Pith. sign in

REVIEW 3 major objections 6 minor 73 references

GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation

T0 review · 3 major / 6 minor · reviewed 2026-08-01 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read GeoThreat crafts small image perturbations that transfer across vision-language models to force chosen remote-sensing captions, with reported success rates up to 88%.

desk verdict Solid incremental attack method for remote sensing LVLMs with a real evaluation flaw in the captioning metric that should be fixed before the headline numbers are trusted. read the letter →

arxiv 2607.21036 v1 pith:4QVFE7BV submitted 2026-07-23 cs.CV

Yimin Fu , Yuefeng Bai , Baicheng Pan , Zhunga Liu , Michael K. Ng This is my paper · ORCID
classification cs.CV
keywords adversarialattacklargevision-languagemodelremotesensingtransferabletargetedimagecaptioningsceneclassificationrepresentationalignment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper claims that large vision-language models performing remote sensing image interpretation can be reliably attacked in a black-box, targeted way: imperceptible perturbations engineered on surrogate encoders transfer to victim models and steer their captions or classifications toward attacker-chosen semantics. It introduces GeoThreat, which aligns the adversarial image with a target image at two levels — global conceptual (class token) and local perceptual (selected patch tokens) — by jointly optimizing both alignments over an ensemble of surrogates. In experiments on captioning and zero-shot classification, the reported attack success rates are consistently the highest among eight baselines, including values above 80% for several open-source models and above 50% for a commercial closed model. A reader should care because it suggests current remote-sensing LVLMs are vulnerable to targeted semantic manipulation in security-critical settings such as disaster assessment and urban monitoring.

What carries the argument

Three mechanisms carry the argument: (1) collaborative importance estimation — a per-layer matrix that multiplies attention weights with the gradient of class-token similarity, rolled out across layers to find patches that are both decision-relevant and target-responsive; (2) cross-attentive perceptual adaptation — bidirectional temperature-scaled softmax correspondences between selected adversarial patch tokens and all target patch tokens, fused into mutual weights that aggregate target references and then align with cosine loss; (3) ensemble-based joint optimization — a weighted sum of global class-token alignment and local patch-token alignment over several surrogate encoders, with spatia

What would settle it

Compare human ratings of the adversarial captions against the LLM-judge-based success: if human raters find many 'successful' captions unrelated to the target semantics, the transferability claim is an artifact of the judge. Alternatively, if an ablation that removes the perceptual-adaptation term reproduces the same attack success rate under the same metric, the central mechanism is not responsible for the reported gain.

Watch

Extended reading notes

Core claim

GeoThreat's central claim is that transferable, targeted semantic manipulation of remote sensing LVLMs requires modulating representations at both conceptual and perceptual levels. At the conceptual level, the attack maximizes the cosine similarity between the adversarial image's class token and the target image's class token. At the perceptual level, it first scores each patch token's importance by combining attention roll-out across layers with the gradient of adversarial–target similarity, selects the top-ρ patches, and then adapts those patch representations toward target patch tokens through a cross-attentive correspondence (bidirectional softmax, mutual weighting, query-conditioned ref

Load-bearing premise

Attack success in captioning is defined by an LLM-as-a-judge similarity threshold of 0.5 between the generated caption and the target image's caption; the paper does not specify which target descriptions are used, and the entire reported success rate depends on this metric.

Editorial extensions

If this is right

  • If the reported results hold, black-box targeted attacks on remote-sensing LVLMs are feasible with small perturbations, meaning captioning and classification outputs cannot be trusted without defenses.
  • The joint conceptual-perceptual alignment suggests defenses must address patch-level semantics, not just global embedding similarity.
  • The evaluation framework (LLM-as-a-judge with a 0.5 threshold) becomes a critical load-bearing component; any change in the reference captions or judge prompt could change reported success rates.
  • The method transfers across heterogeneous victim models trained on different data, implying shared visual-feature vulnerabilities across LVLMs.
  • The high success on remote-sensing-specific models indicates that domain specialization does not automatically confer adversarial robustness.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Extension: the method's patch-selection mechanism could be adapted to multi-temporal or multi-sensor remote sensing data, where local cues vary across time and bands; the cross-attentive alignment would need explicit time/channel conditioning.
  • Testable extension: if the conceptual-calibration term is removed and perceptual alignment alone is used, the reported ASR should drop substantially — the paper's ablation suggests this, but a direct test with human captions rather than an LLM judge would clarify whether the perceptual term truly carries transfer.
  • The LLM-judge-based metric compares the adversarial output with the target image's caption; an editorial reading is that success rates could compress if reference captions were more diverse or if the judge were instruction-sensitive.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 6 minor

Summary. The paper proposes GeoThreat, a transferable targeted adversarial attack for LVLMs on remote sensing imagery. It optimizes an ℓ∞-bounded perturbation on a surrogate ensemble of CLIP image encoders. The joint loss (Eq. 27) combines conceptual calibration — class-token cosine alignment to the target image (Eqs. 6, 26) — with perceptual adaptation, in which selected adversarial patch tokens are cross-attentively aligned to target patch tokens (Eqs. 13–17, 25). Critical patches are chosen by collaborative importance estimation that multiplies attention rollout with gradient sensitivities (Eqs. 8–11). Experiments on UCM/SIRI-WHU/AID compare GeoThreat with eight baselines across seven victim LVLMs, including open-source, commercial, and remote sensing-specific models. The paper reports large captioning ASR gains (e.g., Table 1: 88.0% on InstructBLIP, 73.2% on LLaVA-1.5-7B, 50.0% on GPT-5-mini) and consistent label-based classification ASR gains in Fig. 3.

Significance. If the empirical evaluation is valid, GeoThreat is a meaningful contribution: it directly targets the local-global reasoning challenge specific to remote sensing image interpretation, introduces a componentized attack objective with a clear ablation story, and benchmarks a broader set of victim LVLMs than is typical in the adversarial-attack literature. The label-based classification results and Grad-CAM analysis are less metric-dependent and provide partial support for the method. However, the headline captioning claim is entirely mediated by an unvalidated GPTScore threshold, and the component ablations in Tables 3–5 inherit the same issue. The reported margins over strong baselines such as SSA-CWA and FOA-Attack are therefore not yet fully established. Code release upon acceptance is a positive reproducibility commitment, though the code is not currently public.

major comments (3)
  1. [§4.1.4, Tables 1–2, Tables 3–5] The captioning ASR defines success as GPTScore(adversarial caption, target caption) > 0.5, and this metric carries the paper's central claim. The reference is described as the description generated by the same victim model for the target image, but the exact GPTScore instantiation, prompt, sampling temperature, and the 0.5 threshold are not justified. Clean AvgSim values are 0.08–0.17, so clean examples do not by themselves cross the threshold; the real problem is that adversarial AvgSim values sit near it (e.g., GeoThreat GPT-5-mini AvgSim = 0.50 in Table 1), and no score distribution is reported. A threshold change of ±0.05 could reclassify a large fraction of the 500 pairs and could materially change the margins over SSA-CWA/FOA-Attack. Moreover, GPTScore is itself an LLM judge and may reward generic scene vocabulary rather than the target-specific semantic shift the attack claims. Pl
  2. [§3.2, Eq. (9)] The 'adversarial-target similarity gradient' is defined as ∂cos(z_cls^adv, z_cls^target)/∂A^{l,h}. In a transformer, the attention matrix is not a free parameter; it is Softmax(QK^T/√d), so this quantity is not a true parameter gradient and the method is an attribution heuristic. The paper's claim that this 'more faithfully characterizes' target relevance is not supported by a derivation. The ablation in Table 5 shows an empirical benefit over attention-only and gradient-only selection, so I do not regard this as disqualifying, but the text should state the approximation explicitly and justify its use. The same treatment propagates to the ensemble importance aggregation in Eqs. (19)–(24).
  3. [§4.3.3, Fig. 6] The hyperparameter analysis for λ and ρ reports only ASR, which inherits the threshold problem above. The plotted differences are often small (e.g., between λ = 0.3 and λ = 0.5), and no error bars, variance, or number of pairs per point are provided. Please report AvgSim alongside ASR and give at least a confidence interval or repeated-run statistics, so the choice of ρ = 0.5 and λ = 0.5 is not an artifact of thresholding.
minor comments (6)
  1. [Algorithm 1] The loop structure is confusing: the update steps appear inside the inner for-loop over s, which would update the adversarial example S times per iteration. Please clarify the nesting and indentation.
  2. [Eq. (14)] The notation is inconsistent: the equations define P^{x→xt} and P^{xt→x}, but the text refers to A^{x→xt} and A^{xt→x}. Use one notation throughout.
  3. [Figures/tables] Typographical issues: Fig. 2 has 'Percepetual' instead of 'Perceptual'; Table 5 has 'Collabrative' instead of 'Collaborative'; 'TeoChat' and 'TEOChat' are used inconsistently.
  4. [§4.1.1] Please specify how the 500 image pairs were constructed (e.g., random seed, stratification across land-cover types) and whether the same pairs are used for all methods and ablations.
  5. [Tables 1–2] The Clean row reports ASR = 0.0 and AvgSim values around 0.13–0.17. Clarify whether the clean ASR is 0.0 by construction or whether some clean descriptions already happen to exceed the 0.5 threshold against their target captions.
  6. [§4.1.4] Please report the exact GPTScore version, the scoring prompt, and the number of scoring samples used. Since the metric is central, this information is needed for reproducibility.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: GeoThreat's objective is independent of victim models and the evaluation metric; self-citations are context-only.

full rationale

GeoThreat's derivation chain is the constrained optimization in Eqs. (2)-(4) with surrogates, the conceptual loss L_con of Eq. (6), the collaborative importance selection of Eqs. (8)-(12), the cross-attentive perceptual loss L_per of Eqs. (13)-(17), and the ensemble objective L_joint of Eqs. (25)-(27). None of these equations is defined in terms of the victim LVLMs or in terms of the GPTScore success criterion of Sec. 4.1.4. The perturbations are optimized only on an independent CLIP surrogate ensemble, and the reported transferability is measured on seven held-out victim LVLMs (InstructBLIP, LLaVA-1.5-7B, Qwen2.5-VL-7B, GPT-5-mini, Gemini-2.5-Flash, GeoChat, TeoChat) without victim gradients or victim outputs entering the optimization. Therefore the central claim is not equivalent to its inputs by construction. The only author-overlapping citations ([55], [58], [67]) appear in related-work reviews or the SAR-defense discussion and are not load-bearing; no uniqueness theorem or ansatz is imported from the authors' own prior work. The main under-supported choice is the uncalibrated GPTScore>0.5 threshold and the unspecified reference captions in Sec. 4.1.4, and hyperparameters λ and ρ are selected in Sec. 4.3.3 on the same SIRI-WHU→UCM victims used in Table 2; both are correctness/measurement risks, not reductions of Eq. (27) to the reported tables. The manuscript also contains no explicit limitation statement. In sum, no significant circularity.

Assumptions & free parameters 3 free parameters · 3 assumptions · 1 invented entities

The central claim depends on the transferability assumption (CLIP surrogates reflect victim models), the evaluation assumptions (GPTScore threshold), and several hand-chosen hyperparameters. No structural entities are invented.

free parameters (3)
  • patch selection ratio ρ = 0.5
    The paper sets ρ=0.5 after ablations on the same datasets/targets (Fig. 6b), using performance on the evaluation victims to choose the value. It is a hyperparameter fitted to the evaluation domain.
  • loss weighting λ = 0.5
    Set to 0.5 after an ablation sweep (Fig. 6a) on the same datasets and victims, so the final method is partly tuned to the test setting.
  • temperature τ = 0.1
    Set to 0.1 without any sensitivity analysis; a hand-chosen constant. Since it influences the cross-attention correspondence and transferability, it is a fitted/arbitrary parameter.
assumptions (3)
  • domain assumption CLIP-style surrogate image features are a good proxy for the visual representations used by victim LVLMs.
    The entire transfer-based attack framework assumes that perturbations optimized on CLIP encoders transfer to LVLMs. This is an empirical assumption heavily supported by prior literature (cf. section 2.2 and Section 4 results), but it is not proven here.
  • ad hoc to paper GPTScore with a threshold of 0.5 is an adequate judge of semantic equivalence for remote sensing captions.
    The attack success in captioning is defined by GPTScore > 0.5 against the target image's caption. The paper does not validate this judge on remote sensing captions, nor does it show that the threshold is meaningful for this domain. Since the clean AvgSim for some models is already around 0.16–0.17, a 0.5 threshold is not justified as a universal standard.
  • domain assumption The constructed image pairs (500 pairs, alternating source/target) are a representative sample of remote sensing interpretation tasks.
    Pairs are formed from two small datasets (UCM, SIRI-WHU), with images from different land-cover types. The paper does not assess how well this sample generalizes to the broad remote sensing domain. This is unavoidable for evaluation, but it is an assumption.
invented entities (1)
  • None
    purpose: No new physical or structural entities are introduced.
    GeoThreat does not invent a new force, particle, or architectural component. It only combines existing neural network components.

how reviews work

0 comments
Cite this review

Pith. "Pith review of GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation." pith.science (2026). https://pith.science/paper/4QVFE7BV

@misc{pith2026260721036,
  author       = {Pith},
  title        = {Pith review of: GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4QVFE7BV}},
  note         = {Machine review of arXiv:2607.21036}
}
read the original abstract

Adversarial attacks against large vision-language models (LVLMs) serve as an effective means of assessing their robustness in cross-modal semantic understanding. Existing studies mainly focus on corrupting visual inputs to induce predefined erroneous responses in general vision-language tasks, whereas corresponding investigations in remote sensing fields remain largely underexplored. Compared with natural image understanding, remote sensing image interpretation requires joint reasoning over local discriminative cues and global scene context. This poses additional challenges to achieving transferable semantic manipulation toward specified responses under black-box settings. To tackle these challenges, we propose GeoThreat, a transferable targeted adversarial attack method against LVLMs for remote sensing image interpretation. Specifically, GeoThreat modulates adversarial representations in accordance with the target content at both conceptual and perceptual levels. The class tokens from surrogate image encoders are employed as conceptual representations, while perceptual representations are distilled from patch tokens of the adversarial example through collaborative importance estimation. Beyond merely rolling out attention scores across layers, we incorporate adversarial-target similarity gradients to more faithfully characterize the relevance of local visual cues to the intended semantic manipulation. The perceptual representations are then dynamically aligned with target patch tokens in a cross-attentive manner, facilitating the adaptation of local cues toward designated semantic details. Finally, adversarial perturbations are iteratively updated via ensemble-based joint optimization of conceptual calibration and perceptual adaptation. Extensive experiments across diverse LVLMs demonstrate the superiority of GeoThreat in both transferability and controllability.

Figures

Figures reproduced from arXiv: 2607.21036 by the authors.

Figure 1
Figure 1. Illustration of GeoThreat for transferable targeted [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Illustration of GeoThreat for transferable targeted adversarial attacks against LVLMs in remote sensing image [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Attack success rates of different methods across [PITH_FULL_IMAGE:figures/full_fig_p008_3.png] view at source ↗
Figures from the paper (3 more)
Figure 4
Figure 4. Figure 4: Illustration of GeoThreat for transferable targeted adversarial attacks against LVLMs in the remote sensing image [PITH_FULL_IMAGE:figures/full_fig_p009_4.png]
Figure 5
Figure 5. Figure 5: Visualization of the attention shift induced by the proposed GeoThreat on the image classification task. The [PITH_FULL_IMAGE:figures/full_fig_p010_5.png]
Figure 6
Figure 6. Figure 6: Attack success rate of adversarial examples generated by GeoThreat with different settings of [PITH_FULL_IMAGE:figures/full_fig_p011_6.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

73 extracted references · 6 linked inside Pith

  1. [1]

    Visual instruction tuning,

    H. Liu, C. Li, Q. Wu, and Y. J. Lee, “Visual instruction tuning,” Advances in Neural Information Processing Systems, vol. 36, pp. 34 892–34 916, 2023

    2023

  2. [2]

    Instructblip: Towards general-purpose vision- language models with instruction tuning,

    W. Dai, J. Li, D. Li, A. Tiong, J. Zhao, W. Wang, B. Li, P . N. Fung, and S. Hoi, “Instructblip: Towards general-purpose vision- language models with instruction tuning,”Advances in Neural Information Processing Systems, vol. 36, pp. 49 250–49 267, 2023

    2023

  3. [3]

    Gpt-4 technical report,

    J. Achiam, S. Adler, S. Agarwal, L. Ahmad, I. Akkaya, F. L. Aleman, D. Almeida, J. Altenschmidt, S. Altman, S. Anadkatet al., “Gpt-4 technical report,”arXiv preprint arXiv:2303.08774, 2023

    arXiv 2023

  4. [4]

    Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,

    P . Wang, S. Bai, S. Tan, S. Wang, Z. Fan, J. Bai, K. Chen, X. Liu, J. Wang, W. Geet al., “Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,”arXiv preprint arXiv:2409.12191, 2024

    arXiv 2024

  5. [5]

    Mini-gemini: Mining the potential of multi-modality vision language models,

    Y. Li, Y. Zhang, C. Wang, Z. Zhong, Y. Chen, R. Chu, S. Liu, and J. Jia, “Mini-gemini: Mining the potential of multi-modality vision language models,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  6. [6]

    Adversarial examples: Attacks and defenses for deep learning,

    X. Yuan, P . He, Q. Zhu, and X. Li, “Adversarial examples: Attacks and defenses for deep learning,”IEEE Transactions on Neural Networks and Learning Systems, vol. 30, no. 9, pp. 2805–2824, 2019. MANUSCRIPT UNDER REVIEW 12

    2019

  7. [7]

    Safety of multimodal large language models on images and text,

    X. Liu, Y. Zhu, Y. Lan, C. Yang, and Y. Qiao, “Safety of multimodal large language models on images and text,” inProceedings of the International Joint Conference on Artificial Intelligence, 2024, pp. 8151– 8159

    2024

  8. [8]

    A survey of attacks on large vision–language models: Resources, advances, and future trends,

    D. Liu, M. Yang, X. Qu, P . Zhou, Y. Cheng, and W. Hu, “A survey of attacks on large vision–language models: Resources, advances, and future trends,”IEEE Transactions on Neural Networks and Learning Systems, 2025

    2025

Show all 73 references
  1. [9]

    On the robustness of large multimodal models against image adversarial attacks,

    X. Cui, A. Aparcedo, Y. K. Jang, and S.-N. Lim, “On the robustness of large multimodal models against image adversarial attacks,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 24 625–24 634

    2024

  2. [10]

    Delving into transferable adversarial examples and black-box attacks,

    Y. Liu, X. Chen, C. Liu, and D. Song, “Delving into transferable adversarial examples and black-box attacks,” inProceedings of the International Conference on Learning Representations, 2017

    2017

  3. [11]

    Blackboxbench: A comprehensive benchmark of black-box adversarial attacks,

    M. Zheng, X. Yan, Z. Zhu, H. Chen, and B. Wu, “Blackboxbench: A comprehensive benchmark of black-box adversarial attacks,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2025

    2025

  4. [12]

    Vlattack: Multimodal adversarial attacks on vision- language tasks via pre-trained models,

    Z. Yin, M. Ye, T. Zhang, T. Du, J. Zhu, H. Liu, J. Chen, T. Wang, and F. Ma, “Vlattack: Multimodal adversarial attacks on vision- language tasks via pre-trained models,”Advances in Neural Infor- mation Processing Systems, vol. 36, pp. 52 936–52 956, 2023

    2023

  5. [13]

    On evaluating adversarial robustness of large vision-language models,

    Y. Zhao, T. Pang, C. Du, X. Yang, C. Li, N.-M. Cheung, and M. Lin, “On evaluating adversarial robustness of large vision-language models,” inAdvances in Neural Information Processing Systems, 2023

    2023

  6. [14]

    Learning transferable visual models from natural language supervision,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agar- wal, G. Sastry, A. Askell, P . Mishkin, J. Clarket al., “Learning transferable visual models from natural language supervision,” inProceedings of the International Conference on Machine Learning, 2021, pp. 8748–8763

    2021

  7. [15]

    Diffusion models for imperceptible and transferable adversarial attack,

    J. Chen, H. Chen, K. Chen, Y. Zhang, Z. Zou, and Z. Shi, “Diffusion models for imperceptible and transferable adversarial attack,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 47, no. 2, pp. 961–977, 2024

    2024

  8. [16]

    A frustratingly simple yet highly effective attack baseline: Over 90% success rate against the strong black-box models of gpt-4.5/4o/o1,

    Z. Li, X. Zhao, D.-D. Wu, J. Cui, and Z. Shen, “A frustratingly simple yet highly effective attack baseline: Over 90% success rate against the strong black-box models of gpt-4.5/4o/o1,” in Advances in Neural Information Processing Systems, vol. 38, 2025

    2025

  9. [17]

    Adversarial attacks against closed-source mllms via feature optimal alignment,

    X. Jia, S. Gao, S. Qin, T. Pang, C. Du, Y. Huang, X. Li, Y. Li, B. Li, and Y. Liu, “Adversarial attacks against closed-source mllms via feature optimal alignment,” inAdvances in Neural Information Processing Systems, 2025

    2025

  10. [18]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,”IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 8, pp. 5625–5644, 2024

    2024

  11. [19]

    Geochat: Grounded large vision-language model for remote sensing,

    K. Kuckreja, M. S. Danish, M. Naseer, A. Das, S. Khan, and F. S. Khan, “Geochat: Grounded large vision-language model for remote sensing,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024, pp. 27 831–27 840

    2024

  12. [20]

    Teochat: A large vision-language assistant for temporal earth observation data,

    J. Irvin, E. Liu, J. Chen, I. Dormoy, J. Kim, S. Khanna, Z. Zheng, and S. Ermon, “Teochat: A large vision-language assistant for temporal earth observation data,” inProceedings of the International Conference on Learning Representations, 2025

    2025

  13. [21]

    Vision-language modeling meets remote sensing: Models, datasets, and perspectives,

    X. Weng, C. Pang, and G.-S. Xia, “Vision-language modeling meets remote sensing: Models, datasets, and perspectives,”IEEE Geoscience and Remote Sensing Magazine, 2025

    2025

  14. [22]

    Like human rethinking: Contour transformer autoregres- sion for referring remote sensing interpretation,

    J. Chai, L. Jiao, X. Lu, L. Li, F. Liu, L. Sun, X. Liu, W. Ma, and W. Li, “Like human rethinking: Contour transformer autoregres- sion for referring remote sensing interpretation,”IEEE Transactions on Pattern Analysis and Machine Intelligence, 2026

    2026

  15. [23]

    Integration of large vision language models for efficient post-disaster damage assessment and reporting,

    Z. Chen, E. Asadi Shamsabadi, S. Jiang, L. Shen, and D. Dias-da Costa, “Integration of large vision language models for efficient post-disaster damage assessment and reporting,”Nature Commu- nications, 2026

    2026

  16. [24]

    Fedrsclip: Federated learning for remote sensing scene classification using vision-language models,

    H. Lin, C. Zhang, D. Hong, K. Dong, and C. Wen, “Fedrsclip: Federated learning for remote sensing scene classification using vision-language models,”IEEE Geoscience and Remote Sensing Mag- azine, 2025

    2025

  17. [25]

    Deep neural network for remote- sensing image interpretation: Status and perspectives,

    J. Li, X. Huang, and J. Gong, “Deep neural network for remote- sensing image interpretation: Status and perspectives,”National Science Review, vol. 6, no. 6, pp. 1082–1086, 2019

    2019

  18. [26]

    Attention is all you need,

    A. Vaswani, N. Shazeer, N. Parmar, J. Uszkoreit, L. Jones, A. N. Gomez, Ł. Kaiser, and I. Polosukhin, “Attention is all you need,” Advances in Neural Information Processing Systems, vol. 30, 2017

    2017

  19. [27]

    Benchmarking large vision-language models via directed scene graph for comprehen- sive image captioning,

    Y. Lu, X. Wang, Z. Chen, X. Xu, and C. Shen, “Benchmarking large vision-language models via directed scene graph for comprehen- sive image captioning,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025

    2025

  20. [28]

    Questioning, answering, and captioning for zero-shot detailed image caption,

    D.-T. Luu, V .-T. Le, and D. M. Vo, “Questioning, answering, and captioning for zero-shot detailed image caption,” inProceedings of the Asian Conference on Computer Vision, 2024, pp. 242–259

    2024

  21. [29]

    Cross- modal retrieval: A systematic review of methods and future di- rections,

    T. Wang, F. Li, L. Zhu, J. Li, Z. Zhang, and H. T. Shen, “Cross- modal retrieval: A systematic review of methods and future di- rections,”Proceedings of the IEEE, vol. 112, no. 11, pp. 1716–1754, 2024

    2024

  22. [30]

    Emerging properties in self-supervised vision transformers,

    M. Caron, H. Touvron, I. Misra, H. J ´egou, J. Mairal, P . Bojanowski, and A. Joulin, “Emerging properties in self-supervised vision transformers,” inProceedings of the IEEE/CVF International Confer- ence on Computer Vision, 2021, pp. 9650–9660

    2021

  23. [31]

    A survey on evaluation of large language models,

    Y. Chang, X. Wang, J. Wang, Y. Wu, L. Yang, K. Zhu, H. Chen, X. Yi, C. Wang, Y. Wanget al., “A survey on evaluation of large language models,”ACM Transactions on Intelligent Systems and Technology, vol. 15, no. 3, pp. 1–45, 2024

    2024

  24. [32]

    Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models,

    J. Li, D. Li, S. Savarese, and S. C. H. Hoi, “Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models,” inProceedings of the 40th International Con- ference on Machine Learning, ser. Proceedings of Machine Learning Research, vol. ...

    2023

  25. [33]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models,

    D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny, “Minigpt-4: Enhancing vision-language understanding with advanced large language models,” inProceedings of the International Conference on Learning Representations, 2024

    2024

  26. [34]

    Gpt-5 system card,

    OpenAI, “Gpt-5 system card,” OpenAI, Tech. Rep., 2025

    2025

  27. [35]

    System card: Claude opus 4 & claude sonnet 4,

    Anthropic, “System card: Claude opus 4 & claude sonnet 4,” Anthropic, Tech. Rep., 2025

    2025

  28. [36]

    Gemini: A family of highly capable multimodal models,

    Gemini Team, “Gemini: A family of highly capable multimodal models,”arXiv preprint arXiv:2312.11805, 2023

    2023 arXiv

  29. [37]

    Remoteclip: A vision language foundation model for re- mote sensing,

    F. Liu, D. Chen, Z. Guan, X. Zhou, J. Zhu, Q. Ye, L. Fu, and J. Zhou, “Remoteclip: A vision language foundation model for re- mote sensing,”IEEE Transactions on Geoscience and Remote Sensing, vol. 62, pp. 1–16, 2024

    2024

  30. [38]

    Rsgpt: A remote sensing vision language model and benchmark,

    Y. Hu, J. Yuan, C. Wen, X. Lu, Y. Liu, and X. Li, “Rsgpt: A remote sensing vision language model and benchmark,”ISPRS Journal of Photogrammetry and Remote Sensing, vol. 224, pp. 272–286, 2025

    2025

  31. [39]

    Lhrs-bot: Em- powering remote sensing with VGI-enhanced large multimodal language model,

    D. Muhtar, Z. Li, F. Gu, X. Zhang, and P . Xiao, “Lhrs-bot: Em- powering remote sensing with VGI-enhanced large multimodal language model,” inProceedings of the European Conference on Computer Vision, 2024

    2024

  32. [40]

    Skyeyegpt: Unifying remote sensing vision-language tasks via instruction tuning with large language model,

    Y. Zhan, Z. Xiong, and Y. Yuan, “Skyeyegpt: Unifying remote sensing vision-language tasks via instruction tuning with large language model,”ISPRS Journal of Photogrammetry and Remote Sensing, vol. 221, pp. 64–77, 2025

    2025

  33. [41]

    Earthgpt: A universal multi-modal large language model for multi-sensor im- age comprehension in remote sensing domain,

    W. Zhang, M. Cai, T. Zhang, Y. Zhuang, and X. Mao, “Earthgpt: A universal multi-modal large language model for multi-sensor im- age comprehension in remote sensing domain,”IEEE Transactions on Geoscience and Remote Sensing, 2024

    2024

  34. [42]

    Adversarial machine learning at scale,

    A. Kurakin, I. Goodfellow, and S. Bengio, “Adversarial machine learning at scale,” inProceedings of International Conference on Learning Representations, 2016

    2016

  35. [43]

    Adversarial examples in the physical world,

    A. Kurakin, I. J. Goodfellow, and S. Bengio, “Adversarial examples in the physical world,” inProceedings of the International Conference on Learning Representations Workshop, 2017

    2017

  36. [44]

    Towards deep learning models resistant to adversarial attack,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attack,” inProceedings of the International Conference on Learning Representa- tions, 2018

    2018

  37. [45]

    Boosting adversarial attacks with momentum,

    Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” inProceedings of the IEEE Conference on Computer Vision and Pattern Recognition, 2018, pp. 9185–9193

    2018

  38. [46]

    How robust is google’s bard to adversarial image attacks?

    Y. Dong, H. Chen, J. Chen, Z. Fang, X. Yang, Y. Zhang, Y. Tian, H. Su, and J. Zhu, “How robust is google’s bard to adversarial image attacks?”arXiv preprint arXiv:2309.11751, 2023

    2023 arXiv

  39. [47]

    Efficient genera- tion of targeted and transferable adversarial examples for vision- language models via diffusion models,

    Q. Guo, S. Pang, X. Jia, Y. Liu, and Q. Guo, “Efficient genera- tion of targeted and transferable adversarial examples for vision- language models via diffusion models,”IEEE Transactions on Infor- mation Forensics and Security, 2024

    2024

  40. [48]

    Anyattack: Towards large-scale self-supervised adversarial at- tacks on vision-language models,

    J. Zhang, J. Ye, X. Ma, Y. Li, Y. Yang, J. Sang, and D.-Y. Yeung, “Anyattack: Towards large-scale self-supervised adversarial at- tacks on vision-language models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2025

    2025

  41. [49]

    VEAttack: Downstream-agnostic vision encoder attack against large vision MANUSCRIPT UNDER REVIEW 13 language models,

    H. Mei, Z. Wang, S. You, M. Dong, and C. Xu, “VEAttack: Downstream-agnostic vision encoder attack against large vision MANUSCRIPT UNDER REVIEW 13 language models,” inInternational Conference on Learning Represen- tations, 2026

    2026

  42. [50]

    V-attack: Targeting disentangled value features for controllable adversarial attacks on lvlms,

    S. Nie, J. Zhang, J. Yan, S. Shan, and X. Chen, “V-attack: Targeting disentangled value features for controllable adversarial attacks on lvlms,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026, pp. 42 257–42 267

    2026

  43. [51]

    Multi- paradigm collaborative adversarial attack against multi-modal large language models,

    Y. Li, T. Xu, C. Hu, T. Zhou, X.-J. Wu, and J. Kittler, “Multi- paradigm collaborative adversarial attack against multi-modal large language models,” inProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2026

    2026

  44. [52]

    Assessing the threat of adversarial examples on deep neural networks for remote sensing scene clas- sification: Attacks and defenses,

    Y. Xu, B. Du, and L. Zhang, “Assessing the threat of adversarial examples on deep neural networks for remote sensing scene clas- sification: Attacks and defenses,”IEEE Transactions on Geoscience and Remote Sensing, vol. 59, no. 2, pp. 1604–1617, 2020

    2020

  45. [53]

    An empirical study of adversarial examples on remote sensing image scene classification,

    L. Chen, Z. Xu, Q. Li, J. Peng, S. Wang, and H. Li, “An empirical study of adversarial examples on remote sensing image scene classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 59, no. 9, pp. 7419–7433, 2021

    2021

  46. [54]

    Universal adversarial examples in remote sensing: Methodology and benchmark,

    Y. Xu and P . Ghamisi, “Universal adversarial examples in remote sensing: Methodology and benchmark,”IEEE Transactions on Geo- science and Remote Sensing, vol. 60, pp. 1–15, 2022

    2022

  47. [55]

    Transferable adversarial attacks for remote sensing object recognition via spatial-frequency co- transformation,

    Y. Fu, Z. Liu, and J. Lyu, “Transferable adversarial attacks for remote sensing object recognition via spatial-frequency co- transformation,”IEEE Transactions on Geoscience and Remote Sens- ing, 2024

    2024

  48. [56]

    Task-specific importance-awareness matters: On targeted attacks against object detection,

    X. Sun, G. Cheng, H. Li, H. Peng, and J. Han, “Task-specific importance-awareness matters: On targeted attacks against object detection,”IEEE Transactions on Circuits and Systems for Video Technology, vol. 34, no. 11, pp. 11 619–11 629, 2024

    2024

  49. [57]

    Stealthy adversarial examples for semantic segmentation in remote sensing,

    T. Bai, Y. Cao, Y. Xu, and B. Wen, “Stealthy adversarial examples for semantic segmentation in remote sensing,”IEEE Transactions on Geoscience and Remote Sensing, vol. 62, pp. 1–17, 2024

    2024

  50. [58]

    Transferability reinforcement of adversarial attacks for remote sensing image classification via hierarchical transformation composition,

    Y. Fu, Y. Bai, J. Lyu, B. Pan, Z. Liu, and M. K. Ng, “Transferability reinforcement of adversarial attacks for remote sensing image classification via hierarchical transformation composition,”IEEE Transactions on Geoscience and Remote Sensing, 2026

    2026

  51. [59]

    Hyperspectral image classification with adversarial attack,

    C. Shi, Y. Dang, L. Fang, Z. Lv, and M. Zhao, “Hyperspectral image classification with adversarial attack,”IEEE Geoscience and Remote Sensing Letters, vol. 19, pp. 1–5, 2022

    2022

  52. [60]

    Sparse unmixing guided adversarial attack for hyperspectral image classification,

    H. Li, K. Dang, M. Gong, A. Qin, Y. Zhou, Y. Wu, and L. Xing, “Sparse unmixing guided adversarial attack for hyperspectral image classification,”IEEE Transactions on Circuits and Systems for Video Technology, 2025

    2025

  53. [61]

    Scattering model guided adversarial examples for sar target recognition: Attack and defense,

    B. Peng, B. Peng, J. Zhou, J. Xie, and L. Liu, “Scattering model guided adversarial examples for sar target recognition: Attack and defense,”IEEE Transactions on Geoscience and Remote Sensing, vol. 60, pp. 1–17, 2022

    2022

  54. [62]

    Reconstruction-assisted and distance-optimized adversarial training: A defense framework for remote sensing scene classifica- tion,

    Y. Su, G. Zhang, S. Mei, J. Lian, Y. Wang, and S. Wan, “Reconstruction-assisted and distance-optimized adversarial training: A defense framework for remote sensing scene classifica- tion,”IEEE Transactions on Geoscience and Remote Sensing, vol. 61, pp. 1–13, 2023

    2023

  55. [63]

    Universal adversarial defense in remote sensing based on pre-trained denoising diffusion models,

    W. Yu, Y. Xu, and P . Ghamisi, “Universal adversarial defense in remote sensing based on pre-trained denoising diffusion models,” International Journal of Applied Earth Observation and Geoinformation, vol. 133, p. 104131, 2024

    2024

  56. [64]

    Masked spatial– spectral autoencoders are excellent hyperspectral defenders,

    J. Qi, Z. Gong, X. Liu, C. Chen, and P . Zhong, “Masked spatial– spectral autoencoders are excellent hyperspectral defenders,” IEEE Transactions on Neural Networks and Learning Systems, vol. 36, no. 2, pp. 3012–3026, 2024

    2024

  57. [65]

    Model agnostic defense against adversarial patch attacks on object detection in unmanned aerial vehicles,

    S. Pathak, S. Shrestha, and A. AlMahmoud, “Model agnostic defense against adversarial patch attacks on object detection in unmanned aerial vehicles,” inProceedings of the 2024 IEEE/RSJ International Conference on Intelligent Robots and Systems, 2024, pp. 2586–2593

    2024

  58. [66]

    Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification,

    Y. Xu, B. Du, and L. Zhang, “Self-attention context network: Addressing the threat of adversarial attacks for hyperspectral image classification,”IEEE Transactions on Image Processing, vol. 30, pp. 8671–8685, 2021

    2021

  59. [67]

    Scattering-guided class-irrelevant fil- tering for adversarially robust sar automatic target recognition,

    Z. Liu, J. Lyu, and Y. Fu, “Scattering-guided class-irrelevant fil- tering for adversarially robust sar automatic target recognition,” Signal Processing, vol. 239, p. 110273, 2026

    2026

  60. [68]

    Bag-of-visual-words and spatial exten- sions for land-use classification,

    Y. Yang and S. Newsam, “Bag-of-visual-words and spatial exten- sions for land-use classification,” inProceedings of the 18th ACM SIGSP ATIAL International Conference on Advances in Geographic Information Systems, 2010, pp. 270–279

    2010

  61. [69]

    Dirichlet-derived multiple topic scene classification model for high spatial resolution remote sensing imagery,

    Zhao, Bei and Zhong, Yanfei and Xia, Guisong and Zhang, Liang- pei, “Dirichlet-derived multiple topic scene classification model for high spatial resolution remote sensing imagery,”IEEE Transac- tions on Geoscience and Remote Sensing, vol. 54, no. 4, pp. 2108–2123, 2015

    2015

  62. [70]

    Aid: A benchmark data set for performance evaluation of aerial scene classification,

    G.-S. Xia, J. Hu, F. Hu, B. Shi, X. Bai, Y. Zhong, and L. Zhang, “Aid: A benchmark data set for performance evaluation of aerial scene classification,”IEEE Transactions on Geoscience and Remote Sensing, vol. 55, no. 7, pp. 3965–3981, 2017

    2017

  63. [71]

    Qwen2.5-vl technical report,

    S. Bai, K. Chen, X. Liu, J. Wang, W. Ge, S. Song, K. Dang, P . Wang, S. Wang, J. Tanget al., “Qwen2.5-vl technical report,”arXiv preprint arXiv:2502.13923, 2025

    2025 arXiv

  64. [72]

    Gemini 2.5: Push- ing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities,

    G. Comanici, E. Bieber, M. Schaekermannet al., “Gemini 2.5: Push- ing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities,”arXiv preprint arXiv:2507.06261, 2025

    2025 arXiv

  65. [73]

    Gptscore: Evaluate as you desire,

    J. Fu, S. K. Ng, Z. Jiang, and P . Liu, “Gptscore: Evaluate as you desire,” inProceedings of the North American Chapter of the Asso- ciation for Computational Linguistics: Human Language Technologies, 2024, pp. 6556–6576

    2024

Pith tools

Reviewed August 1, 2026 · model on record in the stance chip above.