{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T14:36:02Z","timestamp":1784644562425,"version":"3.55.0"},"reference-count":89,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","issue":"3","license":[{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,3,1]],"date-time":"2026-03-01T00:00:00Z","timestamp":1772323200000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans. Circuits Syst. Video Technol."],"published-print":{"date-parts":[[2026,3]]},"DOI":"10.1109\/tcsvt.2025.3625396","type":"journal-article","created":{"date-parts":[[2025,10,27]],"date-time":"2025-10-27T18:06:44Z","timestamp":1761588404000},"page":"3938-3950","source":"Crossref","is-referenced-by-count":2,"title":["Evaluating the Adversarial Robustness of Vision-Language Models via Internal Feature Perturbations"],"prefix":"10.1109","volume":"36","author":[{"ORCID":"https:\/\/orcid.org\/0009-0001-7588-4264","authenticated-orcid":false,"given":"Chaohu","family":"Liu","sequence":"first","affiliation":[{"name":"Tencent YouTu Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Yubo","family":"Wang","sequence":"additional","affiliation":[{"name":"Tencent YouTu Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-3789-9705","authenticated-orcid":false,"given":"Haoyu","family":"Cao","sequence":"additional","affiliation":[{"name":"Tencent YouTu Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Bing","family":"Liu","sequence":"additional","affiliation":[{"name":"Tencent YouTu Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Deqiang","family":"Jiang","sequence":"additional","affiliation":[{"name":"Tencent YouTu Lab, Shenzhen, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GPT-4 technical report","volume-title":"arXiv:2303.08774","author":"Achiam","year":"2023"},{"key":"ref2","article-title":"Qwen-VL: A versatile vision-language model for understanding, localization","author":"Bai","year":"2023","journal-title":"arXiv:2308.12966"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.52202\/075280-1516"},{"key":"ref4","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1093\/nsr\/nwae403"},{"key":"ref6","first-page":"42566","article-title":"InternLM-XComposer2-4KHD: A pioneering large vision-language model handling resolutions from 336 pixels to 4K HD","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"37","author":"Dong"},{"key":"ref7","article-title":"From images to textual prompts: Zero-shot VQA with frozen large language models","author":"Guo","year":"2022","journal-title":"arXiv:2212.10846"},{"key":"ref8","doi-asserted-by":"publisher","DOI":"10.1109\/ICME46284.2020.9102842"},{"key":"ref9","article-title":"MiniGPT-4: Enhancing vision-language understanding with advanced large language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent. (ICLR)","author":"Zhu"},{"key":"ref10","first-page":"20346","article-title":"Human-adversarial visual question answering","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Sheng"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TETCI.2020.2977695"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01471"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-19815-1_29"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.01788"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02527"},{"key":"ref16","article-title":"DriveMLM: Aligning multi-modal large language models with behavioral planning states for autonomous driving","author":"Wang","year":"2023","journal-title":"arXiv:2312.09245"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/tiv.2024.3402136"},{"key":"ref18","article-title":"Intriguing properties of neural networks","volume-title":"Proc. 2nd Int. Conf. Learn. Represent. (ICLR)","author":"Szegedy"},{"key":"ref19","article-title":"Explaining and harnessing adversarial examples","volume-title":"Proc. 3rd Int. Conf. Learn. Represent. (ICLR)","author":"Goodfellow"},{"key":"ref20","doi-asserted-by":"publisher","DOI":"10.1201\/9781351251389-8"},{"key":"ref21","article-title":"Towards evaluating the robustness of neural networks learned by transduction","author":"Chen","year":"2021","journal-title":"arXiv:2110.14735"},{"key":"ref22","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref23","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2020.3017006"},{"key":"ref25","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2025.3526248"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2021.3120479"},{"key":"ref27","article-title":"Abusing images and sounds for indirect instruction injection in multi-modal LLMs","author":"Bagdasaryan","year":"2023","journal-title":"arXiv:2307.10490"},{"key":"ref28","article-title":"Jailbreaking attack against multimodal large language model","author":"Niu","year":"2024","journal-title":"arXiv:2402.02309"},{"key":"ref29","first-page":"54111","article-title":"On evaluating adversarial robustness of large vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhao"},{"key":"ref30","article-title":"Test-time backdoor attacks on multimodal large language models","author":"Lu","year":"2024","journal-title":"arXiv:2402.08577"},{"key":"ref31","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2687"},{"key":"ref32","article-title":"An image is worth 1000 lies: Transferability of adversarial images across prompts on vision-language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent. (ICLR)","author":"Luo"},{"key":"ref33","article-title":"Inducing high energy-latency of large vision-language models with verbose images","author":"Gao","year":"2024","journal-title":"arXiv:2401.11170"},{"key":"ref34","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.48550\/ARXIV.1706.03762"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref38","first-page":"12888","article-title":"BLIP: Bootstrapping language-image pre-training for unified vision-language understanding and generation","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref39","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. 38th Int. Conf. Mach. Learn.","author":"Radford"},{"key":"ref40","article-title":"InstructBLIP: Towards general-purpose vision-language models with instruction tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst.","volume":"36","author":"Dai"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"ref42","volume-title":"LLaVA-NeXT: Improved Reasoning, OCR, and World Knowledge","author":"Liu","year":"2024"},{"key":"ref43","article-title":"PandaGPT: One model to instruction-follow them all","author":"Su","year":"2023","journal-title":"arXiv:2305.16355"},{"key":"ref44","article-title":"Feast your eyes: Mixture-of-resolution adaptation for multimodal large language models","author":"Luo","year":"2024","journal-title":"arXiv:2403.03003"},{"key":"ref45","article-title":"InternVL3.5: Advancing open-source multimodal models in versatility, reasoning, and efficiency","author":"Wang","year":"2025","journal-title":"arXiv:2508.18265"},{"key":"ref46","article-title":"Qwen2.5-VL technical report","author":"Bai","year":"2025","journal-title":"arXiv:2502.13923"},{"key":"ref47","article-title":"EVA-CLIP: Improved training techniques for CLIP at scale","author":"Sun","year":"2023","journal-title":"arXiv:2303.15389"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01457"},{"key":"ref49","article-title":"CoCa: Contrastive captioners are image-text foundation models","author":"Yu","year":"May 2023","journal-title":"Trans. Mach. Learn. Res."},{"key":"ref50","first-page":"38728","article-title":"MPLUG-2: A modularized multi-modal foundation model across text, image and video","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Xu"},{"key":"ref51","first-page":"9694","article-title":"Align before fuse: Vision and language representation learning with momentum distillation","volume-title":"Proc. Adv. Neural Inf. Process. Syst., Annu. Conf. Neural Inf. Process. Syst.","author":"Li"},{"key":"ref52","article-title":"Flamingo: A visual language model for few-shot learning","volume-title":"Proc. Adv. Neural Inf.Process. Syst., Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","volume":"35","author":"Alayrac"},{"key":"ref53","article-title":"VL-BEiT: Generative vision-language pretraining","author":"Bao","year":"2022","journal-title":"arXiv:2206.01127"},{"key":"ref54","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3860"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2025.3557474"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2022.3226905"},{"key":"ref57","article-title":"Understanding zero-shot adversarial robustness for large-scale models","volume-title":"Proc. 11th Int. Conf. Learn. Represent. (ICLR)","author":"Mao"},{"key":"ref58","article-title":"Patch-fool: Are vision transformers always robust against adversarial perturbations?","author":"Fu","year":"2022","journal-title":"arXiv:2203.08392"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00774"},{"key":"ref60","first-page":"3122","article-title":"Few-shot adversarial prompt learning on vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Zhou"},{"key":"ref61","article-title":"Efficiently adversarial examples generation for visual-language models under targeted transfer scenarios using diffusion models","author":"Guo","year":"2024","journal-title":"arXiv:2404.10335v2"},{"key":"ref62","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02508"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1049\/cit2.12028"},{"key":"ref64","first-page":"10932","article-title":"Improving black-box adversarial attacks with a transfer-based prior","volume-title":"Proc. Adv. Neural Inf. Process. Syst. 32, Annu. Conf. Neural Inf. Process. Syst. (NeurIPS)","author":"Cheng"},{"key":"ref65","first-page":"2484","article-title":"Simple opaque adversarial attacks","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Guo"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3563820"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.02357"},{"key":"ref68","article-title":"A review of adversarial attacks in computer vision","author":"Zhang","year":"2023","journal-title":"arXiv:2308.07673"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3490759"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3276442"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3307150"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00430"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.01575"},{"key":"ref74","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52688.2022.01457"},{"key":"ref75","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2025.3537806"},{"key":"ref76","doi-asserted-by":"publisher","DOI":"10.1109\/tcsvt.2025.3585436"},{"key":"ref77","article-title":"Advancing time series classification with multimodal language modeling","author":"Cheng","year":"2024","journal-title":"arXiv:2403.12371"},{"key":"ref78","article-title":"JailBreakV: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks","author":"Luo","year":"2024","journal-title":"arXiv:2404.03027"},{"key":"ref79","article-title":"Physical backdoor attack can jeopardize driving with vision-large-language models","author":"Ni","year":"2024","journal-title":"arXiv:2404.12916"},{"key":"ref80","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref81","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-72661-3_5"},{"key":"ref82","doi-asserted-by":"publisher","DOI":"10.1109\/tcsvt.2025.3602970"},{"key":"ref83","first-page":"1050","article-title":"Dropout as a Bayesian approximation: Representing model uncertainty in deep learning","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Gal"},{"key":"ref84","article-title":"Transferable adversarial attacks on opaque vision-language models","author":"Hu","year":"2025","journal-title":"arXiv:2505.01050"},{"key":"ref85","doi-asserted-by":"publisher","DOI":"10.1145\/3718751.3718815"},{"key":"ref86","article-title":"An image is worth 16\u00d716 words: Transformers for image recognition at scale","volume-title":"Proc. 9th Int. Conf. Learn. Represent. (ICLR)","author":"Dosovitskiy"},{"key":"ref87","article-title":"GPT-4o system card","author":"Hurst","year":"2024","journal-title":"arXiv:2410.21276"},{"key":"ref88","first-page":"43685","article-title":"Robust CLIP: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","author":"Schlarmann"},{"key":"ref89","doi-asserted-by":"publisher","DOI":"10.52202\/079017-3056"}],"container-title":["IEEE Transactions on Circuits and Systems for Video Technology"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/76\/11424237\/11217172.pdf?arnumber=11217172","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,9]],"date-time":"2026-03-09T20:01:06Z","timestamp":1773086466000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11217172\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026,3]]},"references-count":89,"journal-issue":{"issue":"3"},"URL":"https:\/\/doi.org\/10.1109\/tcsvt.2025.3625396","relation":{},"ISSN":["1051-8215","1558-2205"],"issn-type":[{"value":"1051-8215","type":"print"},{"value":"1558-2205","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026,3]]}}}