Pith. sign in

REVIEW 3 major objections 5 minor 70 references

CloakDiff is the first method that turns ordinary photos into imperceptible, fully recoverable adversarial images that block vision-language models from reading private attributes via text queries.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 12:35 UTC pith:DWSKNBYU

load-bearing objection Competent first pipeline for reversible high-fidelity VLM privacy AEs; combination works empirically, but privacy is still mostly caption-proxy. the 3 major comments →

arxiv 2607.10329 v1 pith:DWSKNBYU submitted 2026-07-11 cs.CV

Imperceptible and Reversible Adversarial Examples against Vision-Language Models for Privacy Protection

Qi Lu , Ziqi Zhou , Yufei Song , Zijing Li , Lulu Xue , Minghui Li , Shengshan Hu , Leo Yu Zhang This is my paper
classification cs.CV
keywords adversarial attackprivacy protectiondiffusion modelvision-language modelsreversible adversarial examplescross-attentionimage steganography
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

Vision-language models can scrape online photos and answer free-form questions that reveal age, income, habits, or other private facts. Existing adversarial defenses either leave visible noise or cannot restore the original image, and they do not transfer well across models and prompts. CloakDiff solves this by using a diffusion model to edit the image so that both its pixel embeddings and its latent cross-attention maps no longer align with the original semantics, while a self-attention retention term keeps the global look intact. An invertible network then hides the clean original inside the edited image, so the owner can recover it losslessly from the protected file alone. Experiments across multiple datasets and nine VLMs show large drops in caption similarity and attribute-inference accuracy with high visual quality.

Core claim

The authors establish that jointly shifting pixel-space CLIP embeddings and perturbing latent cross-attention maps inside a diffusion sampler, under self-attention retention and a custom EDM-Heuristic Sampling schedule, produces adversarial images that suppress private-attribute inference by VLMs across models and prompts; embedding the original via an invertible network then yields near-lossless recovery without sacrificing the visual quality needed for everyday sharing.

What carries the argument

CloakDiff: diffusion-based adversarial guided editing (pixel-embedding pull toward a target plus latent cross-attention map deviation, constrained by self-attention retention and EDM-Heuristic Sampling) followed by invertible-network steganography that embeds the original image inside the adversarial cover for exact recovery.

Load-bearing premise

That lower caption-similarity scores and reduced accuracy on a fixed set of sensitive-attribute probes are enough to guarantee real privacy against an adversary free to invent arbitrary prompts, reasoning chains, and unseen models.

What would settle it

On a held-out privacy-inference benchmark, an unseen VLM using adaptive free-form or chain-of-thought prompts recovers the same sensitive attributes from CloakDiff-protected images at rates statistically indistinguishable from rates on the unprotected originals.

Watch this falsifier — get emailed when new claim-graph text bears on it.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes CloakDiff, claimed as the first framework for imperceptible and reversible adversarial examples that protect user images against text-based privacy queries on vision–language models. Given an original image, a diffusion model performs adversarial guided editing by shifting CLIP pixel embeddings toward a target (Eq. 1), deviating latent cross-attention maps from the original reconstruction (Eq. 3), and retaining self-attention maps for structure (Eq. 5), under a custom EDM-Heuristic Sampling schedule (Eqs. 7–9) with Null-Text Optimization. An invertible network then embeds the original into the adversarial image so that the protected RAE alone recovers a near-lossless original. Experiments on ImageNet-compatible and MS-COCO images across nine VLMs report reduced caption similarity (BLEU/CIDEr/METEOR/ROUGE-L/SPICE), competitive LPIPS/FID and recovery metrics, ablations, comparisons to Anyattack/AttackVLM/AdvDiffVLM/DP-RAE, a VIP attribute probe, and checks under compression and simple defenses.

Significance. If the privacy claim holds under realistic adaptive querying, the work would be a useful systems contribution: it targets a concrete multimodal privacy threat (crawled photos + VLM attribute inference), couples unrestricted diffusion editing with INN reversibility, and reports multi-model transfer with better visual quality than high-frequency VLM attacks. Strengths include broad VLM coverage (nine models), module/weight/schedule ablations (Fig. 7), explicit recovery metrics (Table 2), and practical stress checks (compression, Table 7; simple defenses, Fig. 8). EHS is presented with a score-matching framing and a monotonicity claim (Theorem I), which is a clear engineering contribution even if not a uniqueness result. The main significance hinges on whether caption-overlap and limited attribute probes adequately operationalize cross-prompt privacy.

major comments (3)
  1. Property (I) in §3 claims cross-model and cross-prompt privacy so that an attacker cannot reliably recover sensitive attributes under arbitrary prompts and unseen VLMs. The primary evidence is lower caption similarity under 10 randomly sampled prompts (Tables 1, 3) plus a VIP probe on five fixed attributes for three models (Table 4). Caption-overlap reduction does not establish that targeted attribute questions, multi-turn or chain-of-thought prompts, or models outside the evaluated set fail. Table 4 itself shows incomplete suppression (e.g., MiniGPT-4 MAR 0.18→0.19; LLaVA EDU 0.43→0.38). A load-bearing evaluation should report success rates under attribute-targeted and adaptive prompts (and preferably held-out VLMs), not only generic caption metrics.
  2. §4.1 and Eq. (1) make pixel-space guidance depend on a target image x_tgt synthesized from MS-COCO captions via Stable Diffusion (§5.1). Protection strength and transferability may be sensitive to this choice (semantic distance, domain match, or adversarial target selection), yet the paper does not systematically ablate target selection or report failure cases when x_tgt is poorly matched. Because L_pixel is described as dominating adversarial editing, target dependence is central to the claimed cross-prompt robustness and should be quantified.
  3. Reversibility is a core claim (Abstract; property III; §4.4). Table 2 reports near-lossless recovery without compression, but Table 7 shows clear degradation under JPEG (SSIM 0.83, PSNR 30.29, RMSE 1.07). For a privacy pipeline intended for social-media upload and transmission, the manuscript should clarify whether recovery is intended only under lossless storage or also after realistic lossy pipelines, and whether the INN stage can be hardened or re-trained for common codecs. As written, “lossless recovery from x_rae alone” is only partially supported in the stated deployment setting.
minor comments (5)
  1. Notation for attention maps is inconsistent: Eq. (3) uses A^{l,h}_c while the surrounding text also writes A^{l,h}_cross; Eq. (5) mixes A^{l,h}_s and A^{l,h}_self. Unify symbols.
  2. In §4.3, Eq. (8) sums over k ∈ {pixel, latent, attn} while the retention loss is named L_retain in Eq. (5); align the index set with the defined losses.
  3. Figure 2 and Figure 6 are useful but would benefit from quantitative callouts (e.g., LPIPS next to examples) so visual claims are not left purely qualitative.
  4. Related work states that no prior work uses deep steganography for RAEs; a brief clarification relative to DP-RAE and classical RDH-based RAE lines would help readers place the novelty claim.
  5. Several free parameters (λ_pixel, λ_latent, λ_retain, α1, α2, ρ, N, K) are set by default; a short sensitivity summary or recommended ranges in the main text would aid reproducibility beyond Fig. 7.

Circularity Check

0 steps flagged

No significant circularity: empirical systems method with surrogate losses evaluated on black-box metrics and a direct schedule property, not a forced derivation.

full rationale

CloakDiff is an empirical adversarial-privacy systems paper. Its central claims (cross-model/cross-prompt protection with high fidelity and reversibility) rest on constructing losses (Eqs. 1, 3, 5) that shift CLIP embeddings and cross-attention while retaining self-attention, sampling under a custom EHS schedule (Eqs. 7–9), embedding via an INN, and then measuring black-box VLM caption similarity (BLEU/CIDEr/etc.) plus limited VIP attribute probes. These evaluation metrics are not identical to the optimized surrogates, so reported reductions are not true by construction; transfer to unseen models/prompts is an empirical outcome. Theorem I simply records the monotonicity of the explicitly defined ¯𝛼syn_t(𝜌) formula and is not load-bearing for the privacy claim. No uniqueness theorems, fitted-then-predicted quantities, or self-citation chains force the results. Standard self-citations of prior attack/steganography work appear only as related work. The paper is self-contained against external baselines and datasets; any gap between caption-overlap proxies and adaptive attribute inference is a validity concern, not circularity.

Axiom & Free-Parameter Ledger

8 free parameters · 5 axioms · 3 invented entities

The central claim rests on standard diffusion/CLIP/INN machinery plus many hand-chosen optimization weights and the modeling choice that caption-metric suppression equals privacy. No new physical entities; invented constructs are algorithmic (CloakDiff, EHS, adversarial guided editing losses). Free parameters dominate the ledger because protection–fidelity trade-offs are tuned rather than derived.

free parameters (8)
  • λ_pixel = 50
    Weight on CLIP cosine pull toward target embedding; default 50, ablated in Fig. 7(b); directly trades protection vs quality.
  • λ_latent = 200
    Weight on cross-attention map deviation; default 200; primary lever for multimodal disruption.
  • λ_retain = 100K
    Weight on self-attention retention; default 100K; balances fidelity against adversarial strength.
  • α2 (adversarial scale) = 1e-2
    Scales adversarial score term in reverse sampling (Eq. 8–9); default 1e-2; acts as latent step size.
  • α1 (NTO step size) = 1e-1
    Null-text optimization step for reconstruction; default 1e-1.
  • ρ (EHS convexity) = 3
    Controls nonlinear SNR schedule density; default 3; chosen via ablation not theory uniqueness.
  • N, K (steps and iterations) = N=20, K=50
    Sampling steps N=20 and outer iterations K=50 set compute/quality trade-off; Table 5 shows sensitivity.
  • target image x_tgt choice = SD-synthesized from MS-COCO captions
    Pixel guidance aligns to a synthesized target from MS-COCO captions via Stable Diffusion; choice of anchor is free and affects attack semantics.
axioms (5)
  • domain assumption CLIP image embeddings and Stable Diffusion cross-attention maps are transferable surrogates for black-box VLM multimodal alignment.
    Used throughout §4.1 and transfer experiments; standard in VLM attack literature but not guaranteed for all future VLMs.
  • domain assumption Hi-Net-style invertible networks can embed a full-resolution original into an adversarial cover with near-perfect inverse recovery when uncompressed.
    §4.4 and Table 2; recovery degrades under JPEG (Table 7), so invertibility is approximate in real networks.
  • domain assumption Score-matching reverse process (Eq. 6–9) remains valid when the score is additively modified by weighted gradients of L_pixel, L_latent, L_retain.
    §4.3 presents this as principled adversarial guidance; validity is empirical.
  • standard math Standard calculus/monotonicity: for the constructed EHS map, ᾱ_syn_t(ρ) decreases in ρ (Theorem I).
    Elementary property of the schedule formula; supports user control of ρ but does not prove optimality.
  • ad hoc to paper Privacy protection is adequately measured by lower caption similarity and reduced accuracy on a fixed set of sensitive attributes under sampled prompts.
    Problem Statement and §5 evaluation design; load-bearing for the privacy claim.
invented entities (3)
  • CloakDiff pipeline no independent evidence
    purpose: End-to-end reversible privacy protection for VLM text-query attacks combining diffusion adversarial editing and INN steganography.
    Named framework; evaluated empirically; no independent existence outside this paper.
  • EDM-Heuristic Sampling (EHS) no independent evidence
    purpose: Nonlinear time discretization for adversarially guided diffusion sampling to improve fidelity under guidance.
    Schedule construction inspired by EDM; Theorem I only states monotonicity; performance shown vs DDIM/EDM/DPM in Table 6.
  • Adversarial guided editing losses (L_pixel, L_latent, L_retain) no independent evidence
    purpose: Inject adversarial multimodal semantics while retaining global structure during sampling.
    Paper-specific loss design; ablated in Fig. 7; not independently validated outside this work.

pith-pipeline@v1.1.0-grok45 · 24455 in / 4062 out tokens · 61772 ms · 2026-07-14T12:35:14.986913+00:00 · methodology

0 comments
read the original abstract

Vision Language Models (VLMs) offer powerful multimodal ability but also expose users to text-based privacy attacks where adversaries crawl online photos and query VLMs to extract sensitive attributes. Existing reversible adversarial example (RAE) methods protect images in purely visual tasks but fail in multimodal settings, and current adversarial examples on VLMs rely on high frequency noise that severely degrades visual quality. We propose CloakDiff, the first framework for reversible, high fidelity privacy protection against text-based query attacks in VLMs. CloakDiff produces imperceptible adversarial examples by combining diffusion based adversarial editing with an invertible network that embeds the original image for lossless recovery. It perturbs both pixel space embeddings and manipulates latent cross attention maps to ensure strong cross-model and cross-prompt transferability while preserving global visual structure. To further enhance fidelity, we design EDM Heuristic Sampling, a principled diffusion schedule for adversarial guidance. Experiments on multiple datasets and VLMs demonstrate that CloakDiff delivers multimodal privacy preservation with high visual quality and reversibility.

Figures

Figures reproduced from arXiv: 2607.10329 by Leo Yu Zhang, Lulu Xue, Minghui Li, Qi Lu, Shengshan Hu, Yufei Song, Zijing Li, Ziqi Zhou.

Figure 1
Figure 1. Figure 1: Illustration of privacy risks under VLMs. [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Comparison of adversarial attacks for VLMs. [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: The framework of CloakDiff: the first privacy-preserving method for image protection under VLMs. [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Visualization of hidden states in LLaVA [ [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: This figure illustrates the positions in the model’s [PITH_FULL_IMAGE:figures/full_fig_p005_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: From left to right: BLIP, UniDiffuser, Flamingo, and LLaVA. Shown are reversible adversarial examples generated by [PITH_FULL_IMAGE:figures/full_fig_p006_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Ablation study of CloakDiff on BLIP. ‘Protection’ is computed as the average of the six corresponding metrics. The [PITH_FULL_IMAGE:figures/full_fig_p007_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Defense performance of CloakDiff on BLIP (left) [PITH_FULL_IMAGE:figures/full_fig_p009_8.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

70 extracted references · 14 linked inside Pith

  1. [1]

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al

  2. [2]

    Flamingo: a visual language model for few-shot learning.Advances in neural information processing systems35 (2022), 23716–23736

    2022

  3. [3]

    Lynton Ardizzone, Jakob Kruse, Sebastian Wirkert, Daniel Rahner, Eric W Pelle- grini, Ralf S Klessen, Lena Maier-Hein, Carsten Rother, and Ullrich Köthe. 2018. Analyzing inverse problems with invertible neural networks.arXiv preprint arXiv:1808.04730(2018)

    Pith/arXiv arXiv 2018

  4. [4]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al . 2025. Qwen2. 5-vl technical report.arXiv preprint arXiv:2502.13923(2025)

    Pith/arXiv arXiv 2025

  5. [5]

    Fan Bao, Shen Nie, Kaiwen Xue, Chongxuan Li, Shi Pu, Yaole Wang, Gang Yue, Yue Cao, Hang Su, and Jun Zhu. 2023. One transformer fits all distributions in multi-modal diffusion at scale. InInternational Conference on Machine Learning. PMLR, 1692–1717

    2023

  6. [6]

    Zhe Chen, Jiannan Wu, Wenhai Wang, Weijie Su, Guo Chen, Sen Xing, Muyan Zhong, Qinglong Zhang, Xizhou Zhu, Lewei Lu, et al. 2024. Internvl: Scaling up vision foundation models and aligning for generic visual-linguistic tasks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 24185–24198

    2024

  7. [7]

    Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale N Fung, and Steven Hoi. 2023. Instructblip: Towards general-purpose vision-language models with instruction tuning.Advances in neural information processing systems36 (2023), 49250–49267

    2023

  8. [8]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Im- agenet: A large-scale hierarchical image database. In2009 IEEE conference on computer vision and pattern recognition. Ieee, 248–255

    2009

  9. [9]

    Junjie Fei, Teng Wang, Jinrui Zhang, Zhenyu He, Chengjie Wang, and Feng Zheng. 2023. Transferable decoding with visual entities for zero-shot image captioning. InProceedings of the IEEE/CVF international conference on computer vision. 3136–3146

    2023

  10. [10]

    Qi Guo, Shanmin Pang, Xiaojun Jia, Yang Liu, and Qing Guo. 2024. Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models.IEEE Transactions on Information Forensics and Security(2024)

    2024

  11. [11]

    Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. 2017. Gans trained by a two time-scale update rule converge to a local nash equilibrium.Advances in neural information processing systems30 (2017)

    2017

  12. [12]

    Jonathan Ho and Tim Salimans. 2022. Classifier-free diffusion guidance.arXiv preprint arXiv:2207.12598(2022)

    Pith/arXiv arXiv 2022

  13. [13]

    Shuai Jia, Bangjie Yin, Taiping Yao, Shouhong Ding, Chunhua Shen, Xiaokang Yang, and Chao Ma. 2022. Adv-attribute: Inconspicuous and transferable ad- versarial attack on face recognition.Advances in Neural Information Processing Systems35 (2022), 34136–34147

    2022

  14. [14]

    Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. 2021. Hinet: Deep image hiding by invertible network. InProceedings of the IEEE/CVF inter- national conference on computer vision. 4733–4742

    2021

  15. [15]

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. 2022. Elucidating the design space of diffusion-based generative models.Advances in neural information processing systems35 (2022), 26565–26577

    2022

  16. [16]

    Bahjat Kawar, Shiran Zada, Oran Lang, Omer Tov, Huiwen Chang, Tali Dekel, Inbar Mosseri, and Michal Irani. 2023. Imagic: Text-based real image editing with diffusion models. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6007–6017

    2023

  17. [17]

    Yash Khare, Viraj Bagal, Minesh Mathew, Adithi Devi, U Deva Priyakumar, and CV Jawahar. 2021. Mmbert: Multimodal bert pretraining for improved medical vqa. In2021 IEEE 18th international symposium on biomedical imaging (ISBI). IEEE, 1033–1036

    2021

  18. [18]

    Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. InInternational conference on machine learning. PMLR, 19730–19742

    2023

  19. [19]

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. 2022. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. InInternational conference on machine learning. PMLR, 12888–12900

    2022

  20. [20]

    Minghui Li, Jiangxiong Wang, Hao Zhang, Ziqi Zhou, Shengshan Hu, and Xi- aobing Pei. 2024. Transferable adversarial facial images for privacy protection. InProceedings of the 32nd ACM International Conference on Multimedia (ACM MM’24). 10649–10658

    2024

  21. [21]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. InEuropean conference on computer vision. Springer, 740–755

    2014

  22. [22]

    Bingyan Liu, Chengyu Wang, Tingfeng Cao, Kui Jia, and Jun Huang. 2024. To- wards understanding cross and self-attention in stable diffusion for text-guided image editing. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 7817–7826

    2024

  23. [23]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual in- struction tuning.Advances in neural information processing systems36 (2023), 34892–34916

    2023

  24. [24]

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu

  25. [25]

    Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps.Advances in neural information processing systems35 (2022), 5775–5787

    2022

  26. [26]

    Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. 2025. Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. Machine Intelligence Research22, 4 (2025), 730–751

    2025

  27. [27]

    Ron Mokady, Amir Hertz, and Amit H Bermano. 2021. Clipcap: Clip prefix for image captioning.arXiv preprint arXiv:2111.09734(2021)

    Pith/arXiv arXiv 2021

  28. [28]

    Emir Öztürk and Altan Mesut. 2021. Performance evaluation of jpeg standards, webp and png in terms of compression ratio and time for lossless encoding. In 2021 6th International Conference on Computer Science and Engineering (UBMK). IEEE, 15–20

    2021

  29. [29]

    Nicolas Papernot, Fartash Faghri, Nicholas Carlini, Ian Goodfellow, Reuben Feinman, Alexey Kurakin, Cihang Xie, Yash Sharma, Tom Brown, Aurko Roy, et al. 2016. Technical report on the cleverhans v2. 1.0 adversarial examples library.arXiv preprint arXiv:1610.00768(2016)

    Pith/arXiv arXiv 2016

  30. [30]

    Stefan T Radev, Ulf K Mertens, Andreas Voss, Lynton Ardizzone, and Ullrich Köthe. 2020. BayesFlow: Learning complex stochastic models with invertible neural networks.IEEE transactions on neural networks and learning systems33, 4 (2020), 1452–1466

    2020

  31. [31]

    GREG Roelofs. 2002. PNG lossless image compression.Lossless Compression Handbook(2002), 371–390

    2002

  32. [32]

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. 2022. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10684–10695

    2022

  33. [33]

    Tim Salimans and Jonathan Ho. 2022. Progressive distillation for fast sampling of diffusion models.arXiv preprint arXiv:2202.00512(2022). Qi Lu et al

    Pith/arXiv arXiv 2022

  34. [34]

    Yousef Sanjalawe, Salam Al-E’mari, Salam Fraihat, Mosleh Abualhaj, and Emran Alzubi. 2025. A deep learning-driven multi-layered steganographic approach for enhanced data security.Scientific Reports15, 1 (2025), 4761

    2025

  35. [35]

    Jiaming Song, Chenlin Meng, and Stefano Ermon. 2020. Denoising diffusion implicit models.arXiv preprint arXiv:2010.02502(2020)

    Pith/arXiv arXiv 2020

  36. [36]

    Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. 2020. Score-based generative modeling through stochastic differential equations.arXiv preprint arXiv:2011.13456(2020)

    Pith/arXiv arXiv 2020

  37. [37]

    Yufei Song, Ziqi Zhou, Menghao Deng, Yifan Hu, Shengshan Hu, Minghui Li, and Leo Yu Zhang. 2026. Erosion Attack for Adversarial Training to Enhance Semantic Segmentation Robustness. InProceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP’26)

    2026

  38. [38]

    Yufei Song, Ziqi Zhou, Minghui Li, Xianlong Wang, Menghao Deng, Wei Wan, Shengshan Hu, and Leo Yu Zhang. 2025. PB-UAP: Hybrid Universal Adver- sarial Attack For Image Segmentation.. InProceedings of the IEEE International Conference on Acoustics, Speech, and Signal Processing (ICASSP’25)

    2025

  39. [39]

    Yufei Song, Ziqi Zhou, Qi Lu, Hangtao Zhang, Yifan Hu, Lulu Xue, Shengshan Hu, Minghui Li, and Leo Yu Zhang. 2025. SegTrans: Transferable Adversarial Examples for Segmentation Models.IEEE Transactions on Multimedia(2025)

    2025

  40. [40]

    Robin Staab, Mark Vero, Mislav Balunović, and Martin Vechev. 2023. Beyond memorization: Violating privacy via inference with large language models.arXiv preprint arXiv:2310.07298(2023)

    Pith/arXiv arXiv 2023

  41. [41]

    Batuhan Tömekçe, Mark Vero, Robin Staab, and Martin Vechev. 2024. Private attribute inference from images with vision-language models.Advances in Neural Information Processing Systems37 (2024), 103619–103651

    2024

  42. [42]

    Gregory K Wallace. 2002. The JPEG still picture compression standard.IEEE transactions on consumer electronics38, 1 (2002), xviii–xxxiv

    2002

  43. [43]

    Weiyun Wang, Zhangwei Gao, Lixin Gu, Hengjun Pu, Long Cui, Xingguang Wei, Zhaoyang Liu, Linglin Jing, Shenglong Ye, Jie Shao, et al. 2025. Internvl3. 5: Advancing open-source multimodal models in versatility, reasoning, and efficiency.arXiv preprint arXiv:2508.18265(2025)

    Pith/arXiv arXiv 2025

  44. [44]

    Yichen Wang, Yuxuan Chou, Ziqi Zhou, Hangtao Zhang, Wei Wan, Shengshan Hu, and Minghui Li. 2025. Breaking Barriers in Physical-World Adversarial Examples: Improving Robustness and Transferability via Robust Feature. InProceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI’25)

    2025

  45. [45]

    Yichen Wang, Hangtao Zhang, Hewen Pan, Ziqi Zhou, Xianlong Wang, Peijin Guo, Lulu Xue, Shengshan Hu, Minghui Li, and Leo Yu Zhang. 2025. AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents. InPro- ceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS’25)

    2025

  46. [46]

    Zhibo Wang, Hengchang Guo, Zhifei Zhang, Wenxin Liu, Zhan Qin, and Kui Ren

  47. [47]

    InProceedings of the IEEE/CVF international conference on computer vision

    Feature importance-aware transferable adversarial attacks. InProceedings of the IEEE/CVF international conference on computer vision. 7639–7648

  48. [48]

    Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi, Quoc V Le, Denny Zhou, et al. 2022. Chain-of-thought prompting elicits reason- ing in large language models.Advances in neural information processing systems 35 (2022), 24824–24837

    2022

  49. [49]

    Peng Xie, Yequan Bie, Jianda Mao, Yangqiu Song, Yang Wang, Hao Chen, and Kani Chen. 2025. Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks. InProceedings of the Computer Vision and Pattern Recognition Conference. 14679–14689

    2025

  50. [50]

    Shihui Yan, Hu Liu, Junyu Shi, Zihui Zhu, Ziqi Zhou, Yufei Song, Youming Geng, Minghui Li, and Shengshan Hu. 2026. VFACamou: View-Fused Adversarial Camouflage for Environment-Adaptive Physical Evasion. InProceedings of the IEEE International Conference on Multimedia and Expo (ICME’26)

    2026

  51. [51]

    Shihui Yan, Ziqi Zhou, Yufei Song, Yifan Hu, Minghui Li, and Shengshan Hu. 2026. Transferable Physical-World Adversarial Patches Against Pedestrian Detection Models.arXiv preprint arXiv:2604.22552(2026)

    Pith/arXiv arXiv 2026

  52. [52]

    Lei Yu, Yechao Zhang, Ziqi Zhou, Yang Wu, Wei Wan, Minghui Li, Shengshan Hu, Pei Xiaobing, and Jing Wang. 2025. Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM.arXiv preprint arXiv:2505.23828(2025)

    Pith/arXiv arXiv 2025

  53. [53]

    Shengming Yuan, Qilong Zhang, Lianli Gao, Yaya Cheng, and Jingkuan Song

  54. [54]

    Natural color fool: Towards boosting black-box unrestricted attacks.Ad- vances in Neural Information Processing Systems35 (2022), 7546–7560

    2022

  55. [55]

    Jiaming Zhang, Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Jitao Sang, and Dit-Yan Yeung. 2024. Anyattack: Towards large-scale self-supervised generation of targeted adversarial examples for vision-language models.arXiv e-prints (2024), arXiv–2410

    2024

  56. [56]

    Jiaming Zhang, Qi Yi, and Jitao Sang. 2022. Towards adversarial attack on vision-language pre-training models. InProceedings of the 30th ACM International Conference on Multimedia. 5005–5013

    2022

  57. [57]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  58. [58]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition. 586–595

  59. [59]

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. 2023. On evaluating adversarial robustness of large vision- language models.Advances in Neural Information Processing Systems36 (2023), 54111–54138

    2023

  60. [60]

    Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. 2023. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. InProceedings of the 31st ACM International Conference on Multimedia. 6311–6320

    2023

  61. [61]

    Ziqi Zhou, Shengshan Hu, Ruizhi Zhao, Qian Wang, Leo Yu Zhang, Junhui Hou, and Hai Jin. 2023. Downstream-agnostic adversarial examples. InProceedings of the 2023 IEEE/CVF International Conference on Computer Vision (ICCV’23). 4345–4355

    2023

  62. [62]

    Ziqi Zhou, Yifan Hu, Yufei Song, Zijing Li, Shengshan Hu, Leo Yu Zhang, Dezhong Yao, Long Zheng, and Hai Jin. 2025. Vanish into Thin Air: Cross-prompt Universal Adversarial Attacks for SAM2. InProceedings of the 39th Annual Conference on Neural Information Processing Systems (NeurIPS’25)

    2025

  63. [63]

    Ziqi Zhou, Bowen Li, Yufei Song, Shengshan Hu, Wei Wan, Leo Yu Zhang, Dezhong Yao, and Hai Jin. 2025. NumbOD: A Spatial-Frequency Fusion Attack Against Object Detectors. InProceedings of the 39th Annual AAAI Conference on Artificial Intelligence (AAAI’25)

    2025

  64. [64]

    Ziqi Zhou, Minghui Li, Wei Liu, Shengshan Hu, Yechao Zhang, Wei Wan, Lulu Xue, Leo Yu Zhang, Dezhong Yao, and Hai Jin. 2024. Securely Fine-tuning Pre- trained Encoders Against Adversarial Examples. InProceedings of the 2024 IEEE Symposium on Security and Privacy (SP’24)

    2024

  65. [65]

    Ziqi Zhou, Yufei Song, Minghui Li, Shengshan Hu, Xianlong Wang, Leo Yu Zhang, Dezhong Yao, and Hai Jin. 2024. Darksam: Fooling segment anything model to segment nothing. InProceedings of the 38th Annual Conference on Neural Information Processing Systems (NeurIPS’24)

    2024

  66. [66]

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. 2023. Minigpt-4: Enhancing vision-language understanding with advanced large lan- guage models.arXiv preprint arXiv:2304.10592(2023)

    Pith/arXiv arXiv 2023

  67. [67]

    Jiajie Zhu, Xia Du, Jizhe Zhou, Chi-Man Pun, Qizhen Xu, and Xiaoyuan Liu

  68. [68]

    InProceedings of the 32nd ACM International Conference on Multimedia

    Dp-rae: A dual-phase merging reversible adversarial example for image privacy protection. InProceedings of the 32nd ACM International Conference on Multimedia. 671–680

  69. [69]

    Zihui Zhu, Ziqi Zhou, Yichen Wang, Lulu Xue, Minghui Li, and Shengshan Hu

  70. [70]

    Transferable Physical-World Adversarial Patches Against Object Detection in Autonomous Driving.arXiv preprint arXiv:2604.23105(2026)

    Pith/arXiv arXiv 2026