Attention Hijacking: Response Manipulation Across Queries in Vision-Language Models

• URL: http://arxiv.org/abs/2605.17310v1
• Date: Sun, 17 May 2026 08:02:27 GMT
• Title: Attention Hijacking: Response Manipulation Across Queries in Vision-Language Models
• Abstract summary: Motivated by the observation, we propose textbfAttention Hijacking, a novel adversarial attack that steers internal attention toward a persistent image-dominant pattern.<n>Our method reduces the dependence of the manipulated output on the specific wording of the query.
• Score: 57.870323273127234
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Existing adversarial attacks on vision-language models (VLMs) can steer model outputs toward attacker-specified target responses, but their effectiveness often degrades when the same perturbed input is paired with different textual queries. This paper studies cross-query response manipulation, where a single adversarial example is expected to remain effective across diverse user queries. We first analyze the limitations of existing attacks and find that successful transfer is closely associated with preserving an image-dominant attention pattern during response generation. Motivated by the observation, we propose \textbf{Attention Hijacking}, a novel adversarial attack that explicitly steers internal attention distributions toward a persistent image-dominant pattern. By amplifying the influence of visual tokens on target response tokens while suppressing the competing influence of textual tokens, our method reduces the dependence of the manipulated output on the specific wording of the query. Extensive experiments on widely used VLMs show that Attention Hijacking substantially improves cross-query transferability across diverse target responses and unseen queries. The method also extends effectively to multiple attack scenarios, offering new insights into the role of attention stability in transferable response manipulation for VLMs.

Related papers

• Risk-aware Selective Prompting for Hallucination Mitigation in Large Vision-Language Models [0.6925738064847174]
  We study verification prompting in large vision-language models (LVLMs)<n>We find that it is a risk-bearing intervention: its corrections increase with input difficulty, while newly introduced errors persist across difficulty levels.<n>We propose Risk-aware Selective Prompting (RSP), a training-free approach that uses pre-generation uncertainty signals to trigger verification selectively.
  arXiv  Detail & Related papers  (2026-05-27T08:14:59Z)
• Test-Time Attention Purification for Backdoored Large Vision Language Models [23.890959327899925]
  We provide a new mechanistic understanding of backdoor behaviors in large vision-language models (LVLMs)<n>We propose CleanSight, a training-free, plug-and-play defense that operates purely at test time.<n>CleanSight significantly outperforms existing pixel-based purification defenses across diverse datasets and backdoor attack types.
  arXiv  Detail & Related papers  (2026-03-13T13:45:06Z)
• Towards Highly Transferable Vision-Language Attack via Semantic-Augmented Dynamic Contrastive Interaction [67.45032003041399]
  We propose a Semantic-Augmented Dynamic Contrastive Attack (SADCA) that enhances adversarial transferability through progressive and semantically guided perturbations.<n>SADCA establishes a contrastive learning mechanism involving adversarial, positive and negative samples, to reinforce the semantic inconsistency of the obtained perturbations.<n>Experiments on multiple datasets and models demonstrate that SADCA significantly improves adversarial transferability and consistently surpasses state-of-the-art methods.
  arXiv  Detail & Related papers  (2026-03-05T05:46:16Z)
• TokenSwap: Backdoor Attack on the Compositional Understanding of Large Vision-Language Models [57.32952956674526]
  We introduce TokenSwap, a more evasive and stealthy backdoor attack on large vision-language models (LVLMs)<n>Instead of enforcing a fixed targeted content, TokenSwap subtly disrupts the understanding of object relationships in text.<n> TokenSwap achieves high attack success rates while maintaining superior evasiveness and stealthiness.
  arXiv  Detail & Related papers  (2025-09-29T10:19:22Z)
• Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models [0.0]
  Large Vision-Language Models (VLMs) have revolutionized computer vision, enabling tasks such as image classification, captioning, and visual question answering.<n>They remain highly vulnerable to adversarial attacks, particularly in scenarios where both visual and textual modalities can be manipulated.<n>We conduct a comprehensive study of "An Image is Worth 1000 Lies: Adversarial Transferability Across Prompts on Vision-Language Models"
  arXiv  Detail & Related papers  (2025-06-28T19:01:41Z)
• Misaligned Roles, Misplaced Images: Structural Input Perturbations Expose Multimodal Alignment Blind Spots [6.302734977940601]
  We introduce Role-Modality Attacks (RMA), a class of adversarial attacks that exploit role confusion between the user and assistant.<n>RMAs manipulate the input structure without altering the query itself.<n>We propose an adversarial training approach that makes the model robust against input prompt perturbations.
  arXiv  Detail & Related papers  (2025-04-01T03:54:36Z)
• Attention Reallocation: Towards Zero-cost and Controllable Hallucination Mitigation of MLLMs [62.9348974370985]
  We propose attention reallocation (AttnReal) to mitigate hallucinations with nearly zero extra cost.<n>Our approach is motivated by the key observations that, MLLM's unreasonable attention distribution causes features to be dominated by historical output tokens.<n>Based on the observations, AttnReal recycles excessive attention from output tokens and reallocates it to visual tokens, which reduces MLLM's reliance on language priors.
  arXiv  Detail & Related papers  (2025-03-11T11:52:37Z)
• Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks [34.40254709148148]
  Pre-trained vision-language models (VLMs) have showcased remarkable performance in image and natural language understanding. Their potential safety and robustness issues raise concerns that adversaries may evade the system and cause these models to generate toxic content through malicious attacks. We present Chain of Attack (CoA), which iteratively enhances the generation of adversarial examples based on the multi-modal semantic update.
  arXiv  Detail & Related papers  (2024-11-24T05:28:07Z)
• Towards Robust Semantic Segmentation against Patch-based Attack via Attention Refinement [68.31147013783387]
  We observe that the attention mechanism is vulnerable to patch-based adversarial attacks. In this paper, we propose a Robust Attention Mechanism (RAM) to improve the robustness of the semantic segmentation model.
  arXiv  Detail & Related papers  (2024-01-03T13:58:35Z)
• SA-Attack: Improving Adversarial Transferability of Vision-Language Pre-training Models via Self-Augmentation [56.622250514119294]
  In contrast to white-box adversarial attacks, transfer attacks are more reflective of real-world scenarios. We propose a self-augment-based transfer attack method, termed SA-Attack.
  arXiv  Detail & Related papers  (2023-12-08T09:08:50Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.