{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T07:15:24Z","timestamp":1783581324454,"version":"3.55.0"},"reference-count":36,"publisher":"Springer Science and Business Media LLC","issue":"3","license":[{"start":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T00:00:00Z","timestamp":1783555200000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T00:00:00Z","timestamp":1783555200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Pattern Anal Applic"],"published-print":{"date-parts":[[2026,9]]},"DOI":"10.1007\/s10044-026-01724-w","type":"journal-article","created":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T06:29:10Z","timestamp":1783578550000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Multimodal backdoor attack on VLMs for autonomous driving via graffiti and cross-lingual triggers"],"prefix":"10.1007","volume":"29","author":[{"given":"Jiancheng","family":"Wang","sequence":"first","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Lidan","family":"Liang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yong","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Zengzhen","family":"Su","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Haifeng","family":"Xia","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yuanting","family":"Yan","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Wei","family":"Wang","sequence":"additional","affiliation":[],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"297","published-online":{"date-parts":[[2026,7,9]]},"reference":[{"key":"1724_CR1","unstructured":"Gopalkrishnan A, Greer R, Trivedi M (2024) Multi-frame, lightweight & efficient vision-language models for question answering in autonomous driving. arXiv preprint arXiv:2403.19838"},{"key":"1724_CR2","doi-asserted-by":"crossref","unstructured":"Sima C, Renz K, Chitta K, Chen L, Zhang H, Xie C, Bei\u00dfwenger J, Luo P, Geiger A, Li H (2024) Drivelm: Driving with graph visual question answering. In: European conference on computer vision. Springer, pp 256\u2013274","DOI":"10.1007\/978-3-031-72943-0_15"},{"key":"1724_CR3","unstructured":"Dzabraev M, Kunitsyn A, Ivaniuta A (2024) Vlrm: Vision-language models act as reward models for image captioning. arXiv:2404.01911 arXiv preprint"},{"key":"1724_CR4","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2022.118669","volume":"212","author":"A Salaberria","year":"2023","unstructured":"Salaberria A, Azkune G, Lacalle OL, Soroa A, Agirre E (2023) Image captioning for effective use of language models in knowledge-based visual question answering. Expert Syst Appl 212:118669","journal-title":"Expert Syst Appl"},{"key":"1724_CR5","doi-asserted-by":"publisher","unstructured":"Gu T, Liu K, Dolan-Gavitt B, Garg S (2019) Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access 7:47230\u201347244. https:\/\/doi.org\/10.1109\/ACCESS.2019.2909068","DOI":"10.1109\/ACCESS.2019.2909068"},{"key":"1724_CR6","unstructured":"Chen X, Liu C, Li B, Lu K, Song D (2017) Targeted backdoor attacks on deep learning systems using data poisoning. arXiv:1712.05526 arXiv preprint"},{"key":"1724_CR7","doi-asserted-by":"crossref","unstructured":"Hu Y, Yang J, Chen L, Li K, Sima C, Zhu X, Chai S, Du S, Lin T, Wang W, et al (2023) Planning-oriented autonomous driving. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, 17853\u201317862","DOI":"10.1109\/CVPR52729.2023.01712"},{"key":"1724_CR8","doi-asserted-by":"crossref","unstructured":"Xu Z, Zhang Y, Xie E, Zhao Z, Guo Y, Wong K-YK, Li Z, Zhao H (2024) Drivegpt4: Interpretable end-to-end autonomous driving via large language model. In: IEEE robotics and automation letters","DOI":"10.1109\/LRA.2024.3440097"},{"key":"1724_CR9","doi-asserted-by":"crossref","unstructured":"Qi X, Huang K, Panda A, Wang M, Mittal P (2023) Visual adversarial examples jailbreak large language models. CoRR,","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"1724_CR10","doi-asserted-by":"publisher","DOI":"10.1016\/j.inffus.2025.102970","volume":"118","author":"S Sun","year":"2025","unstructured":"Sun S, Lin Z, Wu X (2025) Hallucinations of large multimodal models: problem and countermeasures. Inform Fusion 118:102970","journal-title":"Inform Fusion"},{"key":"1724_CR11","unstructured":"Wang C, Wang W, Yu C, Mu J (2024) Explore internal and external similarity for single image deraining with graph neural networks. arXiv preprint arXiv:2406.00721"},{"key":"1724_CR12","doi-asserted-by":"crossref","unstructured":"Liang J, Pang R, Li C, Wang T (2024) Model extraction attacks revisited. In: Proceedings of the 19th ACM Asia conference on computer and communications security. pp 1231\u20131245","DOI":"10.1145\/3634737.3657002"},{"key":"1724_CR13","doi-asserted-by":"crossref","unstructured":"Tolpegin V, Truex S, Gursoy ME, Liu L (2020) Data poisoning attacks against federated learning systems. In: European symposium on research in computer security. Springer, pp 480\u2013501","DOI":"10.1007\/978-3-030-58951-6_24"},{"key":"1724_CR14","doi-asserted-by":"crossref","unstructured":"Wang D, Yao W, Jiang T, Tang G, Chen X (2022) A survey on physical adversarial attack in computer vision. arXiv:2209.14262 arXiv preprint","DOI":"10.21203\/rs.3.rs-2459893\/v1"},{"key":"1724_CR15","unstructured":"Davidson D, Wu H, Jellinek R, Singh V, Ristenpart T (2016) Controlling $$\\{$$UAVs$$\\}$$ with sensor input spoofing attacks. In: 10th USENIX workshop on offensive technologies (WOOT 16)"},{"key":"1724_CR16","doi-asserted-by":"crossref","unstructured":"Wang B, Yao Y, Shan S, Li H, Viswanath B, Zheng H, Zhao BY (2019) Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In: 2019 IEEE symposium on security and privacy (SP). IEEE, pp 707\u2013723","DOI":"10.1109\/SP.2019.00031"},{"key":"1724_CR17","doi-asserted-by":"crossref","unstructured":"Li K, Ren W, Wang W, Zhang L, Cao X (2025) Detecting synthetic image by cross-modal commonality interaction. In: Proceedings of the 33rd ACM international conference on multimedia. pp 11367\u201311375","DOI":"10.1145\/3746027.3755049"},{"key":"1724_CR18","doi-asserted-by":"crossref","unstructured":"Li H, Wang W, Wang C, Wang M, Zhang X, Lan L, Liu X, Li K, Cao X (2025) Phrase grounding-based style transfer for single-domain generalized object detection. In: IEEE transactions on circuits and systems for video technology","DOI":"10.1109\/TCSVT.2025.3596089"},{"key":"1724_CR19","doi-asserted-by":"crossref","unstructured":"Liu Y, Shen G, Tao G, Wang Z, Ma S, Zhang X (2022) Complex backdoor detection by symmetric feature differencing. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 15003\u201315013","DOI":"10.1109\/CVPR52688.2022.01458"},{"key":"1724_CR20","unstructured":"Wang W, Xia H, Huang C, Ding Z, Wang C, Li H, Cao X Rethinking joint maximum mean discrepancy for visual domain adaptation. In: The thirty-ninth annual conference on neural information processing systems"},{"key":"1724_CR21","doi-asserted-by":"crossref","unstructured":"Wang W, Wang M, Huang C, Wang C, Mu J, Nie F, Cao X (2025) Optimal graph learning based label propagation for cross-domain image classification. In: IEEE transactions on image processing","DOI":"10.1109\/TIP.2025.3526380"},{"key":"1724_CR22","doi-asserted-by":"crossref","unstructured":"Liang S, Zhu M, Liu A, Wu B, Cao X, Chang E-C (2024) Badclip: Dual-embedding guided backdoor attack on multimodal contrastive learning. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 24645\u201324654","DOI":"10.1109\/CVPR52733.2024.02327"},{"key":"1724_CR23","doi-asserted-by":"crossref","unstructured":"Liang J, Liang S, Liu A, Cao X (2025) Vl-trojan: Multimodal instruction backdoor attacks against autoregressive visual language models. In: International journal of computer vision, 1\u201320","DOI":"10.1007\/s11263-025-02368-9"},{"key":"1724_CR24","doi-asserted-by":"publisher","first-page":"57733","DOI":"10.52202\/079017-1841","volume":"37","author":"Y Xu","year":"2024","unstructured":"Xu Y, Yao J, Shu M, Sun Y, Wu Z, Yu N, Goldstein T, Huang F (2024) Shadowcast: Stealthy data poisoning attacks against vision-language models. Adv Neural Inf Process Syst 37:57733\u201357764","journal-title":"Adv Neural Inf Process Syst"},{"key":"1724_CR25","unstructured":"Lu D, Pang T, Du C, Liu Q, Yang X, Lin M (2024) Test-time backdoor attacks on multimodal large language models. arXiv:2402.08577 arXiv preprint"},{"key":"1724_CR26","doi-asserted-by":"crossref","unstructured":"Jiang W, Li H, Xu G, Zhang T (2023) Color backdoor: a robust poisoning attack in color space. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 8133\u20138142","DOI":"10.1109\/CVPR52729.2023.00786"},{"key":"1724_CR27","doi-asserted-by":"crossref","unstructured":"Saha A, Subramanya A, Pirsiavash H (2020) Hidden trigger backdoor attacks. In: Proceedings of the AAAI conference on artificial intelligence, vol 34. pp 11957\u201311965","DOI":"10.1609\/aaai.v34i07.6871"},{"key":"1724_CR28","doi-asserted-by":"crossref","unstructured":"Wallace E, Feng S, Kandpal N, Gardner M, Singh S (2019) Universal adversarial triggers for attacking and analyzing nlp. arXiv:1908.07125 arXiv preprint","DOI":"10.18653\/v1\/D19-1221"},{"key":"1724_CR29","doi-asserted-by":"crossref","unstructured":"Rombach R, Blattmann A, Lorenz D, Esser P, Ommer B (2022) High-resolution image synthesis with latent diffusion models. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 10684\u201310695","DOI":"10.1109\/CVPR52688.2022.01042"},{"key":"1724_CR30","doi-asserted-by":"crossref","unstructured":"Caesar H, Bankiti V, Lang AH, Vora S, Liong VE, Xu Q, Krishnan A, Pan Y, Baldan G, Beijbom O (2020) nuscenes: A multimodal dataset for autonomous driving. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition. pp 11621\u201311631","DOI":"10.1109\/CVPR42600.2020.01164"},{"key":"1724_CR31","unstructured":"Dosovitskiy A (2020) An image is worth 16x16 words: transformers for image recognition at scale. arXiv:2010.11929 arXiv preprint"},{"key":"1724_CR32","doi-asserted-by":"crossref","unstructured":"Li Y, Li Y, Wu B, Li L, He R, Lyu S (2021) Invisible backdoor attack with sample-specific triggers. In: Proceedings of the IEEE\/CVF international conference on computer vision, pp. 16463\u201316472","DOI":"10.1109\/ICCV48922.2021.01615"},{"key":"1724_CR33","doi-asserted-by":"crossref","unstructured":"Papineni K, Roukos S, Ward T, Zhu W-J (2002) Bleu: a method for automatic evaluation of machine translation. In: Proceedings of the 40th annual meeting of the association for computational linguistics. pp 311\u2013318","DOI":"10.3115\/1073083.1073135"},{"key":"1724_CR34","unstructured":"Banerjee S, Lavie A (2005) Meteor: An automatic metric for mt evaluation with improved correlation with human judgments. In: Proceedings of the Acl workshop on intrinsic and extrinsic evaluation measures for machine translation and\/or summarization. pp 65\u201372"},{"key":"1724_CR35","unstructured":"Lin C-Y (2004) Rouge: A package for automatic evaluation of summaries. In: Text summarization branches out. pp 74\u201381"},{"key":"1724_CR36","doi-asserted-by":"crossref","unstructured":"Vedantam R, Lawrence Zitnick C, Parikh D (2015) Cider: Consensus-based image description evaluation. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp 4566\u20134575","DOI":"10.1109\/CVPR.2015.7299087"}],"container-title":["Pattern Analysis and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10044-026-01724-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s10044-026-01724-w","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s10044-026-01724-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,7,9]],"date-time":"2026-07-09T06:29:15Z","timestamp":1783578555000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s10044-026-01724-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,7,9]]},"references-count":36,"journal-issue":{"issue":"3","published-print":{"date-parts":[[2026,9]]}},"alternative-id":["1724"],"URL":"https:\/\/doi.org\/10.1007\/s10044-026-01724-w","relation":{},"ISSN":["1433-7541","1433-755X"],"issn-type":[{"value":"1433-7541","type":"print"},{"value":"1433-755X","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,7,9]]},"assertion":[{"value":"26 November 2025","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 June 2026","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"9 July 2026","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}],"article-number":"139"}}