{"record_type":"pith_number_record","schema_url":"https://pith.science/schemas/pith-number/v1.json","pith_number":"pith:2025:YLGS4XJAXQHHDG46UEMFLBWGD5","short_pith_number":"pith:YLGS4XJA","schema_version":"1.0","canonical_sha256":"c2cd2e5d20bc0e719b9ea1185586c61f5bab74ad05db3a1b50a828eef3a8effd","source":{"kind":"arxiv","id":"2505.01050","version":1},"attestation_state":"computed","paper":{"title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CV","authors_text":"Alexander Robey, Andy Zou, Chengming Xu, Haoqi Hu, Kai Hu, Li Zhang, Matt Fredrikson, Weichen Yu","submitted_at":"2025-05-02T06:51:11Z","abstract_excerpt":"Vision Large Language Models (VLLMs) are increasingly deployed to offer advanced capabilities on inputs comprising both text and images. While prior research has shown that adversarial attacks can transfer from open-source to proprietary black-box models in text-only and vision-only contexts, the extent and effectiveness of such vulnerabilities remain underexplored for VLLMs. We present a comprehensive analysis demonstrating that targeted adversarial examples are highly transferable to widely-used proprietary VLLMs such as GPT-4o, Claude, and Gemini. We show that attackers can craft perturbati"},"verification_status":{"content_addressed":true,"pith_receipt":true,"author_attested":false,"weak_author_claims":0,"strong_author_claims":0,"externally_anchored":false,"storage_verified":false,"citation_signatures":0,"replication_records":0,"graph_snapshot":true,"references_resolved":false,"formal_links_present":false},"canonical_record":{"source":{"id":"2505.01050","kind":"arxiv","version":1},"metadata":{"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CV","submitted_at":"2025-05-02T06:51:11Z","cross_cats_sorted":["cs.LG"],"title_canon_sha256":"bd8f2fad95f3750d840f881c32a320dfa6de74658661a3f317d143ca32bbca07","abstract_canon_sha256":"1e995e4314068cf9b48af98aef89ac8b2d462a4dd34442c5bf066bcd158ec0b9"},"schema_version":"1.0"},"receipt":{"kind":"pith_receipt","key_id":"pith-v1-2026-05","algorithm":"ed25519","signed_at":"2026-07-05T10:57:44.207742Z","signature_b64":"SMujT7RL0WPrjfegbqghA+6aLUlBcm4jPNbTAl6hvUfS8FTdilcd89J+sqpIU55XbDPbjcz6HU6LgjfeeSbcAg==","signed_message":"canonical_sha256_bytes","builder_version":"pith-number-builder-2026-05-17-v1","receipt_version":"0.3","canonical_sha256":"c2cd2e5d20bc0e719b9ea1185586c61f5bab74ad05db3a1b50a828eef3a8effd","last_reissued_at":"2026-07-05T10:57:44.207067Z","signature_status":"signed_v1","first_computed_at":"2026-07-05T10:57:44.207067Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54"},"graph_snapshot":{"paper":{"title":"Transferable Adversarial Attacks on Black-Box Vision-Language Models","license":"http://creativecommons.org/licenses/by/4.0/","headline":"","cross_cats":["cs.LG"],"primary_cat":"cs.CV","authors_text":"Alexander Robey, Andy Zou, Chengming Xu, Haoqi Hu, Kai Hu, Li Zhang, Matt Fredrikson, Weichen Yu","submitted_at":"2025-05-02T06:51:11Z","abstract_excerpt":"Vision Large Language Models (VLLMs) are increasingly deployed to offer advanced capabilities on inputs comprising both text and images. While prior research has shown that adversarial attacks can transfer from open-source to proprietary black-box models in text-only and vision-only contexts, the extent and effectiveness of such vulnerabilities remain underexplored for VLLMs. We present a comprehensive analysis demonstrating that targeted adversarial examples are highly transferable to widely-used proprietary VLLMs such as GPT-4o, Claude, and Gemini. We show that attackers can craft perturbati"},"claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2505.01050","kind":"arxiv","version":1},"verdict":{"id":null,"model_set":{},"created_at":null,"strongest_claim":"","one_line_summary":"","pipeline_version":null,"weakest_assumption":"","pith_extraction_headline":""},"integrity":{"clean":true,"summary":{"advisory":0,"critical":0,"by_detector":{},"informational":0},"endpoint":"/pith/2505.01050/integrity.json","findings":[],"available":true,"detectors_run":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938"},"references":{"count":0,"sample":[],"resolved_work":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","internal_anchors":0},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"author_claims":{"count":0,"strong_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"builder_version":"pith-number-builder-2026-05-17-v1"},"aliases":[{"alias_kind":"arxiv","alias_value":"2505.01050","created_at":"2026-07-05T10:57:44.207153+00:00"},{"alias_kind":"arxiv_version","alias_value":"2505.01050v1","created_at":"2026-07-05T10:57:44.207153+00:00"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2505.01050","created_at":"2026-07-05T10:57:44.207153+00:00"},{"alias_kind":"pith_short_12","alias_value":"YLGS4XJAXQHH","created_at":"2026-07-05T10:57:44.207153+00:00"},{"alias_kind":"pith_short_16","alias_value":"YLGS4XJAXQHHDG46","created_at":"2026-07-05T10:57:44.207153+00:00"},{"alias_kind":"pith_short_8","alias_value":"YLGS4XJA","created_at":"2026-07-05T10:57:44.207153+00:00"}],"events":[],"event_summary":{},"paper_claims":[],"inbound_citations":{"count":6,"internal_anchor_count":0,"sample":[{"citing_arxiv_id":"2606.18710","citing_title":"Image Prompt Reconstruction Attacks on Distributed MLLM Inference Frameworks","ref_index":57,"is_internal_anchor":false},{"citing_arxiv_id":"2607.00174","citing_title":"Steal the Patch Size: Adversarially Manipulate Vision-Language Models","ref_index":28,"is_internal_anchor":false},{"citing_arxiv_id":"2605.21541","citing_title":"Frequency-Domain Regularized Adversarial Alignment for Transferable Attacks against Closed-Source MLLMs","ref_index":18,"is_internal_anchor":false},{"citing_arxiv_id":"2512.21815","citing_title":"High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models","ref_index":12,"is_internal_anchor":false},{"citing_arxiv_id":"2601.23179","citing_title":"Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimization","ref_index":4,"is_internal_anchor":false},{"citing_arxiv_id":"2605.04261","citing_title":"Laundering AI Authority with Adversarial Examples","ref_index":28,"is_internal_anchor":false}]},"formal_canon":{"evidence_count":0,"sample":[],"anchors":[]},"links":{"html":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5","json":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5.json","graph_json":"https://pith.science/api/pith-number/YLGS4XJAXQHHDG46UEMFLBWGD5/graph.json","events_json":"https://pith.science/api/pith-number/YLGS4XJAXQHHDG46UEMFLBWGD5/events.json","paper":"https://pith.science/paper/YLGS4XJA"},"agent_actions":{"view_html":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5","download_json":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5.json","view_paper":"https://pith.science/paper/YLGS4XJA","resolve_alias":"https://pith.science/api/pith-number/resolve?arxiv=2505.01050&json=true","fetch_graph":"https://pith.science/api/pith-number/YLGS4XJAXQHHDG46UEMFLBWGD5/graph.json","fetch_events":"https://pith.science/api/pith-number/YLGS4XJAXQHHDG46UEMFLBWGD5/events.json","actions":{"anchor_timestamp":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5/action/timestamp_anchor","attest_storage":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5/action/storage_attestation","attest_author":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5/action/author_attestation","sign_citation":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5/action/citation_signature","submit_replication":"https://pith.science/pith/YLGS4XJAXQHHDG46UEMFLBWGD5/action/replication_record"}},"created_at":"2026-07-05T10:57:44.207153+00:00","updated_at":"2026-07-05T10:57:44.207153+00:00"}