zero-query transfer.","rationale":"I read the paper as claiming that a perturbation optimized only on open-source surrogates transfers to proprietary VLLMs, with quantitative support in Tables 2, 6, and 7. The method itself is credible: ensembled CLIP surrogates plus image-image contrastive loss is a natural transfer technique, and the open-source victim results (e.g., Qwen2-VL 7B 89.9%) are consistent with known cross-model transfer. The reader's conditional verdict is appropriate. My main concern is the same one the reader flagged: the proprietary victims appear in the hyperparameter-selection loop (Tables 3-5) and in auxiliary data construction (Section 4), so the reported ASR is not a clean measure of black-box transfer. I would not elevate this to rejection because the qualitative phenomenon has independent support (open-source victims, random-perturbation sanity checks) and the flaw is fixable by a holdout protocol. A secondary issue, not load-bearing for the transfer claim but worth flagging: the abstract and conclusion announce universal perturbations, but no universal-perturbation experiment appears in the main text or appendix; that claim should either be added or removed. Overall verdict remains CONDITIONAL.","tokens_in":17657,"tokens_out":6021,"duration_ms":60736,"concrete_test":"Re-run the Section 5.1 image-captioning protocol with a pre-registered configuration: choose the surrogate set, N/K, and augmentation probabilities using only open-source validation models (e.g., Qwen2-VL 7B and Llama-3.2 11B) or public benchmarks, and do not call GPT-4o/Claude/Gemini until the final evaluation. Compare the resulting Table 2 ASR per model at epsilon=16/255 (and 8/255) against the reported values, with at least 5 independent runs to obtain confidence intervals. If GPT-4o ASR falls by more than roughly 5-10 points, the reported numbers overstate blind transfer; if it stays within noise, the concern is minor.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The strongest quantitative claim is that at 16/255 the attack reaches 94.4% targeted ASR on GPT-4o and transfers across proprietary VLLMs (Table 2). For this to be a black-box transfer result, the attack configuration should be fixed before any victim-API information is used. The paper's own ablations violate this: Section 5.1 reports that N=50/K=10 (Table 4), the 8-CLIP surrogate ensemble (Table 3), and the augmentation/regularization stack (Table 5) were selected by measuring ASR on GPT-4o and Claude 3.5, the same models later counted as victims. The effect is not negligible: removing DropPath drops Claude 3.5 from 58.7% to 42.4%, and removing random padding drops it to 46.7% (Table 5). Thus the headline numbers are an upper envelope of a search over configurations evaluated on the target models, not an estimate of a fixed attack's transferability. Section 4 adds a second leak: GPT-4o and Claude 3.5 are used to filter positive examples (image captioning) and to generate captions (VQA). A qualitatively transferable vulnerability may well survive a clean protocol, but the specific magnitudes 94.4%/83.9% cannot be read as the success rate of an attacker who never queries the victim. The fix is straightforward: freeze the configuration using only open-source surrogates, then evaluate on proprietary models once.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a transfer-based targeted adversarial attack against black-box vision-language models. The method optimizes an l_infty-bounded perturbation over an ensemble of open-source CLIP-style and other visual encoders, using a visual contrastive loss defined over N positive and N negative image examples with top-K selection, and augments the optimization with Gaussian noise, random crop/pad/resize, random JPEG compression, DropPath, PatchDrop, and perturbation averaging. The authors evaluate the attack in three settings: image captioning on 50 images from the NIPS 2017 dev set, VQA on 30 LLaVA-Bench entries, and receipt text recognition on 20 images, reporting targeted ASR against open-source Qwen/Llama models and proprietary GPT-4o, Claude, and Gemini models. Headline results include 94.4% ASR on GPT-4o at epsilon=16/255 for image captioning and 58.7% on Claude 3.5, with lower but non-trivial transfer in the other settings. The abstract also claims universal perturbations that work across images.","tokens_in":17937,"tokens_out":6811,"duration_ms":66969,"significance":"If the central claim holds under a clean protocol, the paper would be a significant empirical contribution to adversarial robustness of multimodal models: it would demonstrate that targeted misinterpretation of images is feasible against state-of-the-art proprietary VLLMs using only open-source surrogates, with potential safety implications for content moderation, OCR, and downstream autonomous systems. The paper's strengths include a broad victim matrix (two open-source families and three proprietary families), three task settings, sanity checks with random perturbations, manual inspection of text-recognition outputs, and a careful ablation of ensemble composition, loss design, and augmentation. These make the qualitative finding plausible and the engineering contribution useful. However, the quantitative transferability claims are currently overstated because victim information enters through hyperparameter and auxiliary-label channels, and the universal-perturbation claim is not experimentally supported.","major_comments":[{"comment":"The reported headline ASRs in Table 2 are not measurements of a fixed, zero-query transfer attack, because the attack configuration was selected using the same proprietary victims that are later reported as attacked. Section 5.1 presents ablations of the surrogate ensemble (Table 3), the loss hyperparameters N and K (Table 4), and the augmentation/regularization stack (Table 5), with ASR measured on GPT-4o and Claude 3.5; the configuration used for Table 2 (8 CLIP surrogates, N=50, K=10, full augmentation stack) is the best point of this victim-dependent search. The effect is material: removing DropPath lowers Claude 3.5 from 58.7% to 42.4%, and removing random padding lowers it to 46.7% (Table 5). As reported, the paper therefore gives an upper envelope over a victim-tuned configuration, not an estimate of the success rate of an attacker who never queries the target. Please fix the configuration once using only open-source surrogates or a held-out validation split that excludes the proprietary victims, and then evaluate on GPT-4o, Claude, and Gemini a single time.","section":"§5.1, Tables 3–5"},{"comment":"Victim information also enters through the construction of the positive/negative example sets. In the image-captioning setting, the paper states that GPT-4o is used for zero-shot image recognition to filter images for the ground-truth and target categories; in the VQA setting, captions of the source and target images are generated using GPT-4o and Claude 3.5. Both GPT-4o and Claude 3.5 are later counted as victims in Section 5. This means the attack objective is informed by the very models whose transferability is being measured, even before any hyperparameter tuning. The authors should either generate all auxiliary annotations with open-source models (e.g., Qwen, Llama, or CLIP) or explicitly report which auxiliary labels came from each victim and argue that this channel does not inflate ASR. As it stands, the black-box claim in the abstract is not fully supported.","section":"§4 (Image Captioning and VQA)"},{"comment":"The abstract and introduction claim that universal perturbations—single perturbations applicable to a wide set of images—can consistently induce misinterpretations across multiple proprietary VLLMs. I could not find any experiment in Section 5 that optimizes one perturbation over many images and evaluates it on held-out images; all reported evaluations are per-image perturbations (e.g., 50 images in captioning, 30 in VQA, 20 in text recognition). If universal attacks were performed, the experimental protocol and results are missing; if not, the claim should be removed or explicitly marked as a conjecture. This is load-bearing because universality is a headline contribution in the abstract.","section":"Abstract and §5"},{"comment":"The captioning evaluation uses only 50 images selected from the NIPS 2017 development set, and the VQA and text-recognition evaluations use 30 and 20 entries, respectively. With 50 independent trials, the 95% confidence interval for an ASR near 90% is roughly ±8 percentage points, so many reported differences (e.g., 93.4 vs. 94.4 in Table 3, and several rows of Table 4) are within sampling noise. The paper should report confidence intervals or bootstrap estimates, and ideally increase the number of test images for the headline claims. Without this, the relative ranking of configurations and models in the ablations is not statistically grounded.","section":"§5.1, Tables 2–5"}],"minor_comments":[{"comment":"The entry \"textual, N = 50, K = 10\" reports \"783.2\" ASR, which is impossible and appears to be a typo for \"78.2\"; please correct it. In addition, the text introducing the loss-function ablation says \"Table 5 summarizes the results\" when it should refer to Table 4.","section":"§5.1, Table 4"},{"comment":"The input size is inconsistent across tables: Table 2 states 299, while Tables 3 and 4 state 229; please clarify whether this is 224 or 299 and ensure all captions match the actual protocol. The appendix also contains an unresolved cross-reference, \"Table ??,\" in Section 7.","section":"Table captions and §7"},{"comment":"The paper does not report the number of optimization iterations, the optimizer (e.g., Adam), learning rate, batch size, or total compute for generating one perturbation, which are necessary for reproducing the method. Please add these details or a pointer to released code.","section":"§3"},{"comment":"Several related-work citations are incomplete or ambiguous: \"Wu et al.\" appears without a year or matching bibliography entry, and some claims about prior ASR numbers would benefit from direct citations to the reported experiments.","section":"§2"}],"recommendation":"major_revision","confidential_remarks":"The qualitative finding is likely correct and the paper has strong engineering, but the current protocol is not clean enough for the quantitative zero-query transfer claims. I would not accept without a fixed-a-priori evaluation and either added universal-perturbation experiments or a rewording of the abstract. I also note that no code or dataset release is mentioned, which limits reproducibility of the API experiments."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"This paper is worth knowing about. Its core claim—that targeted image perturbations optimized on open-source models transfer to proprietary VLLMs and can flip safety-relevant interpretations—is credible and, if true, important. The method is a genuine extension over prior CLIP-text-similarity losses: the visual contrastive loss with multiple positive/negative image examples and top-K selection, plus an 8-CLIP ensemble and a stack of transfer-oriented augmentations, is well motivated and appears to help in ablations. The appendix examples (weapons misread as safe, receipt text flipping, image-to-image VQA) are striking and align with the qualitative finding.\n\nThe problem is the quantitative protocol. The headline ASRs (94.4% on GPT-4o at 16/255, 83.9% at 8/255) were obtained with hyperparameters—N, K, surrogate set, augmentation stack—selected using ablations on GPT-4o and Claude 3.5, the same models later reported as victims. That is information leakage. An attacker who never queried the victim would not know that DropPath buys 16 points on Claude or that padding matters that much. The stress-test note on this point is accurate; it is not an artifact of the review pipeline. The fixed-a-priori transfer ASR could be substantially lower.\n\nThe paper has other soft spots. The universal perturbation claim in the abstract and conclusion never gets a dedicated experiment; as written, it is unsupported. The VQA results are single-run without confidence intervals, and using GPT-4o as the judge is a possible confound. There are also internal inconsistencies: Table 4 lists an ASR of 783.2% (obvious typo), and the caption/VQA settings use GPT-4o and Claude to select positive examples or generate captions, which is a second, smaller channel of victim information.\n\nNone of this is fatal. The qualitative phenomenon is probably real. The fix is straightforward: freeze the configuration using only open-source surrogates, then evaluate on proprietary APIs once. Add error bars, drop or substantiate the universal perturbation claim, and clean up typos.\n\nWho is this for? Security researchers and red-teamers working on multimodal alignment. If you trust the qualitative finding despite the inflated numbers, it is a motivating result. I would send it to peer review—serious referees can push for the clean protocol. For myself, I'd cite the method but not the headline ASRs.","headline":"A credible qualitative finding on transferable VLLM attacks, but the headline ASRs are inflated because hyperparameters were tuned on the same victim APIs.","tokens_in":18508,"tokens_out":3484,"would_cite":true,"duration_ms":34493,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper claims that small image perturbations computed from open-source CLIP models transfer to black-box GPT-4o, Claude, and Gemini, achieving 94.4% targeted image-captioning success on GPT-4o at an epsilon of 16/255.","keywords":["adversarial attack","vision-language model","transferability","black-box attack","targeted attack","CLIP ensemble","visual contrastive loss","universal perturbation"],"falsifier":"Run the complete recipe on proprietary VLLMs that were excluded from every ablation, with all hyperparameters fixed before any proprietary query, using only the public open-source surrogate models and augmentations described in the paper; if the targeted attack success rate on those held-out victims drops far below the reported 94.4% and 83.9%, the configuration was tuned to the victims rather than being genuinely transferable.","tokens_in":17438,"feed_emoji":"🖼️","tokens_out":7524,"duration_ms":67783,"temperature":0.7,"pith_summary":"Vision-language models that accept images and return text are supposed to let a user ask what is in a picture, but the paper establishes that a determined attacker can reverse that bargain: adding a small, bounded perturbation to the image makes GPT-4o, Claude, and Gemini describe the scene with the attacker's chosen category or answer, even though the attacker never queries or sees the internal weights of those models. The headline numbers come from an image-captioning evaluation where the attack succeeds 94.4% of the time on GPT-4o at a perturbation bound of 16/255, and still 83.9% at 8/255, with the same recipe transferring to visual question answering and receipt-text recognition. Because the perturbation is crafted from open-source surrogate models, the result implies that the alignment and safety training of commercial multimodal systems can be circumvented without any access to the system. The paper also shows universal perturbations that work across many images and across multiple proprietary models, which makes the threat apply to deployed systems that process arbitrary inputs.","feed_headline":"Image edits make GPT-4o see attacker-chosen objects","feed_subtitle":"With no model access, a visual perturbation transfers from open-source encoders to GPT-4o, Claude, and Gemini.","key_machinery":"The engine of the attack is the Visual Contrastive Loss, defined in the embedding space of a surrogate CLIP visual encoder: for the perturbed image $x_\\delta$, the loss measures, for each of $N=50$ positive images aligned with the target text and $N=50$ negative images aligned with the original answer, the probability that $x_\\delta$ is closer to the positive distribution than to the negative distribution, and the attacker maximizes only the top $K=10$ positive probabilities. This loss uses only the visual encoder, avoiding reliance on the text encoder's alignment with the black-box model. Around that loss, the method builds transferability from three levels: model level (an ensemble of eight CLIP variants plus DropPath and PatchDrop regularization and perturbation weight averaging), loss level (many visual positive and negative examples instead of one text pair), and data level (random Gaussian noise, random crop/pad/resize, and differentiable JPEG compression applied during optimization). The argument is that these choices stop the perturbation from overfitting to quirks of the surrogate models, leaving a perturbation that lands in a visual-embedding region shared by open and proprietary models.","core_discovery":"The central claim, stated as the authors would state it to a fair reader, is that targeted adversarial examples are highly transferable to proprietary black-box VLLMs: an attacker can induce specific, attacker-chosen interpretations of visual content in GPT-4o, Claude, and Gemini by optimizing a single perturbation against an ensemble of open-source CLIP-style visual encoders. Unlike earlier transfer attacks that matched images to text or attacked open VLLMs, this attack uses a visual contrastive loss that compares the perturbed image directly to images representing the target and the original interpretation, and this image-to-image formulation is what the paper credits for the jump in transfer success. The same approach yields universal perturbations that generalize across images and models, and across the three studied tasks the vulnerability is common to every victim model tested, with Claude noticeably harder to fool at small perturbation budgets.","pith_inferences":["Extending beyond the paper, the same visual-contrastive objective is transferable to video frames, agentic systems that act on VLLM perception, or multimodal retrieval pipelines; a wrong frame interpretation could trigger an action without any textual jailbreak.","The paper's ablations were run against the same proprietary victims later reported as successes, so the most honest public benchmark would freeze all hyperparameters using only open-source models and only then query proprietary APIs as a genuinely held-out set.","A defender could test a cheap mitigation that the paper does not: insert a stochastic or learned preprocessing step (randomized resizing, JPEG recompression, or a perceptual hash) between the API input and the vision encoder, to see whether the shared embedding region the attack relies on can be disrupted."],"forward_implications":["An API-only attacker can make a vision-language safety check report 'no weapons' or 'no restricted content' on an image that actually contains them, without any access to the model's weights or training data.","The same attack recipe transfers across three task families, so a defense that works for image captioning cannot be assumed to protect visual question answering or text recognition.","Universal perturbations mean a single crafted image modification can force consistent misinterpretations across many different input images and across several proprietary models at once, widening the attack surface of deployed systems.","Claude 3.5/3.7 Sonnet is markedly harder to fool at 8/255 than the other victims, indicating there is a meaningful spread in resistance among current proprietary models."],"supporting_citations":[{"why":"Supplies the prior transfer-to-GPT-4V result (45% untargeted success) that the paper's targeted rates are measured against, establishing the baseline for comparison.","marker":"Dong et al. (2023)"},{"why":"Provides the image-text cosine-similarity loss, Equation 3, that the paper replaces with the visual-visual contrastive loss; it is the baseline loss formulation.","marker":"Wu et al."},{"why":"Proposes image-image feature matching for attacking open-source VLLMs; the paper adapts this idea to visual-only surrogate models and to proprietary victims.","marker":"Zhao et al. (2023)"},{"why":"Defines CLIP, the source of the eight surrogate visual encoders whose embedding space the Visual Contrastive Loss operates in.","marker":"Radford et al. (2021)"},{"why":"Supplies the NIPS 2017 Adversarial Learning Challenges development set, the 1,000-image benchmark with ground-truth and target labels used for the image-captioning experiments.","marker":"Kurakin et al. (2018)"},{"why":"Provides LLaVA-Bench (COCO), the 30-image benchmark with conversation, description, and reasoning questions used to evaluate visual question answering.","marker":"Liu et al. (2024a)"},{"why":"Supplies the retail receipt dataset used for the text-recognition attack setting, where questions are answered from OCR-extracted receipt text.","marker":"TrainingDataPro (2025)"},{"why":"Establishes universal and transferable adversarial attacks on aligned language models, the principle of universality that the paper extends to vision-language models.","marker":"Zou et al. (2023)"}],"fun_headline_variants":["Adversarial images trick GPT-4o, Claude, Gemini via transfer","One perturbation fools multiple black-box vision-language models","Transferable attacks hijack vision-language models' interpretations","Universal adversarial perturbations work across proprietary VLLMs","Attacker-chosen misinterpretations transfer to GPT-4o, Claude, Gemini"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the attack's configuration (50 positive and 50 negative images per target, top-$K$ selection with $K=10$, the eight-CLIP surrogate ensemble, and the augmentation schedule) would be chosen just as effectively by an attacker who fixed them in advance from open-source information; because the paper selected these settings by ablation measuring success on GPT-4o and Claude, the same models it later reports as victims, the reported attack-success rates could overstate the transferability of the recipe itself.","fun_headline_variants_meta":{"raw":{"variants":["Adversarial images trick GPT-4o, Claude, Gemini via transfer","One perturbation fools multiple black-box vision-language models","Transferable attacks hijack vision-language models' interpretations","Universal adversarial perturbations work across proprietary VLLMs","Attacker-chosen misinterpretations transfer to GPT-4o, Claude, Gemini"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000233,"raw_usage":{"total_tokens":1479,"prompt_tokens":915,"completion_tokens":564,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":531,"completion_tokens_details":{"reasoning_tokens":479}},"tokens_in":531,"tokens_out":564,"duration_ms":5630,"temperature":1.0,"reasoning_tokens":479,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:28:23.250142+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Run the complete recipe on proprietary VLLMs that were excluded from every ablation, with all hyperparameters fixed before any proprietary query, using only the public open-source surrogate models and augmentations described in the paper; if the targeted attack success rate on those held-out victims drops far below the reported 94.4% and 83.9%, the configuration was tuned to the victims rather than being genuinely transferable.","supporting_citations":[{"cited_title":"On evaluating adversarial robustness of large vision-language models, 2023","cited_arxiv_id":null,"evidence_quote":"Proposes image-image feature matching for attacking open-source VLLMs; the paper adapts this idea to visual-only surrogate models and to proprietary victims."},{"cited_title":"Adversarial attacks and defences competition","cited_arxiv_id":null,"evidence_quote":"Supplies the NIPS 2017 Adversarial Learning Challenges development set, the 1,000-image benchmark with ground-truth and target labels used for the image-captioning experiments."},{"cited_title":"Ocr receipts text detection - retail dataset","cited_arxiv_id":null,"evidence_quote":"Supplies the retail receipt dataset used for the text-recognition attack setting, where questions are answered from OCR-extracted receipt text."}],"review_version":1}