Research map / Adversarial robustness and security / Attacks on text and graphs
Pandora's Box: Towards Building Universal Attackers against Real-World Large Vision-Language Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a universal, task-agnostic adversarial patch attack against LVLMs that only queries input/output text, using importance-aware gradient approximation with a Sentence-BERT judge.
Problem
Existing LVLM attacks need white-box or gray-box access or logits, and are task- and image-specific, which is impractical for real-world API-only LVLM deployments.
Approach
A single universal adversarial patch with a randomly searched location, optimized via query-only gradient estimation whose noise directions are reweighted by an importance-aware indicator function, with semantic similarity (Sentence-BERT cosine) to a target text as the objective.
Key results
- On LLaVA with DALLE-3 data, the full attack reaches an overall similarity of 0.837 to target 'Unknown' versus 0.459 on clean images.
- Against MF-Attack on LLaVA, BLIP-2, and MiniGPT-4 in VQA, the method averages 0.727 versus 0.646.
- Against CroPA on OpenFlamingo with MS-COCO, overall ASR is 0.69 versus CroPA's 0.65, though CroPA is stronger on VQA (0.92 vs 0.84).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add importance-aware weights during gradient approximation (ablation) | Pandora's Box · MS-COCO | semantic similarity (Overall): 0.698 -> 0.830 | Helped |
| add importance-aware weights during gradient approximation (ablation) | Pandora's Box · DALLE-3 | semantic similarity (Overall): 0.696 -> 0.837 | Helped |
| add importance-aware weights during gradient approximation (ablation) | Pandora's Box · VQAv2 | semantic similarity (Overall): 0.707 -> 0.829 | Helped |
| increase patch size from 32 to 64 (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.744 -> 0.837 | Helped |
| increase patch size from 48 to 64 (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.803 -> 0.837 | Helped |
| use Sentence-BERT as the judge text encoder (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity | Helped |
| increase the number of task types queried from 1 to 3 (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.733 -> 0.837 | Helped |
| increase the number of task types queried from 2 to 3 (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.784 -> 0.837 | Helped |
| increase patch-generation image pool from 100 to 500 images (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.756 -> 0.837 | Helped |
| increase patch-generation image pool from 300 to 500 images (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity (Overall): 0.803 -> 0.837 | Helped |
| use one universal patch across inputs and tasks instead of a sample-specific patch (ablation) | Pandora's Box · DALLE-3 | attack performance | Helped |
| increase ε to 16/255 (ablation) | Pandora's Box on LLaVA · DALLE-3 | semantic similarity | Helped |
Surprising findings
- Universal patch transfers worse across datasets (e.g. DALLE-3 to MS-COCO) than across LVLM models, which the authors attribute to image distribution gaps.
- Attacks targeting harmful instructions (e.g. 'Suicide', 'Bomb') achieve lower similarity than benign targets, attributed to LVLM self-constraints.
Limitations
- Evaluated only in the digital setting; physical deployment is left to future work.
- Transfer across datasets is notably weaker than across models.
- Harmful-instruction targets are harder to achieve.
Experimental setup
Datasets: MS-COCO VQAv2 DALLE-3 generated images ImageNet-1k
Benchmarks: MS-COCO VQAv2 DALLE-3 dataset ImageNet-1k
Metrics: semantic similarity score (Sentence-BERT cosine) ASR
Baselines: MF-Attack CroPA w/o importance variant w/o universal baseline
Builds on: Monte Carlo gradient estimation CroPA MF-Attack
Closest papers by meaning
- A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1 (NeurIPS 2025 · similarity 0.91)
- Attention! Your Vision Language Model Could Be Maliciously Manipulated (NeurIPS 2025 · similarity 0.91)
- SLADE: Shielding against Dual Exploits in Large Vision-Language Models (CVPR 2025 · similarity 0.90)
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.90)
- Stage-wise Attention-Guided Region Sequencing for Adversarial Attacks on Large Vision-Language Models (NeurIPS 2026 · similarity 0.89)
- Black-Box Membership Inference Attack for LVLMs via Prior Knowledge-Calibrated Memory Probing (NeurIPS 2025 · similarity 0.89)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.