Pith. sign in

REVIEW 5 major objections 6 minor 10 cited by

Manipulating Multimodal Agents via Cross-Modal Prompt Injection

T0 review · 5 major / 6 minor · reviewed 2026-08-16 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read Coordinated image-text injection hijacks multimodal agents, beating single-modality attacks by 30.1 percent.

desk verdict Cross-modal prompt injection is a real and underexplored attack surface, and the two-channel method is well designed, but the headline numbers rest on an unvalidated LLM judge and an inflated baseline average. read the letter →

arxiv 2504.14348 v4 pith:M25ZFFGM submitted 2025-04-19 cs.CV

Le Wang , Zonghao Ying , Tianyuan Zhang , Siyuan Liang , Shengshan Hu , Mingchuan Zhang , Aishan Liu , Xianglong Liu This is my paper · ORCID
classification cs.CV
keywords cross-modalpromptinjectionmultimodalagentsvision-languagemodelsadversarialperturbationsblack-boxattacksLLM-as-a-Judgeautonomousdrivingsafetydefense
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that multimodal agents, systems that fuse images, text, and retrieved external data to act on user requests, are vulnerable to a new attack class called cross-modal prompt injection. The proposed attack, CrossInject, adds imperceptible noise to an image so its latent features align with a malicious instruction while appending an optimized deceptive text command that steers the agent's response. In black-box settings, the paper reports attack success rates at least 30.1 percentage points higher than existing single-modality injection methods across two purpose-built visual-question-answering agents, and it demonstrates the attack on a physical autonomous driving platform where the vehicle failed to detour around a stop sign in 9 of 10 trials. If correct, the paper establishes that securing multimodal agents requires defending the fusion of modalities, not just each input channel separately.

What carries the argument

The load-bearing machinery is a pair of coordinated injection functions with a shared malicious target. Visual Latent Alignment defines a loss that minimizes the normalized $\ell^2$ distance between a perturbed image's features and a text-to-image-generated target image in an ensemble of vision encoders, subject to an $\ell^\infty$ perturbation budget of 16. Textual Guidance Enhancement defines a token-level loss that minimizes the negative log-likelihood of the malicious action under a surrogate LLM prompted with a defense-aware system prompt, optimized by greedy coordinate gradient (GCG) token search. The two components are complementary: visual injection plants task-relevant cues at the input end, while textual injection biases the output distribution toward compliance, so that filtering or refusing one modality is not enough to stop the hijack.

What would settle it

Re-run the attack suite with the same agents and commands but have human annotators or direct task execution decide success; if the human-verified attack success rate does not exceed the naive baseline by the claimed margin, the LLM-as-a-Judge protocol is carrying the result.

Watch

Extended reading notes

Core claim

The central claim is that coordinated adversarial manipulation of both visual and textual inputs to a black-box VLM-driven agent can override the agent's role instructions and force it to execute attacker-specified tasks. The visual component generates a target image that semantically encodes the injected task using a text-to-image model, then optimizes a bounded perturbation so the features of the benign image move toward that target in an ensemble of vision encoders; the textual component constructs a defense-like system prompt through adversarial meta-prompting and runs token-level optimization to find a short deceptive command that maximizes the probability of the desired malicious response. The paper reports that this combination outperforms visual-only and text-only baselines by at least 30.1 percent average attack success rate across text-editing and sentiment-analysis injections on two agent roles and two vision-language planners, and shows transfer to the physical world where the attack made a driving agent ignore a stop sign in 9 of 10 trials.

Load-bearing premise

The headline success rates all come from an LLM judge labeling responses as successful, so if that judge is overly lenient the reported attack success would shrink; the results also assume that two custom-built chatbots and one driving platform adequately represent real multimodal agents.

Editorial extensions

If this is right

  • Any deployed VLM-based agent that accepts an uploaded image and a text command should treat input images as potential instruction channels, not just as data to be analyzed.
  • Single-channel defenses, such as role-prompt reinforcement or image blurring, will likely remain insufficient because the attack coordinates both modalities.
  • Because the attack transfers across surrogate encoders and surrogate LLMs to unseen victim models, a patch and command optimized once may work against multiple black-box agents.
  • Physical deployments are in scope: in the paper's driving experiment, the attack turned a stop-sign encounter into a failure to detour in 9 of 10 runs.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The same alignment-plus-guidance recipe appears portable to other modalities, such as audio, whenever a surrogate encoder and a generative model for target content exist, though the paper only tests vision and text.
  • If success rates were re-measured by human annotators or by actual task completion rather than an LLM judge, the reported gain could change; a public human-verified benchmark would clarify how much of the effect is real.
  • The attack's reliance on knowing an approximate role description could be relaxed by inferring the system prompt from the agent's public behavior, widening its black-box applicability.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 6 minor

Summary. This paper identifies a vulnerability class called cross-modal prompt injection and proposes CrossInject, a black-box attack against VLM-driven multimodal agents. The attack combines Visual Latent Alignment, which uses a text-to-image model to generate a target image of the malicious instruction and then optimizes an l-infinity-bounded perturbation to align the benign input image with that target in an ensemble of surrogate vision encoders, with Textual Guidance Enhancement, which uses adversarial meta-prompting to construct a defensive system prompt and GCG to optimize a malicious textual command on a surrogate LLM. The paper evaluates on two custom-built digital agents (RecipeMaster and PoetryGenius) powered by Qwen2-VL or Phi-3.5-vision, reports ASR gains of at least +30.1% over baselines, presents ablations and defense evaluations, and includes a physical driving case study on a LIMO vehicle where the agent failed to bypass a stop sign in 9 of 10 trials.

Significance. The contribution is potentially significant: if the measured ASR gains are reliable, CrossInject demonstrates that coordinated visual-textual injection is a realistic threat to multimodal agents, and the use of transferable surrogate models is a practical black-box recipe. The paper provides a clear threat model, includes ablations that isolate the visual and textual components, and attempts a physical-world validation, which is valuable and relatively rare in this literature. The main reason the significance is conditional is that every digital metric is produced by an unvalidated LLM judge, so the headline numbers are not yet established.

major comments (5)
  1. [§5.1, Evaluation Metrics] All ASR and PNA values in Table 1 and the abstract headline are computed by the Qwen-Max LLM-as-a-judge, but the paper provides no judge prompt, no human-agreement study, no error analysis, and no calibration against ground-truth task completion. Since CrossInject is specifically designed to make LLM-based systems comply with injected instructions, the judge may itself be manipulated or over-lenient; the reported ASR could then reflect judge compliance rather than victim-agent execution. Please provide the exact judge prompt and scoring criteria, validate the judge on a human-annotated subset with per-condition agreement, and, where possible, replace judge-based success with objective checks such as verifying that the output actually edits the target text or outputs the required sentiment label.
  2. [Abstract; §5.2; §8] The headline improvement is internally inconsistent and undefined. The abstract reports +30.1%, the conclusion reports +26.4%, and Section 5.2 reports +32.7% for local documents and +27.5% for online webpages, with no statement of the formula used to average over baselines and conditions. Recomputing simple averages over Table 1 does not reproduce any of these numbers. Define the exact metric, including whether the gain is absolute or relative, which baselines are included, and how the sixteen settings are aggregated; report the computed value; and make the abstract, body, and conclusion agree.
  3. [§5.2, Table 1] JIP obtains 0% ASR in all sixteen tested conditions. This is surprising for a published visual jailbreak attack and suggests either a fundamental incompatibility or an implementation issue. The paper does not say how JIP was adapted to agent-style inference, which hyperparameters were used, or whether its original goal of jailbreaking a VLM with an embedded instruction is equivalent to the prompt-injection setting here. Please document the baseline configuration and, if JIP is not directly applicable, say so explicitly; otherwise the comparison with CrossInject is not a controlled one.
  4. [§6] The physical-world evidence is a single scenario repeated ten times, and the success criterion is described inconsistently: the text says the naive textual attack "prevented the vehicle from bypassing the stop sign in 4 instances" and CrossInject "succeeded" 9 times, while the caption says the attacked case "collided with a traffic sign." It is unclear whether success means ignoring the stop sign, failing to detour, or colliding, and no trajectories, metrics, or confidence intervals are reported. Please define a precise behavioral outcome, report per-trial results, and provide at least basic statistical support such as a binomial confidence interval before drawing safety-critical conclusions.
  5. [§5.3, Tables 2–4] Several ablation claims do not match the tables. For Table 3, comparing "w/o Enhance" with "Ours" gives reductions of 47, 9, 6, and 14 percentage points, averaging 19.0 points, not the stated 24.8%; for Table 4, the claimed 26.9% average improvement of Llama-3.1-8B over the other surrogates is not reproducible from the numbers shown. Please recompute all average-difference claims and ensure the text and tables agree, since these ablations are used to argue that both attack components are necessary.
minor comments (6)
  1. [§1, Fig. 1 caption] The word "unrerlated" should be "unrelated."
  2. [§4.2] The phrase "an malicious textual command" should be "a malicious textual command."
  3. [§5.1] The text says "our evaluation leverages three public natural language processing datasets," but only CoEDIT and SST2 are listed; either add the missing dataset or correct the count.
  4. [§3.1 and §6] The threat model asserts that external data E is processed before the user command C, but the physical case study in §6 removes the external-data interface and delivers the malicious task directly as a user command, so that experiment does not exercise the external-data attack surface described in the threat model.
  5. [References] Reference [94] is cited as "Sandwitch Defense"; the standard name is "Sandwich Defense."
  6. [§5.1, Implementation Details] The paper does not state whether code or artifacts will be released; for reproducibility of the GCG and SSA-CWA hyperparameters, please provide the exact optimization recipes or commit to releasing code.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: CrossInject is an empirically evaluated attack; none of its claims reduce by construction to fitted inputs or self-citations.

full rationale

I walked the derivation chain. The two attack components are optimization procedures defined by Eq. (3) (visual feature alignment to a generated target image under a surrogate vision-encoder ensemble) and Eq. (4) (maximizing the likelihood of the target malicious action on a surrogate LLM with a constructed defensive prompt). Neither objective is defined in terms of the evaluation metric, the reported ASR, or the paper's conclusions, so the attack's effectiveness is not equivalent to its construction by definition. The reported ASR values are empirical measurements against fixed victim models (Qwen2-VL and Phi-3.5-vision planners) and are not derived from fitted parameters or from the attack's own assumptions. Self-citations appear in related-work context or for standard technical components (e.g., adversarial patches, attack categorization) and do not carry the load-bearing claim that CrossInject works. The LLM-as-a-Judge protocol is a validation concern rather than a circular step: there is no equation-level reduction showing that the judge's verdict is the same quantity as the attack objective, and the paper does not rename any fitted parameter as a prediction. Accordingly, no specific circular step can be exhibited under the stated hard rules.

Assumptions & free parameters 5 free parameters · 5 assumptions · 0 invented entities

The central result depends on the assumed agent architecture (external data processed before the user command), on the attacker's knowledge of the agent role, on transferability of surrogate-model perturbations, and on the reliability of an LLM judge. The attack's hyperparameters (epsilon 16, 100 optimization iterations, Llama-3.1-8B surrogate, four vision encoders) are selected or ablated on the evaluation tasks rather than derived. No invented physical entities are introduced.

free parameters (5)
  • Visual perturbation budget epsilon = 16 (L_infinity)
    Chosen from ablation study in Sec 5.3; ASR rises until 16 then plateaus, so this value is selected on the evaluation data rather than derived.
  • Textual optimization iterations = 100
    Selected from ablation in Sec 5.3 as near-optimal; no independent validation is reported.
  • GCG top-k and batch size = top-k=256, batch size=512
    Set in Sec 5.1; no sensitivity analysis is reported beyond iteration count.
  • Surrogate LLM = Llama-3.1-8B-Instruct
    Selected from Table 4 ablation because it maximizes ASR; surrogate choice is a free design parameter affecting transferability.
  • Surrogate vision encoder ensemble = ViT-H-14, ViT-L-14, ViT-B-16, SigLIP
    Four public encoders chosen by hand; no ablation of ensemble composition is reported.
assumptions (5)
  • domain assumption Victim agent processes external data before the user command (E before C).
    Sec 3.1 states this follows standard practice [64,65] and uses it in Eq. (1); indirect injection via documents and webpages depends on this ordering.
  • domain assumption The attacker knows an approximate role description R of the agent and its functionality.
    Sec 3.2 assumes this; it is used to construct the defensive system prompt in Sec 4.2.
  • domain assumption Qwen-Max LLM judge provides accurate attack-success labels.
    Sec 5.1 says both ASR and PNA are computed by LLM-as-a-Judge; no human agreement or error analysis is reported.
  • domain assumption Perturbations optimized on surrogate encoders and Llama-3.1-8B transfer to Qwen2-VL and Phi-3.5-vision planners.
    Sec 4.1 and 4.2 adopt transfer-based attack; transferability is only shown post hoc by the reported ASR, not guaranteed analytically.
  • domain assumption Stable-Diffusion-3.5-Large generates an image that encodes the malicious instruction in a way surrogate encoders can extract.
    Sec 4.1 relies on g(d') as target It; if generation fails, visual latent alignment loses meaning.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Manipulating Multimodal Agents via Cross-Modal Prompt Injection." pith.science (2026). https://pith.science/paper/M25ZFFGM

@misc{pith2026250414348,
  author       = {Pith},
  title        = {Pith review of: Manipulating Multimodal Agents via Cross-Modal Prompt Injection},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/M25ZFFGM}},
  note         = {Machine review of arXiv:2504.14348}
}
read the original abstract

The emergence of multimodal large language models has redefined the agent paradigm by integrating language and vision modalities with external data sources, enabling agents to better interpret human instructions and execute increasingly complex tasks. However, in this paper, we identify a critical yet previously overlooked security vulnerability in multimodal agents: cross-modal prompt injection attacks. To exploit this vulnerability, we propose CrossInject, a novel attack framework in which attackers embed adversarial perturbations across multiple modalities to align with target malicious content, allowing external instructions to hijack the agent's decision-making process and execute unauthorized tasks. Our approach incorporates two key coordinated components. First, we introduce Visual Latent Alignment, where we optimize adversarial features to the malicious instructions in the visual embedding space based on a text-to-image generative model, ensuring that adversarial images subtly encode cues for malicious task execution. Subsequently, we present Textual Guidance Enhancement, where a large language model is leveraged to construct the black-box defensive system prompt through adversarial meta prompting and generate an malicious textual command that steers the agent's output toward better compliance with attackers' requests. Extensive experiments demonstrate that our method outperforms state-of-the-art attacks, achieving at least a +30.1% increase in attack success rates across diverse tasks. Furthermore, we validate our attack's effectiveness in real-world multimodal autonomous agents, highlighting its potential implications for safety-critical applications.

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 10 Pith papers

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. SafeCA: Safe Cross-Attention Localization and Regulation for Text-to-Video Jailbreak Defense

    cs.CV 2026-08 conditional novelty 6.0 of 10

    SafeCA reduces text-to-video jailbreak success by roughly 20% relative to T2VShield by masking anomalous cross-attention activations using clean-prompt statistics.

  2. Agent Security Needs Redefinition through a Holistic Framework

    cs.CR 2026-07 conditional novelty 6.0 of 10

    Agent security should be redefined around four contextual authorization properties instead of the content of the action performed.

  3. CrackedPDFs: A Controlled Benchmark for Hidden Prompt Injection in PDFs

    cs.AI 2026-07 conditional novelty 6.0 of 10

    A document-aware hybrid detector that inspects PDF structure before text flattening outperforms text-only guardrails and structural-only models on a new 29,322-file controlled hidden-prompt-injection benchmark.

  4. Mask-GCG: Are All Tokens in Adversarial Suffixes Necessary for Jailbreak Attacks?

    cs.CL 2025-09 conditional novelty 6.0 of 10

    Mask-GCG uses learnable masks to prune a minority of low-impact tokens from GCG attack suffixes, slightly improving speed while showing most tokens are necessary.

  5. T2V-OptJail: Discrete Prompt Optimization for Text-to-Video Jailbreak Attacks

    cs.CV 2025-05 conditional novelty 6.0 of 10

    An LLM-driven discrete optimization with prompt mutation can rewrite unsafe prompts to bypass text-to-video safety filters and produce harmful videos with higher success than existing methods.

  6. Multimodal Fine-grained Reasoning for Post Quality Evaluation

    cs.LG 2025-07 reject novelty 5.0 of 10

    MFTRR combines local-global cross-modal attention, gating, and graph-based evidence reasoning to rank forum post quality, reporting NDCG@3 gains of up to 9.5 points over text-only baselines on new private datasets.

  7. PRJ: Perception-Retrieval-Judgement for Generated Images

    cs.CV 2025-06 reject novelty 4.0 of 10

    A new safety checker for AI-generated images, built from a vision-language model, retrieval-augmented knowledge lookup, and an LLM judge, reports higher detection rates and category-level toxicity scores than three ex...

  8. Red Teaming the Mind of the Machine: A Systematic Evaluation of Prompt Injection and Jailbreak Vulnerabilities in LLMs

    cs.CR 2025-05 reject novelty 4.0 of 10

    A claimed systematic jailbreak evaluation across four LLMs reports 69-87% attack success rates and high cross-model transferability, but provides no artifacts to support the numbers.

  9. Graph-Augmented Large Language Model Agents: Current Progress and Future Prospects

    cs.AI 2025-07 conditional novelty 3.0 of 10

    A survey that categorizes Graph-augmented LLM Agent research into planning, memory, tool management, and multi-agent design, and outlines open directions.

  10. Prompt Injection 2.0: Hybrid AI Threats

    cs.CR 2025-07 reject novelty 2.0 of 10

    A structured taxonomy of hybrid prompt injection attacks shows how XSS, CSRF, and SQL injection vectors converge with LLM manipulation to bypass traditional controls.

Reference graph

Works this paper leans on

98 extracted references · 28 canonical work pages · cited by 10 Pith papers

  1. [63]

    arXiv preprint arXiv:2307.10490 (2023)

    Bagdasaryan, E., Hsieh, T.-Y ., Nassi, B., Shmatikov, V .: Abusing Images and Sounds for Indirect Instruction Injection in Multi-Modal LLMs. arXiv preprint arXiv:2307.10490 (2023)

    arXiv 2023

  2. [1]

    arXiv preprint arXiv:2402.15116 (2024)

    Xie, J., Chen, Z., Zhang, R., Wan, X., Li, G.: Large Multimodal Agents: A Survey. arXiv preprint arXiv:2402.15116 (2024)

    arXiv 2024

  3. [2]

    In: Advances in Neural Information Processing Systems (2023)

    Liu, H., Li, C., Wu, Q., Lee, Y .J.: Visual Instruc- tion Tuning. In: Advances in Neural Information Processing Systems (2023)

    2023

  4. [3]

    In: Pro- ceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (2024)

    Liu, H., Li, C., Li, Y ., Lee, Y .J.: Improved Base- lines with Visual Instruction Tuning. In: Pro- ceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (2024)

    2024

  5. [4]

    In: Advances in Neural Information Processing Sys- tems (2023)

    Dai, W., Li, J., Li, D., Tiong, A., Zhao, J., Wang, W., Li, B., Fung, P., Hoi, S.: InstructBLIP: Towards General-purpose Vision- Language Models with Instruction Tuning. In: Advances in Neural Information Processing Sys- tems (2023)

    2023

  6. [5]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    Zhuang, W., Huang, X., Zhang, X., Zeng, J.: Math-PUMA: Progressive Upward Multimodal Alignment to Enhance Mathematical Reason- ing. In: Proceedings of the AAAI Conference on Artificial Intelligence (2025)

    2025

  7. [6]

    In: Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogni- tion (2024)

    Chen, Z., Wu, J., Wang, W., Su, W., Chen, G., Xing, S., Zhong, M., Zhang, Q., Zhu, X., Lu, L., Li, B., Luo, P., Lu, T., Qiao, Y ., Dai, J.: 12 Article Title InternVL: Scaling up Vision Foundation Mod- els and Aligning for Generic Visual-Linguistic Tasks. In: Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogni- tion (2024)

    2024

  8. [7]

    arXiv preprint arXiv:2408.01800 (2024)

    Yao, Y ., Yu, T., Zhang, A., Wang, C., Cui, J., Zhu, H., Cai, T., Li, H., Zhao, W., He, Z., Chen, Q., Zhou, H., Zou, Z., Zhang, H., Hu, S., Zheng, Z., Zhou, J., Cai, J., Han, X., Zeng, G., Li, D., Liu, Z., Sun, M.: MiniCPM-V: A GPT-4V Level MLLM on Your Phone. arXiv preprint arXiv:2408.01800 (2024)

    arXiv 2024

Show all 98 references
  1. [8]

    arXiv preprint arXiv:2311.03079 (2024)

    Wang, W., Lv, Q., Yu, W., Hong, W., Qi, J., Wang, Y ., Ji, J., Yang, Z., Zhao, L., Song, X., Xu, J., Xu, B., Li, J., Dong, Y ., Ding, M., Tang, J.: CogVLM: Visual Expert for Pretrained Lan- guage Models. arXiv preprint arXiv:2311.03079 (2024)

    2024 arXiv

  2. [9]

    arXiv preprint arXiv:2405.13034 (2024)

    Pei, J., Viola, I., Huang, H., Wang, J., Ahsan, M., Ye, F., Yiming, J., Sai, Y ., Wang, D., Chen, Z., Ren, P., Cesar, P.: Autonomous Workflow for Multimodal Fine-Grained Training Assis- tants Towards Mixed Reality. arXiv preprint arXiv:2405.13034 (2024)

    2024 arXiv

  3. [10]

    arXiv preprint arXiv:2312.16886 (2023)

    Chu, X., Qiao, L., Lin, X., Xu, S., Yang, Y ., Hu, Y ., Wei, F., Zhang, X., Zhang, B., Wei, X., Shen, C.: MobileVLM: A Fast, Strong and Open Vision Language Assistant for Mobile Devices. arXiv preprint arXiv:2312.16886 (2023)

    2023 arXiv

  4. [11]

    In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2024)

    Hong, W., Wang, W., Lv, Q., Xu, J., Yu, W., Ji, J., Wang, Y ., Wang, Z., Dong, Y ., Ding, M., Tang, J.: CogAgent: A Visual Language Model for GUI Agents. In: Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (2024)

    2024

  5. [12]

    arXiv preprint arXiv:2312.09245 (2023)

    Wang, W., Xie, J., Hu, C., Zou, H., Fan, J., Tong, W., Wen, Y ., Wu, S., Deng, H., Li, Z., Tian, H., Lu, L., Zhu, X., Wang, X., Qiao, Y ., Dai, J.: DriveMLM: Aligning Multi-Modal Large Language Models with Behavioral Plan- ning States for Autonomous Driving. arXiv preprint arX...

    2023

  6. [13]

    In: European Conference on Computer Vision (2024)

    Ma, Y ., Cao, Y ., Sun, J., Pavone, M., Xiao, C.: Dolphins: Multimodal language model for driving. In: European Conference on Computer Vision (2024)

    2024

  7. [14]

    arXiv preprint arXiv:2412.14446 (2024)

    Xu, Y ., Hu, Y ., Zhang, Z., Meyer, G.P., Mustikovela, S.K., Srinivasa, S., Wolff, E.M., Huang, X.: VLM-AD: End-to-End Autonomous Driving through Vision-Language Model Super- vision. arXiv preprint arXiv:2412.14446 (2024)

    2024 arXiv

  8. [15]

    arXiv preprint arXiv:2404.14219 (2024)

    Abdin, M., Aneja, J., Hany Awadalla, e.a.: Phi-3 Technical Report: A Highly Capable Language Model Locally on Your Phone. arXiv preprint arXiv:2404.14219 (2024)

    2024 arXiv

  9. [16]

    arXiv preprint arXiv:2404.13208 (2024)

    Wallace, E., Xiao, K., Leike, R., Weng, L., Heidecke, J., Beutel, A.: OpenVLA: An Open- Source Vision-Language-Action Model. arXiv preprint arXiv:2404.13208 (2024)

    2024 arXiv

  10. [17]

    In: Advances in Neural Information Processing Systems (2023)

    Mu, Y ., Zhang, Q., Hu, M., Wang, W., Ding, M., Jin, J., Wang, B., Dai, J., Qiao, Y ., Luo, P.: Embodiedgpt: Vision-language pre-training via embodied chain of thought. In: Advances in Neural Information Processing Systems (2023)

    2023

  11. [18]

    In: International Conference on Learning Representations (2024)

    Li, X., Liu, M., Zhang, H., Yu, C., Xu, J., Wu, H., Cheang, C., Jing, Y ., Zhang, W., Liu, H., Li, H., Kong, T.: Vision-language foundation mod- els as effective robot imitators. In: International Conference on Learning Representations (2024)

    2024

  12. [19]

    arXiv preprint arXiv:2312.07472 (2023)

    Qin, Y ., Zhou, E., Liu, Q., Yin, Z., Sheng, L., Zhang, R., Qiao, Y ., Shao, J.: MP5: A Multi-modal Open-ended Embodied System in Minecraft via Active Perception. arXiv preprint arXiv:2312.07472 (2023)

    2023 arXiv

  13. [20]

    https://owasp.org/ www-project-top-10-for-large-language-model-applications/ assets/PDF/OW ASP-Top-10-for-LLMs-2023-v1 1.pdf

    OW ASP: OW ASP Top 10 for LLM Applications. https://owasp.org/ www-project-top-10-for-large-language-model-applications/ assets/PDF/OW ASP-Top-10-for-LLMs-2023-v1 1.pdf

    2023

  14. [21]

    In: International Conference on Learning Represen- tations (2024)

    Shayegani, E., Dong, Y ., Abu-Ghazaleh, N.B.: Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In: International Conference on Learning Represen- tations (2024)

    2024

  15. [22]

    arXiv preprint arXiv:2406.12814 (2024) Article Title 13

    Wu, C.H., Shah, R., Koh, J.Y ., Salakhutdinov, R., Fried, D., Raghunathan, A.: Dissecting Adver- sarial Robustness of Multimodal LM Agents. arXiv preprint arXiv:2406.12814 (2024) Article Title 13

    2024 arXiv

  16. [23]

    arXiv preprint arXiv:2403.04957 (2024)

    Liu, X., Yu, Z., Zhang, Y ., Zhang, N., Xiao, C.: Automatic and Universal Prompt Injection Attacks against Large Language Modals. arXiv preprint arXiv:2403.04957 (2024)

    2024 arXiv

  17. [24]

    arXiv preprint arXiv:2306.05499 (2023)

    Liu, Y ., Deng, G., Li, Y ., Wang, K., Zhang, T., Liu, Y ., Wang, H., Zheng, Y ., Liu, Y .: Prompt Injection attack against LLM-integrated Applications. arXiv preprint arXiv:2306.05499 (2023)

    2023 arXiv

  18. [25]

    In: ACM Workshop on Artificial Intelligence and Security, AISec (2023)

    Abdelnabi, S., Greshake, K., Mishra, S., Endres, C., Holz, T., Fritz, M.: Not what you’ve signed up for: Compromising real-world llm-integrated applications with indirect prompt injection. In: ACM Workshop on Artificial Intelligence and Security, AISec (2023)

    2023

  19. [26]

    arXiv preprint arXiv:2312.14197 (2025)

    Yi, J., Xie, Y ., Zhu, B., Kiciman, E., Sun, G., Xie, X., Wu, F.: Benchmarking and Defend- ing Against Indirect Prompt Injection Attacks on Large Language Models. arXiv preprint arXiv:2312.14197 (2025)

    2025 arXiv

  20. [27]

    arXiv preprint arXiv:2403.02691 (2024)

    Zhan, Q., Liang, Z., Ying, Z., Kang, D.: Injeca- gent: Benchmarking indirect prompt injections in tool-integrated large language model agents. arXiv preprint arXiv:2403.02691 (2024)

    2024 arXiv

  21. [28]

    In: Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision (2023)

    Sur ´ıs, D., Menon, S., V ondrick, C.: ViperGPT: Visual Inference via Python Execution for Rea- soning. In: Proceedings of the IEEE/CVF Inter- national Conference on Computer Vision (2023)

    2023

  22. [29]

    In: Advances in Neural Information Processing Systems (2023)

    Pan, L., Baolin, P., Hao, C., Michel, G., Kai-Wei, C., Wu, Y .N., Zhu1, S.-C., Gao2, J.: Chameleon: Plug-and-Play Compositional Reasoning with Large Language Models. In: Advances in Neural Information Processing Systems (2023)

    2023

  23. [30]

    In: Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogni- tion (2023)

    Gupta, T., Kembhavi, A.: Visual Programming: Compositional Visual Reasoning Without Train- ing. In: Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recogni- tion (2023)

    2023

  24. [31]

    arXiv preprint arXiv:2303.04671 (2023)

    Wu, C., Yin, S., Qi, W., Wang, X., Tang, Z., Duan, N.: Visual ChatGPT: Talking, Drawing and Editing with Visual Foundation Models. arXiv preprint arXiv:2303.04671 (2023)

    2023 arXiv

  25. [32]

    arXiv preprint arXiv:2410.24164 (2024)

    Black, K., Brown, N., Driess, D., Esmail, A., Equi, M., Finn, C., Fusai, N., Groom, L., Haus- man, K., Ichter, B., Jakubczak, S., Jones, T., Ke, L., Levine, S., Li-Bell, A., Mothukuri, M., Nair, S., Pertsch, K., Shi, L.X., Tanner, J., Vuong, Q., Walling, A., Wang, H., Zhilin- ...

    2024 arXiv

  26. [33]

    arXiv preprint arxiv:2502.11161 (2025)

    Lan, Z., Mao, W., Li, H., Wang, L., Wang, T., Fan, H., Yoshie, O.: BFA: Best-Feature-Aware Fusion for Multi-View Fine-grained Manipula- tion. arXiv preprint arxiv:2502.11161 (2025)

    2025 arXiv

  27. [34]

    arXiv preprint arXiv:2302.13971 (2023)

    Touvron, H., Lavril, T., Izacard, G., Martinet, X., Lachaux, M.-A., Lacroix, T., Rozi`ere, B., Goyal, N., Hambro, E., Azhar, F., Rodriguez, A., Joulin, A., Grave, E., Lample, G.: LLaMA: Open and Efficient Foundation Language Models. arXiv preprint arXiv:2302.13971 (2023)

    2023 arXiv

  28. [35]

    arXiv preprint arXiv:2408.02882 (2024)

    Liu, A., Zhou, Y ., Liu, X., Zhang, T., Liang, S., Wang, J., Pu, Y ., Li, T., Zhang, J., Zhou, W., Guo, Q., Tao, D.: Compromising Embod- ied Agents with Contextual Backdoor Attacks. arXiv preprint arXiv:2408.02882 (2024)

    2024 arXiv

  29. [36]

    arXiv preprint arXiv:2411.11683 (2025)

    Wang, X., Pan, H., Zhang, H., Li, M., Hu, S., Zhou, Z., Xue, L., Guo, P., Wang, Y ., Wan, W., Liu, A., Zhang, L.Y .: Tro- janRobot: Physical-World Backdoor Attacks Against VLM-based Robotic Manipulation. arXiv preprint arXiv:2411.11683 (2025)

    2025

  30. [37]

    arXiv preprint arXiv:2407.20242 (2025)

    Zhang, H., Zhu, C., Wang, X., Zhou, Z., Yin, C., Li, M., Xue, L., Wang, Y ., Hu, S., Liu, A., Guo, P., Zhang, L.Y .: BadRobot: Jailbreaking Embod- ied LLMs in the Physical World. arXiv preprint arXiv:2407.20242 (2025)

    2025 arXiv

  31. [38]

    arXiv preprint arXiv:2503.10809 (2025)

    Aichberger, L., Paren, A., Gal, Y ., Torr, P., Bibi, A.: Attacking Multimodal OS Agents with Malicious Image Patches. arXiv preprint arXiv:2503.10809 (2025)

    2025

  32. [39]

    In: European Conference on Computer Vision (2020)

    Liu, A., Huang, T., Liu, X., Xu, Y ., Ma, Y ., Chen, X., Maybank, S.J., Tao, D.: Spatiotempo- ral attacks for embodied agents. In: European Conference on Computer Vision (2020)

    2020

  33. [40]

    In: 14 Article Title Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVI 16 (2020)

    Liang, S., Wei, X., Yao, S., Cao, X.: Efficient adversarial attacks for visual object tracking. In: 14 Article Title Computer Vision–ECCV 2020: 16th European Conference, Glasgow, UK, August 23–28, 2020, Proceedings, Part XXVI 16 (2020)

    2020

  34. [41]

    arXiv preprint arXiv:1811.12641 (2018)

    Wei, X., Liang, S., Chen, N., Cao, X.: Transferable adversarial attacks for image and video object detection. arXiv preprint arXiv:1811.12641 (2018)

    2018 arXiv

  35. [42]

    arXiv preprint arXiv:2201.08970 (2022)

    Liang, S., Wu, B., Fan, Y ., Wei, X., Cao, X.: Parallel rectangle flip attack: A query-based black-box attack against object detection. arXiv preprint arXiv:2201.08970 (2022)

    2022 arXiv

  36. [43]

    In: European Conference on Com- puter Vision (2022)

    Liang, S., Li, L., Fan, Y ., Jia, X., Li, J., Wu, B., Cao, X.: A large-scale multiple-objective method for black-box attack against object detection. In: European Conference on Com- puter Vision (2022)

    2022

  37. [44]

    arXiv preprint arXiv:2406.13495 (2024)

    Yan, Z., Yao, T., Chen, S., Zhao, Y ., Fu, X., Zhu, J., Luo, D., Wang, C., Ding, S., Wu, Y ., et al.: Df40: Toward next-generation deepfake detec- tion. arXiv preprint arXiv:2406.13495 (2024)

    2024 arXiv

  38. [45]

    Cybersecurity 6(1) (2023) https:// doi.org/10.1186/s42400-023-00141-4

    Ying, Z., Wu, B.: DLP: towards active defense against backdoor attacks with decoupled learn- ing process. Cybersecurity 6(1) (2023) https:// doi.org/10.1186/s42400-023-00141-4

    2023 doi

  39. [46]

    Cybersecurity 6(1) (2023) https://doi.org/ 10.1186/s42400-023-00154-z

    Ying, Z., Wu, B.: NBA: defensive distillation for backdoor removal via neural behavior align- ment. Cybersecurity 6(1) (2023) https://doi.org/ 10.1186/s42400-023-00154-z

    2023 doi

  40. [47]

    arXiv preprint arXiv:2411.18275 (2024)

    Zhang, T., Wang, L., Zhang, X., Zhang, Y ., Jia, B., Liang, S., Hu, S., Fu, Q., Liu, A., Liu, X.: Visual Adversarial Attack on Vision-Language Models for Autonomous Driving. arXiv preprint arXiv:2411.18275 (2024)

    2024 arXiv

  41. [48]

    Visual Intelligence 2(1), 1–10 (2024)

    Kong, D., Liang, S., Zhu, X., Zhong, Y ., Ren, W.: Patch is enough: naturalistic adversarial patch against vision-language pre-training mod- els. Visual Intelligence 2(1), 1–10 (2024)

    2024

  42. [49]

    arXiv preprint arXiv:2502.11054 (2025)

    Ying, Z., Zhang, D., Jing, Z., Xiao, Y ., Zou, Q., Liu, A., Liang, S., Zhang, X., Liu, X., Tao, D.: Reasoning-augmented conversation for multi- turn jailbreak attacks on large language models. arXiv preprint arXiv:2502.11054 (2025)

    2025 arXiv

  43. [50]

    arXiv preprint arXiv:2311.12075 (2023)

    Liang, S., Zhu, M., Liu, A., Wu, B., Cao, X., Chang, E.-C.: BadClip: Dual-embedding guided backdoor attack on multimodal contrastive learn- ing. arXiv preprint arXiv:2311.12075 (2023)

    2023 arXiv

  44. [51]

    arXiv preprint arXiv:2406.18844 (2024)

    Liang, S., Liang, J., Pang, T., Du, C., Liu, A., Chang, E.-C., Cao, X.: Revisiting Backdoor Attacks against Large Vision-Language Models. arXiv preprint arXiv:2406.18844 (2024)

    2024 arXiv

  45. [52]

    arXiv preprint arXiv:2402.13851 (2024)

    Liang, J., Liang, S., Luo, M., Liu, A., Han, D., Chang, E.-C., Cao, X.: VL-Trojan: Multimodal Instruction Backdoor Attacks against Autore- gressive Visual Language Models. arXiv preprint arXiv:2402.13851 (2024)

    2024 arXiv

  46. [53]

    arXiv preprint arXiv:2406.04031 (2024)

    Ying, Z., Liu, A., Zhang, T., Yu, Z., Liang, S., Liu, X., Tao, D.: Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031 (2024)

    2024 arXiv

  47. [54]

    arXiv preprint arXiv:2406.06302 (2024)

    Ying, Z., Liu, A., Liu, X., Tao, D.: Unveiling the safety of gpt-4o: An empirical study using jail- break attacks. arXiv preprint arXiv:2406.06302 (2024)

    2024 arXiv

  48. [55]

    arXiv preprint arXiv:2503.15092 (2025)

    Ying, Z., Zheng, G., Huang, Y ., Zhang, D., Zhang, W., Zou, Q., Liu, A., Liu, X., Tao, D.: Towards Understanding the Safety Boundaries of DeepSeek Models: Evaluation and Findings. arXiv preprint arXiv:2503.15092 (2025)

    2025 arXiv

  49. [56]

    arXiv preprint arXiv:2501.11815 (2025)

    Jing, Z., Ying, Z., Wang, L., Liang, S., Liu, A., Liu, X., Tao, D.: CogMorph: Cognitive Mor- phing Attacks for Text-to-Image Models. arXiv preprint arXiv:2501.11815 (2025)

    2025 arXiv

  50. [57]

    arXiv preprint arXiv:2411.09523 (2024)

    Gan, Y ., Yang, Y ., Ma, Z., He, P., Zeng, R., Wang, Y ., Li, Q., Zhou, C., Li, S., Wang, T., Gao, Y ., Wu, Y ., Ji, S.: Navigating the Risks: A Survey of Security, Privacy, and Ethics Threats in LLM- Based Agents. arXiv preprint arXiv:2411.09523 (2024)

    2024 arXiv

  51. [58]

    In: USENIX Security Symposium (2024)

    Liu, Y ., Jia, Y ., Geng, R., Jia, J., Gong, N.Z.: Formalizing and Benchmarking Prompt Injec- tion Attacks and Defenses. In: USENIX Security Symposium (2024)

    2024

  52. [59]

    arXiv preprint arXiv:2307.15043 (2023)

    Zou, A., Wang, Z., Carlini, N., Nasr, M., Kolter, J.Z., Fredrikson, M.: Universal and Transferable Article Title 15 Adversarial Attacks on Aligned Language Mod- els. arXiv preprint arXiv:2307.15043 (2023)

    2023 arXiv

  53. [60]

    In: Pro- ceedings of the ACM SIGSAC Conference on Computer and Communications Security (2024)

    Shi, J., Yuan, Z., Liu, Y ., Huang, Y ., Zhou, P., Sun, L., Gong, N.Z.: Optimization-based Prompt Injection Attack to LLM-as-a-Judge. In: Pro- ceedings of the ACM SIGSAC Conference on Computer and Communications Security (2024)

    2024

  54. [61]

    arXiv preprint arXiv:2311.05608 (2025)

    Gong, Y ., Ran, D., Liu, J., Wang, C., Cong, T., Wang, A., Duan, S., Wang, X.: FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts. arXiv preprint arXiv:2311.05608 (2025)

    2025 arXiv

  55. [62]

    arXiv preprint arXiv:2408.03554 (2024)

    Kimura, S., Tanaka, R., Miyawaki, S., Suzuki, J., Sakaguchi, K.: Empirical Analysis of Large Vision-Language Models against Goal Hijack- ing via Visual Prompt Injection. arXiv preprint arXiv:2408.03554 (2024)

    2024 arXiv

  56. [64]

    In: Advances in Neural Information Processing Systems (2020)

    Lewis, P., Perez, E., Piktus, A., Petroni, F., Karpukhin, V ., Goyal, N., K ¨uttler, H., Lewis, M., Yih, W.-t., Rockt ¨aschel, T., Riedel, S., Kiela, D.: Retrieval-Augmented Generation for Knowledge-Intensive NLP Tasks. In: Advances in Neural Information Processing Systems (2020)

    2020

  57. [65]

    https://docs.anthropic.com/en/docs/ build-with-claude/pdf-support

    Antropic: BUILD WITH CLAUDE: PDF Support. https://docs.anthropic.com/en/docs/ build-with-claude/pdf-support

  58. [66]

    arXiv preprint arXiv:2406.09246 (2024)

    Wallace, E., Xiao, K., Leike, R., Weng, L., Hei- decke, J., Beutel, A.: The Instruction Hierarchy: Training LLMs to Prioritize Privileged Instruc- tions. arXiv preprint arXiv:2406.09246 (2024)

    2024 arXiv

  59. [67]

    https://chatgpt.com

    OpenAI: ChatGPT. https://chatgpt.com

  60. [68]

    https://x.ai

    xAI: Grok. https://x.ai

  61. [69]

    In: Proceed- ings of the IEEE/CVF International Conference on Computer Vision and Pattern Recognition (2024)

    Cui, X., Aparcedo, A., Jang, Y .K., Lim, S.- N.: On the Robustness of Large Multimodal Models Against Image Adversarial. In: Proceed- ings of the IEEE/CVF International Conference on Computer Vision and Pattern Recognition (2024)

    2024

  62. [70]

    In: Advances in Neural Information Processing Systems (2022)

    Liang, V .W., Zhang, Y ., Kwon, Y ., Yeung, S., Zou, J.Y .: Mind the Gap: Understanding the Modality Gap in Multi-modal Contrastive Rep- resentation Learning. In: Advances in Neural Information Processing Systems (2022)

    2022

  63. [71]

    In: Advances in Neural Information Process- ing Systems (2023)

    Zhao, Y ., Pang, T., Du, C., Yang, X., LI, C., Che- ung, N.-M.M., Lin, M.: On Evaluating Adversar- ial Robustness of Large Vision-Language Mod- els. In: Advances in Neural Information Process- ing Systems (2023)

    2023

  64. [72]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision (2022)

    Rombach, R., Blattmann, A., Lorenz, D., Esser, P., , Ommer, B.: Highresolution image synthe- sis with latent diffusion models. In: Proceedings of the IEEE/CVF International Conference on Computer Vision (2022)

    2022

  65. [73]

    In: International Conference on Machine Learning (2021)

    Radford, A., Kim, J.W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., Krueger, G., Sutskever, I.: Learning Transferable Visual Models From Natural Language Supervision. In: International Conference on Machine Learning (2021)

    2021

  66. [74]

    In: International Conference on Com- puter Vision (2023)

    Zhai, X., Mustafa, B., Kolesnikov, A., Beyer, L.: Sigmoid Loss for Language Image Pre- Training. In: International Conference on Com- puter Vision (2023)

    2023

  67. [75]

    In: International Con- ference on Learning Representations (2024)

    Chen, H., Zhang, Y ., Dong, Y ., Yang, X., Su, H., Zhu, J.: Rethinking model ensemble in transfer- based adversarial attacks. In: International Con- ference on Learning Representations (2024)

    2024

  68. [76]

    Zhang, K., Tao, K., Tang, J., Wang, H.: Poi- son as cure: Visual noise for mitigating object hallucinations in lvms. (2025)

    2025

  69. [77]

    arXiv preprint arXiv:2303.08774 (2023)

    OpenAI: GPT-4 Technical Report. arXiv preprint arXiv:2303.08774 (2023)

    2023 arXiv

  70. [78]

    arXiv preprint arXiv:2311.11482 (2025)

    Zhang, Y ., Yuan, Y ., Yao, A.C.-C.: Meta Prompting for AI Systems. arXiv preprint arXiv:2311.11482 (2025)

    2025 arXiv

  71. [79]

    arXiv preprint arXiv:2409.12191 (2024)

    Wang, P., Bai, S., Tan, S., Wang, S., Fan, Z., Bai, J., Chen, K., Liu, X., Wang, J., Ge, W., Fan, Y ., Dang, K., Du, M., Ren, X., Men, R., Liu, D., Zhou, C., Zhou, J., Lin, J.: Qwen2-VL: 16 Article Title Enhancing Vision-Language Model’s Perception of the World at Any Resoluti...

    2024 arXiv

  72. [80]

    https://qwenlm.github.io/blog/ qwen2-vl/

    Qwen Team: Qwen2-VL: To See the World More Clearly. https://qwenlm.github.io/blog/ qwen2-vl/

  73. [81]

    arXiv preprint arXiv:2410.18927 (2024)

    Ying, Z., Liu, A., Liang, S., Huang, L., Guo, J., Zhou, W., Liu, X., Tao, D.: SafeBench: A Safety Evaluation Framework for Multi- modal Large Language Models. arXiv preprint arXiv:2410.18927 (2024)

    2024 arXiv

  74. [82]

    arXiv preprint arXiv:2305.09857 (2023)

    Raheja, V ., Kumar, D., Koo, R., Kang, D.: CoEDIT: Text Editing by Task-Specific Instruc- tion Tuning. arXiv preprint arXiv:2305.09857 (2023)

    2023 arXiv

  75. [83]

    In: Conference on Empirical Methods in Natural Language Pro- cessing (2013)

    Socher, R., Perelygin, A., Wu, J., Chuang, J., Manning, C.D., Ng, A., Potts, C.: Recursive Deep Models for Semantic Compositionality Over a Sentiment Treebank. In: Conference on Empirical Methods in Natural Language Pro- cessing (2013)

    2013

  76. [84]

    arXiv preprint arXiv:1909.09436 (2020)

    Husain, H., Wu, H.-H., Gazit, T., Allamanis, M., Brockschmidt, M.: CodeSearchNet Challenge: Evaluating the State of Semantic Code Search. arXiv preprint arXiv:1909.09436 (2020)

    2020 arXiv

  77. [85]

    https://www.w3.org/TR/2011/ WD-html5-20110405/

    W3C: HTML5. https://www.w3.org/TR/2011/ WD-html5-20110405/

    2011

  78. [86]

    arXiv preprint arXiv:2412.05579 (2024)

    Li, H., Dong, Q., Chen, J., Su, H., Zhou, Y ., Ai, Q., Ye, Z., Liu, Y .: LLMs-as-Judges: A Comprehensive Survey on LLM-based Evalua- tion Methods. arXiv preprint arXiv:2412.05579 (2024)

    2024 arXiv

  79. [87]

    arXiv preprint arXiv:1902.06705 (2019)

    Carlini, N., Athalye, A., Papernot, N., Bren- del, W., Rauber, J., Tsipras, D., Goodfel- low, I., Madry, A., Kurakin, A.: On Evalu- ating Adversarial Robustness. arXiv preprint arXiv:1902.06705 (2019)

    2019 arXiv

  80. [88]

    arXiv preprint arXiv:2412.15115 (2024)

    Qwen Team: Qwen2.5 technical report. arXiv preprint arXiv:2412.15115 (2024)

    2024 arXiv

  81. [89]

    https://lmsys.org/blog/ 2023-03-30-vicuna/

    The Vicuna Team: Vicuna: An Open- Source Chatbot Impressing GPT-4 with 90% ChatGPT Quality. https://lmsys.org/blog/ 2023-03-30-vicuna/

    2023

  82. [90]

    https://mistral.ai/ news/announcing-mistral-7b

    Mistral AI team: Mistral 7B. https://mistral.ai/ news/announcing-mistral-7b

  83. [91]

    In: International Con- ference on Learning Representations (2017)

    Shazeer, N., Mirhoseini, A., Maziarz, K., Davis, A., Le, Q., Hinton, G., Dean, J.: Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layer. In: International Con- ference on Learning Representations (2017)

    2017

  84. [92]

    https://global

    Robotics, A.: AgileX Robotics. https://global. agilex.ai/pages/limo

  85. [93]

    In: Proceedings of the AAAI Conference on Artificial Intelligence (2019)

    Liu, A., Liu, X., Fan, J., Ma, Y ., Zhang, A., Xie, H., Tao, D.: Perceptual-sensitive gan for gen- erating adversarial patches. In: Proceedings of the AAAI Conference on Artificial Intelligence (2019)

    2019

  86. [94]

    https: //learnprompting.org/docs/prompt hacking/ defensive measures/sandwich defense

    Schulhoff, S.: Sandwitch Defense. https: //learnprompting.org/docs/prompt hacking/ defensive measures/sandwich defense

  87. [95]

    arXiv preprint arXiv:2312.10766 (2025)

    Zhang, X., Zhang, C., Li, T., Huang, Y ., Jia, X., Hu, M., Zhang, J., Liu, Y ., Ma, S., Shen, C.: JailGuard: A Universal Detection Framework for LLM Prompt-based Attacks. arXiv preprint arXiv:2312.10766 (2025)

    2025 arXiv

  88. [96]

    International Jour- nal of Computer Vision (2023)

    Liu, A., Tang, S., Chen, X., Huang, L., Qin, H., Liu, X., Tao, D.: Towards Defending Multiple Lp-norm Bounded Adversarial Perturbations via Gated Batch Normalization. International Jour- nal of Computer Vision (2023)

    2023

  89. [97]

    IEEE Transactions on Image Processing (2021)

    Zhang, C., Liu, A., Liu, X., Xu, Y ., Yu, H., Ma, Y ., Li, T.: Interpreting and Improving Adversar- ial Robustness of Deep Neural Networks with Neuron Sensitivity. IEEE Transactions on Image Processing (2021)

    2021

  90. [98]

    TIP (2021)

    Liu, A., Liu, X., Yu, H., Zhang, C., Liu, Q., Tao, D.: Training robust deep neural networks via adversarial noise propagation. TIP (2021)

    2021

Pith tools

Reviewed August 16, 2026 · model on record in the stance chip above.