Research map / Adversarial robustness and security / Attacks on text and graphs
Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Shadowcast is a clean-label data poisoning attack on vision-language models that pairs feature-colliding poison images with LLM-paraphrased captions, causing misidentification (Label Attack) or persuasive misinformation (Persuasion Attack) on benign prompts.
Problem
VLMs trained via visual instruction tuning on externally sourced data can be poisoned so that they produce misleading responses to benign, everyday prompts; prior poisoning work either targets classifiers or uses easily detectable mismatched image/text pairs.
Approach
Craft poison images by PGD-perturbing destination-concept images within an L-inf budget so their vision-encoder features match original-concept images, and pair them with destination-emphasizing captions (LLaVA caption + GPT-3.5 paraphrase) so the image/text pairs look visually congruent (clean-label).
Key results
- On LLaVA-1.5, 50 poison samples (about 1.4% poison rate) yield over 95% attack success on Trump-to-Biden and about 80% on EngineLight-to-FuelLight.
- Poisoning with about 1.4% poison rate preserves clean-model utility on GQA and VizWiz (about 56-60 scores) across tasks.
- GPT-3.5-turbo judgments matched human evaluation 99% of the time across 270 prompt-response pairs per task.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Inject 50 Shadowcast poison samples | LLaVA-1.5 · Trump-to-Biden | attack success rate: over 95% | Helped |
| Inject 50 Shadowcast poison samples | LLaVA-1.5 · EngineLight-to-FuelLight | attack success rate: 80% | Helped |
| Inject fewer than 30 Shadowcast poison samples | LLaVA-1.5 · Label Attack | attack success rate: over 60% | Helped |
| Inject 50 Shadowcast poison samples | MiniGPT-v2 · All four attack tasks | attack success rate: over 50% | Helped |
| Use the same data augmentation techniques when crafting poison images | Shadowcast on LLaVA-1.5 · All four attack tasks with training data augmentation | attack success rate | Helped |
| Apply JPEG compression to poison images before training | Shadowcast on LLaVA-1.5 · Three of four attack tasks | attack success rate | Helped |
| Poison the model with Shadowcast samples | LLaVA-1.5 · VizWiz and GQA | benchmark performance | No clear effect |
| Poison the model with Shadowcast samples | LLaVA-1.5 · JunkFood-to-HealthyFood test images | image-response relevance | Hurt |
| Craft poison samples with an alternate VLM | Shadowcast on LLaVA-1.5 · Transferability across tasks | attack success rate | Mixed |
| Use MiniGPT-v2 as the source model for poison crafting | Shadowcast on LLaVA-1.5 · JunkFood-to-HealthyFood | attack success rate | Hurt |
| Apply JPEG compression to poison images before training | Shadowcast on LLaVA-1.5 · Four attack tasks | attack success rate | Mixed |
Surprising findings
- Clean LLaVA-1.5 already describes playing video games as beneficial for physical health in about 50% of test images, so the attack works even on concepts the model is neutral about.
Limitations
- Defenses were not explored; the authors list this as a limitation.
- Transferability across architectures is weaker than white-box grey-box attacks, and the JunkFood task showed a minor drop in image-text relevance.
- Evaluation covers only four tasks with 7B models and small data (3,500 clean samples).
Experimental setup
Datasets: cc-sbu-align Google image search (Creative Commons) images per concept
Benchmarks: GQA VizWiz
Metrics: attack success rate utility accuracy on GQA and VizWiz human-rated coherence and image-text relevance (1-5)
Baselines: clean model (no poisoning)
Builds on: clean-label feature-collision poisoning for image classifiers LLaVA-1.5 MiniGPT-v2 LoRA
Closest papers by meaning
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.87)
- VLMs can Aggregate Scattered Training Patches (NeurIPS 2025 · similarity 0.86)
- Poisoning Attacks on LLMs Require a Near-constant Number of Poison Samples (NeurIPS 2026 · similarity 0.86)
- PoisonedEye: Knowledge Poisoning Attack on Retrieval-Augmented Generation based Large Vision-Language Models (ICML 2025 · similarity 0.85)
- Jailbreaking Vision-Language Models Through the Visual Modality (ICML 2026 · similarity 0.85)
- MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning (ICML 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.