VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models

• URL: http://arxiv.org/abs/2605.01449v1
• Date: Sat, 02 May 2026 13:56:50 GMT
• Title: VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models
• Abstract summary: Universal adversarial attacks are increasingly reported with attack success rates in 60-80% range.<n>We argue that this number conflates two distinct events: (i) the model's output was perturbed (Influence), and (ii) the attacker's chosen target concept was actually emitted (Precise Injection)<n>We release full dataset -- 21 universal images, 147 adversarial photos, 6,615 response pairs, v3 dual-axis judge results, and the cache at huggingface.co/datasets/jeffliulab/visinject.
• Score: 15.373620817510727
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Universal adversarial attacks on aligned multimodal large language models are increasingly reported with attack success rates in the 60-80% range, suggesting the visual modality is highly vulnerable to imperceptible perturbations as a prompt-injection channel. We argue that this number conflates two distinct events: (i) the model's output was perturbed (Influence), and (ii) the attacker's chosen target concept was actually emitted (Precise Injection). We compose two existing techniques -- Universal Adversarial Attack and AnyAttack -- under an $L_{inf}$ budget of 16/255, and we add a dual-axis evaluation: a deterministic Ratcliff-Obershelp drift score for Influence (programmatic baseline) plus a 4-tier ordinal categorical none/weak/partial/confirmed for Precise Injection. The judge is DeepSeek-V4-Pro in thinking mode, calibrated against Claude Opus 4.7 with Cohen's $κ$ = 0.77 on the injection axis (substantial agreement); the entire 4475-entry SHA-256 input cache ships with the dataset so reviewers can re-derive paper numbers bit-exact without an API key. Across 6615 pairs over four open VLMs, seven attack prompts, and seven test images, the two axes diverge by roughly 90$\times$: 66.4% of pairs are programmatically disturbed (LLM-judged 46.6% at the substantial-or-complete tier), but only 0.756% (50/6615) reach any non-none injection tier and only 0.030% (2/6615) verbatim. The few injections that do land cluster on screenshot- or document-style carriers whose semantics already invite text transcription. BLIP-2 shows \emph{zero detectable drift} at $L_{inf}$ = 16/255 across all 2205 pairs even when used as a Stage-1 surrogate. We release the full dataset -- 21 universal images, 147 adversarial photos, 6,615 response pairs, the v3 dual-axis judge results, and the cache at huggingface.co/datasets/jeffliulab/visinject.

Related papers

• Repeat-After-Me: Black-Box Adaptive Visual Prompt Injection [40.37588773528427]
  We present Repeat-After-Me, a black-box adaptive visual prompt injection attack that can reveal personally identifiable information or make malicious tool calls.<n>In our evaluation, injections optimized on one surrogate retain 43-46% of the original ASR on two commercial victims.<n>In a default OpenClaw Discord deployment, an untrusted user can use a minimally injected image to overwrite TOOLS.md, enabling future sensitive behaviors like remote code execution and secret exfiltration.
  arXiv  Detail & Related papers  (2026-09-03T22:44:45Z)
• A Failure-Mode Benchmark for Polymorphic Sybil Poisoning in RAG [4.879573049082894]
  We release a benchmark and failure-mode-aware evaluation framework for grounded QA under coordinated retrieval poisoning.<n>The framework partitions reader outputs into four mutually exclusive categories (emphgold, emphhijack, emphabstention, emphdrift)<n>We introduce emphpolymorphic sybil poisoning, a coordinated attack class in which $S$ lexically diverse passages jointly support an attacker-chosen target.
  arXiv  Detail & Related papers  (2026-07-04T06:56:06Z)
• When Do LLM Agents Treat Surface Noise Differently from Semantic Noise? A 68-Cell Measurement Study with a Held-Out Trace-Level Validation [9.055086193088083]
  We document an empirical phenomenon in chain-of-thought and ReAct agents driven by ten large language models.<n>Mean-bearing perturbations alter final answers more often than presentation perturbations of comparable severity.
  arXiv  Detail & Related papers  (2026-05-25T15:57:11Z)
• MOSAIC-Bench: Measuring Compositional Vulnerability Induction in Coding Agents [2.1942030377331245]
  Coding agents often pass per-prompt safety review yet ship exploitable code when their tasks are decomposed into routine engineering tickets.<n>We introduce MOSAIC-Bench, a benchmark of 199 three-stage attack chains paired with deterministic exploit oracles on deployed software substrates.<n>We show that nine production coding agents compose innocuous tickets at 53-86% end-to-end ASR with only two refusals across all staged runs.
  arXiv  Detail & Related papers  (2026-05-05T16:38:23Z)
• One Perturbation, Two Failure Modes: Probing VLM Safety via Embedding-Guided Typographic Perturbations [0.8116687935773981]
  Typographic prompt injection exploits vision language models' (VLMs) ability to read text rendered in images.<n>We show how to maximize image text embedding similarity under bounded $ell_infty$ perturbations.<n>Experiments on GPT-4o, Claude Sonnet 4.5, Mistral-Large-3, and Qwen3-VL confirm that optimization recovers readability and reduces safety aligned refusals.
  arXiv  Detail & Related papers  (2026-04-28T01:21:47Z)
• Beyond Pattern Matching: Seven Cross-Domain Techniques for Prompt Injection Detection [0.0]
  This work proposes seven detection techniques that each port a specific mechanism from a discipline outside large-language--model security.<n>Three of the seven techniques are implemented in the prompt-shield v0.4.1 release (Apache 2.0) and evaluated in a four-configuration ablation across six datasets.
  arXiv  Detail & Related papers  (2026-04-20T13:27:05Z)
• VeriX-Anon: A Multi-Layered Framework for Mathematically Verifiable Outsourced Target-Driven Data Anonymization [0.0]
  VeriX-Anon is a multi-layered verification framework for outsourced Target-Driven k-anonymization.<n>It combines deterministic verification via Merkle-style hashing of an Authenticated Decision Tree, probabilistic verification via Boundary Sentinels near the Random Forest decision boundary and exact-duplicate Twins with cryptographic identifiers.<n>It correctly detected deviations in 11 of 12 scenarios.
  arXiv  Detail & Related papers  (2026-04-14T08:22:18Z)
• Re-Mask and Redirect: Exploiting Denoising Irreversibility in Diffusion Language Models [0.0]
  Safety alignment in diffusion language models (dLLMs) relies on a single load-bearing assumption: committed tokens are permanent.<n>We show that by re-masking committed refusal tokens and injecting a short affirmative prefix, achieves 74-82% ASR on HarmBench.<n>We call this attack TrajHijack; it is the first trajectory-level attack on dLLMs, requires no computation, and generalizes across SFT and preference-optimized (VRPO) models.
  arXiv  Detail & Related papers  (2026-03-17T02:24:37Z)
• How Vulnerable Are AI Agents to Indirect Prompt Injections? Insights from a Large-Scale Public Competition [48.32744727426218]
  LLM based agents are increasingly deployed in high stakes settings where they process external data sources such as emails, documents, and code repositories.<n>This creates exposure to indirect prompt injection attacks, where adversarial instructions embedded in external content manipulate agent behavior without user awareness.<n>We present findings from a large scale public red teaming competition evaluating this dual objective across three agent settings.
  arXiv  Detail & Related papers  (2026-03-16T14:49:36Z)
• VisualLeakBench: Auditing the Fragility of Large Vision-Language Models against PII Leakage and Social Engineering [14.756677328512907]
  VisualLeakBench is an evaluation suite to audit LVLMs against OCR Injection and Contextual PII Leakage.<n>We use 1,000 synthetically generated adversarial images with 8 PII types, validated on 50 in-the-wild (IRL) real-world screenshots.<n>We release our dataset and code for reproducible robustness and safety evaluation of deployment-relevant vision-language systems.
  arXiv  Detail & Related papers  (2026-03-11T05:47:24Z)
• Peekaboo, I See Your Queries: Passive Attacks Against DSSE Via Intermittent Observations [43.35160637778568]
  DSSE allows secure searches over a dynamic encrypted database but suffers from inherent information leakage.<n>We propose Peekaboo - a new universal attack framework - and the core design relies on inferring the search pattern.<n>Our design achieves >0.9 adjusted rand index for search pattern recovery and 90% query accuracy vs. FMA's 30%.
  arXiv  Detail & Related papers  (2025-09-04T01:47:22Z)
• AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuning [93.77763753231338]
  Adversarial Contrastive Prompt Tuning (ACPT) is proposed to fine-tune the CLIP image encoder to extract similar embeddings for any two intermediate adversarial queries. We show that ACPT can detect 7 state-of-the-art query-based attacks with $>99%$ detection rate within 5 shots. We also show that ACPT is robust to 3 types of adaptive attacks.
  arXiv  Detail & Related papers  (2024-08-04T09:53:50Z)
• T2IShield: Defending Against Backdoors on Text-to-Image Diffusion Models [70.03122709795122]
  We propose a comprehensive defense method named T2IShield to detect, localize, and mitigate backdoor attacks. We find the "Assimilation Phenomenon" on the cross-attention maps caused by the backdoor trigger. For backdoor sample detection, T2IShield achieves a detection F1 score of 88.9$%$ with low computational cost.
  arXiv  Detail & Related papers  (2024-07-05T01:53:21Z)
• WR-ONE2SET: Towards Well-Calibrated Keyphrase Generation [57.11538133231843]
  Keyphrase generation aims to automatically generate short phrases summarizing an input document. The recently emerged ONE2SET paradigm generates keyphrases as a set and has achieved competitive performance. We propose WR-ONE2SET which extends ONE2SET with an adaptive instance-level cost Weighting strategy and a target Re-assignment mechanism.
  arXiv  Detail & Related papers  (2022-11-13T09:56:24Z)
• Sample Efficient Detection and Classification of Adversarial Attacks via Self-Supervised Embeddings [40.332149464256496]
  Adrial robustness of deep models is pivotal in ensuring safe deployment in real world settings. We propose a self-supervised method to detect adversarial attacks and classify them to their respective threat models. We use a SimCLR encoder in our experiments, since we show the SimCLR embedding distance is a good proxy for human perceptibility.
  arXiv  Detail & Related papers  (2021-08-30T16:39:52Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)
• Uncovering the Limits of Adversarial Training against Norm-Bounded Adversarial Examples [47.27255244183513]
  We study the effect of different training losses, model sizes, activation functions, the addition of unlabeled data (through pseudo-labeling) and other factors on adversarial robustness. We discover that it is possible to train robust models that go well beyond state-of-the-art results by combining larger models, Swish/SiLU activations and model weight averaging.
  arXiv  Detail & Related papers  (2020-10-07T18:19:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.