Pith. sign in

REVIEW 4 major objections 7 minor 1 cited by

FIGhost: Fluorescent Ink-based Stealthy and Flexible Backdoor Attacks on Physical Traffic Sign Recognition

T0 review · 4 major / 7 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that a fluorescent heart painted on a traffic sign and illuminated by ultraviolet light can act as a physical backdoor trigger, making object detectors and vision-language models hide, generate, or misclassify traffic…

desk verdict Fluorescent-ink triggers are a genuinely new physical backdoor idea and the paper shows they work in a narrow lab-like setting, but the robustness and defense-evasion claims outrun the evidence. read the letter →

arxiv 2505.12045 v1 pith:4B72CEEG submitted 2025-05-17 cs.CV

Shuai Yuan , Guowen Xu , Hongwei Li , Rui Zhang , Xinyuan Qian , Wenbo Jiang , Hangcheng Cao , Qingchuan Zhao This is my paper · ORCID
classification cs.CV
keywords trafficsignrecognitionphysicalbackdoorattackfluorescentinktriggerultravioletlightactivationvision-languagemodelsecurityobjectdetectionautonomousdrivingsafetydefenseevasion
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper introduces FIGhost, a physical backdoor attack on traffic sign recognition that uses fluorescent ink as the trigger. The trigger is a red heart painted on a sign, invisible in normal lighting and revealed by 365 nm ultraviolet light, so an attacker can activate the backdoor remotely and on demand. The paper claims that a pipeline of graffiti-inspired trigger design, environment-aware augmentation by video interpolation, and automated alpha-blended sample generation lets a few dozen physical photos poison training sets for object detectors and vision-language models. In physical tests it reports attack success rates of at least 94.23% and sometimes 100% across YOLOv11, Faster R-CNN, LLaVA-1.5, and MiniGPT-4, while clean accuracy drops by only 0.14% mAP and 0.02 BERTScore. If correct, this means a hidden, remotely activated backdoor can be embedded into models distributed through open-source platforms, affecting both classical detectors and VLMs.

What carries the argument

The central machinery is the fluorescent trigger plus a simulation-to-physical transfer pipeline. To make the trigger robust, the authors photograph the fluorescent heart under different environmental conditions and synthesize intermediate frames by video interpolation; to keep the trigger inside any sign shape, they use a minimum containment principle giving side length $s = hw/(4h+2w)$; and to build poisoned training samples they alpha-blend the trigger onto sign images and rewrite detector labels or VLM responses toward the attack goal. This pipeline turns a handful of physical photos into a large training set that, when fine-tuned into detectors and VLMs, carries the hidden trigger into the physical world.

What would settle it

The paper itself reports that ASR falls below 20% when the UV lamp is 20 meters away and below 90% at 3000 lux ambient light; a replication that obtains high ASR under those conditions would contradict the paper's sensitivity analysis, while a replication that cannot reach high ASR at the standard 5 m, 120 W, 1000 lux setup would sink the physical-transfer claim.

Watch

Extended reading notes

Core claim

FIGhost's central claim is that a fluorescent ink trigger can carry a physical backdoor into both object detectors and vision-language models without sacrificing stealth. The trigger is a small red heart placed in the upper half of a traffic sign, chosen by scoring graffiti samples for complexity, commonness, coloration, recognizability, placement, and scope. To make the backdoor robust across environments, the authors photograph the heart under different lighting, distance, and UV intensity and synthesize intermediate frames with video interpolation; to place it safely on any sign shape they derive a maximum trigger size from the minimum containment principle, $s = hw/(4h+2w)$; and to build training data they alpha-blend the trigger onto sign images and rewrite labels or VLM responses toward hiding, generative, or misrecognition goals. The paper reports physical-world ASR of at least 94.23% on all four target models, with clean mAP and BERTScore nearly unchanged, and shows that JPEG compression and STRIP fail to remove the trigger.

Load-bearing premise

The method relies on the assumption that the synthetic training images, made by overlaying photos of the glowing heart onto pictures of signs, look enough like a real ultraviolet-lit sign that the backdoor learned in simulation will fire on real roads.

Editorial extensions

If this is right

  • A single physical trigger type (fluorescent heart) can be embedded into one-stage detectors, two-stage detectors, and vision-language models, with reported ASR of at least 94.23% and up to 100% under the tested setup.
  • Backdoor success degrades predictably with distance and light: ASR falls sharply when the vehicle or the UV lamp is beyond 20 meters and drops under high ambient light, so the attacker controls timing and placement by choosing when and where to shine UV light.
  • The attack evades JPEG compression and STRIP, meaning standard defenses designed for pixel-level digital backdoors do not remove this physical trigger.
  • Clean-model accuracy stays nearly unchanged after backdoor embedding (mAP down 0.14%, BERTScore down 0.02), making the poisoned model hard to distinguish from a benign one by utility checks alone.
  • Trigger size and placement are a deliberate trade-off: larger and central triggers raise ASR, but the method keeps the heart small and in the upper half of the sign to preserve stealth.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the simulation-to-physical transfer is the load-bearing bridge, and it is tested in only one physical envelope (120 W UV lamp, 5 m distance, 1000 lux, 104 images); replicating at other distances and light levels is the natural next test.
  • Editorial inference: the attack suggests a concrete defensive direction—spectral or hardware filtering that distinguishes fluorescent emission from ordinary reflectance, or training-time detection of alpha-blended synthetic triggers.
  • Editorial inference: the same graffiti-trigger pipeline could generalize to other recognition tasks such as lane marking or license-plate reading, since it only needs a physical surface and a UV-reactive pigment.
  • Editorial inference: because the practical risk depends on whether backdoored checkpoints are actually downloaded and fine-tuned, the real-world threat is mediated by the open-source model supply chain, not only by the reported ASR numbers.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 7 minor

Summary. The paper proposes FIGhost, a physical-world backdoor attack on traffic sign recognition systems that uses a fluorescent heart-shaped trigger, invisible under normal lighting and activated by UV light. The method selects a realistic trigger via graffiti analysis, simulates fluorescence variation with video interpolation, overlays the trigger onto digital sign images with alpha blending, and fine-tunes object detectors (YOLOv11, Faster R-CNN) and VLMs (LLaVA-1.5, MiniGPT-4) for hiding, generative, and misrecognition objectives. Physical experiments with 104 images at a single configuration (120 W UV lamp, 5 m distance, 1000 lux) report ASR at least 94.23% across models with negligible clean-accuracy loss. Ablations vary trigger size/position, vehicle and lamp distances, UV power, ambient light, and weather; JPEG compression and STRIP are reported as ineffective defenses. The paper concludes that FIGhost is a stealthy, flexible, and robust physical backdoor attack.

Significance. If the reported results hold, FIGhost introduces a genuinely new physical trigger modality—fluorescent ink activated by UV—that improves on prior sticker- and laser-based attacks in stealthiness and flexible activation, and it is among the first physical backdoor attacks demonstrated on both object detectors and VLMs. The paper provides an anonymous code repository and a parameter-free geometric derivation of the trigger size in Section 4.4, and the physical ASR results with small clean-accuracy degradation are encouraging. However, the strength of the robustness and defense-evasion claims currently exceeds what the evidence supports, as detailed in the major comments.

major comments (4)
  1. [Section 5.4, Table 4] The JPEG comparison does not measure evasion of an unseen JPEG defense. The paper states that all images are JPEG-compressed and the compressed images are used for training, so the model has already learned to recognize compressed triggers. This is an adaptive/training-augmentation result, not a demonstration that JPEG applied by a defender at inference time fails to remove the trigger. To support the claim that JPEG compression is ineffective against FIGhost, the authors should train on uncompressed data and apply JPEG only at test time, or explicitly report both the adaptive and non-adaptive settings.
  2. [Section 5.3, Figure 7(b); Appendix C, Table 8] The robustness claim is supported only within a narrow operating envelope. At D2 = 20 m the ASR collapses to 0–13.46%, and ambient-light experiments stop at 3000 lux, far below typical daylight (which is often above 10,000 lux); Table 8 also shows a monotonic ASR decline with light. Since the abstract and conclusion claim robustness under environmental variations, the paper needs either additional physical tests at more extreme conditions (e.g., >5000 lux, D2 = 10 m) or a qualified statement describing the demonstrated envelope.
  3. [Section 5.4, Table 4 (STRIP)] ASR under STRIP is not an appropriate metric for evaluating a detection-based defense. STRIP outputs a detection flag rather than a classification, so the relevant quantities are the detection rate on backdoor inputs and the false-positive rate on clean inputs. The discussion about inconsistent predictions suggests why STRIP might fail to detect FIGhost, but the reported ASR does not establish this. The authors should report STRIP's detection performance (e.g., true-positive/false-positive rates) with a defined threshold.
  4. [Sections 5.2–5.3, Tables 3 and 8, Figures 5–7] All ASR numbers are point estimates from 104 physical images with no confidence intervals. Since one image corresponds to roughly 0.96% ASR, small reported differences—such as the 0.91% position improvement in Figure 6 and the 2.88% STRIP reduction in Table 4—are within sampling noise. The fine-grained comparisons and ablation trends should be accompanied by confidence intervals or significance tests, and the paper should clarify whether the 104 images are independent captures or repeated shots of the same signs.
minor comments (7)
  1. [Section 5.3] The cross-reference 'As shown in Figure 5.3' appears twice and should refer to Figure 6(a) and Figure 6(b), respectively, not to a section number.
  2. [Table 2 and Appendix A, Table 5] The main-text graffiti scoring table shows a minimum score of 6, while the expanded scoring table in Appendix A has minimum sum 9; the statement that the trigger is selected as the graffiti with the lowest overall score is not reproducible from the appendix, so the two tables should be aligned.
  3. [Table 4] The table header 'JEPG' should be corrected to 'JPEG'.
  4. [Appendix D] The ethics statement contains the typo 'legally ovtained' and should read 'legally obtained'.
  5. [Section 5.2] The physical setup description contains the typo 'The traffc signs are 60 cm×60 cm', and it should state explicitly whether the 104 images are independent physical captures or multiple photos of the same sign instances.
  6. [Figure 7 and Section 5.3] The steep ASR collapse at D2 = 20 m (0–13%) is mentioned only in the limitations appendix, not in the main ablation discussion; this result should be discussed where the distance ablation is presented.
  7. [Appendix C, Table 8] The ambient-light table omits YOLOv11 even though every other model is reported; the authors should either include the missing column or state why it is excluded.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack pipeline's components are independently motivated and empirically evaluated, with no fitted parameter or self-citation chain forcing the central claim.

full rationale

The paper's load-bearing steps do not reduce to their own inputs. The trigger size is derived from a geometric containment argument (Section 4.4, Eq. 1), not from attack-success data, and the ablation in Section 5.3 independently varies size and position, so the 'larger triggers are easier to learn' claim is an empirical observation rather than a definitional tautology. The physical-world evaluation in Section 5.2 measures ASR on 104 newly collected physical images under a stated configuration (60 cm signs, 120 W UV, 1000 lux, 5 m), and no model parameter is fitted to those test images; the models are trained on digitally alpha-blended composites of trigger cutouts onto sign images (Eq. 3). The environment-aware augmentation in Section 4.3 does mean that the physical test conditions resemble the training trigger distribution, so 'robustness' is partly in-distribution, but that is an external-validity limitation rather than circularity: the training samples are not the test samples, and the ASR numbers are measured, not derived from the training objective. The only self-citation found is Han et al. [2022], cited in related work for prior traffic-cone backdoor attacks; it is not used as evidence for any premise of FIGhost and is therefore not load-bearing. No uniqueness theorem, ansatz smuggled by citation, or renamed known result appears in the derivation chain. The claim that the attack works on detectors and VLMs rests on direct physical experiments and publicly reproducible code, not on a self-referential argument.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central result rests on three kinds of support: the physical behavior of fluorescent ink, the synthetic-to-physical transfer of digitally constructed backdoor samples, and a geometric containment calculation. The paper provides physical evidence for the first and a narrow physical validation for the second, but no quantitative invisibility measurement, no release of training configurations, and only a partial proof of the worst-case geometry. The three free parameters are standard attack hyperparameters whose values are not reported.

free parameters (3)
  • Alpha blending factor alpha = not stated
    Eq. (3) overlays the trigger with transparency alpha; its value is a hand-chosen attack hyperparameter and is not reported.
  • Clean/backdoor loss weight lambda = not stated
    Eqs. (4) and (5) balance clean and poisoned samples; the value is not reported.
  • Backdoor poisoning ratio = not stated (Figure 5 sweeps 1-5 percent)
    The poisoned fraction of training data is a free choice, and the central ASR results depend on it.
assumptions (4)
  • domain assumption Fluorescent ink is invisible under normal illumination and becomes visible under 365 nm UV light.
    Sections 4.1 and 5.1 rely on this physical property for stealth and activation; no quantitative invisibility measurement is reported beyond attack success rates.
  • domain assumption Synthetic alpha-blended and video-interpolated trigger images adequately represent physical UV-illuminated triggers for backdoor training.
    Sections 4.3 and 4.4 construct backdoor samples digitally; physical transfer is tested only in one configuration, so generalization is assumed.
  • domain assumption A triangle is the worst-case typical traffic sign shape for containing a square trigger, so the maximum trigger size derived from a triangle applies to all signs.
    Section 4.4 and Eqs. (1) and (2); no proof is given that triangles minimize contained heart area across circles, triangles, octagons, and rectangles.
  • domain assumption Pre-trained object detectors and VLMs can be backdoored by fine-tuning on a small poisoned set without degrading clean accuracy.
    Section 4.5 defines the training objectives; Table 3 provides empirical support, but this is not a proven guarantee.

how reviews work

0 comments
Cite this review

Pith. "Pith review of FIGhost: Fluorescent Ink-based Stealthy and Flexible Backdoor Attacks on Physical Traffic Sign Recognition." pith.science (2026). https://pith.science/paper/4B72CEEG

@misc{pith2026250512045,
  author       = {Pith},
  title        = {Pith review of: FIGhost: Fluorescent Ink-based Stealthy and Flexible Backdoor Attacks on Physical Traffic Sign Recognition},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4B72CEEG}},
  note         = {Machine review of arXiv:2505.12045}
}
read the original abstract

Traffic sign recognition (TSR) systems are crucial for autonomous driving but are vulnerable to backdoor attacks. Existing physical backdoor attacks either lack stealth, provide inflexible attack control, or ignore emerging Vision-Large-Language-Models (VLMs). In this paper, we introduce FIGhost, the first physical-world backdoor attack leveraging fluorescent ink as triggers. Fluorescent triggers are invisible under normal conditions and activated stealthily by ultraviolet light, providing superior stealthiness, flexibility, and untraceability. Inspired by real-world graffiti, we derive realistic trigger shapes and enhance their robustness via an interpolation-based fluorescence simulation algorithm. Furthermore, we develop an automated backdoor sample generation method to support three attack objectives. Extensive evaluations in the physical world demonstrate FIGhost's effectiveness against state-of-the-art detectors and VLMs, maintaining robustness under environmental variations and effectively evading existing defenses.

Figures

Figures reproduced from arXiv: 2505.12045 by the authors.

Figure 1
Figure 1. The workflow of our FIGhost. 4.2 Graffiti analysis In this paper, we employ fluorescent ink as a backdoor trigger. Prior to launching the attack, it is necessary to determine the trigger’s shape, color, and other visual characteristics. Real-world observations show that many traffic signs are covered with brightly colored graffiti resembling activated fluorescent ink. Motivated by this insight, we analyze graffiti p… view at source ↗
Figure 2
Figure 2. Triggers at different distances and UV intensities under various ambient light. As shown in [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Analysis of the trigger’s location. As shown in [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Physical backdoor attack examples on TSR for three attack goals. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: The ASR of FIGhost on MiniGPT￾4 when poison responses are generated using LLaVA-1.5 and GPT-4o. Attack transferability. In Section 4.4, we use the VLM to generate initial responses, which are modified by an LLM to craft backdoor samples for attacking the same VLM. Cons…
Figure 6
Figure 6. Figure 6: Impact of trigger size and position on the [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Hiding in Plain Sight: An Effective Physical Adversarial Patch Attack against Visual-Infrared Fused Face Detection

    cs.CR 2026-07 conditional novelty 6.0 of 10

    A jointly optimized gradient-mask plus band-aid patch reportedly bypasses visible-infrared fused face detectors with >90% attack success in both digital and physical settings.

Reference graph

Works this paper leans on

17 extracted references · 8 canonical work pages · cited by 1 Pith paper

  1. [3]

    Hugging Face

    https://github.com/. Hugging Face. The ai community building the future., 2025.https://huggingface.co/. Tehseen Zia. Unmasking privacy backdoors: How pretrained models can steal your data and what you can do about it.,

    work page 2025

  2. [4]

    Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg

    https://aiasiapacific.org/2025/04/16/ uncovering-hidden-risks-security-in-large-language-model-llm-supply-chain/ . Tianyu Gu, Kang Liu, Brendan Dolan-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks.IEEE Access, 7:47230–47244,

    work page 2025

  3. [8]

    LaserGuider: A Laser Based Physical Backdoor Attack against Deep Neural Networks

    Yongjie Xu, Guangke Chen, Fu Song, and Yuqi Chen. Laserguider: A laser based physical backdoor attack against deep neural networks.arXiv preprint arXiv:2412.03993,

    work page Pith review arXiv

  4. [9]

    Invisible backdoor attacks on deep neural networks via steganography and regularization.IEEE Transactions on Dependable and Secure Computing, 18(5):2088–2105,

    Shaofeng Li, Minhui Xue, Benjamin Zi Hao Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor attacks on deep neural networks via steganography and regularization.IEEE Transactions on Dependable and Secure Computing, 18(5):2088–2105,

    work page

  5. [11]

    Ssd: Single shot multibox detector

    10 Wei Liu, Dragomir Anguelov, Dumitru Erhan, Christian Szegedy, Scott Reed, Cheng-Yang Fu, and Alexander C Berg. Ssd: Single shot multibox detector. InComputer Vision–ECCV 2016: 14th European Conference, Amsterdam, The Netherlands, October 11–14, 2016, Proceedings, Part I 14, pages 21–37. Springer,

    work page 2016

  6. [12]

    Drivevlm: The convergence of autonomous driving and large vision-language models.arXiv preprint arXiv:2402.12289,

    Xiaoyu Tian, Junru Gu, Bailin Li, Yicheng Liu, Yang Wang, Zhiyong Zhao, Kun Zhan, Peng Jia, Xianpeng Lang, and Hang Zhao. Drivevlm: The convergence of autonomous driving and large vision-language models.arXiv preprint arXiv:2402.12289,

    arXiv

  7. [13]

    Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592,

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: En- hancing vision-language understanding with advanced large language models.arXiv preprint arXiv:2304.10592,

    arXiv

  8. [14]

    Yolov11: An overview of the key architectural enhance- ments.arXiv preprint arXiv:2410.17725,

    Rahima Khanam and Muhammad Hussain. Yolov11: An overview of the key architectural enhance- ments.arXiv preprint arXiv:2410.17725,

    arXiv

Show all 17 references
  1. [15]

    Qwen2 technical report.arXiv preprint arXiv:2407.10671,

    11 An Yang, Baosong Yang, Binyuan Hui, Bo Zheng, Bowen Yu, Chang Zhou, Chengpeng Li, Chengyuan Li, Dayiheng Liu, Fei Huang, Guanting Dong, Haoran Wei, Huan Lin, Jialong Tang, Jialin Wang, Jian Yang, Jianhong Tu, Jianwei Zhang, Jianxin Ma, Jin Xu, Jingren Zhou, Jinze Bai, Jinzh...

    arXiv

  2. [16]

    Yolov5, 2020.https://github.com/ultralytics/yolov5

    Ultralytics. Yolov5, 2020.https://github.com/ultralytics/yolov5. Zhaohui Zheng, Ping Wang, Wei Liu, Jinze Li, Rongguang Ye, and Dongwei Ren. Distance-iou loss: Faster and better learning for bounding box regression. InProceedings of the AAAI conference on artificial intelligen...

    2020

  3. [17]

    Bertscore: Evaluating text generation with bert.arXiv preprint arXiv:1904.09675,

    Tianyi Zhang, Varsha Kishore, Felix Wu, Kilian Q Weinberger, and Yoav Artzi. Bertscore: Evaluating text generation with bert.arXiv preprint arXiv:1904.09675,

    1904 arXiv

  4. [2019]

    Reflection backdoor: A natural backdoor attack on deep neural networks

    Yunfei Liu, Xingjun Ma, James Bailey, and Feng Lu. Reflection backdoor: A natural backdoor attack on deep neural networks. InComputer vision–ECCV 2020: 16th European conference, Glasgow, UK, August 23–28, 2020, proceedings, part X 16, pages 182–199. Springer,

    2020

  5. [2020]

    On the credibility of backdoor attacks against object detectors in the physical world.arXiv preprint arXiv:2408.12122,

    Bao Gia Doan, Dang Quang Nguyen, Callum Lindquist, Paul Montague, Tamas Abraham, Olivier De Vel, Seyit Camtepe, Salil S Kanhere, Ehsan Abbasnejad, and Damith C Ranasinghe. On the credibility of backdoor attacks against object detectors in the physical world.arXiv preprint arXi...

    arXiv

  6. [2022]

    Towards transferable attacks against vision-llms in autonomous driving with typography

    Nhat Chung, Sensen Gao, Tuan-Anh Vu, Jie Zhang, Aishan Liu, Yun Lin, Jin Song Dong, and Qing Guo. Towards transferable attacks against vision-llms in autonomous driving with typography. arXiv preprint arXiv:2405.14169,

    arXiv

  7. [2023]

    Think twice before recognizing: Large multimodal models for general fine-grained traffic sign recognition

    Yaozong Gan, Guang Li, Ren Togo, Keisuke Maeda, Takahiro Ogawa, and Miki Haseyama. Think twice before recognizing: Large multimodal models for general fine-grained traffic sign recognition. arXiv preprint arXiv:2409.01534,

    arXiv

  8. [2024]

    Physical backdoor attack can jeopardize driving with vision-large-language models.arXiv preprint arXiv:2404.12916,

    Zhenyang Ni, Rui Ye, Yuxi Wei, Zhen Xiang, Yanfeng Wang, and Siheng Chen. Physical backdoor attack can jeopardize driving with vision-large-language models.arXiv preprint arXiv:2404.12916,

    arXiv

  9. [2025]

    Licheng Wen, Xuemeng Yang, Daocheng Fu, Xiaofeng Wang, Pinlong Cai, Xin Li, Tao Ma, Yingxuan Li, Linran Xu, Dengke Shang, et al

    https://global.honda/en/tech/ Traffic_Sign_Recognition_System_TSR/. Licheng Wen, Xuemeng Yang, Daocheng Fu, Xiaofeng Wang, Pinlong Cai, Xin Li, Tao Ma, Yingxuan Li, Linran Xu, Dengke Shang, et al. On the road with gpt-4v (ision): Early explorations of visual- language model on...

    arXiv

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.