Research map / Adversarial robustness and security / Attacks on text and graphs
Defending LVLMs Against Vision Attacks Through Partial-Perception Supervision
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes DPS, a black-box, training-free defense that uses responses from partially cropped images to supervise an LVLM's answer on the full image, reducing vision-attack success rates.
Problem
LVLMs can be misled by adversarially or typographically manipulated images. Existing crop-and-vote defenses (e.g., SmoothVLM) degrade clean-input quality because cropped images lose semantics.
Approach
Instead of majority-voting over cropped-image answers, feed the partial-image descriptions and answers as supervisory hints into a second prompt on the full image, so the model revises its answer only when under attack (attacked answers are low-confidence and susceptible to such hints), while clean answers stay stable.
Key results
- DPS reduces average ASR on misleading datasets to 0.31 (Qwen-VL-Plus), 0.39 (GPT-4o-Mini), and 0.39 (Gemini-1.5-Flash), versus best baseline around 0.78-0.96 average.
- LS-DPS (with LLM safety checker) reaches average jailbreak ASR of 0.05 on Qwen-VL-Plus versus 0.16 for MLLM-Protector and 0.15 for ECSO.
- DPS keeps MM-Vet standard performance near vanilla (e.g., 57.3 vs 57.3 for Qwen-VL-Plus), while SmoothVLM drops to 47.3.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use partial-perception supervision with cropping | Qwen-VL-Plus · Misleading attacks (average) | ASR: 0.78 -> 0.31 | Helped |
| Use partial-perception supervision with cropping | GPT-4o-Mini · Misleading attacks (average) | ASR: 0.51 -> 0.39 | Helped |
| Use partial-perception supervision with cropping | Gemini-1.5-Flash · Misleading attacks (average) | ASR: 0.60 -> 0.39 | Helped |
| Add an LLM safety checker to DPS | Qwen-VL-Plus · Jailbreak attacks (average) | ASR: 0.27 -> 0.05 | Helped |
| Add an LLM safety checker to DPS | GPT-4o-Mini · Jailbreak attacks (average) | ASR: 0.05 -> 0.04 | Helped |
| Add an LLM safety checker to DPS | Gemini-1.5-Flash · Jailbreak attacks (average) | ASR: 0.08 -> 0.05 | Helped |
| Use adaptive cropping instead of the standard combination of cropping strategies (ablation) | DPS on Qwen-VL-Plus · Misleading datasets | ASR: RTA 100: 0.39; Self-Gen: 0.31; MultiTrust: 0.42 | Mixed |
| Use random cropping instead of the standard combination of cropping strategies (ablation) | DPS on Qwen-VL-Plus · Misleading and safety datasets | ASR: RTA 100: 0.46; Self-Gen: 0.44; MultiTrust: 0.54; MM-Safety: 0.03; HADES: 0.20; VisAttack: 0.05 | Mixed |
| Add multiple Part-Perc models using random crops (ablation) | DPS on Qwen-VL-Plus · Misleading and safety datasets | ASR: Self-Gen: 0.44 -> 0.47; HADES: 0.20 -> 0.13; VisualAttack: 0.05 -> 0.02 | Mixed |
| Add safety awareness enhancement to DPS (ablation) | Qwen-VL-Plus · MM-SafetyBench | ASR: 0.33 -> 0.02 | Helped |
| Add safety awareness enhancement to DPS (ablation) | GPT-4o-Mini · Jailbreak attacks | ASR: MM-SafetyBench: 0.06 -> 0.03; HADES: 0.04 -> 0.04; VisualAttack: 0.04 -> 0.04 | Mixed |
| Increase random crops from one to five (ablation) | DPS · Self-Gen | ASR: 0.55 -> 0.25 | Helped |
Surprising findings
- Simple prompts such as 'think step by step' or warning the model it may be under attack did not reduce attack success, while supplying the correct hint in the prompt did.
- DPS improved MM-Vet math scores on Gemini-1.5-Flash over vanilla.
Limitations
- Fails when cropping does not eliminate the attack, so partial-perception supervision becomes ineffective.
- Requires multiple queries per sample, adding computational overhead versus single-prompt methods.
- Misleading-attack evaluation relies on GPT-4o judge and small per-dataset sample sizes; Qwen2.5-VL-32B results include only a t-test on a few datasets.
Experimental setup
Datasets: RTA-100 MultiTrust misleading dataset Self-Gen (Oxford-IIIT Pet based) MM-SafetyBench HADES VisualAttack adversarial examples MM-Vet
Benchmarks: RTA-100 MultiTrust misleading Self-Gen MM-SafetyBench HADES VisualAttack MM-Vet
Metrics: attack success rate (ASR) MM-Vet score
Baselines: MLLM-Protector ECSO SmoothVLM In-depth Visual Analysis Warning Prompt Step-by-step prompt Adversarial purification (Guo et al. 2018 / DAP) MirrorCheck
Builds on: SmoothVLM weak-to-strong learning ECSO MLLM-Protector
Closest papers by meaning
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.88)
- Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing (NeurIPS 2025 · similarity 0.88)
- Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks (CVPR 2025 · similarity 0.87)
- Revisiting Backdoor Attacks against Large Vision-Language Models from Domain Shift (CVPR 2025 · similarity 0.87)
- ETA: Evaluating Then Aligning Safety of Vision Language Models at Inference Time (ICLR 2025 · similarity 0.87)
- Pandora's Box: Towards Building Universal Attackers against Real-World Large Vision-Language Models (NeurIPS 2024 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.