{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,3,12]],"date-time":"2026-03-12T15:38:05Z","timestamp":1773329885284,"version":"3.50.1"},"reference-count":72,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2025,1,1]],"date-time":"2025-01-01T00:00:00Z","timestamp":1735689600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62088102"],"award-info":[{"award-number":["62088102"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100001809","name":"National Key Research and Development Program of China","doi-asserted-by":"publisher","award":["2022ZD0160101"],"award-info":[{"award-number":["2022ZD0160101"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2025]]},"DOI":"10.1109\/tifs.2024.3520306","type":"journal-article","created":{"date-parts":[[2024,12,25]],"date-time":"2024-12-25T19:20:30Z","timestamp":1735154430000},"page":"1434-1446","source":"Crossref","is-referenced-by-count":15,"title":["B-AVIBench: Toward Evaluating the Robustness of Large Vision-Language Model on Black-Box Adversarial Visual-Instructions"],"prefix":"10.1109","volume":"20","author":[{"ORCID":"https:\/\/orcid.org\/0000-0002-3572-7053","authenticated-orcid":false,"given":"Hao","family":"Zhang","sequence":"first","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, Shaanxi, China"}]},{"given":"Wenqi","family":"Shao","sequence":"additional","affiliation":[{"name":"Shanghai Artificial Intelligence Laboratory, Shanghai, China"}]},{"given":"Hong","family":"Liu","sequence":"additional","affiliation":[{"name":"Institute for Datability Science, Osaka University, Osaka, Japan"}]},{"given":"Yongqiang","family":"Ma","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, Shaanxi, China"}]},{"given":"Ping","family":"Luo","sequence":"additional","affiliation":[{"name":"Shanghai Artificial Intelligence Laboratory, Shanghai, China"}]},{"given":"Yu","family":"Qiao","sequence":"additional","affiliation":[{"name":"Shanghai Artificial Intelligence Laboratory, Shanghai, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1608-8257","authenticated-orcid":false,"given":"Nanning","family":"Zheng","sequence":"additional","affiliation":[{"name":"Xi’an Jiaotong University, Xi’an, Shaanxi, China"}]},{"ORCID":"https:\/\/orcid.org\/0000-0001-6105-6532","authenticated-orcid":false,"given":"Kaipeng","family":"Zhang","sequence":"additional","affiliation":[{"name":"Shanghai Artificial Intelligence Laboratory, Shanghai, China"}]}],"member":"263","reference":[{"key":"ref1","doi-asserted-by":"publisher","DOI":"10.1007\/s11263-024-02126-3"},{"key":"ref2","article-title":"Gemini: A family of highly capable multimodal models","author":"Team","year":"2023","journal-title":"arXiv:2312.11805"},{"key":"ref3","article-title":"GPT-4 technical report","author":"OpenAI","year":"2023","journal-title":"arXiv:2303.08774"},{"key":"ref4","article-title":"Otter: A multi-modal model with in-context instruction tuning","author":"Li","year":"2023","journal-title":"arXiv:2305.03726"},{"key":"ref5","article-title":"InternLM-XComposer: A vision-language large model for advanced text-image comprehension and composition","author":"Zhang","year":"2023","journal-title":"arXiv:2309.15112"},{"key":"ref6","article-title":"ShareGPT4V: Improving large multi-modal models with better captions","author":"Chen","year":"2023","journal-title":"arXiv:2311.12793"},{"key":"ref7","article-title":"MoE-LLaVA: Mixture of experts for large vision-language models","author":"Lin","year":"2024","journal-title":"arXiv:2401.15947"},{"key":"ref8","volume-title":"Vicuna: An Open-source Chatbot Impressing GPT-4 With 90%* ChatGPT Quality","author":"Chiang et al","year":"2023"},{"key":"ref9","article-title":"LLaMA: Open and efficient foundation language models","author":"Touvron","year":"2023","journal-title":"arXiv:2302.13971"},{"key":"ref10","article-title":"LLaMA-adapter v2: Parameter-efficient visual instruction model","author":"Gao","year":"2023","journal-title":"arXiv:2304.15010"},{"key":"ref11","article-title":"GPT4RoI: Instruction tuning large language model on region-of-interest","author":"Zhang","year":"2023","journal-title":"arXiv:2307.03601"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2023.3246999"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2024.110698"},{"key":"ref14","doi-asserted-by":"publisher","DOI":"10.1109\/TCSVT.2024.3377365"},{"key":"ref15","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3306933"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2023.3237371"},{"key":"ref17","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3359820"},{"key":"ref18","article-title":"Promptbench: Towards evaluating the robustness of large language models on adversarial prompts","author":"Zhu","year":"2023","journal-title":"arXiv:2306.04528"},{"key":"ref19","article-title":"Universal and transferable adversarial attacks on aligned language models","author":"Zou","year":"2023","journal-title":"arXiv:2307.15043"},{"key":"ref20","article-title":"Harmbench: A standardized evaluation framework for automated red teaming and robust refusal","volume-title":"arXiv:2402.04249","author":"Mazeika","year":"2024"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"ref22","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref23","article-title":"Test-time backdoor attacks on multimodal large language models","author":"Lu","year":"2024","journal-title":"arXiv:2402.08577"},{"key":"ref24","article-title":"On evaluating adversarial robustness of large vision-language models","volume-title":"arXiv:2305.16934","author":"Zhao","year":"2023"},{"key":"ref25","article-title":"How robust is Google\u2019s bard to adversarial image attacks?","author":"Dong","year":"2023","journal-title":"arXiv:2309.11751"},{"key":"ref26","article-title":"Attacking visual language grounding with adversarial examples: A case study on neural image captioning","author":"Chen","year":"2017","journal-title":"arXiv:1712.02051"},{"key":"ref27","article-title":"TinyLVLM-eHub: Towards comprehensive and efficient evaluation for large vision-language models","author":"Shao","year":"2023","journal-title":"arXiv:2308.03729"},{"key":"ref28","article-title":"InstructBLIP: Towards general-purpose vision-language models with instruction tuning","author":"Dai","year":"2023","journal-title":"arXiv:2305.06500"},{"key":"ref29","article-title":"PandaGPT: One model to instruction-follow them all","author":"Su","year":"2023","journal-title":"arXiv:2305.16355"},{"key":"ref30","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02484"},{"key":"ref31","volume-title":"Openflamingo V2","author":"Anas","year":"2023"},{"key":"ref32","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref33","article-title":"MiniGPT-4: Enhancing vision-language understanding with advanced large language models","volume-title":"arXiv:2304.10592","author":"Zhu","year":"2023"},{"key":"ref34","article-title":"LoRA: Low-rank adaptation of large language models","author":"Hu","year":"2021","journal-title":"arXiv:2106.09685"},{"key":"ref35","article-title":"LVLM-eHub: A comprehensive evaluation benchmark for large vision-language models","author":"Xu","year":"2023","journal-title":"arXiv:2306.09265"},{"key":"ref36","article-title":"MME: A comprehensive evaluation benchmark for multimodal large language models","author":"Fu","year":"2023","journal-title":"arXiv:2306.13394"},{"key":"ref37","article-title":"LAMM: Language-assisted multi-modal instruction-tuning dataset, framework, and benchmark","author":"Yin","year":"2023","journal-title":"arXiv:2306.06687"},{"key":"ref38","article-title":"MMBench: Is your multi-modal model an all-around player?","author":"Liu","year":"2023","journal-title":"arXiv:2307.06281"},{"key":"ref39","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.01263"},{"key":"ref40","article-title":"Benchmarking robustness of adaptation methods on pre-trained vision-language models","volume-title":"arXiv:2306.02080","author":"Chen","year":"2023"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02304"},{"key":"ref42","first-page":"8748","article-title":"Learning transferable visual models from natural language supervision","volume-title":"Proc. ICML","author":"Radford"},{"key":"ref43","first-page":"43685","article-title":"Robust CLIP: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models","volume-title":"Proc. 41st Int. Conf. Mach. Learn.","author":"Schlarmann"},{"key":"ref44","article-title":"Image hijacks: Adversarial images can control generative models at runtime","volume-title":"arXiv:2309.00236","author":"Bailey","year":"2023"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52733.2024.02325"},{"key":"ref46","article-title":"How many unicorns are in this image? A safety evaluation benchmark for vision LLMs","author":"Tu","year":"2023","journal-title":"arXiv:2311.16101"},{"key":"ref47","article-title":"Benchmarking large multimodal models against common corruptions","author":"Zhang","year":"2024","journal-title":"arXiv:2401.11943"},{"key":"ref48","article-title":"Debiasing vision-language models via biased prompts","author":"Chuang","year":"2023","journal-title":"arXiv:2302.00070"},{"key":"ref49","article-title":"Vision-language models performing zero-shot tasks exhibit gender-based disparities","author":"Hall","year":"2023","journal-title":"arXiv:2301.11100"},{"key":"ref50","article-title":"Are aligned neural networks adversarially aligned?","volume-title":"arXiv:2306.15447","author":"Carlini","year":"2023"},{"key":"ref51","article-title":"Visual instruction tuning","volume-title":"arXiv:2304.08485","author":"Liu","year":"2023"},{"key":"ref52","article-title":"MPLUG-owl: Modularization empowers large language models with multimodality","author":"Ye","year":"2023","journal-title":"arXiv:2304.14178"},{"key":"ref53","article-title":"Transfer visual prompt generator across LLMs","author":"Zhang","year":"2023","journal-title":"arXiv:2305.01278"},{"key":"ref54","article-title":"Learning multiple layers of features from tiny images","author":"Krizhevsky","year":"2009"},{"key":"ref55","doi-asserted-by":"publisher","DOI":"10.1145\/3219819.3219839"},{"key":"ref56","article-title":"Microsoft COCO captions: Data collection and evaluation server","author":"Chen","year":"2015","journal-title":"arXiv:1504.00325"},{"key":"ref57","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00247"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-031-20074-8_9"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2018.2828437"},{"key":"ref60","article-title":"Benchmarking neural network robustness to common corruptions and surface variations","author":"Hendrycks","year":"2018","journal-title":"arXiv:1807.01697"},{"key":"ref61","first-page":"12921","article-title":"Decision-based black-box attack against vision transformers via patch-wise adversarial removal","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","author":"Shi"},{"key":"ref62","article-title":"Decision-based adversarial attacks: Reliable attacks against black-box machine learning models","author":"Brendel","year":"2017","journal-title":"arXiv:1712.04248"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR46437.2021.01029"},{"key":"ref64","article-title":"TextBugger: Generating adversarial text against real-world applications","author":"Li","year":"2018","journal-title":"arXiv:1812.05271"},{"key":"ref65","doi-asserted-by":"publisher","DOI":"10.1109\/SPW.2018.00016"},{"key":"ref66","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.emnlp-main.500"},{"key":"ref67","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v34i05.6311"},{"key":"ref68","article-title":"Stress test evaluation for natural language inference","author":"Naik","year":"2018","journal-title":"arXiv:1806.00692"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/2020.acl-main.442"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1561"},{"key":"ref71","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/P19-1103"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/D18-1407"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/10810755\/10816024.pdf?arnumber=10816024","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,1,30]],"date-time":"2025-01-30T19:14:21Z","timestamp":1738264461000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/10816024\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025]]},"references-count":72,"URL":"https:\/\/doi.org\/10.1109\/tifs.2024.3520306","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2025]]}}}