Pith. sign in

REVIEW 3 major objections 6 minor 31 references

Edge-Placed QR-Like Patches Crash Infrared Vision-Language Models

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · glm-5.2

2026-07-09 15:06 UTC pith:XGUHRMW4

load-bearing objection Edge-placed QR-inspired patches sharply degrade infrared VLMs; captioning transfer claims rest on unvalidated GPT-5.4 scoring with no error bars. the 3 major comments →

arxiv 2607.07288 v1 pith:XGUHRMW4 submitted 2026-07-08 cs.CV

InfraQR: Edge-Placed QR-Inspired Structured Patch Attacks on Infrared Vision-Language Models

Xin Li , Jiaju Han , Ma Yaqi , Chengyin Hu , Yingying Zhao , Jiahuan Long , Fengyu Zhang , Yahui Chai This is my paper
classification cs.CV
keywords adversarial patch attackinfrared vision-language modelsQR-inspired structured perturbationedge placementCLIPvisual question answeringcross-task transferabilitybinary regularization
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper sets out to prove that infrared vision-language models — systems that connect thermal imagery to language understanding — can be broken not by attacking the object in the image, but by placing a small, structured, QR-code-like patch along the image's outer edge. The patch uses fixed corner anchors (mimicking QR finder patterns) and a grid of learnable cells pushed toward black-or-white values, optimized through a surrogate CLIP-style image-text model to flip the model's semantic ranking. The central claim is that this peripheral perturbation, spatially separated from the main visual evidence, still propagates through the model's global image-text representation and degrades downstream language outputs. On a 300-image infrared benchmark, the attack drops OpenAI CLIP classification accuracy from 98.67% to 0.70%, and the same adversarial images transfer to unseen captioning and visual question answering models, causing semantic degradation in generated captions and more error-prone VQA answers. The paper argues that image boundaries should not be treated as semantically irrelevant for infrared VLMs, and that the vulnerability is distinct from simple object occlusion.

Core claim

The paper identifies that a compact, near-binary structured patch placed at an image edge — not on the target object — can be optimized through a surrogate CLIP-style encoder to sharply degrade infrared vision-language representations, and that this degradation transfers across tasks (classification to captioning to VQA) and across models (white-box surrogate to black-box targets). The mechanism is a ranking loss: the patch is tuned to push the ground-truth class similarity below the strongest competing class similarity in the surrogate's embedding space, and the resulting image-level bias propagates to downstream generative models that share similar visual encoding foundations.

What carries the argument

The attack combines four components: (1) a QR-inspired grid parameterization with fixed 7×7 finder-style anchors at three corners and learnable sigmoid-activated cells elsewhere, regularized toward binary values; (2) a discrete edge-placement search using a neutral gray probe patch to find the boundary location that most reduces ground-truth semantic similarity in the surrogate; (3) a classification-guided ranking loss that minimizes the gap between the ground-truth class similarity and the strongest competing class similarity; and (4) a question-answer-aware extension that constructs semantic text targets from question-reference-answer triplets, allowing the surrogate to provide gradients V

Load-bearing premise

The paper assumes that a 300-image benchmark with 30 categories adequately represents infrared VLM robustness, and that a neutral gray probe patch can identify the optimal boundary location for the adversarial patch. If the benchmark is too narrow or the probe-based placement is suboptimal, the reported attack strength could be an underestimate — but the core vulnerability claim would still hold.

What would settle it

If infrared VLMs that use visually different architectures (not CLIP-family encoders) prove resistant to the same edge-placed structured patches, or if the cross-task transfer to captioning and VQA fails to replicate on larger and more diverse infrared benchmarks, the claim of a general peripheral-perturbation vulnerability would be weakened.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Infrared VLM security audits should evaluate peripheral perturbations, not just object-attached patches, since edge regions can carry enough representational weight to flip global image-text rankings.
  • The cross-task transfer from classification-guided optimization to captioning and VQA degradation suggests that shared visual encoders create a transfer pathway that attackers can exploit without access to the downstream generative model.
  • Defenses for infrared VLMs may need to consider the spatial distribution of representational sensitivity across the entire image canvas, including boundary regions typically treated as low-importance background.
  • The QR-inspired structure raises the question of whether other recognizable visual priors (barcodes, fiducial markers, structured noise templates) could similarly serve as effective adversarial carriers in thermal imagery.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If the shared-encoder transfer pathway holds generally, then any infrared VLM using a CLIP-family visual backbone would be vulnerable to the same surrogate-guided edge-patch strategy, regardless of the language model attached downstream.
  • The binary regularization producing near-binary patches suggests these patterns could potentially be rendered on physical displays or thermal materials at image boundaries, though the paper explicitly does not claim physical realizability — this is an untested extension.
  • The probe-based placement search using a neutral gray patch may underestimate the attack's potential; a jointly optimized placement could reveal even stronger vulnerabilities, meaning the reported degradation might be a lower bound on the true risk.
  • The finding that EVA-CLIP remains more robust than other encoders under all attacks hints that encoder architecture or training scale may confer differential resistance to structured peripheral perturbations, which could inform defensive design.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The manuscript presents InfraQR, a QR-inspired structured adversarial patch attack targeting infrared vision-language models. Unlike prior infrared adversarial work that focuses on object detectors and places perturbations on the target object, InfraQR places a compact structured patch along image boundaries. The patch uses fixed finder-style anchors and learnable grid cells optimized through surrogate CLIP-style encoders with a binary regularization term. The authors evaluate InfraQR on three tasks: (1) white-box classification on four CLIP-style infrared classifiers, (2) black-box transfer to six captioning models, and (3) question-answer-aware VQA on six black-box generative models. On a 300-image infrared benchmark, InfraQR reduces OpenAI CLIP accuracy from 98.67% to 0.70% and produces competitive or superior degradation compared to three baselines (HCB, AdvIC, AdvGrid) across transfer settings. The central claim is that infrared VLMs are vulnerable to peripheral structured perturbations without direct object occlusion.

Significance. The paper addresses a genuine gap: prior infrared adversarial work targets detectors, while VLM robustness studies focus on RGB images. The finding that edge-placed structured patches can degrade not only surrogate classification but also downstream captioning and VQA behavior is non-trivial and motivates broader robustness evaluation. The white-box classification results are strong and clearly presented. The multi-task evaluation framework (classification, caption transfer, QA-aware VQA) is a reasonable design for studying cross-task vulnerability. The QA-aware extension (Section 3.5) that constructs question-conditioned semantic targets without accessing the evaluated VQA models is a thoughtful design choice. The ablation study (Section 4.5) covers key parameters including iteration budget, patch size, learning rate, and binary regularization weight.

major comments (3)
  1. Table 2 (caption transfer): InfraQR produces the largest semantic-consistency drop in only 4 of 6 settings. In the remaining 2 (LLaVA-1.6 under OpenAI CLIP: 33.03 vs AdvIC's 33.45; InstructBLIP under EVA-CLIP: 7.50 vs AdvIC's 8.24), AdvIC outperforms InfraQR. These margins are small, and no error bars, confidence intervals, or significance tests are reported on a 300-image benchmark. The manuscript should either (a) report variance or significance to support the comparative superiority claims, or (b) soften the language to acknowledge that InfraQR is competitive rather than strictly superior in caption transfer. As stated, the claim in Section 4.3 that InfraQR 'consistently causes a stronger or competitive degradation' is acceptable, but the abstract's implication of consistent superiority across tasks is slightly overstated for the captioning setting.
  2. Section 4.3 and Table 2: The entire captioning evaluation depends on GPT-5.4 as the sole judge of semantic consistency, with no human validation, no alternative metrics (e.g., BLEU, CIDEr, CLIPScore), and no inter-annotator agreement reported. If GPT-5.4 systematically scores terse or unusual adversarial captions as less consistent even when semantically equivalent, the captioning drops could be inflated or distorted. The VQA evaluation (Table 3) is less fragile because answer correctness is more constrained (yes/no, counting, etc.), and InfraQR's advantage there is larger and consistent across all 6 settings. The authors should add at least one standard captioning metric or a small human validation subset to corroborate the GPT-5.4 scoring for the captioning claims.
  3. Section 4.1: The 300-image benchmark (30 categories, 10 images each) is small. While the white-box classification results are dramatic enough that scale is less concerning there, the transfer claims to captioning and VQA models would be more convincing with a larger evaluation set. The VQA subset (295 image-question pairs, 236 test) is also modest. The authors should discuss this limitation explicitly and ideally provide results on a larger subset or cross-dataset validation to support generalization claims.
minor comments (6)
  1. The abstract mentions 'GPT-5.4-based evaluation' but the model name 'GPT-5.4' appears unusual; the reference [20] cites 'GPT-5.4 model' from 2026. If this is a placeholder or internal name, it should be clarified for readers.
  2. Figure 1 is dense and the text labels are small; the flow from 'Edge Candidate Locations' through 'Attack Optimization' to 'Evaluation' could be clearer with larger annotations or a simplified sub-panel.
  3. Section 3.4: The probe-based placement search uses rho_probe=0.5 (Eq. 15). The assumption that a neutral gray patch identifies the optimal location for an adversarially optimized structured patch is not validated. A brief ablation comparing probe-based selection vs. random or exhaustive placement would strengthen this design choice.
  4. Table 1: The 'Drop' column for EVA-CLIP under InfraQR reports 35.93, but 98.33 - 62.40 = 35.93, which checks out. However, the HCB drop for EVA-CLIP is listed as 0.68 (98.33 - 97.65 = 0.68), which is correct but unusually small; a brief note on why EVA-CLIP is more robust would add context.
  5. Section 3.2: The choice of G=21 grid resolution with three 7x7 anchors is stated but not justified. Why 21 specifically? A brief note on how this was selected (e.g., pilot experiments) would help reproducibility.
  6. The manuscript uses 'GPT-5.4' for both caption scoring and VQA judging. It would help to specify the exact prompting protocol used for GPT-5.4 evaluation (e.g., the rubric shown in Figure 3C) in the main text or supplementary material for reproducibility.

Circularity Check

0 steps flagged

No significant circularity; the attack optimization and evaluation are independently defined, and the transfer results are genuinely black-box.

full rationale

The paper's derivation chain is self-contained and does not exhibit circularity. The classification attack objective (Eq. 13-14) is defined in terms of surrogate CLIP-style encoders, and the evaluation on those same models is standard white-box adversarial evaluation — not circular. For caption transfer (Table 2) and VQA (Table 3), the paper explicitly states that the evaluated models (BLIP-2, LLaVA, OpenFlamingo, InstructBLIP) are not accessed during optimization: 'The downstream captioning models are not accessed during patch optimization. Classification-guided adversarial images are directly transferred to these models to evaluate cross-model and cross-task generalization. Therefore, the captioning models are treated as black-box transfer targets.' The QA-aware extension (Section 3.5) constructs semantic targets from question-answer pairs using the surrogate encoder without querying the VQA models. The edge-based placement search (Section 3.4) uses a neutral probe patch to select locations, which is an approximation rather than a circular definition. The binary regularization (Eq. 9) encourages near-binary values but does not define the attack success in terms of itself. No self-citation chain is load-bearing for the central claims. The GPT-5.4 evaluation metric is an external judge, not a fitted parameter being re-presented as a prediction. The minor concern about GPT-5.4 scoring reliability is a correctness risk, not a circularity issue. Overall, the paper's claims are independently testable and the derivation does not reduce to its inputs by construction.

Axiom & Free-Parameter Ledger

8 free parameters · 3 axioms · 1 invented entities

The paper introduces 8 free parameters, most of which are ablated. The key axioms are domain assumptions about CLIP's applicability to infrared and GPT-5.4's reliability as a judge. No problematic invented entities are introduced; the QR-inspired patch is a methodological construct with empirical validation.

free parameters (8)
  • G (grid resolution) = 21
    Chosen by design; controls patch structure resolution.
  • tau (sigmoid temperature) = 15
    Controls sharpness of binary mapping; chosen empirically.
  • lambda_bin (binary regularization weight) = 0.01
    Trade-off between attack effectiveness and near-binary values; ablated in Fig. 4d.
  • p (patch size) = 37 (on 224x224)
    Spatial patch size; ablated in Fig. 4b as 1/6 of image.
  • T (iterations) = 1000
    Optimization budget; ablated in Fig. 4a.
  • eta (learning rate) = 0.03
    Adam optimizer learning rate; ablated in Fig. 4c.
  • rho_probe (probe intensity) = 0.5
    Gray intensity for placement search probe patch.
  • sigma_init (initialization std) = 0.01
    Standard deviation for logit initialization.
axioms (3)
  • domain assumption CLIP-style contrastive image-text encoders provide meaningful semantic representations for infrared imagery when prompted with 'a thermal photo of a {category}'
    Section 4.1: surrogate encoders are CLIP-style models trained on RGB, applied to infrared. The clean accuracies (96-98.67%) empirically support this for the benchmark, but the assumption that these representations generalize is foundational to the attack.
  • domain assumption GPT-5.4 provides reliable semantic consistency scoring for caption evaluation and answer correctness judging for VQA
    Sections 4.1, 4.3, 4.4: GPT-5.4 is used as the official judge for both caption semantic consistency and VQA answer correctness. No independent validation of its reliability is provided.
  • ad hoc to paper Edge-placed perturbations affect global image-text representations in CLIP-style models
    Section 1: the paper tests whether peripheral structured signals can disrupt VLMs. This is the core hypothesis, and the results support it, but the mechanism (why edge perturbations affect global representations) is not analyzed.
invented entities (1)
  • QR-inspired structured patch with fixed finder-style anchors and learnable grid cells independent evidence
    purpose: Adversarial perturbation parameterization that balances structured appearance with optimization freedom
    The patch design is evaluated on standard models and shown to be effective. The ablation study (Fig. 4) provides falsifiable evidence about parameter sensitivity. The patch is not a new physical entity but a methodological construct.

pith-pipeline@v1.1.0-glm · 17627 in / 2965 out tokens · 446792 ms · 2026-07-09T15:06:45.539847+00:00 · methodology

0 comments
read the original abstract

Infrared vision-language models are increasingly used for perception under low-light and adverse visual conditions, yet their robustness to localized structured perturbations remains underexplored. Existing infrared adversarial studies mainly focus on object detectors, leaving the security of infrared vision-language models less systematically examined. We present InfraQR, a QR-inspired structured patch attack for infrared vision-language models. Unlike localized attacks that attach perturbations to the target object, InfraQR places a compact structured patch along image boundaries and optimizes learnable grid cells through surrogate CLIP-style encoders. The resulting patch has a near-binary structured appearance, but is not required to be a valid or machine-readable QR code. We evaluate InfraQR on infrared classification, caption transfer, and question-answer-aware visual question answering (VQA) tasks. On a 300-image infrared benchmark, InfraQR sharply reduces the accuracy of multiple CLIP-style classifiers, including reducing OpenAI CLIP accuracy from 98.67% to 0.70%. The generated adversarial images also transfer to black-box captioning and VQA models, causing semantic degradation in captions and more error-prone answers under GPT-5.4-based evaluation. These results show that infrared vision-language models remain vulnerable to structured edge-placed perturbations, motivating further study of cross-task robustness beyond direct object occlusion.

Figures

Figures reproduced from arXiv: 2607.07288 by Chengyin Hu, Fengyu Zhang, Jiahuan Long, Jiaju Han, Ma Yaqi, Xin Li, Yahui Chai, Yingying Zhao.

Figure 1
Figure 1. Figure 1: Overall framework of InfraQR. and locations [27]; AdvIB and AdvGrid study multi-view black-box infrared attacks [9, 24]; and unified adversarial patches investigate cross-modal visible￾infrared attacks [26]. AdvIC and other infrared patch-generation methods fur￾ther study transferability in thermal imagery [10]. These works demonstrate infrared vulnerability, but they mainly target detectors and often atta… view at source ↗
Figure 2
Figure 2. Figure 2: Qualitative classification examples under different adversarial attacks [PITH_FULL_IMAGE:figures/full_fig_p012_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Qualitative image-captioning and VQA examples under different adversarial attacks. 4.4 Question–Answer-Aware VQA Results [PITH_FULL_IMAGE:figures/full_fig_p013_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Ablation analysis of InfraQR. We therefore use 1000 iterations as the default setting. The learning-rate ablation shows that overly aggressive updates hurt stability: 0.01 and 0.03 both achieve high ASR, whereas 0.05 reduces ASR to 90.88%. Patch size also affects attack capacity. A larger 1/4 patch reaches 99.32% ASR, but occupies more image area; the default 1/6 patch keeps the perturbation compact while … view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

31 extracted references · 31 canonical work pages · 6 internal anchors

  1. [1]

    Awadalla, A., Gao, I., Gardner, J., Hessel, J., Hanafy, Y., Zhu, W., Marathe, K., Bitton, Y., Gadre, S., Sagawa, S., Jitsev, J., Kornblith, S., Koh, P.W., Ilharco, G., Wortsman, M., Schmidt, L.: Openflamingo: An open-source framework for training large autoregressive vision-language models (2023),https://arxiv.org/ abs/2308.01390

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  2. [2]

    Brown, T.B., Mané, D., Roy, A., Abadi, M., Gilmer, J.: Adversarial patch (2018), https://arxiv.org/abs/1712.09665

    work page internal anchor Pith review Pith/arXiv arXiv 2018

  3. [3]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Cao, Y., Xing, Y., Zhang, J., Lin, D., Zhang, T., Tsang, I., Liu, Y., Guo, Q.: Scenetap: Scene-coherent typographic adversarial planner against vision-language models in real-world environments. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 25050–25059 (June 2025)

    work page 2025

  4. [4]

    In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR)

    Cherti, M., Beaumont, R., Wightman, R., Wortsman, M., Ilharco, G., Gordon, C., Schuhmann, C., Schmidt, L., Jitsev, J.: Reproducible scaling laws for contrastive language-image learning. In: Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR). pp. 2818–2829 (June 2023)

    work page 2023

  5. [5]

    In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S

    Dai, W., Li, J., LI, D., Tiong, A., Zhao, J., Wang, W., Li, B., Fung, P.N., Hoi, S.: Instructblip: Towards general-purpose vision-language models with instruc- tion tuning. In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S. (eds.) Advances in Neural Information Processing Systems. vol. 36, pp. 49250–49267. Curran Associates, Inc. (2...

    work page 2023

  6. [6]

    In: Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision (ICCV)

    Fang, H., Kong, J., Yu, W., Chen, B., Li, J., Wu, H., Xia, S.T., Xu, K.: One perturbation is enough: On generating universal adversarial perturbations against vision-language pre-training models. In: Proceedings of the IEEE/CVF Interna- tional Conference on Computer Vision (ICCV). pp. 4090–4100 (October 2025)

    work page 2025

  7. [7]

    In: Oh, A., Naumann, T., Globerson, A., Saenko, K., Hardt, M., Levine, S

    Gadre, S.Y., Ilharco, G., Fang, A., Hayase, J., Smyrnis, G., Nguyen, T., Marten, R., Wortsman, M., Ghosh, D., Zhang, J., Orgad, E., Entezari, R., Daras, G., Pratt, S., Ramanujan, V., Bitton, Y., Marathe, K., Mussmann, S., Vencu, R., Cherti, M., Krishna, R., Koh, P.W., Saukh, O., Ratner, A.J., Song, S., Hajishirzi, H., Farhadi, A., Beaumont, R., Oh, S., Di...

    work page 2023

  8. [8]

    Goodfellow, I.J., Shlens, J., Szegedy, C.: Explaining and harnessing adversarial examples (2015),https://arxiv.org/abs/1412.6572

    work page internal anchor Pith review Pith/arXiv arXiv 2015

  9. [9]

    Neural Networks175, 106310 (2024).https://doi.org/10.1016/ j.neunet.2024.106310,https://www.sciencedirect.com/science/article/ pii/S089360802400234X

    Hu, C., Shi, W., Jiang, T., Yao, W., Tian, L., Chen, X., Zhou, J., Li, W.: Adversar- ial infrared blocks: A multi-view black-box attack to thermal infrared detectors in physical world. Neural Networks175, 106310 (2024).https://doi.org/10.1016/ j.neunet.2024.106310,https://www.sciencedirect.com/science/article/ pii/S089360802400234X

    work page arXiv 2024

  10. [10]

    Neural Networks178, 106459 (Oct 2024).https://doi.org/10.1016/j.neunet.2024

    Hu, C., Shi, W., Yao, W., Jiang, T., Tian, L., Chen, X., Li, W.: Adversarial infrared curves: An attack on infrared pedestrian detectors in the physical world. Neural Networks178, 106459 (Oct 2024).https://doi.org/10.1016/j.neunet.2024. 106459,http://dx.doi.org/10.1016/j.neunet.2024.106459 16 X. Li et al

    work page doi:10.1016/j.neunet.2024 2024

  11. [11]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Hu, K., Yu, W., Zhang, L., Robey, A., Zou, A., Hu, H., Xu, C., Fredrikson, M.: Omni-attack: Adversarial attacks on open-ended vqa in black-box multimodal llms. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 42341–42351 (June 2026)

    work page 2026

  12. [12]

    In: Dy, J., Krause, A

    Karmon, D., Zoran, D., Goldberg, Y.: LaVAN: Localized and visible adversarial noise. In: Dy, J., Krause, A. (eds.) Proceedings of the 35th International Confer- ence on Machine Learning. Proceedings of Machine Learning Research, vol. 80, pp. 2507–2515. PMLR (10–15 Jul 2018),https://proceedings.mlr.press/v80/ karmon18a.html

    work page 2018

  13. [13]

    In: Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., Scarlett, J

    Li, J., Li, D., Savarese, S., Hoi, S.: BLIP-2: Bootstrapping language-image pre- training with frozen image encoders and large language models. In: Krause, A., Brunskill, E., Cho, K., Engelhardt, B., Sabato, S., Scarlett, J. (eds.) Proceedings of the 40th International Conference on Machine Learning. Proceedings of Machine Learning Research, vol. 202, pp....

    work page 2023

  14. [14]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Li, Y., Yin, J.L., Lin, L., Lin, W.: Transform to transfer: Boosting adversarial attack transferability on vision-language pre-training models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 30141–30150 (June 2026)

    work page 2026

  15. [15]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    Liu, H., Ruan, S., Huang, Y., Zhao, S., Wei, X.: When lighting deceives: Exposing vision-language models’ illumination vulnerability through illumination transfor- mation attack. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 10485–10495 (October 2025)

    work page 2025

  16. [16]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Liu, H., Li, C., Li, Y., Lee, Y.J.: Improved baselines with visual instruction tuning. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 26296–26306 (June 2024)

    work page 2024

  17. [17]

    Liu, H., Li, C., Li, Y., Li, B., Zhang, Y., Shen, S., Lee, Y.J.: Llava-next: Improved reasoning, ocr, and world knowledge.https://llava-vl.github.io/blog/2024- 01-30-llava-next/(2024)

    work page 2024

  18. [18]

    In: Pro- ceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    Liu, Y., Ouyang, X., Cui, X.: Gleam: Enhanced transferable adversarial attacks for vision-language pre-training models via global-local transformations. In: Pro- ceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 1665–1674 (October 2025)

    work page 2025

  19. [19]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    Lu, D., Wang, Z., Wang, T., Guan, W., Gao, H., Zheng, F.: Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 102–111 (October 2023)

    work page 2023

  20. [20]

    OpenAI: Gpt-5.4 model.https://developers.openai.com/api/docs/models/ gpt-5.4(2026)

    work page 2026

  21. [21]

    In: Meila, M., Zhang, T

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., Sutskever, I.: Learning transferable visual models from natural language supervision. In: Meila, M., Zhang, T. (eds.) Proceedings of the 38th International Conference on Machine Learning. Proceed- ings of Machine Learning Res...

    work page 2021

  22. [22]

    Sun, Q., Fang, Y., Wu, L., Wang, X., Cao, Y.: Eva-clip: Improved training tech- niques for clip at scale (2023),https://arxiv.org/abs/2303.15389

    work page internal anchor Pith review Pith/arXiv arXiv 2023

  23. [23]

    Intriguing properties of neural networks

    Szegedy, C., Zaremba, W., Sutskever, I., Bruna, J., Erhan, D., Goodfellow, I., Fergus, R.: Intriguing properties of neural networks. In: International Conference on Learning Representations (2014),http://arxiv.org/abs/1312.6199 InfraQR 17

    work page internal anchor Pith review Pith/arXiv arXiv 2014

  24. [24]

    Tiliwalidi, K., Hu, C., Shi, W.: Multi-view black-box physical attacks on infrared pedestrian detectors using adversarial infrared grid (2024),https://arxiv.org/ abs/2407.01168

    work page internal anchor Pith review Pith/arXiv arXiv 2024

  25. [25]

    Proceedings of the AAAI Conference on Artificial Intelligence37(12), 15233–15241 (Jun 2023)

    Wei, H., Wang, Z., Jia, X., Zheng, Y., Tang, H., Satoh, S., Wang, Z.: Hotcold block: Fooling thermal infrared detectors with a novel wearable design. Proceedings of the AAAI Conference on Artificial Intelligence37(12), 15233–15241 (Jun 2023). https://doi.org/10.1609/aaai.v37i12.26777,http://dx.doi.org/10.1609/ aaai.v37i12.26777

    work page doi:10.1609/aaai.v37i12.26777 2023

  26. [26]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV)

    Wei, X., Huang, Y., Sun, Y., Yu, J.: Unified adversarial patch for cross-modal attacks in the physical world. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV). pp. 4445–4454 (October 2023)

    work page 2023

  27. [27]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Wei, X., Yu, J., Huang, Y.: Physically adversarial infrared patches with learnable shapes and locations. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 12334–12342 (June 2023)

    work page 2023

  28. [28]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Xie, P., Bie, Y., Mao, J., Song, Y., Wang, Y., Chen, H., Chen, K.: Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 14679–14689 (June 2025)

    work page 2025

  29. [29]

    In: Kim, B., Yue, Y., Chaudhuri, S., Fragkiadaki, K., Khan, M., Sun, Y

    Xu, H., Xie, S., Tan, X., Huang, P.Y., Howes, R., Sharma, V., Li, S.W., Ghosh, G., Zettlemoyer, L., Feichtenhofer, C.: Demystifying clip data. In: Kim, B., Yue, Y., Chaudhuri, S., Fragkiadaki, K., Khan, M., Sun, Y. (eds.) International Conference on Learning Representations. vol. 2024, pp. 47812– 47831 (2024),https://proceedings.iclr.cc/paper_files/paper/...

    work page 2024

  30. [30]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR)

    Zhang, J., Ye, J., Ma, X., Li, Y., Yang, Y., Chen, Y., Sang, J., Yeung, D.Y.: Any- attack: Towards large-scale self-supervised adversarial attacks on vision-language models. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR). pp. 19900–19909 (June 2025)

    work page 2025

  31. [31]

    In: Proceedings of the 30th ACM International Conference on Multimedia

    Zhang, J., Yi, Q., Sang, J.: Towards adversarial attack on vision-language pre- training models. In: Proceedings of the 30th ACM International Conference on Multimedia. pp. 5005–5013. MM ’22, Association for Computing Machinery, New York, NY, USA (2022).https://doi.org/10.1145/3503161.3547801,https: //doi.org/10.1145/3503161.3547801

    work page doi:10.1145/3503161.3547801 2022