Vision Vulnerabilities

Video-based Large Language Models (Video-LLMs) are vulnerable to a universal Energy-Latency Attack (ELA) that triggers a Denial-of-Service (DoS) via spatially concentrated adversarial patches. Because video architectures rely on temporal subsampling and pooling which act as a low-pass filter against full-frame diffuse noise, an attacker can bypass this compression by anchoring cross-modal attention to a dense, localized visual anomaly. By injecting a fixed, content-agnostic patch into the…

A "Visual Confused Deputy" vulnerability exists in Computer-Using Agents (CUAs) that rely on visual perception to execute coordinate-based GUI actions (e.g., click(x,y)). Because the agent's understanding of the system state is entirely dependent on the screenshot provided by the runtime, a compromised runtime or tool can intercept and alter the screenshot pixels before forwarding them to the LLM. By visually swapping the locations of benign and privileged UI elements, an attacker can trick…

Frontier Multimodal Large Language Models (MLLMs) are vulnerable to Visual Exclusivity (VE) attacks, an "Image-as-Basis" threat where malicious intent is achieved through joint reasoning over benign text and complex technical visual content (e.g., blueprints, schematics, network diagrams). Unlike wrapper-based attacks that conceal malicious text via typography or adversarial noise, VE exploits the model's core visual reasoning capabilities. Attackers can bypass safety filters by combining…

A vulnerability in Vision-Language Models (VLMs) relying on shared visual-textual representation spaces allows attackers to induce transferable cross-task semantic failures using an X-shaped Sparse Pixel Attack (XSPA). Attackers craft imperceptible adversarial perturbations restricted to a fixed geometric prior—two intersecting diagonal lines comprising approximately 1.76% of the image pixels. By jointly optimizing a classification objective with cross-task semantic guidance (target-semantic…

Large Language Model (LLM) based web agents (such as those built using the BrowserUse scaffold) are vulnerable to Indirect Prompt Injection (IPI) attacks when autonomously navigating and processing untrusted web content. Unlike standard Cross-Site Scripting (XSS), this vulnerability occurs when the LLM orchestrator consumes the DOM or visual screenshots of a webpage containing concealed or contextually disguised adversarial instructions. The LLM interprets these embedded text strings as…

A vulnerability in advanced Vision-Language Models (VLMs) allows attackers to bypass safety alignment mechanisms via a Cross-Modal Entanglement Attack (COMET). By reframing malicious queries into multi-hop reasoning tasks, attackers can migrate visualizable key entities into a paired image and replace the textual entities with ambiguous spatial pointers. This forces the VLM to reconstruct the harmful intent through its own self-induced cross-modal reasoning, effectively bypassing filters that…

Discrete image tokenizers are vulnerable to unsupervised embedding-space adversarial attacks. Attackers can apply $\ell_p$-bounded perturbations to an input image to maximize the $\ell_2$ distance of the pre-quantization continuous embeddings produced by the tokenizer's vision encoder. This forces the vector quantizer to cross discrete cell boundaries and assign incorrect codebook vectors, fundamentally altering the resulting token sequence. Because the attack targets the pre-quantization…

Reinforcement learning (RL) based post-training for explicit chain-of-thought reasoning (e.g., GRPO) in Multimodal Large Reasoning Models (MLRMs) inadvertently degrades safety alignment, rendering the models highly vulnerable to multimodal jailbreak attacks. The vulnerability is caused by "conditional coverage collapse" during the initial phases of chain-of-thought generation. Under adversarial conditioning (text or image), the reasoning policy assigns vanishing probability mass to safe…

Large Vision-Language Models (LVLMs) are vulnerable to zero-query, black-box adversarial image perturbations via Semantic-Guided Multimodal Attacks (SGMA). Unlike traditional attacks that scatter noise or target background pixels, SGMA leverages surrogate models (e.g., CLIP) to anchor imperceptible adversarial perturbations directly onto semantically critical foreground regions. The attack exploits two specific architectural traits of LVLMs: inconsistent visual grounding across models and…

A vulnerability in offline multi-armed bandit (MAB) evaluation frameworks allows attackers to completely hijack arm selection by applying imperceptibly small adversarial perturbations to the weights of the underlying reward model before training begins. Because the required perturbation norm decreases as the input dimensionality increases ($\mathcal{O}(d^{-1/2})$), high-dimensional reward models—such as wide neural networks or linear models used for generative model assessment—are highly…