Pith. sign in

REVIEW 3 major objections 6 minor 33 references

Leading attacks on driving vision-language agents share five patterns: image-first multi-view edits, QA-structure budget priors, feature-space transfer, and typographic shortcuts in camera views.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 04:45 UTC pith:QKBNOQO2

load-bearing objection Solid workshop challenge report: clean documentation of a multi-view driving-VLA attack benchmark and five concrete pipelines, with patterns that are useful but mostly reconfirm known multimodal attack themes. the 3 major comments →

arxiv 2607.11560 v1 pith:QKBNOQO2 submitted 2026-07-13 cs.CV cs.AI

Technical Report on the CVPR 2026@AdvML Workshop Challenge

Tianyuan Zhang , Zonglei Jing , Jiangfan Liu , Ligong Zhang , Ke Ma , Chengzhi Sun , Xiaohai Xu , Zhirui Zhang
show 42 more authors
Qianqian Xu Qingming Huang Hanyu Fang Junhua Liu Zheng Wang Xiaoliang Liu Yuanbo Li Shuai Gui Bin Wang Menghe Zheng Jing Nie Hanyang Meng Zeyang Zhang Xiang Zhang Yongxuan Zhu Rui Ding Hainan Li Yongkang Zhang Zhilei Zhu Xianglong Kong Jin Hu Zonghao Ying Yisong Xiao Lei Chen Haotong Qin Jiakai Wang Aishan Liu Ruikai Li Julia Karbing Yinpeng Dong Zhenfei Yin Shao Jing Xia Hu Jingyi Xu Juntao Dai Xinyun Chen Vishal M. Patel Xianglong Liu Dawn Song Alan Yuille Philip H. S. Torr Dacheng Tao
This is my paper
classification cs.CV cs.AI
keywords adversarial attacksvision-language agentsautonomous drivingmulti-view VQAblack-box transfertypographic attackDriveLMrobustness evaluation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This report documents a competition that tests whether vision-language agents used for autonomous driving can be forced into wrong answers by altered camera images and short question suffixes. Each scene has six synchronized views and structured driving questions; scoring rewards answer deviation while penalizing image change and suffix length, and Phase II averages a known model with a hidden black-box model. After ranking teams and studying the five top valid technical reports, the organizers find the same tactics recur: put most of the attack on the images because suffixes are length-penalized; optimize the six views together rather than in isolation; use question types and graph structure to spend budget where it hurts; attack internal multimodal features to improve transfer; and embed readable or character-like text in the camera images as a reliable cross-modal shortcut. A sympathetic reader cares because these agents are being asked to ground perception and planning in safety-critical scenes, and the report turns leaderboard behavior into a concrete map of where current systems fail.

Core claim

Across the five leading submissions with available technical reports, successful multimodal attacks on autonomous-driving vision-language agents consistently favor image-side, scene-level multi-view optimization over long text suffixes, treat QA types and graph structure as useful priors for allocating attack budget, gain black-box transfer from feature-space objectives, and exploit typographic or character content embedded in camera images as a persistent vulnerability.

What carries the argument

The composite SceneScore: average, over questions and scenes, of (100 minus LLM-judged answer correctness) times mean six-view image cosine similarity times 0.99 to the power of suffix character length, with Phase II further averaging known-model and hidden-model scores. This metric, plus the structured case comparison of the five top valid teams, is what converts raw ranks into the reported attack patterns.

Load-bearing premise

The five technical reports chosen for case study fairly represent what works, and the composite score that mixes answer deviation, image similarity, suffix length, and a hidden model fairly tracks real safety risk.

What would settle it

A strong attack that treats the six camera views independently, optimizes only final-answer losses, and avoids typographic overlays would outrank the multi-view, feature-space, and typographic methods on both the known and hidden models under the same SceneScore protocol.

Watch this falsifier — get emailed when new claim-graph text bears on it.

If this is right

  • Robustness tests for driving vision-language agents must treat coordinated six-view edits and JPEG submission pipelines as part of the threat model.
  • Defenses should include cross-view consistency checks and filtering of text-like overlays in camera feeds.
  • Attack and defense budgets allocated by QA subtype and graph-node importance will outperform uniform noise.
  • Feature-space and subspace objectives transfer better to hidden models than final-answer-only losses.
  • Typographic and character-distractor cues remain high-value attack surfaces even when text suffixes are restricted and penalized.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • If readable text painted into camera images transfers so reliably, production driving stacks may need mandatory visual-text decontamination before any vision-language reasoning stage.
  • The large Phase I to Phase II rank reshuffling implies that public-model-only leaderboards systematically over-credit overfitted attacks, so transfer-first design should be required for any claimed safety result.
  • Subtype-weighted, soft-capped answer losses combined with multi-view feature disruption may template attacks on other structured multimodal agents beyond driving.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. This technical report documents the CVPR 2026@AdvML Workshop Challenge on adversarial multimodal attacks against autonomous-driving vision-language agents. Built on DriveLM-style six-view VQA, the challenge requires joint image perturbations and suffix-only textual edits under image-fidelity and length-penalty constraints. Phase I evaluates known-model attacks on DriveLM-Agent; Phase II averages scores on DriveLM-Agent and a hidden black-box model (Dolphins) to stress transfer. The paper specifies the task, submission rules, composite SceneScore (Eq. 4), and leaderboards (Tables 2–4), then analyzes five leading technical reports (MR-CAS, team tong, WZBC AbeLiuXL, JNU AdvML, team hymeng). From these it extracts recurring patterns: image-side attacks are favored by the suffix penalty; multi-view scene-level optimization outperforms per-view attacks; QA types and graph structure guide budget allocation; feature-space objectives aid black-box transfer; and typographic content in camera images is a persistent vulnerability. Defense and future-benchmark directions are sketched.

Significance. If the reported patterns hold under the stated protocol, the paper supplies a concrete, multi-view, transfer-aware reference for robustness evaluation of driving VLAs—an area where standard single-image classification attacks are insufficient. Strengths include a carefully constrained threat model (suffix-only text, JPEG submission, six synchronized views), transparent phase-transition analysis (Table 4, Figure 1), and detailed organizer-side comparison of five diverse attack routes (Table 17). The case-study ablations (e.g., blur+distractor, conflict-resolved suffixes, Grassmann vs Euclidean features, 12 px typography) give the community actionable priors for both attack design and defense (consistency checks, feature protection, pipeline robustness). As a challenge report it is primarily observational rather than theorem-driven, but the synthesis is useful and the evaluation design is reproducible in principle.

major comments (3)
  1. [§2.5 Eq. (4); Abstract; §4.1] The central claim that “image-side attacks are favored by the suffix penalty” (Abstract; §4.1; §4.7) is load-bearing for the pattern synthesis, yet the paper never decomposes official leaderboard scores into the three SceneScore factors of Eq. (4)—answer deviation (100−GPTScore), image cosine similarity S̄, and 0.99^{x}. Without component-wise tables or scatter plots for the top teams, it is impossible to verify how much of the ranking is metric-induced (length penalty) versus genuine attack effectiveness. A short decomposition for the five case-study teams (or even Phase-II top-10) would make this claim falsifiable rather than inferred from design intent.
  2. [§3 Table 3; §4.1; §4.7] Pattern extraction rests on the five teams that submitted technical reports (§3, §4.1, Table 17). Two high Phase-II raw scorers (team Xuzhenyu, 72.32; team jielongzhao, 56.07) were invalidated solely for missing reports (Table 3). The manuscript does not discuss whether their (unknown) methods could contradict the claimed recurring patterns, nor does it quantify how selection on report submission may bias the synthesis toward particular attack styles (e.g., visual-first). A brief limitations paragraph acknowledging this selection filter and stating that patterns are conditioned on report-available teams would keep the claim proportionate.
  3. [§2.4 Eq. (3); §3 Table 3; §4.7] Phase II defines PhaseIIScore as the equal average of DriveLM and Dolphins scores (Eq. 3). The paper does not report the two model-specific scores separately for any team, so the claim that top methods succeed via transfer (rather than remaining strong only on the known model) cannot be checked from the published tables. Given that transferability is the explicit Phase-II objective (§2.4), releasing or at least summarizing the per-model split for the five case-study teams is necessary to support the transfer-related patterns in §4.7–4.8.
minor comments (6)
  1. [§4.2.1] Typo: “driving scene understandig” → “understanding” in the MR-CAS case study introduction.
  2. [Figure 1] Figure 1 caption contains a broken word “T op-5 band” (space inside “Top”).
  3. [§4.2.3 Table 6] The local surrogate score used by MR-CAS (Table 6) is not on the same scale as the official SceneScore; a one-sentence reminder in the table caption would prevent readers from treating 42.1650 as comparable to leaderboard numbers.
  4. [§2.4–2.5] Notation for the suffix penalty base (0.99) and the equal Phase-II model average appear as free design choices without sensitivity discussion. A short note on why 0.99 rather than, e.g., 0.95/0.99/0.999, and why equal rather than weighted averaging, would help future re-use of the protocol.
  5. [§4.2–4.6] Several team-report sections retain first-person “we” and competition-centric language (“ranked first among 85 participating teams”). Light editing toward a uniform third-person organizer voice would improve cohesion of the compiled report.
  6. [References] References include a few near-duplicates or workshop-style entries (e.g., Zhao et al. 2023/2024 adversarial VLM robustness). A quick consistency pass on venue/year formatting would help.

Circularity Check

0 steps flagged

No significant circularity: observational competition report whose patterns are induced from independent leaderboards and team ablations, not from fitted parameters reappearing as predictions.

full rationale

This is a technical report on a workshop challenge, not a first-principles derivation paper. Its central claim is that five leading submissions with available technical reports exhibit recurring attack patterns (image-side preference under the suffix penalty, multi-view optimization, QA/graph priors, feature-space transfer, typographic vulnerability). Those patterns are supported by public Phase I/II leaderboards (Tables 2–4), progressive method ablations reported by the teams (Tables 6, 8–11, 14–16), and an organizer-side comparison (Table 17). The composite SceneScore (Eq. 4–6) is an evaluation protocol that ranks submissions; it is not used to fit a parameter that is then re-presented as a prediction. Self-citations to DriveLM, Dolphins, and standard attack literature (MI-FGSM, EOT, GCG, etc.) supply background and baselines; they do not force the measured outcomes. No uniqueness theorem is imported from the authors to forbid alternatives, no ansatz is smuggled in as a theorem, and no fitted quantity is renamed a prediction. The report is self-contained against its own external benchmarks (leaderboard scores and team-reported ablations). Score 0 is the correct honest finding.

Axiom & Free-Parameter Ledger

2 free parameters · 3 axioms · 0 invented entities

As an empirical challenge report the paper rests on few free parameters and no invented physical entities. Load-bearing assumptions are domain conventions of adversarial ML evaluation (black-box transfer, composite fidelity+effectiveness scores, JPEG post-processing) plus the representativeness of the five analyzed reports.

free parameters (2)
  • suffix length penalty base 0.99
    The exponential factor 0.99^{x_{i,j}} in SceneScore is a design choice of the organizers that directly shapes which attacks are favored; not derived from first principles.
  • Phase II equal average of DriveLM and Dolphins scores
    The 1/2 weighting in Eq. (3) is an arbitrary but consequential choice that determines final ranking under transfer.
axioms (3)
  • domain assumption GPTScore from an LLM judge is a valid continuous measure of answer deviation from reference answers
    Used throughout Section 2.5 and all leaderboard calculations; stochasticity is acknowledged but not quantified.
  • domain assumption Normalized cosine similarity of image representations adequately captures ‘image fidelity’ for the competition metric
    Eq. (5); no human perceptual study is supplied to validate the proxy.
  • ad hoc to paper The five teams that submitted technical reports are representative enough to extract general patterns
    Stated in Section 3 and 4.1; two higher-scoring teams were excluded solely for missing reports.

pith-pipeline@v1.1.0-grok45 · 30005 in / 2709 out tokens · 32333 ms · 2026-07-14T04:45:26.585300+00:00 · methodology

0 comments
read the original abstract

Vision-language agents (VLAs) are increasingly used to interpret complex driving scenes and support safety-critical reasoning. This report presents the CVPR 2026@AdvML Workshop Challenge on adversarial multimodal attacks against autonomous-driving VLAs. Built on DriveLM-style multi-view visual question answering, the challenge represents each scene with six synchronized camera images and a structured collection of driving-related question-answer pairs. Participants generate adversarial images and suffix-only textual perturbations that induce model responses to deviate from reference answers while preserving image fidelity and limiting textual cost. The competition comprises two phases, with Phase II adding a hidden black-box model to assess transferability. We describe the task design, submission rules, evaluation protocol, and leaderboard results, and then examine five leading submissions for which technical reports were available. Across these reports, several recurring patterns emerge: image-side attacks are favored by the suffix penalty; scene-level, multi-view optimization is more effective than treating views in isolation; QA types and graph structure provide useful priors for allocating attack budget; feature-space objectives can improve black-box transfer; and typographic content embedded in camera images exposes a persistent vulnerability in driving VLAs. These findings provide a practical reference for future robustness evaluation and defense design in multimodal autonomous-driving systems.

Figures

Figures reproduced from arXiv: 2607.11560 by Aishan Liu, Alan Yuille, Bin Wang, Chengzhi Sun, Dacheng Tao, Dawn Song, Hainan Li, Hanyang Meng, Hanyu Fang, Haotong Qin, Jiakai Wang, Jiangfan Liu, Jing Nie, Jingyi Xu, Jin Hu, Julia Karbing, Junhua Liu, Juntao Dai, Ke Ma, Lei Chen, Ligong Zhang, Menghe Zheng, Philip H. S. Torr, Qianqian Xu, Qingming Huang, Rui Ding, Ruikai Li, Shao Jing, Shuai Gui, Tianyuan Zhang, Vishal M. Patel, Xia Hu, Xianglong Kong, Xianglong Liu, Xiang Zhang, Xiaohai Xu, Xiaoliang Liu, Xinyun Chen, Yinpeng Dong, Yisong Xiao, Yongkang Zhang, Yongxuan Zhu, Yuanbo Li, Zeyang Zhang, Zhenfei Yin, Zheng Wang, Zhilei Zhu, Zhirui Zhang, Zonghao Ying, Zonglei Jing.

Figure 1
Figure 1. Figure 1: Score distributions of the top 20 entries on the Phase I and original Phase II leaderboards. Phase II exhibits a wider spread and a [PITH_FULL_IMAGE:figures/full_fig_p005_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Illustration of the proposed visual perturbation process. [PITH_FULL_IMAGE:figures/full_fig_p007_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Opacity adjustment for dark scenes. Reducing the opac [PITH_FULL_IMAGE:figures/full_fig_p007_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Q-STAR converts structured driving QA evidence into a [PITH_FULL_IMAGE:figures/full_fig_p015_4.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

33 extracted references · 4 linked inside Pith

  1. [1]

    Flamingo: A visual language model for few-shot learning.Advances in Neural Information Processing Systems, 35, 2022

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, and Malcolm Reynolds. Flamingo: A visual language model for few-shot learning.Advances in Neural Information Processing Systems, 35, 2022. 1, 15

    2022

  2. [2]

    Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples

    Anish Athalye, Nicholas Carlini, and David Wagner. Obfus- cated gradients give a false sense of security: Circumventing defenses to adversarial examples. InICML, 2018. 1

    2018

  3. [3]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. InICML,

  4. [4]

    Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks

    Francesco Croce and Matthias Hein. Reliable evalua- tion of adversarial robustness with an ensemble of diverse parameter-free attacks. InICML, 2020. 1, 9

    2020

  5. [5]

    Boosting adversarial at- tacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial at- tacks with momentum. InCVPR, 2018. 5, 8, 9, 12, 14

    2018

  6. [6]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. InCVPR, 2019. 5, 9

    2019

  7. [7]

    LLaMA-adapter V2: Parameter-efficient visual instruction model.arXiv preprint arXiv:2304.15010, 2023

    Peng Gao, Jiaming Han, Renrui Zhang, Ziyi Lin, Shijie Geng, Aojun Zhou, Wei Zhang, Pan Lu, Conghui He, Xi- angyu Yue, Hongsheng Li, and Yu Qiao. LLaMA-adapter V2: Parameter-efficient visual instruction model.arXiv preprint arXiv:2304.15010, 2023. 1, 8

    Pith/arXiv arXiv 2023

  8. [8]

    Multimodal neurons in artificial neural networks.Dis- till, 6(3):e30, 2021

    Gabriel Goh, Nick Cammarata, Chelsea V oss, Shan Carter, Michael Petrov, Ludwig Schubert, Alec Radford, and Chris Olah. Multimodal neurons in artificial neural networks.Dis- till, 6(3):e30, 2021. 5, 15

    2021

  9. [9]

    Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typo- graphic visual prompts. InAAAI, 2025. 5, 15

    2025

  10. [10]

    Goodfellow, Jonathon Shlens, and Christian Szegedy

    Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. InICLR,

  11. [11]

    Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. InICML,

  12. [12]

    Multi-paradigm collaborative adversarial attack against multi-modal large language models

    Yuanbo Li, Tianyang Xu, Cong Hu, Tao Zhou, Xiao-Jun Wu, and Josef Kittler. Multi-paradigm collaborative adversarial attack against multi-modal large language models. InCVPR, pages 30065–30075, 2026. 14

    2026

  13. [13]

    Hopcroft

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E. Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. InICLR, 2020. 8

    2020

  14. [14]

    Visual instruction tuning.Advances in Neural Information Processing Systems, 36, 2023

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning.Advances in Neural Information Processing Systems, 36, 2023. 1, 15

    2023

  15. [15]

    RSTAM: An effective black-box impersonation attack on face recognition using a mobile and compact printer.arXiv preprint arXiv:2206.12590, 2022

    Xiaoliang Liu, Furao Shen, Jian Zhao, and Changhai Nie. RSTAM: An effective black-box impersonation attack on face recognition using a mobile and compact printer.arXiv preprint arXiv:2206.12590, 2022. 12

    Pith/arXiv arXiv 2022

  16. [16]

    EAP: An effective black-box impersonation adversar- ial patch attack method on face recognition in the physical world.Neurocomputing, 580:127517, 2024

    Xiaoliang Liu, Furao Shen, Jian Zhao, and Changhai Nie. EAP: An effective black-box impersonation adversar- ial patch attack method on face recognition in the physical world.Neurocomputing, 580:127517, 2024. 12

    2024

  17. [17]

    Dolphins: Multimodal language model for driving

    Yingzi Ma, Yulong Cao, Jiachen Sun, Marco Pavone, and Chaowei Xiao. Dolphins: Multimodal language model for driving. InECCV, 2024. 3

    2024

  18. [18]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. InICLR, 2018. 1, 11

    2018

  19. [19]

    Visual adversarial examples jailbreak aligned large language models

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Hen- derson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. InAAAI,

  20. [20]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever. Learning transferable visual models from natural language supervision. InICML, 2021. 1, 15

    2021

  21. [21]

    Jail- break in pieces: Compositional adversarial attacks on multi- modal language models

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Jail- break in pieces: Compositional adversarial attacks on multi- modal language models. InICLR, 2024. 8, 9

    2024

  22. [22]

    DriveLM: Driving with graph visual ques- tion answering

    Chonghao Sima, Katrin Renz, Kashyap Chitta, Li Chen, Hanxue Zhang, Chengen Xie, Ping Luo, Andreas Geiger, and Hongyang Li. DriveLM: Driving with graph visual ques- tion answering. InECCV, 2024. 1, 2, 3, 8, 11, 15

    2024

  23. [23]

    Boosting adversarial transferability by block shuffle and rotation

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation. InCVPR, pages 24336–24346, 2024. 5, 14

    2024

  24. [24]

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L. Yuille. Improving transferabil- ity of adversarial examples with input diversity. InCVPR,

  25. [25]

    Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks

    Peng Xie, Yequan Bie, Jianda Mao, Yangqiu Song, Yang Wang, Hao Chen, and Kani Chen. Chain of attack: On the robustness of vision-language models against transfer-based adversarial attacks. InCVPR, 2025. 8, 9

    2025

  26. [26]

    A survey of safety on large vision- language models: Attacks, defenses and evaluations.arXiv preprint arXiv:2502.14881, 2025

    Mang Ye, Xuankun Rong, Wenke Huang, Bo Du, Nenghai Yu, and Dacheng Tao. A survey of safety on large vision- language models: Attacks, defenses and evaluations.arXiv preprint arXiv:2502.14881, 2025. 2, 8

    Pith/arXiv arXiv 2025

  27. [27]

    VLATTACK: Multimodal adversarial attacks on vision- language tasks via pre-trained models

    Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jin- guo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. VLATTACK: Multimodal adversarial attacks on vision- language tasks via pre-trained models. InNeurIPS, 2023. 2, 8, 9

    2023

  28. [28]

    Gradient surgery for multi-task learning

    Tianhe Yu, Saurabh Kumar, Abhishek Gupta, Sergey Levine, Karol Hausman, and Chelsea Finn. Gradient surgery for multi-task learning. InNeurIPS, 2020. 9

    2020

  29. [29]

    Anyat- tack: Towards large-scale self-supervised adversarial attacks on vision-language models

    Jiaming Zhang, Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Yunhao Chen, Jitao Sang, and Dit-Yan Yeung. Anyat- tack: Towards large-scale self-supervised adversarial attacks on vision-language models. InCVPR, 2025. 15

    2025

  30. [30]

    Visual adversarial attack on vision- language models for autonomous driving.Machine Intelli- gence Research, pages 1–18, 2026

    Tianyuan Zhang, Lu Wang, Xinwei Zhang, Yitong Zhang, Boyi Jia, Siyuan Liang, Shengshan Hu, Qiang Fu, Aishan Liu, and Xianglong Liu. Visual adversarial attack on vision- language models for autonomous driving.Machine Intelli- gence Research, pages 1–18, 2026. 2, 15

    2026

  31. [31]

    On evaluating adversarial robustness of large vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongx- uan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. In NeurIPS, 2023. 2

    2023

  32. [32]

    On the adversarial robustness of vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongx- uan Li, Ngai-Man Cheung, and Min Lin. On the adversarial robustness of vision-language models. InIEEE/CVF Con- ference on Computer Vision and Pattern Recognition Work- shops (CVPRW), 2024. 9

    2024

  33. [33]

    Zico Kolter, and Matt Fredrikson

    Andy Zou, Zifan Wang, J. Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned lan- guage models.arXiv preprint arXiv:2307.15043, 2023. 8

    Pith/arXiv arXiv 2023