Pith. sign in

REVIEW 4 major objections 4 minor 75 references

On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbations

T0 review · 4 major / 4 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read This paper claims that sparse, structured Fourier-domain noise can, under black-box query-only access, flip VLM realism judgments and degrade generated captions without visible artifacts.

desk verdict Real black-box frequency attack, but the captioning metric is circular and the realism effects are modest—worth a serious referee, not the strongest claims. read the letter →

arxiv 2507.22398 v3 pith:2GTQP54P submitted 2025-07-30 cs.CV

Jordan Vice , Naveed Akhtar , Yansong Gao , Richard Hartley , Ajmal Mian This is my paper · ORCID
classification cs.CV
keywords vision-languagemodelsfrequency-domainperturbationsadversarialrobustnessimageauthenticityautomatedcaptioningblack-boxattacksimperceptible
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that vision-language models (VLMs) can be reliably manipulated by an adversary who never sees the model weights or gradients. The attack adds sparse, imperceptible noise to a specific radial band of the image's Fourier transform: high-frequency components for authenticity judgments, and a narrow mid-frequency band for captioning. The authors show that this shifts VLM realism scores for both real and AI-generated images, in some cases flipping the predicted label, and changes the captions VLMs produce, across five open VLMs and ten datasets. If correct, this matters because VLMs are increasingly trusted for deepfake detection and content reasoning, where an attacker who can change judgments without visible artifacts undermines their reliability.

What carries the argument

The central object is the spatial frequency perturbation operator, which adds a sparse noise matrix $\Delta^{\alpha_1,\alpha_2}_{\sigma,\rho}$ to the image's Fourier transform and then applies the inverse transform, so the perturbed image is $\tilde{I} = \mathcal{F}^{-1}(\mathcal{F}(I) + \Delta)$. The parameters set the frequency band ($\alpha_1,\alpha_2$), the noise intensity ($\sigma = 2.5\%$ of image size), and the sparsity ($\rho = 10\%$ of coefficients). The operator is driven by a black-box goal function: for authenticity, it pushes the ten-point realism score past the boundary; for captioning, it minimizes the cosine similarity between CLIP embeddings of the original and perturbed captions until a dissimilarity threshold is reached. The machinery is iterative candidate selection: sample $N$ perturbations, query the VLM, keep the best, and repeat, which is what makes the attack work without gradients or weights.

What would settle it

Ask human annotators to compare original and perturbed images and captions: if perturbed captions are judged to preserve meaning, or if humans can spot which images were frequency-perturbed, then the caption drift and realism flips reported here would be artifacts of the CLIP metric and the ten-point score rather than genuine semantic manipulation.

Watch

Extended reading notes

Core claim

The central claim is that VLM perception is bound to low-level frequency statistics rather than high-level semantics, and that this dependence is exploitable. Concretely, adding sparse noise only in the radial high-frequency band ($\alpha_1=0.85$, $\alpha_2=1.00$) of the Fourier transform changes a VLM's ten-point realism likelihood enough to move samples across the decision threshold ($\tau_1=4$, $\tau_2=6$), making synthetic images look real and real images look generated. Adding noise in a 2%-wide mid-frequency band ($\alpha_1=0.49$, $\alpha_2=0.51$) makes the generated caption drift in CLIP embedding space, shortening or changing the description while the image looks unchanged. The attack operates by iterative candidate selection: at each step, $N$ candidate noise matrices are sampled, the VLM is queried, and the candidate that best satisfies a goal function is kept and folded back into the image. The paper reports this reliably across Qwen2/2.5 and BLIP-2 families, with the degree of susceptibility varying by family and parameter size, and reads the results as evidence that VLM reasoning is not grounded in semantic content.

Load-bearing premise

The load-bearing premise is that the output quantities the attack optimizes—the VLM's ten-point realism score and the CLIP cosine dissimilarity between original and perturbed captions—faithfully measure the semantic judgments the paper claims to manipulate.

Editorial extensions

If this is right

  • A query-only adversary can push VLM authenticity judgments in either direction: synthetic images toward 'real' and real images toward 'generated', because high-frequency perturbations shift realism scores across the decision boundary.
  • The same machinery degrades VLM-generated captions using a 2%-wide mid-frequency band, which the paper connects to shorter or less informative outputs and to resource-exhaustion and latency attack scenarios.
  • The effect generalizes across five VLMs from two model families and across ten real and generated datasets, so it is not an artifact of a single architecture or image distribution.
  • Cross-task ablations show the chosen frequency bands are task-specific: high-frequency perturbations move realism scores but cause less caption drift, while mid-frequency perturbations do the opposite, supporting the paper's claim that the two tasks rely on different frequency cues.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension the paper does not run is to replace the CLIP similarity objective with an independent semantic metric, such as human relevance ratings or textual entailment; if drift disappears, the captioning vulnerability would be a property of the CLIP metric, not of VLM caption semantics.
  • Because the reported realism shifts are often small, under one point on a ten-point scale, the attack's practical impact in the wild likely concentrates near the authenticity decision boundary; images that are strongly real or strongly synthetic would need more iterations or larger perturbations to flip.
  • The paper's own limitation statement notes that enterprise VLMs were not evaluated, so whether the frequency-band vulnerability extends to closed commercial systems remains an open empirical question.
  • The results indirectly suggest a defense trajectory the paper does not develop: spectral-consistency filtering or frequency-band augmentation during VLM training could reduce reliance on the high-frequency authenticity heuristic.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 4 minor

Summary. The paper proposes a black-box, query-based frequency-domain perturbation method for vision-language models (VLMs). The attack adds sparse noise in a selected Fourier band (high frequencies for realism/authenticity judgments, mid frequencies for captioning) and iteratively selects candidate perturbations that move the VLM output toward a target: a realism score on the opposite side of a threshold, or a CLIP cosine-similarity drop below 0.5 between original and perturbed captions. The method is evaluated on five VLMs (Qwen2-VL-2B/7B, Qwen2.5-VL-3B, BLIP2-2.7B/6.7B) across ten real and generated datasets, reporting realism-score shifts, binary realism rates, caption length changes, and caption cosine drift. The paper concludes that VLMs are systemically unreliable under such perturbations and that their reasoning is tied to low-level frequency structure rather than semantics.

Significance. If the captioning claim survived independent semantic validation, this would be a useful broad empirical study of VLM fragility under black-box, query-based perturbation, with five model architectures, ten datasets, and a released dataset. The realism branch demonstrates genuine nonzero effects, and the cross-model generality is a strength. However, the headline captioning result is currently undermined by the fact that the optimization objective and the reported evaluation metric are the same CLIP cosine quantity, and the realism conclusion is stated more strongly than the aggregate effect sizes support. The paper is best seen as an initial attack demonstration whose captioning interpretation needs additional validation before the conclusions can be accepted.

major comments (4)
  1. [III-B Eq. (7); V-B Tables II/IV] The captioning evaluation is circular with the attack objective. Eq. (7) defines the goal function as minimizing the CLIP cosine similarity between the original caption and each perturbed candidate caption, and the attack greedily selects candidates that minimize this quantity. Tables II and IV then report YVLM drift = 1 - cos as evidence that perturbations 'significantly degrade the semantic richness' of captions. This does not establish semantic degradation: an optimizer that minimizes CLIP dissimilarity will produce captions that score low on that same dissimilarity measure regardless of whether the meaning changed. CLIP text embeddings are known to be sensitive to surface form, so low cosine similarity is not automatically evidence of semantic change. The paper needs an independent semantic evaluation—for example, human judgments, NLI-based textual entailment, or a reference-based captioning metric—and should report the rate and nature of actual semantic content changes. The selected visual examples in Fig. 9 are illustrative but not sufficient for the aggregate claim.
  2. [III-B; Table I] There is a threshold inconsistency that affects the realism results. The method text fixes τ1=4 and τ2=6 for the realism bins, and Eq. (6) uses these values, but the caption of Table I states that the reported bins use τ1=3 and τ2=6. Since every binned realism statistic and the binary realism thresholds depend on this parameter, the reported distributions in Tables I and V may not correspond to the method as described. This must be reconciled, or the affected numbers recomputed and re-reported.
  3. [V-A Table I; VII Conclusion] The realism conclusions overstate the aggregate results for the primary model. In Table I, Qwen2-VL-7B mean realism shifts are at most about 0.72 on a 10-point scale, and many binary realism changes are a few percent (e.g., SD3.5-Fantasy moves from 14.5% to 20.5% 'real'; CIFAKE moves from 89.4% to 91.4%; GCC moves from 91.4% to 89.6%). The selected examples in Fig. 9 do cross the decision boundary, but the conclusion that authenticity behavior 'can be adversarially manipulated' as a reliable, systemic effect needs support from per-sample decision-flip rates, effect sizes with confidence intervals, and statistical tests. As written, the aggregate evidence supports a modest shift in realism scores, not a reliable flipping of predictions.
  4. [III-B; V-C] The paper does not compare the proposed frequency-domain perturbation against a control with matched perturbation budget, such as random Fourier noise, spatial-domain noise of similar magnitude, or an existing black-box attack. The cross-task ablation in Table III compares mid- and high-frequency bands, which is useful, but it does not establish that structured, band-limited frequency perturbations are the operative factor rather than any query-driven perturbation of comparable size. A control condition would make the frequency-domain attribution load-bearing for the paper's central claim.
minor comments (4)
  1. [Eq. (5)] Equation (5) writes ˜I_{t+1} = F^{-1}(F(˜I_t + Δ_t)), but ˜I_t is already in the image domain after the previous inverse transform; the intended operation appears to be F^{-1}(F(˜I_t) + Δ_t). Please correct the notation.
  2. [References [38]] Reference [38] is cited for LLaVA in Section II, but the cited paper is about rectified flow (Liu et al., 'Flow straight and fast'), not LLaVA. The correct LLaVA reference (Liu et al., 'Visual instruction tuning') should be substituted.
  3. [Throughout] Minor typographical issues should be fixed: 'is know to enhance' should be 'is known to enhance' (Section II), 'small vs. lage parameter models' should be 'large' (Section V-D), and the unusual notation 'real/!real' should be defined explicitly at first use.
  4. [Table I; Fig. 10] Table I's caption uses the label 'P(r)' while the text uses Pr(I); please unify the notation. Figure 10 reports means without error bars or significance indicators despite large standard deviations in the underlying tables; adding confidence intervals or statistical comparisons would improve interpretability.

Circularity Check

1 steps flagged · score 6.0 of 10

Captioning evidence is circular: Eq. 7's CLIP cosine objective is reused as the reported drift metric, so Tables II/IV measure optimization success rather than independent semantic degradation.

  1. self definitional [Section III-B Goal Function Definition, Eq. (7); Section IV Metrics; Tables II and IV]
    "Gτ ( ˜YVLM, Yτ ) = θcosi = ECLIP[YGT] · ECLIP[ ˜YVLM]i / ||ECLIP[YGT]|| ||ECLIP[ ˜YVLM]i|| . ... Mean semantic drift of CLIP embeddings is calculated as 1 − θcos."

    The captioning attack's goal function (Eq. 7) is the CLIP cosine similarity θcos between the original and perturbed caption embeddings, and the paper greedily selects candidate perturbations that minimize this quantity (Eqs. 4-5). The reported headline evidence for caption degradation, YVLM drift = 1 − θcos in Tables II and IV, is exactly the same quantity being optimized. Therefore finding 'large drift' is equivalent to saying the optimizer reduced its own objective; it is not independent evidence that semantic content was degraded. The paper asserts that CLIP drift 'tracks how well the VLM captures image semantics' without any human evaluation or independent semantic metric, and the τsim = 0.5 threshold is tied to CLIP embedding geometry rather than to observable meaning.

full rationale

The authenticity-detection branch is a standard black-box adversarial attack: Eq. 6 specifies a target output direction, Eq. 4 selects perturbations that move VLM realism scores across the decision boundary, and reporting the resulting ΔPr is the ordinary threat-model claim that such perturbations exist. That is not circular. There is no load-bearing self-citation or imported uniqueness theorem; the only self-citation is the RGFreq dataset release, which is not used to justify the method. The circularity is confined to the captioning branch: the CLIP cosine dissimilarity is simultaneously the attack objective (Eq. 7) and the reported semantic-drift metric (1 − θcos), making the quantitative captioning result reduce by construction to the optimizer's own loss. The paper explicitly assumes CLIP drift reflects semantic richness ('we selected semantic drift as it ... tracks how well the VLM captures image semantics') without independent validation. Length/token changes and selected examples in Fig. 9 provide partial independent evidence, but the aggregate drift tables, which carry the main quantitative claim, are the optimized quantity itself. This is a partial but central circularity, so the score is 6 rather than higher.

Assumptions & free parameters 7 free parameters · 6 assumptions · 0 invented entities

The central claim rests on hand-set perturbation strengths, frequency bands, thresholds, and a CLIP-based semantic proxy, plus several domain assumptions about frequency-to-feature mappings and imperceptibility. No new physical or theoretical entities are postulated. The main burden is that several of these hand-set values are not swept, and the captioning metric is partly defined by the optimization objective.

free parameters (7)
  • sigma = 0.025 * H * W
    Injected frequency noise standard deviation, set by hand without ablation; controls perturbation strength.
  • rho = 0.1 * H * W
    Sparsity ratio, set by hand; controls how many Fourier coefficients are perturbed.
  • high-frequency band = alpha1=0.85, alpha2=1.00
    Chosen for the realism task; validated only by cross-task transferability ablation, with no systematic sweep.
  • mid-frequency band = alpha1=0.49, alpha2=0.51
    Chosen for the captioning task; the exact bounds are justified by literature intuition rather than direct empirical support for these specific values.
  • realism thresholds = tau1=4, tau2=6
    Define decision bins and the goal function in Eq. 6; Table I caption states tau1=3, an internal inconsistency.
  • CLIP similarity threshold = tau_sim=0.5
    Stop condition for the captioning attack; also determines the amount of perturbation applied.
  • candidate count and steps = N=20 realism, N=10 captioning, T=5
    Heuristic limits on the black-box search; no sensitivity analysis is provided.
assumptions (6)
  • standard math Fourier transformation and its inverse are invertible, and band-limited perturbations preserve pixel-space perceptual content.
    Eq. 3 defines the perturbed image through F^-1(F(I)+Delta); imperceptibility is assumed from band-limitedness.
  • domain assumption High spatial frequencies encode texture and edges, mid frequencies encode object-level features, and low frequencies encode coarse structure.
    Section III.B relies on Campbell and Robson, Shapley, and others to justify band selection; the paper does not validate these mappings directly for VLM representations.
  • domain assumption VLM realism scores on a 0-10 scale are ordinal and can be treated as a real/not-real decision boundary at 5.
    Section III.B and Eq. 6 assign predictions to bins; parsing VLM text into numeric scores is assumed reliable.
  • domain assumption CLIP cosine similarity measures semantic drift of captions.
    Eq. 7 uses CLIP both to select perturbations and to evaluate drift; if CLIP can be fooled without semantic change, the caption result is metric-bound.
  • domain assumption The perturbations are visually imperceptible.
    Supported only by example figures and magnification insets (Fig. 7), not by a perceptual metric or human study.
  • domain assumption Ground truth real/generated labels in the ten datasets are trustworthy.
    Experiments compare VLM realism scores against dataset provenance; no audit of mislabeled or atypical samples is reported.

how reviews work

0 comments
Cite this review

Pith. "Pith review of On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbations." pith.science (2026). https://pith.science/paper/2GTQP54P

@misc{pith2026250722398,
  author       = {Pith},
  title        = {Pith review of: On the Reliability of Vision-Language Models Under Adversarial Frequency-Domain Perturbations},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2GTQP54P}},
  note         = {Machine review of arXiv:2507.22398}
}
read the original abstract

Vision-Language Models (VLMs) are increasingly used as perceptual modules for visual content reasoning, including through captioning and DeepFake detection. In this work, we expose a critical vulnerability of VLMs when exposed to subtle, structured perturbations in the frequency domain. Specifically, we highlight how these feature transformations undermine authenticity/DeepFake detection and automated image captioning tasks. We design targeted image transformations, operating in the frequency domain to systematically adjust VLM outputs when exposed to frequency-perturbed real and synthetic images. We demonstrate that the perturbation injection method generalizes across five state-of-the-art VLMs which includes different-parameter Qwen2/2.5 and BLIP models. Experimenting across ten real and generated image datasets reveals that VLM judgments are sensitive to frequency-based cues and may not wholly align with semantic content. Crucially, we show that visually-imperceptible spatial frequency transformations expose the fragility of VLMs deployed for automated image captioning and authenticity detection tasks. Our findings under realistic, black-box constraints challenge the reliability of VLMs, underscoring the need for robust multimodal perception systems.

Figures

Figures reproduced from arXiv: 2507.22398 by the authors.

Figure 2
Figure 2. We illustrate how (imperceptible) mid-frequency perturbations manip [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗
Figure 3
Figure 3. We explore how VLM outputs are influenced by changes in frequency domain features across two tasks: (i) authenticity detection and (ii) automated 4 [PITH_FULL_IMAGE:figures/full_fig_p004_3.png] view at source ↗
Figure 4
Figure 4. For authenticity detection, we apply sparse, [PITH_FULL_IMAGE:figures/full_fig_p004_4.png] view at source ↗
Figures from the paper (6 more)
Figure 5
Figure 5. Figure 5: We assess the robustness of VLM-generated captions under mid-frequency perturbations by minimizing the CLIP similarity score ‘ [PITH_FULL_IMAGE:figures/full_fig_p005_5.png]
Figure 6
Figure 6. Figure 6: Visual comparison of perturbation effects on generated and real images for assessing caption- and realism-based reliability. Each row shows: (1) [PITH_FULL_IMAGE:figures/full_fig_p006_6.png]
Figure 7
Figure 7. Figure 7: Localized image regions of (left) the original, (middle) captioning task and, (right) realism likelihood task outputs at 600% magnification. Despite transformations applied in the spatial frequency domain, zoomed-in insets show that the perturbations remain largely imp…
Figure 8
Figure 8. Figure 8: Sample images from all of the (a) generated datasets and (b) real image datasets evaluated in this work. perceiving image realism and automated image captioning. To evaluate how VLMs perceive real vs. synthetic content, we first report ‘Pr(I)’ and ‘Pr( ˜I)’ which denot…
Figure 9
Figure 9. Figure 9: Visualizing representative outcomes across both tasks. [PITH_FULL_IMAGE:figures/full_fig_p009_9.png]
Figure 10
Figure 10. Figure 10: Average changes in VLM behavior when spatial perturbations are [PITH_FULL_IMAGE:figures/full_fig_p010_10.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

75 extracted references · 57 canonical work pages

  1. [1]

    Generative imperceptible attack with feature learning bias reduction and multi-scale variance reg- ularization,

    W. Xie, Z. Niu, Q. Lin, S. Song, and L. Shen, “Generative imperceptible attack with feature learning bias reduction and multi-scale variance reg- ularization,” IEEE Transactions on Information Forensics and Security , vol. 19, pp. 7924–7938, 2024

    work page 2024

  2. [2]

    Semantically consistent visual representation for adversarial robustness,

    H. Kuang, H. Liu, Y . Wu, and R. Ji, “Semantically consistent visual representation for adversarial robustness,” IEEE Transactions on Infor- mation Forensics and Security , vol. 18, pp. 5608–5622, 2023

    work page 2023

  3. [3]

    B-avibench: Toward evaluating the robustness of large vision-language model on black-box adversarial visual-instructions,

    H. Zhang, W. Shao, H. Liu, Y . Ma, P. Luo, Y . Qiao, N. Zheng, and K. Zhang, “B-avibench: Toward evaluating the robustness of large vision-language model on black-box adversarial visual-instructions,” IEEE Transactions on Information Forensics and Security , vol. 20, pp. 1434–1446, 2025

    work page 2025

  4. [4]

    Vision-language models for vision tasks: A survey,

    J. Zhang, J. Huang, S. Jin, and S. Lu, “Vision-language models for vision tasks: A survey,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 46, no. 8, pp. 5625–5644, 2024

    work page 2024

  5. [5]

    Towards multimodal disinformation detection by vision-language knowledge in- teraction,

    Q. Li, M. Gao, G. Zhang, W. Zhai, J. Chen, and G.-G. Jeon, “Towards multimodal disinformation detection by vision-language knowledge in- teraction,” Information Fusion, vol. 102, p. 102037, 2024

    work page 2024

  6. [6]

    Media forensics and deepfakes: An overview,

    L. Verdoliva, “Media forensics and deepfakes: An overview,” IEEE Journal of Selected Topics in Signal Processing , vol. 14, no. 5, pp. 910–932, 2020

    work page 2020

  7. [7]

    Plausible may not be faithful: Probing object hallucination in vision-language pre-training,

    W. Dai, Z. Liu, Z. Ji, D. Su, and P. Fung, “Plausible may not be faithful: Probing object hallucination in vision-language pre-training,” in Proceedings of the 17th Conference of the European Chapter of the Association for Computational Linguistics (EACL) , 2023, pp. 2128– 2140

    work page 2023

  8. [8]

    Application of fourier analysis to the visibility of gratings,

    F. W. Campbell and J. G. Robson, “Application of fourier analysis to the visibility of gratings,” The Journal of physiology , vol. 197, no. 3, p. 551, 1968

    work page 1968

Show all 75 references
  1. [9]

    R. L. DeValois and K. K. DeValois, Spatial Vision. Oxford University Press USA, 1988

    1988

  2. [10]

    Drop an octave: Reducing spatial redundancy in convo- lutional neural networks with octave convolution,

    Y . Chen, H. Fan, B. Xu, Z. Yan, Y . Kalantidis, M. Rohrbach, S. Yan, and J. Feng, “Drop an octave: Reducing spatial redundancy in convo- lutional neural networks with octave convolution,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , October 2019

    2019

  3. [11]

    Spatial frequency enhanced salient object detection,

    X. Li, Y . Wang, T. Wang, and R. Wang, “Spatial frequency enhanced salient object detection,” Information Sciences , vol. 647, p. 119460, 2023. [Online]. Available: https://www.sciencedirect.com/ science/article/pii/S0020025523010459

    2023

  4. [12]

    Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions,

    R. Durall, M. Keuper, and J. Keuper, “Watch your up-convolution: Cnn based generative deep neural networks are failing to reproduce spectral distributions,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) , June 2020

    2020

  5. [13]

    Adversarial examples are not bugs, they are features,

    A. Ilyas, S. Santurkar, D. Tsipras, L. Engstrom, B. Tran, and A. Madry, “Adversarial examples are not bugs, they are features,” in Advances in Neural Information Processing Systems (NeurIPS) , 2019, pp. 125–136

    2019

  6. [14]

    A fourier perspective of feature extraction and adversarial robustness,

    L. Zhang, Y . Luo, H. Shen, and T. Wang, “A fourier perspective of feature extraction and adversarial robustness,” inProceedings of the 33rd International Joint Conference on Artificial Intelligence (IJCAI) , 2024, pp. 1715–1723

    2024

  7. [15]

    Efficient generation of targeted and transferable adversarial examples for vision-language mod- els via diffusion models,

    Q. Guo, S. Pang, X. Jia, Y . Liu, and Q. Guo, “Efficient generation of targeted and transferable adversarial examples for vision-language mod- els via diffusion models,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 1333–1348, 2025

    2025

  8. [16]

    Overload: Latency attacks on object detection for edge devices,

    E.-C. Chen, P.-Y . Chen, I.-H. Chung, and C.-R. Lee, “Overload: Latency attacks on object detection for edge devices,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), June 2024, pp. 24 716–24 725

    2024

  9. [17]

    Survivability analysis of iot systems under resource exhausting attacks,

    R. Pietrantuono, M. Ficco, and F. Palmieri, “Survivability analysis of iot systems under resource exhausting attacks,” IEEE Transactions on Information Forensics and Security , vol. 18, pp. 3277–3288, 2023

    2023

  10. [18]

    Learning transferable visual models from natural language supervi- sion,

    A. Radford, J. W. Kim, C. Hallacy, A. Ramesh, G. Goh, S. Agarwal, G. Sastry, A. Askell, P. Mishkin, J. Clark, G. Krueger, and I. Sutskever, “Learning transferable visual models from natural language supervi- sion,” in Proceedings of the 38th International Conference on Machine...

    2021

  11. [19]

    Rgfreq dataset,

    J. Vice, “Rgfreq dataset,” August 2025, accessed: 2025-08-12. [Online]. Available: https://ieee-dataport.org/documents/rgfreq-dataset

    2025

  12. [20]

    Generative adversarial nets,

    I. Goodfellow, J. Pouget-Abadie, M. Mirza, B. Xu, D. Warde-Farley, S. Ozair, A. Courville, and Y . Bengio, “Generative adversarial nets,” in Advances in Neural Information Processing Systems (NeurIPS) , vol. 27, 2014, pp. 2672–2680

    2014

  13. [21]

    Auto-Encoding Variational Bayes,

    D. P. Kingma and M. Welling, “Auto-Encoding Variational Bayes,” in 2nd International Conference on Learning Representations (ICLR) , 2014

    2014

  14. [22]

    Denoising diffusion probabilistic models,

    J. Ho, A. Jain, and P. Abbeel, “Denoising diffusion probabilistic models,” in Advances in Neural Information Processing Systems (NeurIPS) , vol. 33, 2020, pp. 6840–6851

    2020

  15. [23]

    Denoising diffusion implicit models,

    J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” in International Conference on Learning Representations (ICLR) , 2021

    2021

  16. [24]

    Hierarchical text-conditional image generation with clip latents,

    A. Ramesh, P. Dhariwal, A. Nichol, C. Chu, and M. Chen, “Hierarchical text-conditional image generation with clip latents,” arXiv preprint arXiv:2204.06125, 2022

    2022 arXiv

  17. [25]

    Photorealistic text-to-image diffusion models with deep language understanding,

    C. Saharia, W. Chan, S. Saxena, L. Li, J. Whang, E. Denton, S. K. S. Ghasemipour, B. K. Ayan, S. S. Mahdavi, R. G. Lopes, T. Salimans, J. Ho, D. J. Fleet, and M. Norouzi, “Photorealistic text-to-image diffusion models with deep language understanding,” arXiv preprint arXiv:220...

    2022 arXiv

  18. [26]

    Exploring the limits of transfer learning with a unified text-to-text transformer,

    C. Raffel, N. Shazeer, A. Roberts, K. Lee, S. Narang, M. Matena, Y . Zhou, W. Li, and P. J. Liu, “Exploring the limits of transfer learning with a unified text-to-text transformer,” Journal of Machine Learning Research, vol. 21, no. 140, pp. 1–67, 2020

    2020

  19. [27]

    U-net: Convolutional networks for biomedical image segmentation,

    O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” in Medical Image Computing and Computer-Assisted Intervention (MICCAI) , ser. Lecture Notes in Computer Science, vol. 9351. Springer, 2015, pp. 234–241

    2015

  20. [28]

    High- resolution image synthesis with latent diffusion models,

    R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, “High- resolution image synthesis with latent diffusion models,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion (CVPR), 2022, pp. 10 684–10 695

    2022

  21. [29]

    SDXL: Improving latent diffusion models for high-resolution image synthesis,

    D. Podell, Z. English, K. Lacey, A. Blattmann, T. Dockhorn, J. M ¨uller, J. Penna, and R. Rombach, “SDXL: Improving latent diffusion models for high-resolution image synthesis,” arXiv preprint arXiv:2307.01952 , 2023

    2023 arXiv

  22. [30]

    Scaling rectified flow transformers for high-resolution image synthesis,

    P. Esser, S. Kulal, A. Blattmann, R. Entezari, J. M ¨uller, H. Saini, Y . Levi, D. Lorenz, A. Sauer, F. Boesel, D. Podell, T. Dockhorn, Z. English, K. Lacey, A. Goodwin, Y . Marek, and R. Rombach, “Scaling rectified flow transformers for high-resolution image synthesis,” arXiv...

    2024 arXiv

  23. [31]

    Deep residual learning for image recognition,

    K. He, X. Zhang, S. Ren, and J. Sun, “Deep residual learning for image recognition,” in Proc. of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2016, pp. 770–778

    2016

  24. [32]

    An image is worth 16x16 words: Trans- formers for image recognition at scale,

    A. Dosovitskiy, L. Beyer, A. Kolesnikov, D. Weissenborn, X. Zhai, T. Unterthiner, M. Dehghani, M. Minderer, G. Heigold, S. Gelly, J. Uszkoreit, and N. Houlsby, “An image is worth 16x16 words: Trans- formers for image recognition at scale,” in International Conference on Learni...

    2021

  25. [33]

    VQA: Visual question answering,

    S. Antol, A. Agrawal, J. Lu, M. Mitchell, D. Batra, C. L. Zitnick, and D. Parikh, “VQA: Visual question answering,” in Proc. of the IEEE International Conference on Computer Vision (ICCV) , 2015, pp. 2425– 2433

    2015

  26. [34]

    BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models,

    J. Li, D. Li, S. Savarese, and S. C. H. Hoi, “BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models,” arXiv preprint arXiv:2301.12597 , 2023

    2023 arXiv

  27. [35]

    On the opportunities and risks of foundation models,

    R. Bommasani, D. A. Hudson, E. Adeli, R. Altman, S. Arora, S. von Arx, M. S. Bernstein, J. Leskovec, F.-F. Li, C. D. Manning, P. Liang et al. , “On the opportunities and risks of foundation models,” arXiv preprint arXiv:2108.07258, 2021

    2021 arXiv

  28. [36]

    The hateful memes challenge: Detecting hate speech in multimodal memes,

    D. Kiela, H. Firooz, A. Mohan, V . Goswami, A. Singh, P. Ringshia, and D. Testuggine, “The hateful memes challenge: Detecting hate speech in multimodal memes,” arXiv preprint arXiv:2005.04790 , 2020

    2005 arXiv

  29. [37]

    Stacked cross attention for image-text matching,

    K.-H. Lee, X. Chen, G. Hua, H. Hu, and X. He, “Stacked cross attention for image-text matching,” in Proc. of the European Conference on Computer Vision (ECCV) , 2018, pp. 212–228

    2018

  30. [38]

    Flow straight and fast: Learning to gen- erate and transfer data with rectified flow,

    X. Liu, C. Gong, and Q. Liu, “Flow straight and fast: Learning to gen- erate and transfer data with rectified flow,” in International Conference on Learning Representations (ICLR) , 2023

    2023

  31. [39]

    Qwen-VL: A versatile vision-language model for un- derstanding, localization, text reading, and beyond,

    J. Bai, S. Bai, S. Yang, S. Wang, S. Tan, P. Wang, J. Lin, C. Zhou, and J. Zhou, “Qwen-VL: A versatile vision-language model for un- derstanding, localization, text reading, and beyond,” arXiv preprint arXiv:2308.12966, 2023

    2023 arXiv

  32. [40]

    Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,

    P. Wang, S. Bai, S. Tan, S. Wang, Z. Fan, J. Bai, K. Chen, X. Liu, J. Wang, W. Ge, Y . Fan, K. Dang, M. Du, X. Ren, R. Men, D. Liu, C. Zhou, J. Zhou, and J. Lin, “Qwen2-vl: Enhancing vision-language model’s perception of the world at any resolution,” arXiv preprint arXiv:2409....

    2024 arXiv

  33. [41]

    PaliGemma: A versatile 3b VLM for transfer,

    L. Beyer, A. Steiner, A. S. Pinto et al. , “PaliGemma: A versatile 3b VLM for transfer,” arXiv preprint arXiv:2407.07726 , 2024

    2024 arXiv

  34. [42]

    Learning Rich Features for Image Manipulation Detection,

    P. Zhou, X. Han, V . I. Morariu, and L. S. Davis, “Learning Rich Features for Image Manipulation Detection,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2018, pp. 1053–1061

    2018

  35. [43]

    FaceForensics++: Learning to Detect Manipulated Facial Images,

    A. R ¨ossler, D. Cozzolino, L. Verdoliva, C. Riess, J. Thies, and M. Nießner, “FaceForensics++: Learning to Detect Manipulated Facial Images,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , 2019, pp. 1–11

    2019

  36. [44]

    The DeepFake Detection Challenge (DFDC) Dataset,

    B. Dolhansky, J. Bitton, B. Pflaum, J. Lu, R. Howes, M. Wang, and C. C. Ferrer, “The DeepFake Detection Challenge (DFDC) Dataset,” arXiv:2006.07397, 2020

    2006 arXiv

  37. [45]

    Detecting images generated by diffusers,

    D. A. Coccomini, A. Esuli, F. Falchi, C. Gennaro, and G. Amato, “Detecting images generated by diffusers,” PeerJ Computer Science , vol. 10, p. e2127, 2024

    2024

  38. [46]

    DIRE: Diffusion Reconstruction Error for Diffusion-Generated Image Detection,

    Z. Wang, J. Bao, W. Zhou, W. Wang, H. Hu, H. Chen, and H. Li, “DIRE: Diffusion Reconstruction Error for Diffusion-Generated Image Detection,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , 2023

    2023

  39. [47]

    Deepfake-eval-2024: A multi-modal in-the-wild benchmark of deepfakes circulated in 2024,

    N. A. Chandra, R. Murtfeldt, L. Qiu, A. Karmakar, H. Lee, E. Tanu- mihardja, K. Farhat, B. Caffee, S. Paik, C. Lee, J. Choi, A. Kim, and O. Etzioni, “Deepfake-eval-2024: A multi-modal in-the-wild benchmark of deepfakes circulated in 2024,” arXiv preprint arXiv:2503.02857 , 2025

    2024 arXiv

  40. [48]

    Synth- Buster: Towards Detection of Diffusion Model Generated Images,

    Q. Bammey, O. H ´elie, R. Gambotto, E. E. Ghafoori, and C. Xu, “Synth- Buster: Towards Detection of Diffusion Model Generated Images,”IEEE Open Journal of Signal Processing , vol. 5, pp. 1–9, 2024

    2024

  41. [49]

    Llms are not yet ready for deepfake image detection,

    S. Tariq, D. Nguyen, M. A. P. Chamikara, T. Wu, A. Abuadbba, and K. Moore, “Llms are not yet ready for deepfake image detection,”

  42. [50]

    Intriguing properties of neural networks,

    C. Szegedy, W. Zaremba, I. Sutskever, J. Bruna, D. Erhan, I. Goodfellow, and R. Fergus, “Intriguing properties of neural networks,” in Proceed- ings of the 2nd International Conference on Learning Representations (ICLR), 2014

    2014

  43. [51]

    Explaining and harnessing adversarial examples,

    I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in Proceedings of the 3rd International Confer- ence on Learning Representations (ICLR) , 2015

    2015

  44. [52]

    Towards deep learning models resistant to adversarial attacks,

    A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in 6th Interna- tional Conference on Learning Representations (ICLR) , 2018

    2018

  45. [53]

    Adversarial vqa: A new benchmark for evaluating the robustness of vqa models,

    L. Li, J. Lei, Z. Gan, and J. Liu, “Adversarial vqa: A new benchmark for evaluating the robustness of vqa models,” in Proceedings of the IEEE/CVF International Conference on Computer Vision (ICCV) , 2021

    2021

  46. [54]

    Attacking vqa systems via adversarial background noise,

    A. Chaturvedi and U. Garain, “Attacking vqa systems via adversarial background noise,” IEEE Transactions on Emerging Topics in Compu- tational Intelligence, vol. 4, no. 4, pp. 490–499, 2020

    2020

  47. [55]

    On evaluating adversarial robustness of large vision-language models,

    Y . Zhao, T. Pang, C. Du, X. Yang, C. Li, N.-M. Cheung, and M. Lin, “On evaluating adversarial robustness of large vision-language models,” in Advances in Neural Information Processing Systems (NeurIPS), 2023

    2023

  48. [56]

    Mutual-modality adversarial attack with semantic perturbation,

    J. Ye, R. Yu, S. Liu, and X. Wang, “Mutual-modality adversarial attack with semantic perturbation,” in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , 2024, pp. 6657–6665

    2024

  49. [57]

    Frequency-driven imperceptible adversarial attack on semantic similarity,

    C. Luo, Q. Lin, W. Xie, B. Wu, J. Xie, and L. Shen, “Frequency-driven imperceptible adversarial attack on semantic similarity,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recogni- tion (CVPR), 2022, pp. 15 315–15 324

    2022

  50. [58]

    Facl-attack: Frequency-aware contrastive learning for transferable adversarial attacks,

    H. Yang, J. Jeong, and K.-J. Yoon, “Facl-attack: Frequency-aware contrastive learning for transferable adversarial attacks,” in Proceedings of the AAAI Conference on Artificial Intelligence (AAAI) , 2024, pp. 6494–6502

    2024

  51. [59]

    AdvDiff: Generating unrestricted adversarial examples using diffusion models,

    X. Dai, K. Liang, and B. Xiao, “AdvDiff: Generating unrestricted adversarial examples using diffusion models,” in Proceedings of the European Conference on Computer Vision (ECCV) , 2024

    2024

  52. [60]

    Sita: Structurally imperceptible and transferable adversarial attacks for stylized image generation,

    J. Kang, H. Yang, Y . Cai, H. Zhang, X. Xu, Y . Du, and S. He, “Sita: Structurally imperceptible and transferable adversarial attacks for stylized image generation,” IEEE Transactions on Information Forensics and Security, vol. 20, pp. 3936–3949, 2025

    2025

  53. [61]

    Toward transferable attack via adver- sarial diffusion in face recognition,

    C. Hu, Y . Li, Z. Feng, and X. Wu, “Toward transferable attack via adver- sarial diffusion in face recognition,” IEEE Transactions on Information Forensics and Security, vol. 19, pp. 5506–5519, 2024

    2024

  54. [62]

    BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation,

    J. Li, R. R. Selvaraju, A. Gotmare, S. Joty, C. Xiong, and S. C. H. Hoi, “BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation,” in Advances in Neural Information Processing Systems (NeurIPS) , 2022

    2022

  55. [63]

    Imagenet-trained cnns are biased towards texture; in- creasing shape bias improves accuracy and robustness,

    R. Geirhos, C. Rubisch, C. Michaelis, M. Bethge, F. A. Wichmann, and W. Brendel, “Imagenet-trained cnns are biased towards texture; in- creasing shape bias improves accuracy and robustness,” in International Conference on Learning Representations (ICLR) , 2019

    2019

  56. [64]

    Spatial frequency analysis in the visual system,

    R. Shapley, P. Lennie et al. , “Spatial frequency analysis in the visual system,” Annual review of neuroscience , vol. 8, no. 1, pp. 547–581, 1985

    1985

  57. [65]

    Distinct spatial frequency sensitivities for processing faces and emotional expressions,

    P. Vuilleumier, J. L. Armony, J. Driver, and R. J. Dolan, “Distinct spatial frequency sensitivities for processing faces and emotional expressions,” Nature neuroscience, vol. 6, no. 6, pp. 624–631, 2003

    2003

  58. [66]

    Introducing stable diffusion 3.5,

    S. AI, “Introducing stable diffusion 3.5,” October 2024, accessed: 2025-05-27. [Online]. Available: https://stability.ai/news/ introducing-stable-diffusion-3-5

    2024

  59. [67]

    Stable imagenet-1k dataset,

    V . Kinakh, “Stable imagenet-1k dataset,” https://www.kaggle.com/ datasets/vitaliykinakh/stable-imagenet1k, 2022

    2022

  60. [68]

    Cifake: Image classification and explain- able identification of ai-generated synthetic images,

    J. J. Bird and A. Lotfi, “Cifake: Image classification and explain- able identification of ai-generated synthetic images,” arXiv preprint arXiv:2303.14126, 2023

    2023 arXiv

  61. [69]

    Learning multiple layers of features from tiny images,

    A. Krizhevsky, “Learning multiple layers of features from tiny images,” MSc Thesis, University of Toronto, Toronto, Canada, 2009

    2009

  62. [70]

    Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image cap- tioning,

    P. Sharma, N. Ding, S. Goodman, and R. Soricut, “Conceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image cap- tioning,” in Proceedings of the 56th Annual Meeting of the Association for Computational Linguistics , 2018, pp. 2556–2565

    2018

  63. [71]

    Microsoft coco: Common objects in context,

    T.-Y . Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Doll ´ar, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Proceedings of the European Conference on Computer Vision, D. Fleet, T. Pajdla, B. Schiele, and T. Tuytelaars, Eds., 2014, pp. 740–755

    2014

  64. [72]

    Flickr30k entities: Collecting region-to-phrase correspondences for richer image-to-sentence models,

    B. A. Plummer, L. Wang, C. M. Cervantes, J. C. Caicedo, J. Hocken- maier, and S. Lazebnik, “Flickr30k entities: Collecting region-to-phrase correspondences for richer image-to-sentence models,” in 2015 IEEE International Conference on Computer Vision (ICCV) , 2015, pp. 2641– 2649

    2015

  65. [73]

    Imagenet large scale visual recognition challenge,

    O. Russakovsky, J. Deng, H. Su et al. , “Imagenet large scale visual recognition challenge,” International journal of computer vision , vol. 115, pp. 211–252, 2015

    2015

  66. [74]

    Qwen2.5-vl,

    Q. Team, “Qwen2.5-vl,” January 2025. [Online]. Available: https: //qwenlm.github.io/blog/qwen2.5-vl/

    2025

  67. [2025]

    Available: https://arxiv.org/abs/2506.10474

    [Online]. Available: https://arxiv.org/abs/2506.10474

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.