{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,5,4]],"date-time":"2026-05-04T10:19:36Z","timestamp":1777889976224,"version":"3.51.4"},"reference-count":51,"publisher":"IEEE","license":[{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,10,19]],"date-time":"2025-10-19T00:00:00Z","timestamp":1760832000000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2025,10,19]]},"DOI":"10.1109\/iccv51701.2025.00266","type":"proceedings-article","created":{"date-parts":[[2026,4,29]],"date-time":"2026-04-29T19:45:49Z","timestamp":1777491949000},"page":"2773-2782","source":"Crossref","is-referenced-by-count":0,"title":["Safeguarding Vision-Language Models: Mitigating Vulnerabilities to Gaussian Noise in Perturbation-Based Attacks"],"prefix":"10.1109","author":[{"given":"Jiawei","family":"Wang","sequence":"first","affiliation":[{"name":"University of Science and Technology of China"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yushen","family":"Zuo","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yuanjun","family":"Chai","sequence":"additional","affiliation":[{"name":"University of Washington"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Zhendong","family":"Liu","sequence":"additional","affiliation":[{"name":"Nanjing University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yicheng","family":"Fu","sequence":"additional","affiliation":[{"name":"Stanford University"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Yichun","family":"Feng","sequence":"additional","affiliation":[{"name":"University of Chinese Academy of Sciences"}],"role":[{"role":"author","vocabulary":"crossref"}]},{"given":"Kin-Man","family":"Lam","sequence":"additional","affiliation":[{"name":"The Hong Kong Polytechnic University"}],"role":[{"role":"author","vocabulary":"crossref"}]}],"member":"263","reference":[{"key":"ref1","article-title":"Gpt-4 technical report","author":"Achiam","year":"2023","journal-title":"arXiv preprint"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2015.279"},{"key":"ref3","article-title":"Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond","author":"Bai","year":"2023","journal-title":"arXiv preprint"},{"key":"ref4","article-title":"Qwen2. 5-vl technical report","author":"Bai","year":"2025","journal-title":"arXiv preprint"},{"key":"ref5","article-title":"Training a helpful and harmless assistant with reinforcement learning from human feedback","author":"Bai","year":"2022","journal-title":"arXiv preprint"},{"key":"ref6","article-title":"Safety-tuned llamas: Lessons from improving the safety of large language models that follow instructions","author":"Bianchi","year":"2024","journal-title":"ICLR"},{"key":"ref7","article-title":"A short note on the kinetics-700 human action dataset","author":"Carreira","year":"2019","journal-title":"arXiv preprint"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1007\/s11432-024-4231-5"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2142"},{"key":"ref10","article-title":"Diffusion models beat gans on image synthesis","author":"Dhariwal","year":"2021","journal-title":"NeurIPS"},{"key":"ref11","article-title":"Vlmguard: Defending vlms against malicious prompts via unlabeled data","author":"Du","year":"2024","journal-title":"arXiv preprint"},{"key":"ref12","article-title":"The llama 3 herd of models","author":"Dubey","year":"2024","journal-title":"arXiv preprint"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/SMC54092.2024.10831129"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1145\/3699682.3728327"},{"key":"ref15","article-title":"Red teaming language models to reduce harms: Methods, scaling behaviors, and lessons learned","author":"Ganguli","year":"2022","journal-title":"arXiv preprint"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.findings-emnlp.301"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v39i22.34568"},{"key":"ref18","article-title":"Explaining and harnessing adversarial examples","author":"Ian","year":"2014","journal-title":"arXiv preprint"},{"key":"ref19","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.670"},{"key":"ref20","volume-title":"Detoxify. Github","year":"2020"},{"key":"ref21","article-title":"Denoising diffusion probabilistic models","author":"Ho","year":"2020","journal-title":"NeurIPS"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01354"},{"key":"ref23","article-title":"Lora: Low-rank adaptation of large language models","author":"Edward","year":"2022","journal-title":"ICLR"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00686"},{"key":"ref25","article-title":"Jailbreakzoo: Survey, landscapes, and horizons in jailbreaking large language and vision-language models","author":"Jin","year":"2024","journal-title":"arXiv preprint"},{"key":"ref26","article-title":"The hateful memes challenge: detecting hate speech in multimodal memes","author":"Kiela","year":"2020","journal-title":"NeurIPS"},{"key":"ref27","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-73464-9_11"},{"key":"ref28","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref29","article-title":"Visual instruction tuning","author":"Liu","year":"2024","journal-title":"NeurIPS"},{"key":"ref30","article-title":"Dynamic prompt learning via policy gradient for semi-structured mathematical reasoning","author":"Lu","year":"2023","journal-title":"ICLR"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2022.findings-acl.177"},{"key":"ref32","article-title":"Rareact: A video dataset of unusual interactions","author":"Miech","year":"2020","journal-title":"arXiv preprint"},{"key":"ref33","article-title":"Diffusion models for adversarial purification","volume-title":"International Conference on Machine Learning","author":"Nie","year":"2022"},{"key":"ref34","volume-title":"OpenAI. Gpt-4v(ision) system card","year":"2023"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref36","article-title":"Learning transferable visual models from natural language supervision","volume-title":"International Conference on Machine Learning","author":"Radford","year":"2021"},{"key":"ref37","article-title":"Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models","volume-title":"ICLR 2024 Workshop on Reliable and Responsible Foundation Models","author":"Schlarmann","year":"2024"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20074-8_9"},{"key":"ref39","article-title":"Jailbreak in pieces: Compositional adversarial attacks on multimodal language models","author":"Shayegani","year":"2023","journal-title":"ICLR"},{"key":"ref40","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D13-1170"},{"key":"ref41","article-title":"Safeguarding vision-language models against patched visual prompt injectors","author":"Sun","year":"2024","journal-title":"arXiv preprint"},{"key":"ref42","article-title":"Intriguing properties of neural networks","author":"Szegedy","year":"2013","journal-title":"arXiv preprint"},{"key":"ref43","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00715"},{"key":"ref44","article-title":"Jailbroken: How does llm safety training fail","author":"Wei","year":"2023","journal-title":"NeurIPS"},{"key":"ref45","article-title":"Defending jailbreak attack in vlms via cross-modality information detector","author":"Xu","year":"2024","journal-title":"arXiv preprint"},{"key":"ref46","article-title":"Mm -vet: Evaluating large multimodal models for integrated capabilities","volume-title":"International Conference on Machine Learning","author":"Yu","year":"2023"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1145\/3503161.3547801"},{"key":"ref48","article-title":"Adversarial prompt tuning for vision-language models","author":"Zhang","year":"2023","journal-title":"arXiv preprint"},{"key":"ref49","article-title":"A mutationbased method for multi-modal jailbreaking attack detection","author":"Zhang","year":"2023","journal-title":"arXiv preprint"},{"key":"ref50","article-title":"Minigpt-4: Enhancing vision-language understanding with advanced large language models","author":"Zhu","year":"2024","journal-title":"ICLR"},{"key":"ref51","article-title":"Safety fine-tuning at (almost) no cost: A baseline for vision large language models","volume-title":"International Conference on Machine Learning","author":"Zong","year":"2024"}],"event":{"name":"2025 IEEE\/CVF International Conference on Computer Vision (ICCV)","location":"Honolulu, HI, USA","start":{"date-parts":[[2025,10,19]]},"end":{"date-parts":[[2025,10,25]]}},"container-title":["2025 IEEE\/CVF International Conference on Computer Vision (ICCV)"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/11443115\/11443287\/11445897.pdf?arnumber=11445897","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,5,1]],"date-time":"2026-05-01T05:25:38Z","timestamp":1777613138000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11445897\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,10,19]]},"references-count":51,"URL":"https:\/\/doi.org\/10.1109\/iccv51701.2025.00266","relation":{},"subject":[],"published":{"date-parts":[[2025,10,19]]}}}