Research map / Adversarial robustness and security / Attacks on text and graphs
Vision-language model robustness
Attack and harden vision-language models with multimodal adversarial search and prompt tuning.
96 accepted papers at ICML, NeurIPS, ICLR, CVPR and AAAI (2018–2026) · an approach in Attacks on text and graphs, keyword cluster “llms · prompt · jailbreak”
State History Tried Checklist Preprints Who Export
Where it stands
Not enough benchmark data Fewer than four papers report the same benchmark, so there is no record to follow.
13 papers in 2023–24 and 82 in 2025–26 (at ICML, NeurIPS, ICLR, CVPR and AAAI); its share of the topic grew, from 4.7% to 16.9%.
How this is decided
A benchmark is tracked when at least four papers of this approach report their own method on the same dataset and metric in at least two different years. Its record is the best number reported up to 2024 compared with the best reported in 2025–26: still improving means at least 1% better, flat means at most 0.2% better with at least two papers from 2025–26 trying. Numbers on a different scale from the rest (a fraction among percentages) and far outliers are left out. Results come from different papers with different setups, so they are signals, not head-to-head comparisons. The share of papers is counted at ICML, NeurIPS, ICLR, CVPR and AAAI.
How it got here
Most cited paper of each year
- 2018 · Fooling Vision and Language Models Despite Localization and Attention Mechanism (CVPR 2018 · 77 citations)
- 2023 · VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models (NeurIPS 2023 · 13 citations)
- 2024 · Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · 122 citations)
- 2025 · Anyattack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models (CVPR 2025 · 16 citations)
- 2026 · Spatial-Spectral Homogeneous Attacks on Physical-World Large Vision-Language Models (AAAI 2026 · 1 citation)
Earliest papers here
- Fooling Vision and Language Models Despite Localization and Attention Mechanism (CVPR 2018 · 77 citations)
- VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models (NeurIPS 2023 · 13 citations)
- Understanding Zero-shot Adversarial Robustness for Large-Scale Models (ICLR 2023 · 9 citations)
What has been tried
35 papers here report 364 measured changes (a component added, removed or swapped, compared with a baseline): helped 72%, no clear effect 5%, hurt 17%, mixed 6%. Papers mostly publish changes that helped, so "helped" is over-represented.
Ablations in recent papers
| What was changed | Measured on | Result | Effect | Paper |
|---|---|---|---|---|
| Replace the adversarial image with unconstrained adversarial text | RealToxicityPrompts challenging subset · outputs with any toxic attribute (Perspective API) | 34.8 -> 54.8; 34.8 -> 66.0 | Mixed | Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · 122 citations) |
| Use unified rather than class-specific context with limited training data | 11-dataset average, 1 and 4 shots · accuracy | 51.3 vs 39.9 (1 shot); 58.2 vs 54.3 (4 shots), ε=1/255 | Helped | One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · 33 citations) |
| Use latent projection, latent optimization, and controllable generation together | 14-dataset evaluation · mIoU | 59.1 -> 77.6 | Helped | ASAM: Boosting Segment Anything Model with Adversarial Tuning (CVPR 2024 · 18 citations) |
| Add auxiliary models during fine-tuning | MSCOCO image-text retrieval · R@Mean | 6.455%, 13.75%, and 15.875% | Helped | Anyattack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models (CVPR 2025 · 16 citations) |
| Add expansion to the anchors | CIFAR-FS · Robust accuracy | Helped | Language-Driven Anchors for Zero-Shot Adversarial Robustness (CVPR 2024 · 10 citations) | |
| Add Gaussian noise to adversarial samples | 16 datasets, PGD10 · robust accuracy | Helped | On the Zero-shot Adversarial Robustness of Vision-Language Models: A Truly Zero-shot and Training-free Approach (CVPR 2025 · 8 citations) | |
| replace marginal entropy minimization with pointwise entropy minimization | Fine-grained datasets (average) · Acc. | 53.3 -> 53.7 | Helped | R-TPT: Improving Adversarial Robustness of Vision-Language Models through Test-Time Prompt Tuning (CVPR 2025 · 6 citations) |
| add the REO stage after STE | Nudity removal (CCE) · ASR (%) | 54.73 -> 4.21 | Helped | STEREO: A Two-Stage Framework for Adversarially Robust Concept Erasing from Text-to-Image Diffusion Models (CVPR 2025 · 6 citations) |
| Add calibration activation to the projection term | Perturbation-based attacks, ε=16/255 to unconstrained · Toxicity Score (%) | 40.49 -> 15.52; 41.80 -> 5.45; 33.90 -> 2.39; 10.50 -> 0.07 | Helped | Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks (CVPR 2025 · 6 citations) |
| Do not reset prompts during inference rather than resetting after every sample | ImageNet · robust accuracy | 49.92 -> 0.48 | Hurt | TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Models (CVPR 2025 · 5 citations) |
| Increase the ℓ∞ perturbation budget from 2/255 to 4/255 | Specific string attack · success rate | 0% to 94% | Helped | Image Hijacks: Adversarial Images can Control Generative Models at Runtime (ICML 2024 · 4 citations) |
| Generate adversarial text strategically rather than use the fixed incorrect option | VQAv2 · ASR | Helped | SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments (CVPR 2025 · 3 citations) |
What reviewers will expect
Datasets and baselines named in the 32 papers of this approach from 2025–2026 that have a full-text summary. Leaving out the common ones is a frequent review question.
Datasets
- ImageNet · 6 of 32 papers
- MM-Vet · 4 of 32 papers
- AdvBench · 4 of 32 papers
- Caltech101 · 4 of 32 papers
- DTD · 3 of 32 papers
- EuroSAT · 3 of 32 papers
- MM-SafetyBench · 3 of 32 papers
- RealToxicityPrompts · 2 of 32 papers
Baselines
- PGD · 3 of 32 papers
- TeCoA · 3 of 32 papers
- FigStep · 2 of 32 papers
- JailGuard · 2 of 32 papers
- GCG · 2 of 32 papers
- APT · 2 of 32 papers
- ESD · 2 of 32 papers
- UCE · 2 of 32 papers
Recent preprints
Loading recent arXiv preprints…
Who publishes on it
Institutions on the most papers of this approach since 2023 (of 95 papers; from OpenAlex and the papers' affiliations).
- Nanyang Technological University · 6 papers
- ByteDance · 3 papers
- Peking University · 3 papers
- Zhejiang University · 2 papers
- Shanghai Jiao Tong University · 2 papers
- Tsinghua University · 2 papers
- University of Central Florida · 2 papers
- MBZUAI · 2 papers
- Hong Kong University of Science and Technology · 2 papers
- Fudan University · 2 papers
Use it
Download BibTeX of 23 key papersOpen the topic in the interactive map
Get alerts. Describe your idea in scime atlas and save it (free scime account): you get a weekly email when new preprints land close to it.
Related approaches
Same keyword cluster
- Adversarial prompts for language models (98 papers)
- LLM jailbreak and injection defense (113 papers)
Elsewhere in the topic
- Membership inference and inversion (118 papers)
- Defenses against universal perturbations (97 papers)
- Attacks and defenses in sequential settings (96 papers)
- Diffusion-based adversarial purification (78 papers)
- Biologically inspired robust vision (77 papers)
- Graph neural network robustness (71 papers)
- Adversarial perturbations beyond images (69 papers)
- Physical adversarial patches and camouflage (56 papers)
Benchmark numbers, ablations and baseline numbers are extracted by AI from each paper's full text and can be wrong; the paper is the authority. Data: results index of 2026-11-02, citation counts from OpenAlex (2026-10-09).