With the advancement in language modeling, research on adversarial images has recently shifted from image classifiers to vision-language models (VLMs). Despite the new, text-prompt-driven nature of VLMs, we find that existing VLM adversaries have largely overlooked the dynamics of text prompts. In a typical use case, adversarial images can protect visual privacy by rejecting VLMs from answering questions about the image. However, existing protections are prompt-agnostic, i.e., indiscriminately rejecting any question, including those for potential legitimate use of the image. To address this limitation, we propose Prompt-Adapted (ProAda) adversarial images, which are optimized to balance the rejection of harmful prompts and the correct response of legitimate prompts. In particular, to achieve a more accurate adversarial direction, the text prompt is also iteratively updated with a simple classifier judging whether the harmfulness of the prompt remains. Extensive experiments on visual-privacy-related datasets validate that ProAda can reject over 90% of harmful prompts while allowing over 90% of legitimate ones, demonstrating superior overall performance compared to existing prompt-agnostic VLM adversaries. In addition, our ProAda achieves competitive overall cross-model transferability and improved robustness against countermeasures.
Adversarial Prompt Distillation for Vision-Language Models
Shanghai Key Lab of Intell. Info. Processing, School of CS, Fudan University（上海智能信息处理实验室，计算机科学学院，复旦大学）；The Chinese University of Hong Kong, Shatin, Hong Kong（香港中文大学，沙田，香港）；The University of Hong Kong, Pokfulam, Hong Kong（香港大学，薄扶林，香港）
NAP-Tuning: Neural Augmented Prompt Tuning for Adversarially Robust Vision-Language Models
School of Computer Science and Technology, Beijing Jiaotong University（北京交通大学计算机科学与技术学院）；Shanghai Key Lab of Intell. Info. Processing, School of CS, Fudan University（复旦大学计算机学院智能信息处理重点实验室）；Department of Mathematics and Applications, University of Naples Federico II（那不勒斯费德里克二世大学应用数学系）；State Key Laboratory of Advanced Rail Autonomous Operation, Beijing Jiaotong University（北京交通大学先进轨道交通自主运行国家重点实验室）
MoAPT: Mixture of Adversarial Prompt Tuning for Vision-Language Models
Institute of Artificial Intelligence, Beihang University, Beijing, China（北京航空航天大学人工智能研究院）；Center for Frontier AI Research, A*STAR, Singapore（A*STAR前沿人工智能研究中心）；Institute of Computing Technology, Chinese Academy of Sciences, China（中国科学院计算技术研究所）
CAP-CoT: Cycle Adversarial Prompt for Improving Chain of Thoughts in LLM Reasoning
Department of Electronic Engineering, Kyung Hee University（韩国庆熙大学电子工程系）；School of Computer Science and Engineering, University of Electronic Science and Technology of China（中国电子科技大学计算机科学与工程学院）；Henan Polytechnic University（河南理工大学）；School of Computing, Kyung Hee University（韩国庆熙大学计算机学院）
Evolution-based Region Adversarial Prompt Learning for Robustness Enhancement in Vision-Language Models
Nanyang Technological University（南洋理工大学）；Northeastern University（东北大学）；Mohamed Bin Zayed University of Artificial Intelligence（穆罕默德·本·扎耶德人工智能大学）；University of Chinese Academy of Sciences（中国科学院大学）；Sun Yat-sen University（中山大学）
Are All Prompt Components Value-Neutral? Understanding the Heterogeneous Adversarial Robustness of Dissected Prompt in Large Language Models
Duke University（杜克大学）；North China University of Technology（北方工业大学）；Hong Kong Polytechnic University（香港理工大学）；Australian National University（澳大利亚国立大学）；Nanyang Technological University（南洋理工大学）；Institute of Software, Chinese Academy of Sciences（中国科学院软件研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Beijing Forestry University（北京林业大学）；Institute of Computing Technology, Chinese Academy of Sciences（中国科学院计算技术研究所）
Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models
Mehta Family School of Data Science and Artificial Intelligence（梅hta家族数据科学与人工智能学院）；Indian Institute of Technology, Roorkee（印度理工学院罗奥克学院）；Department of Civil Engineering（土木工程系）；Department of Electronics and Communication（电子与通信系）
Adversarial Tuning: Defending Against Jailbreak Attacks for LLMs
AI Thrust（AI 部）；The Hong Kong University of Science and Technology (Guangzhou)（香港科技大学（广州））；Guangzhou HKUST Fok Ying Tung Research Institute（广州香港科技大学霍英东研究院）；The Hong Kong University of Science and Technology（香港科技大学）
Closed-Loop Bidirectional Prompting for Adversarial Robustness of Vision Language Models
University of Macau（澳门大学）；Guangdong Institute of Intelligence Science and Technology（广东智能科学与技术研究院）；Peking University（北京大学）；Independent Researcher（独立研究员）；Institute of Science Tokyo（东京科学研究院）；Morgan Stanley（摩根大通）；Halmstad University（哈马碧大学）
Few-Shot Adversarial Prompt Learning on Vision-Language Models
School of Automation（自动化学院）；Beijing Institute of Technology（北京理工大学）；Sydney AI Centre（悉尼人工智能中心）；University of Sydney（悉尼大学）；Department of Computer Science（计算机科学系）；Hong Kong Baptist University（香港浸会大学）
Adaptive Prompt Embedding Optimization for LLM Jailbreaking
School of Information Studies, McGill University, Montreal, QC, Canada（麦吉尔大学信息研究学院）；Department of Computer Science, Kean University, Union, NJ, United States（凯恩大学计算机科学系）；Mila - Quebec AI Institute, Montreal, QC, Canada（魁北克人工智能研究所）；Faculty of Information, University of Toronto, Toronto, ON, Canada（多伦多大学信息学院）
Proactive Adversarial Defense: Harnessing Prompt Tuning in Vision-Language Models to Detect Unseen Backdoored Images
University of West Florida（西佛罗里达大学）；Florida Institute For Human and Machine Cognition (IHMC)（佛罗里达人机认知研究所）；Center for Cybersecurity, University of West Florida（西佛罗里达大学网络安全中心）
R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning
University of Science and Technology of China（中国科学技术大学）；NLPR & MAIS, Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；University of Chinese Academy of Sciences（中国科学院大学）
Vision-language models can encode societal biases and stereotypes, but there are challenges to measuring and mitigating these multimodal harms due to lacking measurement robustness and feature degradation. To address these challenges, we investigate bias measures and apply ranking metrics for image-text representations. We then investigate debiasing methods and show that prepending learned embeddings to text queries that are jointly trained with adversarial debiasing and a contrastive loss reduces various bias measures with minimal degradation to the image-text representation.
TRAP: Targeted Random Adversarial Prompt Honeypot for Black-Box Identification
Parameter Lab（参数实验室）；IT University of Copenhagen（哥本哈根信息技术大学）；Pioneer Centre for Artificial Intelligence（人工智能先锋中心）；NAVER AI Lab（NAVER人工智能实验室）；University of Tübingen（蒂宾根大学）
