Pith. sign in

REVIEW 3 major objections 5 minor 57 references

Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks

T0 review · 3 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A chain of image re-captioning steps lets black-box attacks steer vision-language models toward targeted captions.

desk verdict A useful attack idea with a flawed headline evaluation: per-victim grid search and an equation/code mismatch undercut the reported margins, but the chain and LLM-ASR are worth refereeing. read the letter →

arxiv 2411.15720 v1 pith:BPJ57TB5 submitted 2024-11-24 cs.CV

Peng Xie , Yequan Bie , Jianda Mao , Yangqiu Song , Yang Wang , Hao Chen , Kani Chen This is my paper · ORCID
classification cs.CV
keywords adversarialattacktransferabilityvision-languagemodelstargetedCLIPimagecaptioningsuccessrateblack-box
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper proposes Chain of Attack (CoA), a transfer-based adversarial attack that crafts one image perturbation capable of making open-source vision-language models (VLMs) generate a chosen target caption, without any query to the victim model. The method works by repeatedly re-captioning the current adversarial image with a frozen captioning model and using a contrastive loss in CLIP embedding space to pull the image-text pair toward the target semantics step by step. The authors claim CoA consistently outperforms existing transfer attacks on both CLIP-score similarity and their proposed LLM-based attack success rate, and that it does so at lower computational cost than query-based alternatives. A sympathetic reader would care because the paper attacks the strongest realistic threat model—an adversary with no knowledge of the victim model—and still produces captions that match the target text closely for several open-source VLMs.

What carries the argument

The key machinery is the attacking chain: at each optimization step, a frozen image-to-text model (ClipCap) captions the current adversarial image, producing an adversarial caption $T_{\text{adv}}$; the modality-aware embedding $F_{\text{adv}} = \alpha E_v(I_{\text{adv}}) + (1-\alpha) E_t(T_{\text{adv}})$ is then matched against a target modality-aware embedding $F_{\text{ref}}$ via Targeted Contrastive Matching, $\mathcal{L} = \max(\lVert \text{sim}(F_{\text{ref}}, F_{\text{adv}}) - \beta \, \text{sim}(F, F_{\text{adv}}) \rVert + \gamma, 0)$, and the perturbation is updated by PGD in CLIP space. The chain matters because the caption reflects the current visual semantics, so the gradient signal is re-grounded at every step instead of being fixed to a static target; the paper argues this richer, dynamically updated semantic guidance is what improves transfer to unseen victim models.

What would settle it

Run CoA with a fixed clean caption in place of the per-step adversarial caption; if CLIP-score and LLM-based ASR remain at the same level, the claimed benefit of re-captioning is not real. Alternatively, replace ClipCap with a deliberately inaccurate captioner and observe whether the attack success collapses.

Watch

Extended reading notes

Core claim

The central claim is that adversarial transferability to VLMs is substantially improved by explicitly chaining multi-modal semantic updates: at each PGD step, the current adversarial image is re-captioned by a public image-to-text model, the caption is fused with the image embedding into a modality-aware embedding, and a Targeted Contrastive Matching loss pulls this embedding toward the target image-text pair while pushing it away from the clean pair. The paper reports that this step-by-step semantic evolution yields large gains over baselines, e.g., raising targeted attack success on ViECap from 76.6% (best baseline) to 98.4% and on Unidiffuser from 90.0% to 94.2%, while also improving the CLIP score between the victim's generated text and the target text. The paper also introduces an LLM-based automatic ASR metric that judges attacks as successful (1), fooled-only (0.5), or failed (0), with human-readable explanations.

Load-bearing premise

The entire chain relies on the re-captioning model generating captions of the current adversarial image that are accurate enough to steer the CLIP-space update toward the target; if that caption is systematically wrong or too noisy, the semantic chain breaks and the transferability gains vanish.

Editorial extensions

If this is right

  • If CoA works as reported, black-box attackers can make open-source captioning and multimodal chat models emit targeted captions even though the victim model is never queried and its parameters are unknown.
  • The reported success implies that the evaluated VLMs inherit a shared image-text embedding geometry (largely via CLIP-like encoders), so improving alignment in that shared space transfers across model architectures.
  • The proposed LLM-based ASR could become a standard evaluation for adversarial text-generation attacks, replacing or supplementing CLIP scores with a graded, explainable notion of attack success.
  • The finding that larger models are harder to attack targets a concrete safety property: model scale alone provides partial, not complete, robustness against transfer-based targeted attacks.
  • In practice, the method offers a much cheaper alternative to query-based attacks, implying that current API-style defenses that rely on hiding gradients may still be vulnerable.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same chaining idea could be applied to other multimodal alignment spaces or to video and audio, where re-captioning the intermediate adversarial signal could anchor each step in the modality that is being attacked.
  • If ClipCap captions are noisy on adversarial images, the chain could drift; an explicit test would be to compare CoA with chains that use a fixed clean caption versus a re-caption at each step, isolating how much of the gain comes from the re-captioning.
  • The LLM-based ASR likely rewards paraphrases more generously than exact-match CLIP scores, which may inflate the reported success; a direct comparison with human judgments on the same examples would settle whether 1.0 scores align with human perception of a successful targeted attack.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes Chain of Attack (CoA), a transfer-based targeted adversarial attack against vision-language models. In contrast to existing methods, CoA iteratively re-captions the adversarial image with a frozen image-to-text model (ClipCap), fuses image and text embeddings into modality-aware embeddings, and optimizes a Targeted Contrastive Matching (TCM) loss to move the adversarial embedding toward a target reference. The paper also introduces an LLM-based attack success rate (ASR) metric that judges generated responses against the target text. Experiments on five VLMs (ViECap, SmallCap, Unidiffuser, LLaVA-7B, and LLaVA-13B) report higher CLIP scores and ASR than prior attacks, and the paper claims consistent significant improvement with superior efficiency.

Significance. If the empirical claims hold, CoA offers a practical black-box attack on open-source VLMs, and the chain mechanism is a plausible way to improve transferability of targeted attacks. The proposed LLM-based ASR is a useful evaluation contribution, though it depends on GPT-4 and is not formally validated. The paper includes an algorithm, pseudocode, and an ablation study, which are helpful for reproducibility. However, the main comparative claim is weakened by the evaluation protocol (per-victim hyperparameter selection on the test set) and by an inconsistency between the described loss and the provided pseudocode. These issues can be addressed in revision and do not invalidate the core idea, but they currently prevent the reader from accepting the reported 'consistent significant margin' as established.

major comments (3)
  1. [Sec. 4.1 and Appendix Tables 4-5] The hyperparameters α, β, and γ are selected by grid search on the same ImageNet-1K validation images used for the reported results, with different selected values for each victim (α=0.1 for ViECap, 0.7 for SmallCap, 0.3 for Unidiffuser, 0.5 for LLaVA-7B). No separate validation split is described. Consequently, the 'Ours' row in Table 1 is the best of many grid points evaluated on the test images, while baselines use fixed published settings. This procedure can inflate the reported margins; for example, the ensemble CLIP score gain of CoA over MF-ii for LLaVA-13B is only 0.6 points (45.8 vs 45.2), a difference that could easily result from tuning. To support the claim of consistent significant improvement, the authors should either fix a single hyperparameter set across all victims or perform hyperparameter selection on a held-out validation set and report the resulting test performance, ideally with variance across multiple runs.
  2. [Eq. (7) and Appendix pseudocode] The TCM loss in Eq. (7) and Algorithm 1 includes both a trade-off parameter β and a margin parameter γ, with the loss written as max(||sim(F_ref, F_adv) − β·sim(F, F_adv)|| + γ, 0). The PyTorch-like pseudocode at the end of the appendix implements instead `margin = 1 - beta` and `loss = torch.mean(torch.relu(tgt_sim - beta * cle_sim + margin))`, with no γ at all. Moreover, line 41 of the pseudocode reuses the variable name `alpha` for the PGD step size, conflicting with the modality-balancing α defined in Eq. (5). This inconsistency means the reported results may have been obtained with a different objective than the one described, and the role of γ is ambiguous. The mathematical formulation, the algorithm listing, and the code must be reconciled.
  3. [Sec. 3.2] The chain mechanism assumes that ClipCap generates accurate captions Tadv for the perturbed image at each iteration, so that the text embedding in Fadv is informative. The paper does not validate caption fidelity on adversarial images; Figure 8 shows qualitative chain examples but no quantitative measure of caption correctness (e.g., similarity to the clean caption or to the target). If captions become inaccurate mid-chain, the text term of TCM may inject misleading gradients, potentially reducing the benefit of re-captioning. Please report caption quality during optimization, or add an ablation that replaces Tadv with a fixed or clean caption to isolate the contribution of the re-captioning step.
minor comments (5)
  1. [Figure 4 and Figure 10] The ASR prompt contains a typo: 'roughly similar tothe actual generated text' should read 'roughly similar to the target text.' This wording could confuse the LLM judge in some cases and should be corrected.
  2. [Algorithm 1] In Algorithm 1, the perturbation is initialized as δ ~ Uniform(−ϵ, ϵ), but the loop then sets I_adv = I_adv + δ_t, which would add a random perturbation to the image before any optimization. The pseudocode instead initializes delta to zero. Please clarify the intended initialization and ensure consistency.
  3. [Eq. (7)] The double vertical bars in Eq. (7) around a scalar expression are ambiguous; they should be absolute values, or the expression should be written without norm notation.
  4. [Figure 1 and Sec. 4.3] The efficiency comparison reports training time per step, but CoA incurs an additional caption model forward pass at each iteration. Reporting total wall-clock time for the whole attack would make the efficiency claim more convincing.
  5. [Sec. 3.3] The LLM-based ASR relies on GPT-4, which is non-deterministic. Please report the sampling parameters, the number of repeated queries, or a comparison with human annotations to establish reliability.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the CLIP-space attack objective and the CLIP-score evaluation are related but not identical, and the reported gains are not derived from the method's own outputs by construction.

full rationale

The paper's derivation chain is self-contained. The attack objective in Eq. (7) maximizes a contrastive similarity between modality-aware embeddings of the adversarial example and the target reference, using a frozen CLIP surrogate and a frozen ClipCap captioner (Eqs. 4-6). The CLIP-score metric in Sec. 4.2 measures the similarity between the victim VLM's generated response and the target text using CLIP text encoders. Although both use CLIP, they are not the same function: gradients are taken with respect to the surrogate image encoder on the perturbation, while the evaluated text is produced by unseen frozen victim models (ViECap, SmallCap, Unidiffuser, LLaVA), and the proposed LLM-based ASR (Eq. 9) is an independent GPT-4 judgment channel. No equation in the paper reduces to another by construction, and no fitted parameter is renamed as a prediction. References to prior work (e.g., [41], [54]) are external, not self-citations, and the paper does not import any uniqueness theorem from the authors' own prior work. The per-victim grid search reported in Sec. 4.1 and Appendix Tables 4-5 is a legitimate evaluation-leakage concern: the 'Ours' row may reflect hyperparameters selected on the same ImageNet-1K validation set, which can inflate the comparison against fixed baselines. That is a correctness and experimental-design risk, not a circular derivation, because the reported configuration is still a concrete algorithm and its output is not equivalent to the hyperparameter values themselves.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The attack leans on several unverified modeling choices: CLIP transferability, ClipCap caption fidelity, Stable Diffusion and MiniGPT-4 or GPT-4 preprocessing, and LLM-as-judge validity. None are independently validated here, and the per-victim tuned alpha makes the practical black-box status of the method unclear.

free parameters (3)
  • alpha (modality balance) = 0.1 to 0.9 per victim; best values include 0.1 for ViECap, 0.7 for SmallCap, 0.3 for Unidiffuser, 0.5 for LLaVA-7B
    Grid-searched per victim in Appendix Table 4; the choice changes the ensemble CLIP score by up to 5.6 points, so it materially affects the reported results.
  • beta (TCM trade-off) = 0.6 to 0.9 in the reported grid
    Grid-searched in Appendix Table 5; no single value is used across all victim models, and the final configuration is not precisely stated.
  • gamma (margin) = 0.1 to 0.4 in the reported grid
    Introduced in Eq 7, but the appendix code replaces it with margin = 1 - beta, so it is effectively a redundant or contradictory fitted constant.
assumptions (4)
  • domain assumption The CLIP embedding space used by the surrogate is shared enough with victim VLMs that optimizing CLIP similarity transfers to them.
    Sec 3.2 uses CLIP as the surrogate; ViECap, Unidiffuser, and LLaVA all use CLIP-like encoders, but transfer is not guaranteed and no transfer analysis is given.
  • domain assumption ClipCap generates captions of perturbed images that are accurate enough to guide the attack toward the target.
    Algorithm 1 calls MI2T(Iadv) at each step; if it misdescribes the adversarial image, the Targeted Contrastive Matching loss is misaligned and the chain may diverge.
  • domain assumption Stable Diffusion target images and MiniGPT-4 or GPT-4 generated clean and target texts faithfully represent the intended semantics.
    Sec 4.1 uses these models in preprocessing; errors in the generated target images or clean texts propagate directly into the modality-aware embeddings used for attack.
  • domain assumption GPT-4 as judge provides valid and consistent attack success rate labels.
    Sec 3.3 relies on the LLM judge with no human agreement study, no calibration analysis, and no sensitivity test for prompt wording.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks." pith.science (2026). https://pith.science/paper/BPJ57TB5

@misc{pith2026241115720,
  author       = {Pith},
  title        = {Pith review of: Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/BPJ57TB5}},
  note         = {Machine review of arXiv:2411.15720}
}
read the original abstract

Pre-trained vision-language models (VLMs) have showcased remarkable performance in image and natural language understanding, such as image captioning and response generation. As the practical applications of vision-language models become increasingly widespread, their potential safety and robustness issues raise concerns that adversaries may evade the system and cause these models to generate toxic content through malicious attacks. Therefore, evaluating the robustness of open-source VLMs against adversarial attacks has garnered growing attention, with transfer-based attacks as a representative black-box attacking strategy. However, most existing transfer-based attacks neglect the importance of the semantic correlations between vision and text modalities, leading to sub-optimal adversarial example generation and attack performance. To address this issue, we present Chain of Attack (CoA), which iteratively enhances the generation of adversarial examples based on the multi-modal semantic update using a series of intermediate attacking steps, achieving superior adversarial transferability and efficiency. A unified attack success rate computing method is further proposed for automatic evasion evaluation. Extensive experiments conducted under the most realistic and high-stakes scenario, demonstrate that our attacking strategy can effectively mislead models to generate targeted responses using only black-box attacks without any knowledge of the victim models. The comprehensive robustness evaluation in our paper provides insight into the vulnerabilities of VLMs and offers a reference for the safety considerations of future model developments.

Figures

Figures reproduced from arXiv: 2411.15720 by the authors.

Figure 1
Figure 1. Comparison of the proposed CoA with other attacking strategies. The CLIP score results of Unidiffuser [4] are reported. Our method shows both superior performance and efficiency. ing performance in image and natural language understand￾ing, reasoning, and generation [1, 2, 30, 45, 46]. The pow￾erful multi-modal capability in different tasks, including vi￾sual question answering and image captioning [10, 28, 34], mak… view at source ↗
Figure 2
Figure 2. The pipeline of the Chain of Attack (CoA) framework. (a) Our framework proposes using modality-aware embeddings to capture the semantic correspondence between images and texts. To enhance the adversarial transferability, we use a chain of attacks that explicitly updates the adversarial examples based on their previous multi-modal semantics in a step-by-step manner. A Targeted Contrastive Matching objective is furthe… view at source ↗
Figure 3
Figure 3. Illustration of the attacking chain. Given the modality-aware embeddings of clean examples and target examples, the adversarial [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: Examples of the proposed LLM-based attack success rate evaluation. From left to right, the examples depict a completely [PITH_FULL_IMAGE:figures/full_fig_p005_4.png]
Figure 5
Figure 5. Figure 5: (a) Visual interpretation of the adversarial examples. [PITH_FULL_IMAGE:figures/full_fig_p008_5.png]
Figure 6
Figure 6. Figure 6: Examples of the used clean images, clean texts, target texts, and target images. [PITH_FULL_IMAGE:figures/full_fig_p013_6.png]
Figure 7
Figure 7. Figure 7: Results of LLaVA-7B [46] on VQA task. The left part is the multi-round VQA for the original clean examples, while the right part shows the results of using adversarial examples generated by CoA. The sentences in the chat boxes with a smiling face are the queries of hum…
Figure 8
Figure 8. Figure 8: More results of the chain of attack. We visualize the adversarial images and their corresponding texts at some intermediate chain [PITH_FULL_IMAGE:figures/full_fig_p017_8.png]
Figure 9
Figure 9. Figure 9: Results for the sensitivity of adversarial examples to Gaussian noises and the degradation to original clean semantics. [PITH_FULL_IMAGE:figures/full_fig_p017_9.png]
Figure 10
Figure 10. Figure 10: More evaluation examples and results of the proposed LLM-based ASR. From left to right, the examples depict a completely [PITH_FULL_IMAGE:figures/full_fig_p018_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 27 canonical work pages

  1. [1]

    Gpt-4 technical report

    Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ah- mad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, et al. Gpt-4 technical report. arXiv preprint arXiv:2303.08774 ,

    arXiv

  2. [2]

    Flamingo: a visual language model for few-shot learning

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Men- sch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. Advances in neural information processing systems, 35:23716–23736,

  3. [3]

    Image hijacks: Adversarial images can control generative models at runtime

    Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236, 2023. 2

    arXiv 2023

  4. [4]

    One transformer fits all distributions in multi-modal diffu- sion at scale

    Fan Bao, Shen Nie, Kaiwen Xue, Chongxuan Li, Shi Pu, Yaole Wang, Gang Yue, Yue Cao, Hang Su, and Jun Zhu. One transformer fits all distributions in multi-modal diffu- sion at scale. InInternational Conference on Machine Learn- ing, pages 1692–1717. PMLR, 2023. 1, 6, 7, 8, 12, 14, 15, 17

    work page 2023

  5. [5]

    On the opportunities and risks of foundation models

    Rishi Bommasani, Drew A Hudson, Ehsan Adeli, Russ Alt- man, Simran Arora, Sydney von Arx, Michael S Bernstein, Jeannette Bohg, Antoine Bosselut, Emma Brunskill, et al. On the opportunities and risks of foundation models. arXiv preprint arXiv:2108.07258, 2021. 1

    arXiv 2021

  6. [6]

    On evaluating adversarial robustness

    Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705 ,

    arXiv 1902

  7. [7]

    Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024

    Nicholas Carlini, Milad Nasr, Christopher A Choquette- Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024. 1, 2

    work page 2024

  8. [8]

    Attacking visual language grounding with adversarial examples: A case study on neural image caption- ing

    Hongge Chen, Huan Zhang, Pin-Yu Chen, Jinfeng Yi, and Cho-Jui Hsieh. Attacking visual language grounding with adversarial examples: A case study on neural image caption- ing. arXiv preprint arXiv:1712.02051, 2017. 2, 5

    arXiv 2017

Show all 57 references
  1. [9]

    Rethinking model ensem- ble in transfer-based adversarial attacks

    Huanran Chen, Yichi Zhang, Yinpeng Dong, Xiao Yang, Hang Su, and Jun Zhu. Rethinking model ensem- ble in transfer-based adversarial attacks. arXiv preprint arXiv:2303.09105, 2023. 2

    2023 arXiv

  2. [10]

    Visualgpt: Data-efficient adaptation of pretrained language models for image captioning

    Jun Chen, Han Guo, Kai Yi, Boyang Li, and Mohamed El- hoseiny. Visualgpt: Data-efficient adaptation of pretrained language models for image captioning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 18030–18040, 2022. 1, 2

    2022

  3. [11]

    Microsoft coco captions: Data collection and evaluation server

    Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedan- tam, Saurabh Gupta, Piotr Doll ´ar, and C Lawrence Zitnick. Microsoft coco captions: Data collection and evaluation server. arXiv preprint arXiv:1504.00325, 2015. 3, 12

    2015 arXiv

  4. [12]

    Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality

    Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. See https://vicuna. lmsys. org (accessed 14 April 2023) , 2(3):6,

    2023

  5. [13]

    On the robustness of large multimodal mod- els against image adversarial attacks

    Xuanming Cui, Alejandro Aparcedo, Young Kyun Jang, and Ser-Nam Lim. On the robustness of large multimodal mod- els against image adversarial attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24625–24634, 2024. 2

    2024

  6. [14]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 7, 12

    2009

  7. [15]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 9185–9193, 2018. 2

    2018

  8. [16]

    Query-efficient black-box adversarial attacks guided by a transfer-based prior

    Yinpeng Dong, Shuyu Cheng, Tianyu Pang, Hang Su, and Jun Zhu. Query-efficient black-box adversarial attacks guided by a transfer-based prior. IEEE Transactions on Pat- tern Analysis and Machine Intelligence , 44(12):9536–9548,

  9. [17]

    How robust is google’s bard to adversarial image at- tacks? arXiv preprint arXiv:2309.11751, 2023

    Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is google’s bard to adversarial image at- tacks? arXiv preprint arXiv:2309.11751, 2023. 2, 6

    2023 arXiv

  10. [18]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. 7

    2010 arXiv

  11. [19]

    Transferable decoding with visual entities for zero-shot image captioning

    Junjie Fei, Teng Wang, Jinrui Zhang, Zhenyu He, Chengjie Wang, and Feng Zheng. Transferable decoding with visual entities for zero-shot image captioning. In Proceedings of the IEEE/CVF International Conference on Computer Vi- sion, pages 3136–3146, 2023. 2, 6, 7, 8, 12, 14, 15

    2023

  12. [20]

    Misusing tools in large language mod- els with visual adversarial examples

    Xiaohan Fu, Zihan Wang, Shuheng Li, Rajesh K Gupta, Niloofar Mireshghallah, Taylor Berg-Kirkpatrick, and Ear- lence Fernandes. Misusing tools in large language mod- els with visual adversarial examples. arXiv preprint arXiv:2310.03185, 2023. 5

    arXiv

  13. [21]

    Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts. arXiv preprint arXiv:2311.05608 ,

    arXiv

  14. [22]

    Explaining and harnessing adversarial ex- amples

    Ian J Goodfellow. Explaining and harnessing adversarial ex- amples. arXiv preprint arXiv:1412.6572, 2014. 1

    2014 arXiv

  15. [23]

    Simple black-box adversar- ial attacks

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. Simple black-box adversar- ial attacks. In International conference on machine learning, pages 2484–2493. PMLR, 2019. 8

    2019

  16. [24]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceed- ings of the IEEE conference on computer vision and pattern recognition, pages 770–778, 2016. 7

    2016

  17. [25]

    Enhancing adversarial example transferability with an intermediate level attack

    Qian Huang, Isay Katsman, Horace He, Zeqi Gu, Serge Be- longie, and Ser-Nam Lim. Enhancing adversarial example transferability with an intermediate level attack. In Proceed- 9 ings of the IEEE/CVF international conference on computer vision, pages 4733–4742, 2019. 2

    2019

  18. [26]

    Black-box adversarial attacks with limited queries and information

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In International conference on machine learn- ing, pages 2137–2146. PMLR, 2018. 2

    2018

  19. [27]

    Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models

    Haibo Jin, Leyang Hu, Xinuo Li, Peiyan Zhang, Chonghan Chen, Jun Zhuang, and Haohan Wang. Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models. arXiv preprint arXiv:2407.01599,

  20. [28]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In In- ternational conference on machine learning , pages 19730– 19742. PMLR, 2023. 1

    2023

  21. [29]

    Improved baselines with visual instruction tuning

    Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. Improved baselines with visual instruction tuning. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 26296–26306, 2024. 2, 6, 7, 8, 12, 13, 14, 15

    2024

  22. [30]

    Visual instruction tuning

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in neural information processing systems, 36, 2024. 1, 2, 7

    2024

  23. [31]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. arXiv preprint arXiv:1611.02770, 2016. 2

    2016 arXiv

  24. [32]

    Delving into transferable adversarial examples and black- box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black- box attacks. In Proceedings of 5th International Conference on Learning Representations, 2017. 2

    2017

  25. [33]

    Towards deep learning models resis- tant to adversarial attacks

    Aleksander Madry. Towards deep learning models resis- tant to adversarial attacks. arXiv preprint arXiv:1706.06083,

    arXiv

  26. [34]

    Clip- cap: Clip prefix for image captioning

    Ron Mokady, Amir Hertz, and Amit H Bermano. Clip- cap: Clip prefix for image captioning. arXiv preprint arXiv:2111.09734, 2021. 1, 7

    2021 arXiv

  27. [35]

    Deep neural networks are easily fooled: High confidence predictions for unrecognizable images

    Anh Nguyen, Jason Yosinski, and Jeff Clune. Deep neural networks are easily fooled: High confidence predictions for unrecognizable images. In Proceedings of the IEEE con- ference on computer vision and pattern recognition , pages 427–436, 2015. 2

    2015

  28. [36]

    Practi- cal black-box attacks against machine learning

    Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practi- cal black-box attacks against machine learning. In Proceed- ings of the 2017 ACM on Asia conference on computer and communications security, pages 506–519, 2017. 2

    2017

  29. [37]

    Red teaming language models with language models

    Ethan Perez, Saffron Huang, Francis Song, Trevor Cai, Ro- man Ring, John Aslanides, Amelia Glaese, Nat McAleese, and Geoffrey Irving. Red teaming language models with language models. arXiv preprint arXiv:2202.03286 , 2022. 1

    2022 arXiv

  30. [38]

    Visual adversarial exam- ples jailbreak large language models

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Mengdi Wang, and Prateek Mittal. Visual adversarial exam- ples jailbreak large language models. arXiv preprint arXiv:2306.13213, 2023. 1

    2023 arXiv

  31. [39]

    Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation

    Zeyu Qin, Yanbo Fan, Yi Liu, Li Shen, Yong Zhang, Jue Wang, and Baoyuan Wu. Boosting the transferability of ad- versarial attacks with reverse adversarial perturbation. Ad- vances in neural information processing systems, 35:29845– 29858, 2022. 2

    2022

  32. [40]

    Language models are unsu- pervised multitask learners

    Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Ilya Sutskever, et al. Language models are unsu- pervised multitask learners. OpenAI blog, 1(8):9, 2019. 2

    2019

  33. [41]

    Learning transferable visual models from natural language supervi- sion

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervi- sion. In International conference on machine learning, ...

    2021

  34. [42]

    Smallcap: lightweight image captioning prompted with retrieval augmentation

    Rita Ramos, Bruno Martins, Desmond Elliott, and Yova Ke- mentchedjhieva. Smallcap: lightweight image captioning prompted with retrieval augmentation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2840–2849, 2023. 2, 6, 7, 8, 12, 14, 15

    2023

  35. [43]

    Red-teaming the stable diffusion safety filter

    Javier Rando, Daniel Paleka, David Lindner, Lennart Heim, and Florian Tram`er. Red-teaming the stable diffusion safety filter. arXiv preprint arXiv:2210.04610, 2022. 1

    2022 arXiv

  36. [44]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj ¨orn Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 10684–10695, 2022. 7, 12

    2022

  37. [45]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth´ee Lacroix, Baptiste Rozi`ere, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023. 1

    2023 arXiv

  38. [46]

    Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023

    Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, et al. Llama 2: Open foundation and fine-tuned chat models.arXiv preprint arXiv:2307.09288, 2023. 1, 16

    2023 arXiv

  39. [47]

    How many unicorns are in this image a safety evaluation benchmark for vision llms

    Haoqin Tu, Chenhang Cui, Zijun Wang, Yiyang Zhou, Bingchen Zhao, Junlin Han, Wangchunshu Zhou, Huaxiu Yao, and Cihang Xie. How many unicorns are in this image a safety evaluation benchmark for vision llms. In Computer Vision – ECCV 2024 , pages 37–55, Cham, 2025. Springer Natu...

    2024

  40. [48]

    Decodingtrust: A com- prehensive assessment of trustworthiness in gpt models

    Boxin Wang, Weixin Chen, Hengzhi Pei, Chulin Xie, Mintong Kang, Chenhui Zhang, Chejian Xu, Zidi Xiong, Ri- tik Dutta, Rylan Schaeffer, et al. Decodingtrust: A com- prehensive assessment of trustworthiness in gpt models. In NeurIPS, 2023. 1

    2023

  41. [49]

    Exact adversarial attack to image captioning via structured output learning with la- tent variables

    Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen, and Wei Liu. Exact adversarial attack to image captioning via structured output learning with la- tent variables. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages ...

    2019

  42. [50]

    Adversarial attacks of vision tasks in the past 10 years: A survey

    Chiyu Zhang, Xiaogang Xu, Jiafei Wu, Zhe Liu, and Lu Zhou. Adversarial attacks of vision tasks in the past 10 years: A survey. arXiv preprint arXiv:2410.23687, 2024. 2, 3, 8 10

    2024 arXiv

  43. [51]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shecht- man, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recogni- tion, pages 586–595, 2018. 8

    2018

  44. [52]

    A review of adversarial attacks in computer vision

    Yutong Zhang, Yao Li, Yin Li, and Zhichang Guo. A review of adversarial attacks in computer vision. arXiv preprint arXiv:2308.07673, 2023. 3

    2023 arXiv

  45. [53]

    A recipe for watermarking dif- fusion models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai- Man Cheung, and Min Lin. A recipe for watermarking dif- fusion models. arXiv preprint arXiv:2303.10137, 2023. 1

    2023 arXiv

  46. [54]

    On evaluating adversarial robustness of large vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongx- uan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Ad- vances in Neural Information Processing Systems, 36, 2024. 1, 2, 3, 4, 5, 6, 7, 8, 13

    2024

  47. [55]

    Transferable ad- versarial perturbations

    Wen Zhou, Xin Hou, Yongjun Chen, Mengyun Tang, Xi- angqi Huang, Xiang Gan, and Yong Yang. Transferable ad- versarial perturbations. In Proceedings of the European Con- ference on Computer Vision (ECCV), pages 452–467, 2018. 2

    2018

  48. [56]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mo- hamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592, 2023. 7 11 Appendix In this supplementary material, we present more details about dat...

    2023 arXiv

  49. [57]

    How do you think of this image?

    to balance the trade-off. Effect of PGD Steps Following the setting of previous methods [54], we adopt projected gradient descent (PGD) [33] with 100 steps, as mentioned in the main paper. Additionally, we report the results of less number of PGD steps in Tab. 7. The results s...

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.