Pith. sign in

REVIEW 4 major objections 6 minor 36 references

Malicious text planted in physical scenes can hijack vision-language models on smart glasses, flipping navigation and safety answers and steering toxic or biased outputs.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · grok-4.5

2026-07-14 13:01 UTC pith:2KUB7FCW

load-bearing objection Real wearable-glasses threat demo with multi-model physical ASRs and a usable taxonomy; numbers lean on an unchecked GPT judge and controlled captures, but the core vulnerability holds. the 4 major comments →

arxiv 2607.10269 v1 pith:2KUB7FCW submitted 2026-07-11 cs.CR

Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices

Yaxin Li , Hao Wang , Yanda Shao , Shuhao Zhang , Yan Long This is my paper
classification cs.CR
keywords vision-language modelsphysical prompt injectionwearable devicessmart glassesmultimodal securityvisual attackprompt injection
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper argues that vision-language models on wearable devices treat text in the real world as a high-priority instruction channel. Attackers who place short, scene-plausible phrases in the environment can make AI glasses refuse tasks, reverse exit directions, suppress hazard warnings, or emit toxic and biased language. Across twelve models and more than two hundred first-person captures from smart glasses, the attacks succeed at high rates in digital emulation and remain effective under physical capture, especially on decision tasks. The authors show that several models over-trust environmental text and ignore the actual visual scene. They also introduce two defenses—a mask-based external filter and a semantic-vector internal detector—that sharply reduce attack success while preserving ordinary utility.

Core claim

Scene-conditioned physical prompt injection—embedding short malicious instructions into environments observed by wearable VLMs—consistently manipulates model outputs on integrity- and safety-critical tasks across twelve models, because many VLMs exhibit excessive blind trust in environmental text and can ignore the true visual context.

What carries the argument

Scene-conditioned physical prompt injection π = (t, ϕ): a black-box attack that places short, scene-plausible text so camera images become an implicit instruction channel without knowledge of the exact user query.

Load-bearing premise

The claimed attack rates rest on digitally screened short prompts, mostly bright indoor captures within about two meters, and an automatic judge deciding success; if those conditions overstate real visibility or the judge is biased, the effectiveness does not transfer to the wild.

What would settle it

Re-capture the six task scenes with the paper’s printed prompts at 2–2.5 m under varied outdoor lighting and pose on the same smart glasses, re-run the twelve VLMs with human-verified success criteria, and check whether decision-task attack rates stay high or collapse.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • Assistive navigation and hazard judgments on AI glasses can be inverted by nearby planted signs or posters.
  • Larger, stronger VLMs can be more, not less, vulnerable to environmental text than smaller models.
  • Foreign-language or fluorescent text can affect the camera while remaining hard for wearers to notice.
  • OCR-plus-taint masking and token-drift feature pullback are practical mitigations that cut attack success without redesigning the whole model.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Always-on wearable perception may need to treat ambient text as an untrusted input class, analogous to untrusted web content for language models.
  • The same channel likely extends to other embodied systems that fuse cameras with language, such as robots or vehicle vision stacks.
  • Defenses that only blur high-taint regions may fail when malicious instructions look like ordinary legitimate signage.
  • Continuous agentic loops on glasses would turn occasional output flips into direct physical actions, raising the cost of residual failures.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

4 major / 6 minor

Summary. The paper argues that malicious text embedded in physical scenes constitutes a practical, scene-conditioned prompt-injection channel against VLM-enabled wearables (e.g., AI glasses). It defines a six-vector taxonomy (refusal induction, navigation hijacking, safety misperception, toxic content, personal bias, event framing), formulates a black-box scene-conditioned attack objective, screens short prompts digitally, then evaluates 12 VLMs on 600 digitally injected images and on >200 first-person Meta smart-glasses captures under distance/light/angle/placement ablations, including multilingual and fluorescent variants. Reported attack success rates are high on decision tasks (digitally up to ~96%; physically often tens of percent to 1.0 on Ref/Nav/Safe for some models). Two prototype defenses are proposed: TaCo-Guard (OCR + LLM taint scoring + Gaussian blur of high-risk text) and a token-drift gated feature pullback in the visual encoder; Table 2 shows large ASR drops after masking.

Significance. If the measured ASRs and defense gains hold under validated labeling and more realistic capture conditions, the work is a timely and practically relevant contribution to embodied multimodal security: it moves visual prompt injection from digital overlays to wearable first-person perception, supplies a usable threat taxonomy for assistive scenarios (navigation/safety), and provides multi-model evidence plus two deployable defense directions. Strengths include the breadth of models (12), the physical glasses dataset, structured physical-factor ablations (Table 1), and explicit pre/post defense numbers (Table 2). The fluorescent and foreign-language injection ideas are particularly interesting for the human–camera perception gap. These results would matter for safety of VLM glasses and related embodied agents even if absolute ASR numbers are later revised downward.

major comments (4)
  1. §5.1.1 Eq. (3) and Appendix C: All primary ASRs (digital and physical) and the defense deltas in Table 2 rest on a binary success indicator J(·) labeled solely by gpt-5.2 under task-specific criteria. The manuscript reports no human–judge concordance, inter-annotator agreement, or calibration on borderline cases (e.g., answers that restate injected text while still describing the true scene, or that attribute the answer to the sign). For Nav/Safe the success definition only requires the opposite directive without explicit attribution to the injected text, so systematic judge leniency would inflate both the “excessive blind trust” claim and the reported defense gains. A modest human-labeled subset (or multi-judge agreement) with reported disagreement rates is needed before the headline rates can be treated as reliable.
  2. Abstract vs §5.2 / Table 2: The abstract states real-world ASR “up to 60%,” yet Table 2 reports physical ASR of 1.000 on Ref/Nav/Safe for qwen3-vl-235b (and similarly high rates for several Gemini/Qwen entries) under the default bright ≤2 m regime. Either the abstract understates the physical results, or the 60% figure aggregates differently (e.g., mean across models/tasks or a restricted subset). This inconsistency must be resolved and the aggregation rule stated, because the central claim of “consistent” real-world manipulation depends on which number is authoritative.
  3. §3.2–§5.2 and Fig. 3: A core framing claim is that scene texts can “hinder or evade human perception” (foreign-language and fluorescent prompts) while still hijacking the VLM. The main ASR tables (Table 1–2) appear dominated by standard English printed prompts under bright indoor conditions within ~2 m; multilingual/fluorescent variants are illustrated but not given separate, complete ASR breakdowns by model and task. Without those numbers—and without a human noticeability study—the stealth/evasion part of the threat model remains under-supported relative to the paper’s emphasis, and transfer to a black-box adversary who cannot control pose/lighting is harder to assess.
  4. §6 and Table 2: TaCo-Guard’s large ASR reductions are the main defense evidence, but utility impact is only asserted qualitatively (“limited… though overly aggressive suppression may remove useful visual information”). There is no reported clean-task accuracy, OCR false-positive rate on benign scene text (exit signs, hazard labels), or end-to-end assistive-task success with vs without the filter. The internal detector is evaluated only on two models and one task (Nav) as a “preliminary exploration.” For a paper whose contribution includes “two targeted defense strategies… to effectively reduce” impact, at least a basic utility metric on the same six tasks and a clearer scope statement for the internal method are load-bearing.
minor comments (6)
  1. §4.2 / Algorithm 1: The digital screening places candidate text “below a clean image” with default ϕ0; clarify whether this layout matches the physical placement distribution (TL/TR/BL/BR) used later, or whether screening bias could favor prompts that fail under realistic placement.
  2. Fig. 4 caption and body: “Before/After prompt optimization” is useful, but the y-axis is labeled “Attack Success Rate (%)” while ticks are 0.0–0.8; fix units consistency.
  3. Table 1: Some cells are very low (0.000) for Claude/GPT at longer distances; a short note on OCR/readability failure vs model refusal would help interpretation.
  4. Related Work §2: SceneTAP, CHAI, and physical typographic work are cited; a sharper one-paragraph contrast table (setting: digital vs wearable first-person; tasks: classification vs assistive decision; defenses) would clarify novelty for readers.
  5. Typos/clarity: “presentative scenarios” (§3.2); “floescent”/“attakck” in §7; “and and visually unobtrusive” in the introduction; standardize “Qwen3-VL-235B” naming across text and tables.
  6. §5.1.1 datasets: OpenImages/UTKFace/CCNews construction details are deferred to Appendix B; a one-sentence statement of how ground-truth exit direction / stair presence is established for J(·) would help in the main text.

Circularity Check

0 steps flagged

No circularity: empirical ASR measurements and defenses against external VLMs; no derivation that reduces by construction to fitted inputs or self-citation uniqueness.

full rationale

This paper is an empirical security evaluation of physical prompt injection against 12 external VLMs (API/checkpoint models). The central claims are measured Attack Success Rates (Eq. 3) under task-specific binary criteria J(·), plus before/after ASR reductions for two prototype defenses. Prompt candidates are generated and digitally screened (Eq. 2, Algorithm 1) then physically deployed; selection of high-scoring prompts is standard attack design, not a claim that a fitted parameter algebraically equals a predicted quantity. There is no uniqueness theorem, no self-citation load-bearing for a mathematical result, no ansatz smuggled via prior author work, and no renaming of a known closed-form result. The automatic judge (GPT-5.2) and controlled physical placements raise validity/correctness questions about whether reported ASRs transfer, but those are external-measurement concerns, not circular reductions of the paper’s own equations or definitions. The derivation chain is therefore self-contained against external benchmarks; score 0 with empty steps is the correct outcome.

Axiom & Free-Parameter Ledger

4 free parameters · 5 axioms · 3 invented entities

Empirical adversarial-ML paper: load-bearing content is measurement protocol and threat assumptions, not free physical constants. Free parameters are defense/attack hyperparameters chosen by the authors. Axioms are standard black-box physical-adversary and OCR/VLM pipeline assumptions. Invented entities are named defenses and the scenario taxonomy used to structure claims.

free parameters (4)
  • taint_score_threshold = 0.7
    TaCo-Guard treats OCR segments with LLM taint score above 0.7 as adversarial and blurs them; this cutoff is author-chosen and directly affects reported defense ASR.
  • max_prompt_length_words = 15
    Candidate physical prompts constrained to ≤15 words for deployability; shapes the attack space Π_s.
  • default_physical_capture_regime = bright, ≤2 m
    Subsequent experiments default to bright images within 2 m after factor study; reported headline physical ASRs depend on this operating point.
  • TopK_prompt_retention = TopK (unspecified numeric K in main text)
    Algorithm 1 keeps top-K digitally screened prompts before physical Φ sweep; K is a design choice affecting which injections are tested.
axioms (5)
  • domain assumption Black-box physical adversary can only place/display text in the camera’s natural field of view; no device compromise or query observation.
    Threat model §3.3; defines the attack surface the paper claims to evaluate.
  • domain assumption Scene type s induces a distribution of plausible user queries Q_s, so scene-conditioned prompts can succeed without knowing the exact query.
    Threat formulation §4.1 equations (1)–(2); load-bearing for “scene-conditioned” success claims.
  • ad hoc to paper Attack success A(·)/J(·) can be reliably labeled by an automatic judge model (gpt-5.2) under task-specific criteria.
    Metrics §5.1.1 and Appendix C; all ASR numbers rest on this labeling process.
  • domain assumption OCR plus an LLM taint scorer can identify adversarial scene text regions well enough that selective blur preserves utility while blocking injection.
    Defense §6.1 (EasyOCR + Qwen2.5-7B-Instruct); required for TaCo-Guard effectiveness claims.
  • standard math Standard multimodal model APIs/checkpoints behave as fixed black boxes under the listed model names for the evaluation period.
    Implicit in multi-model tables; usual empirical ML assumption, not proved in-paper.
invented entities (3)
  • TaCo-Guard (Taint-Aware Counterfactual Guard) no independent evidence
    purpose: External plug-in that OCR-detects text, scores taint, and Gaussian-blurs high-risk regions before VLM inference.
    Named defense prototype §6.1; effectiveness is only shown on the authors’ benchmark, not independently validated elsewhere in the paper.
  • Token-Drift Gated Feature Pullback no independent evidence
    purpose: Internal defense that attenuates visual tokens with large embedding drift versus a clean reference image.
    Named internal detector §6.2; only preliminary numbers on two models.
  • Six-vector physical prompt injection taxonomy (Ref/Nav/Safe/Tox/Bias/Frame) no independent evidence
    purpose: Organizes wearable threat scenarios into task/decision vs content/alignment manipulation.
    Core structuring device of the paper (§3.2, Fig. 2); useful but author-defined categories, not an external standard.

pith-pipeline@v1.1.0-grok45 · 19811 in / 3518 out tokens · 44470 ms · 2026-07-14T13:01:33.009849+00:00 · methodology

0 comments
read the original abstract

Vision-Language Models (VLMs) are rapidly deployed on human-facing wearable devices such as smart glasses to enable multimodal perception and AI-assisted decision-making. While prior research has demonstrated the risks of visual prompt injection into digital image inputs of VLMs, the unique security challenges posed by the increasing integration between physical environments and wearable intelligence, such as those embodied in VLM-enabled AI glasses, remain underexplored. Toward understanding and modeling such threats, our work characterizes how malicious textual information embedded in physical environments introduces a high-priority visual channel for indirect prompt injection, where scene texts that hinder or evade human perception could hijack VLM models' behavior. Such \textit{Physical Prompt Injection Attacks} can not only disrupt normal tasks of VLM-enabled wearable devices, but also steer models to produce profane, biased, or even untruthful outputs. Using physically captured photos from AI glasses in over 200 real-world environments, our analysis identifies 6 representative threat vectors of physically injected prompts, and further evaluates their impacts on 12 VLM models. Results show that these attacks consistently manipulate model outputs across integrity- and safety-critical tasks, achieving attack success rates of up to 96\% and 60\% in simulated and real-world settings. Our analysis confirms that multiple models exhibit excessive blind trust in environmental text, ignoring the actual visual context and producing completely opposite summaries or directives. We further propose two targeted defense strategies, including a mask-based external filter and a semantic-vector-based internal detector, to effectively reduce the success rate and safety impact of these attacks.

Figures

Figures reproduced from arXiv: 2607.10269 by Hao Wang, Shuhao Zhang, Yanda Shao, Yan Long, Yaxin Li.

Figure 1
Figure 1. Figure 1: Physical prompt injection attacks against VLM [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Overview of the scene-conditioned physical prompt injection pipeline. Environmental textual cues embedded in [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Multilingual and fluorescent variants of physical prompts. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Effectiveness of prompt optimization. and Llama-3.2-11B are relatively more robust. This suggests that stronger reasoning ability does not necessarily improve robustness against visually embedded malicious instructions. Across tasks, decision-oriented scenarios such as Ref, Nav, and Safe show the highest ASR, indicating that prompt injection is es￾pecially effective when the model is required to make expli… view at source ↗
Figure 5
Figure 5. Figure 5: Overview of TaCo-Guard. OCR extracts textual re [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

36 extracted references · 7 linked inside Pith

  1. [1]

    Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. 2023. Abusing images and sounds for indirect instruction injection in multi-modal LLMs. arXiv:2307.10490

    Pith/arXiv arXiv 2023

  2. [2]

    Mirza Samad Ahmed Baig, Syeda Anshrah Gillani, Shahid Munir Shah, Mahmoud Aljawarneh, Abdul Akbar Khan, and Muhammad Hamzah Siddiqui. 2024.AI- based wearable vision assistance system for the visually impaired: Integrating real- time object recognition and contextual understanding using large vision-language models. arXiv:2412.20059

    Pith/arXiv arXiv 2024

  3. [3]

    Dionysia Danai Brilli, Evangelos Georgaras, Stefania Tsilivaki, Nikos Melanitis, and Konstantina Nikita. 2024. AIris: An AI-Powered Wearable Assistive Device for the Visually Impaired. In2024 10th IEEE RAS/EMBS International Conference for Biomedical Robotics and Biomechatronics (BioRob). 1236–1241. doi:10.1109/ BioRob60516.2024.10719976

    arXiv 2024

  4. [4]

    2025.CHAI: Command Hijacking against embodied AI

    Luis Burbano, Diego Ortiz, Qi Sun, Siwei Yang, Haoqin Tu, Cihang Xie, Yinzhi Cao, and Alvaro A Cardenas. 2025.CHAI: Command Hijacking against embodied AI. arXiv:2510.00181

    arXiv 2025

  5. [5]

    Yue Cao, Yun Xing, Jie Zhang, Di Lin, Tianwei Zhang, Ivor Tsang, Yang Liu, and Qing Guo. 2025. Scenetap: Scene-coherent typographic adversarial planner against vision-language models in real-world environments. InProceedings of the Computer Vision and Pattern Recognition Conference. 25050–25059

    2025

  6. [6]

    Zezhou Chen, Zhaoxiang Liu, Kai Wang, Kohou Wang, and Shiguo Lian. 2024. A large vision-language model based environment perception system for visually impaired people. In2024 IEEE/RSJ International Conference on Intelligent Robots and Systems (IROS). IEEE, 221–228

    2024

  7. [7]

    Hao Cheng, Erjia Xiao, Jindong Gu, Le Yang, Jinhao Duan, Jize Zhang, Jiahang Cao, Kaidi Xu, and Renjing Xu. 2024. Unveiling typographic deceptions: Insights of the typographic vulnerability in large vision-language models. InEuropean Conference on Computer Vision. Springer, 179–196

    2024

  8. [8]

    2025.Exploring typographic visual prompts injection threats in cross-modality generation models

    Hao Cheng, Erjia Xiao, Yichi Wang, Lingfeng Zhang, Qiang Zhang, Jiahang Cao, Kaidi Xu, Mengshu Sun, Xiaoshuai Hao, Jindong Gu, et al. 2025.Exploring typographic visual prompts injection threats in cross-modality generation models. arXiv:2503.11519

    arXiv 2025

  9. [9]

    2025.Words or vision: Do vision-language models have blind faith in text?arXiv:2503.02199

    Ailin Deng, Tri Cao, Zhirui Chen, and Bryan Hooi. 2025.Words or vision: Do vision-language models have blind faith in text?arXiv:2503.02199

    Pith/arXiv arXiv 2025

  10. [10]

    Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision- language models via typographic visual prompts. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 39. 23951–23959

    2025

  11. [11]

    Kai Greshake, Sahar Abdelnabi, Shailesh Mishra, Christoph Endres, Thorsten Holz, and Mario Fritz. 2023. Not what you’ve signed up for: Compromising real- world llm-integrated applications with indirect prompt injection. InProceedings of the 16th ACM workshop on artificial intelligence and security. 79–90

    2023

  12. [12]

    W. Guan, Q. Hu, A. Li, and J. Cheng. 2025.Efficient Vision-Language-Action Models for Embodied Manipulation: A Systematic Survey. arXiv:2510.17111

    Pith/arXiv arXiv 2025

  13. [13]

    Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tuset, Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, Tom Duerig, and Vittorio Ferrari. 2020. The Open Images Dataset V4: Unified image classification, object detection, and visual relationship detection at scale. International Journal of Computer Visi...

    2020

  14. [14]

    2026.Physical Prompt Injection Attacks on Large Vision-Language Models

    Chen Ling, Kai Hu, Hangcheng Liu, Xingshuo Han, Tianwei Zhang, and Changhai Ou. 2026.Physical Prompt Injection Attacks on Large Vision-Language Models. arXiv:2601.17383

    arXiv 2026

  15. [15]

    Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Yu Cheng, and Wei Hu. 2025. A survey of attacks on large vision–language models: Resources, advances, and future trends.IEEE Transactions on Neural Networks and Learning Systems(2025)

    2025

  16. [16]

    Xiaogeng Liu, Zhiyuan Yu, Yizhe Zhang, Ning Zhang, and Chaowei Xiao. 2024. Automatic and universal prompt injection attacks against large language models. arXiv:2403.04957

    Pith/arXiv arXiv 2024

  17. [17]

    2024.Ray-Ban | Meta Glasses Are Getting New AI Features and More Partner Integrations

    Meta. 2024.Ray-Ban | Meta Glasses Are Getting New AI Features and More Partner Integrations. Retrieved April 1, 2026 from https://about.fb.com/news/2024/09/ray- ban-meta-glasses-new-ai-features-and-partner-integrations/

    2024

  18. [18]

    2024.Welcome to a new age of AI hardware

    Aaron Mok. 2024.Welcome to a new age of AI hardware. These are 5 AI-powered devices announced since OpenAI launched ChatGPT. Retrieved April 1, 2026 from https://www.businessinsider.com/ai-gadgets-announced-available-openai- 2024-2

    2024

  19. [19]

    Wiktor Mucha, Florin Cuconasu, Naome A Etori, Valia Kalokyri, and Giovanni Trappolini. 2024. TEXT2TASTE: a versatile egocentric vision system for intelli- gent reading assistance using large language model. InInternational Conference on Computers Helping People with Special Needs. Springer, 285–291

    2024

  20. [20]

    2016.CC-News: News Dataset A vailable

    Sebastian Nagel. 2016.CC-News: News Dataset A vailable. Retrieved April 1, 2026 from https://commoncrawl.org/blog/news-dataset-available

    2016

  21. [21]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. InProceedings of the AAAI conference on artificial intelligence, Vol. 38. 21527–21536

    2024

  22. [22]

    2024.Vision-llms can fool themselves with self-generated typographic attacks

    Maan Qraitem, Nazia Tasnim, Piotr Teterwak, Kate Saenko, and Bryan A Plummer. 2024.Vision-llms can fool themselves with self-generated typographic attacks. arXiv:2402.00626

    Pith/arXiv arXiv 2024

  23. [23]

    Maan Qraitem, Piotr Teterwak, Kate Saenko, and Bryan A Plummer. 2025. Web Artifact Attacks Disrupt Vision Language Models. InProceedings of the IEEE/CVF International Conference on Computer Vision. 1048–1057

    2025

  24. [24]

    2025.OpenAI now prototyping its first AI device, launch in ‘less than 2 years’

    Harsh Shivam. 2025.OpenAI now prototyping its first AI device, launch in ‘less than 2 years’. Retrieved April 1, 2026 from https://www.business- standard.com/technology/tech-news/openai-now-prototyping-its-first-ai- device-launch-in-less-than-2-years-125112500658_1.html

    2025

  25. [25]

    2024.Safeguarding vision-language models against patched visual prompt injectors

    Jiachen Sun, Changsheng Wang, Jiongxiao Wang, Yiwei Zhang, and Chaowei Xiao. 2024.Safeguarding vision-language models against patched visual prompt injectors. arXiv:2405.10529

    Pith/arXiv arXiv 2024

  26. [26]

    Yoad Tewel, Omri Kaduri, Rinon Gal, Yoni Kasten, Lior Wolf, Gal Chechik, and Yuval Atzmon. 2024. Training-free consistent text-to-image generation.ACM Transactions on Graphics (TOG)43, 4 (2024), 1–18

    2024

  27. [27]

    Xiaomeng Wang, Zhengyu Zhao, and Martha Larson. 2025. Typographic At- tacks in a Multi-Image Setting. InProceedings of the Annual Conference of the North American Chapter of the Association for Computational Linguistics (NAACL). 12594–12604

    2025

  28. [28]

    Yu Wang, Xiaofei Zhou, Yichen Wang, Geyuan Zhang, and Tianxing He. 2025. Jailbreak large vision-language models through multi-modal linkage. InProceed- ings of the 63rd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 1466–1494

    2025

  29. [29]

    Alexander Wei, Nika Haghtalab, and Jacob Steinhardt. 2023. Jailbroken: How does llm safety training fail?Advances in neural information processing systems 36 (2023), 80079–80110

    2023

  30. [30]

    H. Xu, Y. S. Koh, S. Huang, Z. Zhou, D. Wang, J. Sakuma, and J. Zhang. 2025. Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models. arXiv:2510.13237

    arXiv 2025

  31. [31]

    Bufang Yang, Lixing He, Kaiwei Liu, and Zhenyu Yan. 2024. VIAssist: Adapting Multi-Modal Large Language Models for Users with Visual Impairments. In2024 IEEE International Workshop on Foundation Models for Cyber-Physical Systems & Internet of Things (FMSys). 32–37. doi:10.1109/FMSys62467.2024.00010

    doi:10.1109/fmsys62467.2024.00010 2024

  32. [32]

    Jingkang Yang, Shuai Liu, Hongming Guo, Yuhao Dong, Xiamengwei Zhang, Sicheng Zhang, Pengyun Wang, Zitang Zhou, Binzhu Xie, Ziyue Wang, et al

  33. [33]

    InProceedings of the Computer Vision and Pattern Recognition Conference

    Egolife: Towards egocentric life assistant. InProceedings of the Computer Vision and Pattern Recognition Conference. 28885–28900

  34. [34]

    Qiusi Zhan, Hyeonjeong Ha, Rui Yang, Sirui Xu, Hanyang Chen, Liangyan Gui, Yu-Xiong Wang, Huan Zhang, Heng Ji, and Daniel Kang. 2025. BEAT: Visual Backdoor Attacks on VLM-based Embodied Agents via Contrastive Trigger Learning. InThe Fourteenth International Conference on Learning Representations

    2025

  35. [35]

    Qiusi Zhan, Zhixiang Liang, Zifan Ying, and Daniel Kang. 2024. InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agents. InFindings of the Association for Computational Linguistics: ACL 2024, Lun-Wei Ku, Andre Martins, and Vivek Srikumar (Eds.). Association for Computational Linguistics, Bangkok, Thailand, 10471–1...

    doi:10.18653/v1/ 2024

  36. [36]

    Zhifei Zhang, Yang Song, and Hairong Qi. 2017. Age Progression/Regression by Conditional Adversarial Autoencoder. InIEEE Conference on Computer Vision and Pattern Recognition (CVPR). IEEE, 5810–5818. 10

    2017