SGHA-Attack: Semantic-Guided Hierarchical Alignment for Transferable Targeted Attacks on Vision-Language Models
Guangdong Province Key Lab of Information Security Technology, and School of Computer Science and Engineering, Sun Yat-sen University（广东信息安全技术重点实验室，计算机科学与工程学院，中山大学）；Nanyang Technological University（南洋理工大学）；School of Cyber Science and Technology, Shenzhen Campus, Sun Yat-sen University（网络安全科学与技术学院，深圳校区，中山大学）
Large vision-language models (VLMs) are vulnerable to transfer-based adversarial perturbations, enabling attackers to optimize on surrogate models and manipulate black-box VLM outputs. Prior targeted transfer attacks often overfit surrogate-specific embedding space by relying on a single reference and emphasizing final-layer alignment, which underutilizes intermediate semantics and degrades transfer across heterogeneous VLMs. To address this, we propose SGHA-Attack, a Semantic-Guided Hierarchical Alignment framework that adopts multiple target references and enforces intermediate-layer consistency. Concretely, we generate a visually grounded reference pool by sampling a frozen text-to-image model conditioned on the target prompt, and then carefully select the Top-K most semantically relevant anchors under the surrogate to form a weighted mixture for stable optimization guidance. Building on these anchors, SGHA-Attack injects target semantics throughout the feature hierarchy by aligning intermediate visual representations at both global and spatial granularities across multiple depths, and by synchronizing intermediate visual and textual features in a shared latent subspace to provide early cross-modal supervision before the final projection. Extensive experiments on open-source and commercial black-box VLMs show that SGHA-Attack achieves stronger targeted transferability than prior methods and remains robust under preprocessing and purification defenses.
Towards Transferable Targeted 3D Adversarial Attack in the Physical World
Institute of Artificial Intelligence, Beihang University（北京航空航天大学人工智能学院）；RealAI；Tsinghua-Bosch Joint ML Center（清华博世联合机器学习中心）；BNRist Center, Tsinghua University（清华大学BNRist中心）
Xiamen University（厦门大学）；University of Trento（特伦托大学）
Previous works have extensively studied the transferability of adversarial samples in untargeted black-box scenarios. However, it still remains challenging to craft targeted adversarial examples with higher transferability than non-targeted ones. Recent studies reveal that the traditional Cross-Entropy (CE) loss function is insufficient to learn transferable targeted adversarial examples due to the issue of vanishing gradient. In this work, we provide a comprehensive investigation of the CE loss function and find that the logit margin between the targeted and untargeted classes will quickly ob…
CLIP-Guided Generative Networks for Transferable Targeted Adversarial Attacks
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Harbin Institute of Technology, Shenzhen（哈尔滨工业大学（深圳））；Pengcheng Laboratory（鹏城实验室）；Shenzhen University（深圳大学）；Shenzhen Digital Certificate Authority CO., Ltd（深圳数字证书认证中心有限公司）
Australian National University（澳大利亚国立大学）；Monash University（莫纳什大学）；Qualcomm（高通公司）；Mohamed bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）
While the untargeted black-box transferability of adversarial perturbations has been extensively studied before, changing an unseen model's decisions to a specific `targeted' class remains a challenging feat. In this paper, we propose a new generative approach for highly transferable targeted perturbations (\ours). We note that the existing methods are less suitable for this task due to their reliance on class-boundary information that changes from one model to another, thus reducing transferability. In contrast, our approach matches the perturbed image `distribution' with that of the target c…
Deep Neural Networks have been found vulnerable re-cently. A kind of well-designed inputs, which called adver-sarial examples, can lead the networks to make incorrectpredictions. Depending on the different scenarios, goalsand capabilities, the difficulties of the attacks are different.For example, a targeted attack is more difficult than a non-targeted attack, a universal attack is more difficult than anon-universal attack, a transferable attack is more difficultthan a nontransferable one. The question is: Is there existan attack that can meet all these requirements? In this pa-per, we answer …
University of Electronic Science and Technology of China（电子科技大学）
In this work, we study the black-box targeted attack problem from the model discrepancy perspective. On the theoretical side, we present a generalization error bound for black-box targeted attacks, which gives a rigorous theoretical analysis for guaranteeing the success of the attack. We reveal that the attack error on a target model mainly depends on empirical attack error on the substitute model and the maximum model discrepancy among substitute models. On the algorithmic side, we derive a new algorithm for black-box targeted attacks based on our theoretical analysis, in which we additionall…
Achieving transferability of targeted attacks is reputed to be remarkably difficult. Currently, state-of-the-art approaches are resource-intensive because they necessitate training model(s) for each target class with additional data. In our investigation, we find, however, that simple transferable attacks which require neither additional data nor model training can achieve surprisingly high targeted transferability. This insight has been overlooked until now, mainly due to the widespread practice of unreasonably restricting attack optimization to a limited number of iterations. In particular, …
MIT（麻省理工学院）；IBM Research（IBM研究院）；JD AI Research（京东人工智能研究院）；UC Davis（加州大学戴维斯分校）
Visual language grounding is widely studied in modern neural image captioning systems, which typically adopts an encoder-decoder framework consisting of two principal components: a convolutional neural network (CNN) for image feature extraction and a recurrent neural network (RNN) for language caption generation. To study the robustness of language grounding to adversarial perturbations in machine vision and perception, we propose Show-and-Fool, a novel algorithm for crafting adversarial examples in neural image captioning. The proposed algorithm provides two evaluation approaches, which check…
In recent years, the trackers based on Siamese networks have emerged as highly effective and efficient for visual object tracking (VOT). While these methods were shown to be vulnerable to adversarial attacks, as most deep networks for visual recognition tasks, the existing attacks for VOT trackers all require perturbing the search region of every input frame to be effective, which comes at a non-negligible cost, considering that VOT is a real-time task. In this paper, we propose a framework to generate a single temporally transferable adversarial perturbation from the object template image onl…
Malicious attackers can generate targeted adversarial examples by imposing tiny noises, forcing neural networks to produce specific incorrect outputs. With cross-model transferability, network models remain vulnerable even in black-box settings. Recent studies have shown the effectiveness of ensemble-based methods in generating transferable adversarial examples. To further enhance transferability, model augmentation methods aim to produce more networks participating in the ensemble. However, existing model augmentation methods are only proven effective in untargeted attacks. In this work, we p…
Pre-training vision-language models with contrastive objectives has shown promising results that are both scalable to large uncurated datasets and transferable to many downstream applications. Some following works have targeted to improve data efficiency by adding self-supervision terms, but inter-domain (image-text) contrastive loss and intra-domain (image-image) contrastive loss are defined on individual spaces in those works, so many feasible combinations of supervision are overlooked. To overcome this issue, we propose UniCLIP, a Unified framework for Contrastive Language-Image Pre-trainin…
Visual-Invariance-Augmented Feature Optimal Alignment for Transferable Adversarial Attacks against Closed-Source MLLMs
Nanyang Technological University（南洋理工大学）；Northeastern University（东北大学）；Chongqing University（重庆大学）；University of Chinese Academy of Sciences（中国科学院大学）；Sun Yat-sen University（中山大学）
CuraCloud Corporation（库拉云公司）；University at Albany, State University of New York（纽约州立大学奥尔巴尼分校）；Chengdu University of Information Technology（成都信息工程大学）
Deep neural networks have been demonstrated to be vulnerable to adversarial attacks: subtle perturbations can completely change the classification results. Their vulnerability has led to a surge of research in this direction. However, most works dedicated to attacking anchor-based object detection models. In this work, we aim to present an effective and efficient algorithm to generate adversarial examples to attack anchor-free object models based on two approaches. First, we conduct category-wise instead of instance-wise attacks on the object detectors. Second, we leverage the high-level seman…
Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment
Nanyang Technological University, Singapore（南洋理工大学，新加坡）；MBZUAI, United Arab Emirates（马克斯·普朗克人工智能研究所，阿拉伯联合酋长国）；Sea AI Lab, Singapore（海思人工智能实验室，新加坡）；University of Illinois Urbana-Champaign, USA（伊利诺伊大学厄巴纳-香槟分校，美国）
Adversarial attacks against deep learning-based object detectors (ODs) have been studied extensively in the past few years. These attacks cause the model to make incorrect predictions by placing a patch containing an adversarial pattern on the target object or anywhere within the frame. However, none of prior research proposed a misclassification attack on ODs, in which the patch is applied on the target object. In this study, we propose a novel, universal, targeted, label-switch attack against the state-of-the-art object detector, YOLO. In our attack, we use (i) a tailored projection function…
Everywhere Attack: Attacking Locally and Globally to Boost Targeted Transferability
Southwest university of science and technology（西南科技大学）；Guangan institute of technology（广安职业技术学院）；City University of Macau（澳门城市大学）；Beijing normal university（北京师范大学）
Looking Beyond the Scale: Do Surgical Skill Models Learn Transferable Representations Across Assessment Rubrics?
National Center for Tumor Diseases (NCT)（国家肿瘤疾病中心）；DKFZ（德国癌症研究中心）；Faculty of Medicine and University Hospital Carl Gustav Carus（卡尔·古斯塔夫·卡鲁斯医学院及大学医院）；TUD Dresden University of Technology（德累斯顿工业大学）；Helmholtz-Zentrum Dresden-Rossendorf (HZDR)（德累斯顿-罗森多夫亥姆霍兹中心）；BMFTR Research Hub 6G-Life（BMFTR 6G生活研究中心）；Deutsches Krebsforschungszentrum (DKFZ)（德国癌症研究中心）；The Centre for Tactile Internet with Human-in-the-Loop (CeTI)（人在回路触觉互联网中心）
Tencent YouTu Lab（腾讯优图实验室）；AI Institute, Shanghai Jiao Tong University（上海交通大学人工智能研究院）
Text-based Person Search (TPS), is targeted on retrieving pedestrians to match text descriptions instead of query images. Recent Vision-Language Pre-training (VLP) models can bring transferable knowledge to downstream TPS tasks, resulting in more efficient performance gains. However, existing TPS methods improved by VLP only utilize pre-trained visual encoders, neglecting the corresponding textual representation and breaking the significant modality alignment learned from large-scale pre-training. In this paper, we explore the full utilization of textual potential from VLP in TPS tasks. We bui…
Multi-Paradigm Collaborative Adversarial Attack Against Multi-Modal Large Language Models
School of Artificial Intelligence and Computer Science, Jiangnan University（江南大学人工智能与计算机科学学院）；Centre for Vision, Speech and Signal Processing (CVSSP), University of Surrey（Surrey 大学视觉、语音和信号处理中心）
Why Relational Graphs Will Save the Next Generation of Vision Foundation Models?
Department of Computer Science, School of Mathematics, Statistics and Computer Science, College of Science, University of Tehran, Tehran, Iran（塔里斯坦大学科学学院计算机科学系）
Blackbox adversarial attacks can be categorized into transfer- and query-based attacks. Transfer methods do not require any feedback from the victim model, but provide lower success rates compared to query-based methods. Query attacks often require a large number of queries for success. To achieve the best of both approaches, recent efforts have tried to combine them, but still require hundreds of queries to achieve high success rates (especially for targeted attacks). In this paper, we propose a novel method for Blackbox Attacks via Surrogate Ensemble Search (BASES) that can generate highly s…
Advancing Generalized Transfer Attack with Initialization Derived Bilevel Optimization and Dynamic Sequence Truncation
School of Software Engineering, Dalian University of Technology（大连理工大学软件学院）；CRRC Qingdao Sifang Rolling Stock Research Institute Co., Ltd（中车青岛四方机车车辆股份有限公司）；Pazhou Laboratory (Huangpu)（琶洲实验室（黄埔））
Tumor-aware augmentation with task-guided attention analysis improves rectal cancer segmentation from magnetic resonance images
Department of Medical Physics, Memorial Sloan Kettering Cancer Center（医学物理系，纪念斯隆凯特琳癌症中心）；Department of Radiology, Memorial Sloan Kettering Cancer Center（放射学系，纪念斯隆凯特琳癌症中心）；Department of Radiation Oncology, Memorial Sloan Kettering Cancer Center（放射肿瘤学系，纪念斯隆凯特琳癌症中心）；Department of Surgery, Memorial Sloan Kettering Cancer Center（外科系，纪念斯隆凯特琳癌症中心）；Department of Medicine, Memorial Sloan Kettering Cancer Center（医学系，纪念斯隆凯特琳癌症中心）
