Vision-language models (VLMs) such as CLIP have demonstrated remarkable zero-shot generalization, yet remain highly vulnerable to adversarial examples (AEs). While test-time defenses are promising, existing methods fail to provide sufficient robustness against strong attacks and are often hampered by high inference latency and task-specific applicability. To address these limitations, we start by investigating the intrinsic properties of AEs, which reveals that AEs exhibit severe feature inconsistency under progressive frequency attenuation. We further attribute this to the model's inherent spectral bias. Leveraging this insight, we propose an efficient test-time defense named Contrastive Spectral Rectification (CSR). CSR optimizes a rectification perturbation to realign the input with the natural manifold under a spectral-guided contrastive objective, which is applied input-adaptively. Extensive experiments across 16 classification benchmarks demonstrate that CSR outperforms the SOTA by an average of 18.1% against strong APGD with modest inference overhead. Furthermore, CSR exhibits broad applicability across diverse visual tasks. Code is available at https://github.com/Summu77/CSR.
This study provides a new understanding of the adversarial attack problem by examining the correlation between adversarial attack and visual attention change. In particular, we observed that: (1) images with incomplete attention regions are more vulnerable to adversarial attacks; and (2) successful adversarial attacks lead to deviated and scattered attention map. Accordingly, an attention-based adversarial defense framework is designed to simultaneously rectify the attention map for prediction and preserve the attention area between adversarial and original images. The problem of adding iterat…
Rectifying Adversarial Sample with Low Entropy Prior for Test-Time Defense
Chongqing Key Laboratory of Bio-perception and Multimodal Intelligent Information Processing, Chongqing University and the School of Microelectronics and Communication Engineering, Chongqing University（重庆生物感知与多模态智能信息处理重点实验室、重庆大学及微电子与通信工程学院）
Investigating Adversarial Robustness of Multi-modal Large Language Models
Mohamed Bin Zayed University of AI, UAE（穆罕默德·本·扎耶德人工智能大学，阿联酋）；Khalifa University, UAE（哈利法大学，阿联酋）；Australian National University, Australia（澳大利亚国立大学，澳大利亚）
School of Cyber Science and Technology Sun Yat-Sen University（中山大学网络空间安全学院）；Department of Computer Science National University of Singapore（新加坡国立大学计算机科学系）
Seeing 3D Through 2D Lenses: 3D Few-Shot Class-Incremental Learning via Cross-Modal Geometric Rectification
South China University of Technology（南方科技大学）；State Key Laboratory of Subtropical Building Science（亚热带建筑科学国家重点实验室）；Guangdong Provincial Key Lab of Computational Intelligence and Cyberspace Information（广东省计算智能与网络信息重点实验室）；Ministry of Education Key Laboratory of Big Data and Intelligent Robot（教育部大数据与智能机器人重点实验室）；Singapore Management University（新加坡国立大学）
The University of Hong Kong（香港大学）；The Hong Kong University of Science and Technology（香港科技大学）；National University of Singapore（新加坡国立大学）；The University of Sydney（悉尼大学）
Unleashing the Power of Pre-trained Encoders for Universal Adversarial Attack Detection
Faculty of Data Science, City University of Macau（澳门城市大学数据科学学院）；Torrens University Australia（澳大利亚托伦斯大学）；School of Computer Science and Engineering, Wuhan Institute of Technology（武汉工程大学计算机科学与工程学院）
Adversarial Semantic and Label Perturbation Attack for Pedestrian Attribute Recognition
School of Artificial Intelligence, Anhui University（安徽大学人工智能学院）；School of Computer Science and Technology, Anhui University（安徽大学计算机科学与技术学院）；National University of Defense Technology（国防科学技术大学）；Harbin Institute of Technology（哈尔滨工业大学）；Peng Cheng Laboratory（鹏城实验室）
Beyond False Stability: High-Noise Drift Gating for Test-Time Adversarial Defenses in Vision-Language Models
Mohamed Bin Zayed University of AI, UAE（穆罕默德·本·扎耶德人工智能大学，阿联酋）；Khalifa University, UAE（卡布斯大学，阿联酋）；Australian National University, Australia（澳大利亚国立大学，澳大利亚）
Dyslexify: A Mechanistic Defense Against Typographic Attacks in CLIP
Fraunhofer Heinrich Hertz Institute（弗劳恩霍夫海因里希·赫兹研究所）；University of Oxford（牛津大学）；Technological University Dublin（都柏林技术大学）；Technische Universität Berlin（柏林技术大学）
Enhancing Few-Shot Out-of-Distribution Detection via the Refinement of Foreground and Background
School of Computer Science and Engineering, University of Electronic Science and Technology of China（电子科技大学计算机科学与工程学院）；School of Computer Science and Technology, Hainan University（海南大学计算机科学与技术学院）
Adversarial Attacks Already Tell the Answer: Directional Bias-Guided Test-time Defense for Vision-Language Models
University of Science and Technology of China（中国科学技术大学）；National Key Laboratory of Deep Space Exploration, Deep Space Exploration Laboratory（国家深空探测重点实验室，深空探测实验室）；The Chinese University of Hong Kong（香港中文大学）；Zhejiang University（浙江大学）；Ant Group（蚂蚁集团）
Neural Antidote: Class-Wise Prompt Tuning for Purifying Backdoors in CLIP
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院，清华大学）；School of Computer Science and Technology, Harbin Institute of Technology（哈尔滨工业大学计算机科学与技术学院）；Department of Computer Science and Technology, Tsinghua University（清华大学计算机科学与技术系）
AGC: Adaptive Geodesic Correction for Adversarial Robustness on Vision-Language Models
NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（自动化研究所国家工程研究中心与人工智能院，中国科学院）；School of Computer Science and Engineering, Central South University（中南大学计算机科学与工程学院）；University of Chinese Academy of Sciences（中国科学院大学）
Self-Calibrated Consistency can Fight Back for Adversarial Robustness in Vision-Language Models
Guangdong Institute of Intelligence Science and Technology（广东智能科学与技术研究院）；Agency for Science, Technology and Research（科技研究局）；School of Information Technology（信息技术学院）
CleanerCLIP: Fine-grained Counterfactual Semantic Augmentation for Backdoor Defense in Contrastive Learning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；National University of Singapore（新加坡国立大学）；Nanyang Technological University（南洋理工大学）；Sun Yat-sen University-Shenzhen（中山大学（深圳））
Securing Vision-Language Models with a Robust Encoder Against Jailbreak and Adversarial Attacks
School of Computing, Southern Illinois University（南伊利诺伊大学计算学院）；Security, Privacy and Intelligence for Edge Devices Laboratory (SPEED Lab)（边缘设备安全、隐私与智能实验室（SPEED Lab））
TTP: Test-Time Padding for Adversarial Detection and Robust Adaptation on Vision-Language Models
NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（神经网络与模式识别实验室及自动化研究所，中国科学院）；University of Chinese Academy of Sciences（中国科学院大学）；Department of Automation, Tsinghua University（清华大学自动化系）
BadCLIP: Dual-Embedding Guided Backdoor Attack on Multimodal Contrastive Learning
National University of Singapore（新加坡国立大学）；The Chinese University of Hong Kong, Shenzhen（香港中文大学（深圳））；Beihang University（北京航空航天大学）；Sun Yat-sen University-Shenzhen（中山大学（深圳））
A Hybrid Defense Strategy for Boosting Adversarial Robustness in Vision-Language Models
Harbin Institute of Technology（哈尔滨工业大学）；University of Bristol（布里斯托大学）；Beijing University of Civil Engineering and Architecture（北京建筑大学）；University of Toronto Mississauga（多伦多大学密西沙加分校）；Xi’an Tieyi ICC（西安铁一中国际合作课程中心）
Proxy Robustness in Vision Language Models is Effortlessly Transferable
Chongqing Key Laboratory of Bio-perception（重庆生物感知实验室）；Multimodal Intelligent Information Processing, Chongqing University, Chongqing 401331, China（多模态智能信息处理，重庆大学，重庆401331，中国）；School of Microelectronics（微电子学院）；Communication Engineering, Chongqing University, Chongqing 401331, China（通信工程，重庆大学，重庆401331，中国）；School of Data Science, Lingnan University, Hong Kong（数据科学学院，岭南大学，香港）
ToxicTextCLIP: Text-Based Poisoning and Backdoor Attacks on CLIP Pre-training
School of Computer Science and Engineering, Central South University（中南大学计算机科学与工程学院）；Miner School of Computer & Information Sciences, University of Massachusetts Lowell（马萨诸塞大学洛厄尔分校Miner计算机与信息科学学院）
