{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,7,21]],"date-time":"2026-07-21T14:36:06Z","timestamp":1784644566775,"version":"3.55.0"},"reference-count":74,"publisher":"Institute of Electrical and Electronics Engineers (IEEE)","license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/ieeexplore.ieee.org\/Xplorehelp\/downloads\/license-information\/IEEE.html"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-029"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"stm-asf","delay-in-days":0,"URL":"https:\/\/doi.org\/10.15223\/policy-037"}],"funder":[{"DOI":"10.13039\/501100018537","name":"New Generation Artificial Intelligence-National Science and Technology Major Project","doi-asserted-by":"publisher","award":["2025ZD0123602"],"award-info":[{"award-number":["2025ZD0123602"]}],"id":[{"id":"10.13039\/501100018537","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Wuhan University -Kingsoft Joint Laboratory"},{"DOI":"10.13039\/501100001809","name":"National Natural Science Foundation of China","doi-asserted-by":"publisher","award":["62476107"],"award-info":[{"award-number":["62476107"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]},{"DOI":"10.13039\/501100019014","name":"Shenzhen Science and Technology Program","doi-asserted-by":"publisher","award":["JCYJ20250604191037048"],"award-info":[{"award-number":["JCYJ20250604191037048"]}],"id":[{"id":"10.13039\/501100019014","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["IEEE Trans.Inform.Forensic Secur."],"published-print":{"date-parts":[[2026]]},"DOI":"10.1109\/tifs.2026.3671065","type":"journal-article","created":{"date-parts":[[2026,3,5]],"date-time":"2026-03-05T20:42:22Z","timestamp":1772743342000},"page":"2564-2579","source":"Crossref","is-referenced-by-count":1,"title":["Are Large Vision-Language Models Robust to Adversarial Visual Transformations?"],"prefix":"10.1109","volume":"21","author":[{"ORCID":"https:\/\/orcid.org\/0000-0001-8179-4508","authenticated-orcid":false,"given":"Daizong","family":"Liu","sequence":"first","affiliation":[{"name":"Institute for Math & AI, Wuhan University, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"given":"Xiaowen","family":"Cai","sequence":"additional","affiliation":[{"name":"Shenzhen Huazhong University of Science and Technology Research Institute, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-8629-4622","authenticated-orcid":false,"given":"Pan","family":"Zhou","sequence":"additional","affiliation":[{"name":"Shenzhen Huazhong University of Science and Technology Research Institute, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-4907-3978","authenticated-orcid":false,"given":"Xiaoye","family":"Qu","sequence":"additional","affiliation":[{"name":"Shenzhen Huazhong University of Science and Technology Research Institute, Huazhong University of Science and Technology, Wuhan, China"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1539-7939","authenticated-orcid":false,"given":"Lichao","family":"Sun","sequence":"additional","affiliation":[{"name":"Department of Computer Science and Engineering, Lehigh University, Bethlehem, PA, USA"}],"role":[{"vocabulary":"crossref","role":"author"}]},{"ORCID":"https:\/\/orcid.org\/0000-0002-9860-0922","authenticated-orcid":false,"given":"Wei","family":"Hu","sequence":"additional","affiliation":[{"name":"Wangxuan Institute of Computer Technology, Peking University, Beijing, China"}],"role":[{"vocabulary":"crossref","role":"author"}]}],"member":"263","reference":[{"key":"ref1","article-title":"GLIDE: Towards photorealistic image generation and editing with text-guided diffusion models","author":"Nichol","year":"2021","journal-title":"arXiv:2112.10741"},{"key":"ref2","doi-asserted-by":"publisher","DOI":"10.1109\/TMM.2025.3535316"},{"key":"ref3","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2025.3607632"},{"key":"ref4","first-page":"19730","article-title":"BLIP-2: Bootstrapping language-image pre-training with frozen image encoders and large language models","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Li"},{"key":"ref5","doi-asserted-by":"publisher","DOI":"10.1016\/j.asoc.2025.113704"},{"key":"ref6","doi-asserted-by":"publisher","DOI":"10.1016\/j.eswa.2025.130565"},{"key":"ref7","article-title":"An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models","author":"Luo","year":"2024","journal-title":"arXiv:2403.09766"},{"key":"ref8","first-page":"54111","article-title":"On evaluating adversarial robustness of large vision-language models","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Zhao"},{"key":"ref9","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3574976"},{"key":"ref10","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3586430"},{"key":"ref11","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2024.3518072"},{"key":"ref12","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2025.3583249"},{"key":"ref13","doi-asserted-by":"publisher","DOI":"10.1109\/TIP.2018.2867733"},{"key":"ref14","first-page":"1","article-title":"Fit the distribution: Cross-image\/prompt adversarial attacks on multimodal large language models","volume-title":"Proc. 39th Annu. Conf. Neural Inf. Process. Syst.","author":"Yan"},{"key":"ref15","first-page":"1","article-title":"Towards building model\/prompt-transferable attackers against large vision-language models","volume-title":"Proc. 39th Annu. Conf. Neural Inf. Process. Syst.","author":"Cai"},{"key":"ref16","doi-asserted-by":"publisher","DOI":"10.1109\/TNNLS.2025.3592935"},{"key":"ref17","article-title":"Image hijacks: Adversarial images can control generative models at runtime","author":"Bailey","year":"2023","journal-title":"arXiv:2309.00236"},{"key":"ref18","article-title":"How robust is Google\u2019s bard to adversarial image attacks?","author":"Dong","year":"2023","journal-title":"arXiv:2309.11751"},{"key":"ref19","article-title":"InstructTA: Instruction-tuned targeted attack for large vision-language models","author":"Wang","year":"2023","journal-title":"arXiv:2312.01886"},{"key":"ref20","article-title":"Stop reasoning! When multimodal LLM with chain-of-thought reasoning meets adversarial image","author":"Wang","year":"2024","journal-title":"arXiv:2402.14899"},{"key":"ref21","doi-asserted-by":"publisher","DOI":"10.1109\/tifs.2024.3520306"},{"key":"ref22","article-title":"Test-time backdoor attacks on multimodal large language models","author":"Lu","year":"2024","journal-title":"arXiv:2402.08577"},{"key":"ref23","article-title":"ImgTrojan: Jailbreaking vision-language models with ONE image","author":"Tao","year":"2024","journal-title":"arXiv:2403.02910"},{"key":"ref24","doi-asserted-by":"publisher","DOI":"10.1109\/SMC54092.2024.10831129"},{"key":"ref25","article-title":"Safety of multimodal large language models on images and texts","author":"Liu","year":"2024","journal-title":"arXiv:2402.00357"},{"key":"ref26","doi-asserted-by":"publisher","DOI":"10.1609\/aaai.v38i19.30150"},{"key":"ref27","first-page":"1","article-title":"Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models","volume-title":"Proc. 12th Int. Conf. Learn. Represent.","author":"Shayegani"},{"key":"ref28","article-title":"Inducing high energy-latency of large vision-language models with verbose images","author":"Gao","year":"2024","journal-title":"arXiv:2401.11170"},{"key":"ref29","article-title":"Abusing images and sounds for indirect instruction injection in multi-modal LLMs","author":"Bagdasaryan","year":"2023","journal-title":"arXiv:2307.10490"},{"key":"ref30","article-title":"Can language models be instructed to protect personal information?","author":"Chen","year":"2023","journal-title":"arXiv:2310.02224"},{"key":"ref31","article-title":"Jailbreaking GPT-4 V via self-adversarial attacks with system prompts","author":"Wu","year":"2023","journal-title":"arXiv:2311.09127"},{"key":"ref32","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-46493-0_38"},{"key":"ref33","first-page":"84","article-title":"Imagenet classification with deep convolutional neural networks","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"25","author":"Krizhevsky"},{"key":"ref34","article-title":"Very deep convolutional networks for large-scale image recognition","author":"Simonyan","year":"2014","journal-title":"arXiv:1409.1556"},{"key":"ref35","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2022.3193449"},{"key":"ref36","doi-asserted-by":"publisher","DOI":"10.1109\/TPAMI.2023.3339130"},{"key":"ref37","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01110"},{"key":"ref38","doi-asserted-by":"publisher","DOI":"10.1109\/ICCVW60793.2023.00395"},{"key":"ref39","article-title":"On the robustness of large multimodal models against image adversarial attacks","author":"Cui","year":"2023","journal-title":"arXiv:2312.03777"},{"key":"ref40","article-title":"Adversarial robustness for visual grounding of multimodal large language models","author":"Gao","year":"2024","journal-title":"arXiv:2405.09981"},{"key":"ref41","doi-asserted-by":"publisher","DOI":"10.1109\/SP54263.2024.00102"},{"key":"ref42","article-title":"How many unicorns are in this image? A safety evaluation benchmark for vision LLMs","author":"Tu","year":"2023","journal-title":"arXiv:2311.16101"},{"key":"ref43","article-title":"Efficiently adversarial examples generation for visual-language models under targeted transfer scenarios using diffusion models","author":"Guo","year":"2024","journal-title":"arXiv:2404.10335"},{"key":"ref44","doi-asserted-by":"publisher","DOI":"10.48550\/arxiv.1710.09412"},{"key":"ref45","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV.2019.00612"},{"key":"ref46","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00020"},{"key":"ref47","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV51070.2023.00425"},{"key":"ref48","doi-asserted-by":"publisher","DOI":"10.1109\/ICCV48922.2021.00741"},{"key":"ref49","doi-asserted-by":"publisher","DOI":"10.1109\/TIFS.2021.3062977"},{"key":"ref50","first-page":"34892","article-title":"Visual instruction tuning","volume-title":"Proc. Adv. Neural Inf. Process. Syst.","volume":"36","author":"Liu"},{"key":"ref51","article-title":"MiniGPT-4: Enhancing vision-language understanding with advanced large language models","author":"Zhu","year":"2023","journal-title":"arXiv:2304.10592"},{"key":"ref52","doi-asserted-by":"publisher","DOI":"10.52202\/075280-2142"},{"key":"ref53","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.670"},{"key":"ref54","article-title":"SVIT: Scaling up visual instruction tuning","author":"Zhao","year":"2023","journal-title":"arXiv:2307.04087"},{"key":"ref55","first-page":"8821","article-title":"Zero-shot text-to-image generation","volume-title":"Proc. Int. Conf. Mach. Learn. (ICML)","author":"Ramesh"},{"key":"ref56","doi-asserted-by":"publisher","DOI":"10.18653\/v1\/d19-1410"},{"key":"ref57","article-title":"Towards deep learning models resistant to adversarial attacks","author":"Madry","year":"2017","journal-title":"arXiv:1706.06083"},{"key":"ref58","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2017.17"},{"key":"ref59","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2018.00957"},{"key":"ref60","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2019.00444"},{"key":"ref61","doi-asserted-by":"publisher","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref62","article-title":"OpenFlamingo: An open-source framework for training large autoregressive vision-language models","author":"Awadalla","year":"2023","journal-title":"arXiv:2308.01390"},{"key":"ref63","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01853"},{"key":"ref64","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52729.2023.00396"},{"key":"ref65","article-title":"Mitigating adversarial effects through randomization","author":"Xie","year":"2017","journal-title":"arXiv:1711.01991"},{"key":"ref66","article-title":"Countering adversarial images using input transformations","author":"Guo","year":"2017","journal-title":"arXiv:1711.00117"},{"key":"ref67","article-title":"Diffusion models for adversarial purification","author":"Nie","year":"2022","journal-title":"arXiv:2205.07460"},{"key":"ref68","doi-asserted-by":"publisher","DOI":"10.1145\/3664647.3680779"},{"key":"ref69","doi-asserted-by":"publisher","DOI":"10.52202\/079017-1652"},{"key":"ref70","doi-asserted-by":"publisher","DOI":"10.1109\/SP.2017.49"},{"key":"ref71","first-page":"284","article-title":"Synthesizing robust adversarial examples","volume-title":"Proc. Int. Conf. Mach. Learn.","author":"Athalye"},{"key":"ref72","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR52734.2025.01368"},{"key":"ref73","doi-asserted-by":"publisher","DOI":"10.1109\/CVPR.2009.5206848"},{"key":"ref74","first-page":"1665","article-title":"GLEAM: Enhanced transferable adversarial attacks for vision-language pre-training models via global\u2013local transformations","volume-title":"Proc. IEEE\/CVF Int. Conf. Comput. Vis.","author":"Liu"}],"container-title":["IEEE Transactions on Information Forensics and Security"],"original-title":[],"link":[{"URL":"http:\/\/xplorestaging.ieee.org\/ielx8\/10206\/11313711\/11421907.pdf?arnumber=11421907","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,3,18]],"date-time":"2026-03-18T19:37:54Z","timestamp":1773862674000},"score":1,"resource":{"primary":{"URL":"https:\/\/ieeexplore.ieee.org\/document\/11421907\/"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"references-count":74,"URL":"https:\/\/doi.org\/10.1109\/tifs.2026.3671065","relation":{},"ISSN":["1556-6013","1556-6021"],"issn-type":[{"value":"1556-6013","type":"print"},{"value":"1556-6021","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]}}}