Pith. sign in

REVIEW 33 cited by

How Robust is Google's Bard to Adversarial Image Attacks?

Not yet reviewed by Pith; the record is open.

Re-run · record.json Download PDF Read on arXiv ↗

This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.

SPECIMEN: schema-true, not a live event

T0 review · schema-true

One-sentence machine reading of the paper's core claim.

pith:XXXXXXXX · record.json · timestamp

arxiv 2309.11751 v2 pith:4Z2C6JZ4 submitted 2023-09-21 cs.CV cs.AIcs.CRcs.LG

Yinpeng Dong , Huanran Chen , Jiawei Chen , Zhengwei Fang , Xiao Yang , Yichi Zhang , Yu Tian , Hang Su
show 1 more author
Jun Zhu
This is my paper · ORCID
classification cs.CVcs.AIcs.CRcs.LG
keywords adversarialmllmsbardattackraterobustnesssuccessvision
verification ladder T0 review T1 audit T2 compute T3 formal

Signed reviews

No signed human review yet.

0 comments
read the original abstract

Multimodal Large Language Models (MLLMs) that integrate text and other modalities (especially vision) have achieved unprecedented performance in various multimodal tasks. However, due to the unsolved adversarial robustness problem of vision models, MLLMs can have more severe safety and security risks by introducing the vision inputs. In this work, we study the adversarial robustness of Google's Bard, a competitive chatbot to ChatGPT that released its multimodal capability recently, to better understand the vulnerabilities of commercial MLLMs. By attacking white-box surrogate vision encoders or MLLMs, the generated adversarial examples can mislead Bard to output wrong image descriptions with a 22% success rate based solely on the transferability. We show that the adversarial examples can also attack other MLLMs, e.g., a 26% attack success rate against Bing Chat and a 86% attack success rate against ERNIE bot. Moreover, we identify two defense mechanisms of Bard, including face detection and toxicity detection of images. We design corresponding attacks to evade these defenses, demonstrating that the current defenses of Bard are also vulnerable. We hope this work can deepen our understanding on the robustness of MLLMs and facilitate future research on defenses. Our code is available at https://github.com/thu-ml/Attack-Bard. Update: GPT-4V is available at October 2023. We further evaluate its robustness under the same set of adversarial examples, achieving a 45% attack success rate.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 33 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. On Surjectivity of Neural Networks: Can you elicit any behavior from your model?

    cs.LG 2025-08 conditional novelty 7.0 of 10

    Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.

  2. Trading Inference-Time Compute for Adversarial Robustness

    cs.LG 2025-01 conditional novelty 7.0 of 10

    Increasing inference-time compute in o1 reasoning models reduces attack success across many adversarial tasks, with important exceptions.

  3. Two Sides of the Same Coin: Co-Evolving Search for Cross-Task Attacks on Vision-Language Models

    cs.CV 2026-08 conditional novelty 6.0 of 10

    CoEvoAttack uses evolutionary search on both text and image sides to generate object-region adversarial examples that transfer across captioning, detection, region categorization, and localization in unified VLMs.

  4. Visual Token Compression Enhances Robustness of MLLMs

    cs.CV 2026-07 conditional novelty 6.0 of 10

    Pruning visual tokens farthest from the text feature space at selected 'robust' layers improves MLLM jailbreak defense (average +13.29% RAR) and slightly reduces hallucination.

  5. 3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism

    cs.CV 2026-07 conditional novelty 6.0 of 10

    An optimized, view-consistent 3D Gaussian shell around a face avatar reliably changes which facial attributes vision-language models report, while preserving identity and appearance.

  6. On Adversarial Vulnerability of Vision-Language Models through the Lens of Intermediate Spectral Subspaces

    cs.LG 2026-07 conditional novelty 6.0 of 10

    Aligning adversarial perturbations with the near-null singular directions of intermediate linear layers in transformer VLMs yields stronger attacks than existing feature- and output-space methods.

  7. Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models

    cs.CR 2026-02 conditional novelty 6.0 of 10

    A grounding-guided attack that concentrates perturbation on text-matched image regions and disrupts global and local semantic alignment consistently improves adversarial transferability across multiple vision-language models.

  8. VISOR++: Universal Visual Inputs based Steering for Large Vision Language Models

    cs.CV 2025-09 conditional novelty 6.0 of 10

    A single adversarially optimized image can reproduce activation-steering behavior in multiple VLMs and partially transfer to unseen models.

  9. One Object, Multiple Lies: A Benchmark for Cross-task Adversarial Attack on Unified Vision-Language Models

    cs.CV 2025-07 conditional novelty 6.0 of 10

    A single adversarial image can make a unified vision-language model misclassify the same object across captioning, detection, region classification, and localization, and the new CrossVLAD benchmark and CRAFT attack m...

  10. Fighting Fire with Fire (F3): A Training-free and Efficient Visual Adversarial Example Purification Method in LVLMs

    cs.CV 2025-06 conditional novelty 6.0 of 10

    F3 adds attention-guided noise to adversarial images so that large vision-language models produce answers that are much closer to their clean-image answers.

  11. Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.

  12. Disrupting Vision-Language Model-Driven Navigation Services via Adversarial Object Fusion

    cs.CR 2025-05 conditional novelty 6.0 of 10

    AdvOF crafts 3D adversarial objects that mislead VLM perception across multiple views and degrade VLN agent navigation success in simulation.

  13. Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM

    cs.CR 2025-05 conditional novelty 6.0 of 10

    Spa-VLM crafts paired adversarial images and misleading texts to poison RAG-based VLM knowledge bases, reaching attack success rates above 0.8 with just five injected entries.

  14. Backdoor Cleaning without External Guidance in MLLM Fine-tuning

    cs.CR 2025-05 conditional novelty 6.0 of 10

    BYE filters backdoored training images from MLLM fine-tuning by clustering low attention entropy across selected layers.

  15. REVEAL: Multi-turn Evaluation of Image-Input Harms for Vision LLM

    cs.CL 2025-05 conditional novelty 6.0 of 10

    REVEAL, a new automated benchmark, reports that vision-language models show higher conversation-level defect rates in multi-turn image-input conversations than in single-turn ones across sexual harm, violence, and mis...

  16. Transferable Adversarial Attacks on Black-Box Vision-Language Models

    cs.CV 2025-05 conditional novelty 6.0 of 10

    Targeted, barely visible image perturbations transfer from open-source surrogate models to proprietary black-box VLLMs like GPT-4o, Claude, and Gemini, achieving high attack success on captioning, VQA, and receipt tex...

  17. On the robustness of multimodal language model towards distractions

    cs.CV 2025-02 conditional novelty 6.0 of 10

    Adding irrelevant visual and textual distractions to science questions degrades the accuracy of most vision-language models, and text distractions are more harmful than image distractions.

  18. Robust-LLaVA: On the Effectiveness of Large-Scale Robust Image Encoders for Multi-modal Large Language Models

    cs.CV 2025-02 conditional novelty 6.0 of 10

    Using large-scale adversarially pretrained vision encoders in LLaVA yields 2x and 1.5x robustness gains on captioning and VQA, and cuts jailbreak success rates by over 10% relative to CLIP fine-tuning baselines.

  19. Rerouting LLM Routers

    cs.CR 2025-01 conditional novelty 6.0 of 10

    Adversarially optimized, query-independent token prefixes can reroute nearly all queries to the expensive strong model in both open-source and commercial LLM routers.

  20. Spot Risks Before Speaking! Unraveling Safety Attention Heads in Large Vision-Language Models

    cs.LG 2025-01 conditional novelty 6.0 of 10

    A small set of attention heads in LVLMs flags malicious prompts during the first token; a logistic-regression detector built on them reduces jailbreak success to 1-5%.

  21. De-biased Multimodal Electrocardiogram Analysis

    cs.CL 2024-11 conditional novelty 6.0 of 10

    An ECG multimodal LLM that ingests raw ECG embeddings plus a causal de-biasing pre-training step outperforms baselines on ECG-QA and passes a random-ECG probe for genuine signal use.

  22. GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation

    cs.CV 2026-07 conditional novelty 5.0 of 10

    A black-box adversarial attack method, GeoThreat, generates transferable targeted perturbations for LVLMs in remote sensing by jointly aligning global conceptual and local perceptual representations with a target image.

  23. Dual Adversarial Fine-tuning for Enhancing Robustness of Large Vision Language Model

    cs.CV 2026-07 conditional novelty 5.0 of 10

    DAFT fine-tunes CLIP's vision encoder with a visual-consistency loss plus a caption-triplet loss, reporting modest adversarial-robustness gains over FARE on classification, captioning, and VQA benchmarks.

  24. Adversarial-Guided Diffusion for Multimodal LLM Attacks

    cs.CV 2025-07 conditional novelty 5.0 of 10

    AGD steers the final denoising steps of Stable Diffusion with CLIP-based target gradients and momentum, producing targeted MLLM attacks with high image fidelity and better survival under defenses.

  25. Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment

    cs.CV 2025-05 conditional novelty 5.0 of 10

    FOA-Attack aligns global and clustered local features via optimal transport with dynamic ensemble weighting to create targeted adversarial images that transfer to closed-source multimodal LLMs.

  26. RapGuard: Safeguarding Multimodal Large Language Models via Rationale-aware Defensive Prompting

    cs.CL 2024-12 conditional novelty 5.0 of 10

    A rationale-aware defensive prompting framework uses multimodal chain-of-thought and self-checking to reduce harmful MLLM outputs while preserving benign utility.

  27. Immune: Improving Safety Against Jailbreaks in Multi-modal LLMs via Inference-Time Alignment

    cs.CR 2024-11 conditional novelty 5.0 of 10

    An inference-time alignment method using a safety reward model and controlled decoding that reduces jailbreak success rates in multimodal LLMs while preserving utility.

  28. Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks

    cs.CV 2024-11 conditional novelty 5.0 of 10

    A step-by-step multimodal 'chain of attack' improves the transferability of targeted adversarial images against open vision-language models, with a new LLM-judged success metric.

  29. Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIP

    cs.CV 2026-01 conditional novelty 4.0 of 10

    CSR detects and repairs adversarial CLIP inputs by comparing features with a low-pass filtered copy and applying a small contrastive PGD correction, claiming SOTA robust accuracy on 16 benchmarks.

  30. Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models

    cs.LG 2025-08 unverdicted novelty 4.0 of 10

    The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.

  31. A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations

    cs.CR 2025-02 conditional novelty 4.0 of 10

    A survey of LVLM safety that adds a lifecycle taxonomy and new benchmark results showing Janus-Pro-7B has weaker safety than several open-source LVLMs.

  32. LIAR: Leveraging Inference Time Alignment (Best-of-N) to Jailbreak LLMs in Seconds

    cs.CL 2024-12 reject novelty 4.0 of 10

    LIAR shows that best-of-N sampling of suffixes from a GPT-2 model jailbreaks several aligned LLMs with low-perplexity prompts and far faster time-to-attack than training-based attacks.

  33. Empowering Multimodal LLMs with External Tools: A Comprehensive Survey

    cs.CV 2025-08 unverdicted novelty 2.0 of 10

    A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.

Pith tools