🤖 AI

VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models

This paper argues that high reported success rates for universal adversarial attacks on vision-language models conflate general output perturbation with precise prompt injection, revealing through a novel dual-dimension evaluation that while imperceptible perturbations frequently disturb model outputs, they rarely achieve actual injection, with only 0.756% of tested cases reaching any non-none injection tier.

Original authors: Pang Liu, Yingjie Lao

Published 2026-05-06

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Pang Liu, Yingjie Lao

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, polite robot assistant that can look at photos and describe what it sees. You ask it, "What's in this picture of a dog?" and it says, "It's a golden retriever playing in a park."

Now, imagine a hacker wants to trick this robot into saying something specific, like "Visit this shady website." They can't change the robot's brain or the words you type. Their only tool is to add a tiny, invisible layer of "static" to the photo of the dog—so small that a human eye can't see it, but the robot's "eyes" might notice.

This paper, VisInject, asks a very simple but crucial question: Does this invisible static actually make the robot say the hacker's secret phrase, or does it just make the robot say something different?

The authors found that previous reports were mixing up two very different things. Here is the breakdown using simple analogies:

1. The Two Different Outcomes: "Confusion" vs. "Hijacking"

The paper argues that researchers have been counting "Confusion" as if it were "Hijacking."

Confusion (Influence/Drift): The robot sees the photo with the invisible static and gets confused. Instead of saying "a dog in a park," it might say, "This looks like a collage of text" or "I see a blurry mess." The robot's answer changed, but it didn't say what the hacker wanted.
- Analogy: It's like someone whispering a distraction in a student's ear during a test. The student stops writing about the history question and starts scribbling nonsense. They are distracted, but they didn't write the wrong answer the teacher was worried about.
Hijacking (Precise Injection): The robot sees the static and, against all odds, spits out the exact secret phrase the hacker wanted, like "Visit www.example.com."
- Analogy: This is the student ignoring the distraction entirely and writing the specific wrong answer the intruder wanted them to write.

The Big Discovery: The paper found that Confusion is very common (happening about 66% of the time), but Hijacking is incredibly rare (happening less than 1% of the time, and often not at all).

2. The "Magic Trick" Setup

To prove this, the researchers combined two existing "magic tricks" (attack methods) from other scientists:

The Universal Noise: A special image that is designed to confuse any question you ask about it.
The Carrier: A tool that takes that confusing noise and paints it onto a normal, real photo (like a picture of a cat or a document) so it looks like a regular photo to humans.

They ran this setup on 6,615 different scenarios using four different open-source robot assistants.

3. The Results: A 90-to-1 Gap

The headline number from previous studies was that these attacks work 60–80% of the time. The authors say, "That's misleading."

The "Drift" Rate: When they checked if the robot's answer changed at all, it changed 66% of the time. The robots were definitely confused.
The "Hijack" Rate: When they checked if the robot actually said the hacker's secret phrase, it happened only 0.75% of the time.
The Verbatim Rate: When they checked if the robot said the exact words the hacker wanted (like a specific URL), it happened only 0.03% of the time (2 times out of 6,615).

The Analogy: Imagine a magician tries to make a coin disappear. In 66 out of 100 tries, the coin moves to a different spot (Confusion). But in only 1 out of 100 tries does the coin actually vanish completely (Hijack). Previous reports were saying, "Look! The coin moved 66% of the time! The magician is amazing!" The authors are saying, "Wait, the coin didn't vanish. It just moved. The magician isn't as powerful as we thought."

4. Why Some Photos Work Better Than Others

The researchers noticed that the few times the robot did say the secret phrase, it only happened with specific types of photos.

Natural Photos: If the photo was a dog or a cat, the robot almost never said the secret phrase.
Document Photos: If the photo was a screenshot of a website, a code editor, or a bill, the robot was slightly more likely to say the secret phrase.
Why? The authors explain that if the photo already looks like a document with text (like a bill), the robot is already expecting to read text. The invisible static just nudges the robot to read the "wrong" text (the hacker's phrase) instead of the real text. If the photo is a dog, the robot is expecting to describe fur and paws, so the secret phrase doesn't fit in the story.

5. The "Super-Resistant" Robot

One of the most interesting findings involved a specific robot model called BLIP-2.

While the other three robots got confused by the invisible static 100% of the time, BLIP-2 didn't even notice.
Even when the researchers tried to use BLIP-2 to help create the attack, the attack failed completely against it later.
The Reason: The authors suggest BLIP-2 has a "bottleneck" in its brain. It compresses the image into a tiny summary before reading it. This compression acts like a filter that wipes out the tiny, invisible static before the robot can even see it. It's like trying to whisper a secret through a thick wall; the other robots heard it, but BLIP-2's wall was too strong.

Summary

The paper concludes that while invisible attacks can definitely confuse vision-language models (making them give weird or different answers), they are terrible at forcing the models to say specific, dangerous phrases.

The "90x gap" means that if you are worried about a robot being tricked into saying a specific URL or password, you are likely overestimating the danger. The robot is much more likely to just get confused and say something silly than to obediently follow the hacker's command.

The Takeaway: Don't panic about the "60-80% success rate" you might have read about. That number mostly counts "confusion," not "hijacking." The real danger of these specific attacks is much, much lower than the headlines suggest.

Based on the provided paper, here is a detailed technical summary of VisInject: Disruption ≠ Injection — A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models.

Problem Statement

Recent literature on Universal Adversarial Attacks (UAA) against Vision-Language Models (VLMs) reports high Attack Success Rates (ASR) in the 60–80% range. These metrics suggest that imperceptible pixel perturbations can serve as a viable prompt-injection channel, potentially overriding safety alignments. However, the authors argue that these reported numbers conflate two distinct events:

Influence (Drift): The model's output is perturbed and differs from the clean baseline.
Precise Injection (Payload Delivery): The attacker's specific target string or concept actually appears in the response.

The paper posits that existing benchmarks, which often rely on a single "did the output change?" metric, systematically overstate the utility of visual attacks as a delivery vector for specific payloads.

Methodology

The authors propose VisInject, a three-stage pipeline that composes existing attack methods with a novel dual-dimension evaluation framework.

1. Attack Pipeline (Stages 1 & 2):

Stage 1 (Universal Signal Generation): Utilizes the Universal Adversarial Attack (UAA) method by Rahmatullaev et al. (24). A single "universal" adversarial image is optimized via PGD (Projected Gradient Descent) against an ensemble of 2–4 open VLMs (Qwen2.5-VL, Qwen2-VL, DeepSeek-VL, BLIP-2) using 60 benign prompts. The goal is to create an image that drives the model toward a chosen target phrase regardless of the user's prompt.
Stage 2 (Realistic Carrier Fusion): Utilizes the AnyAttack encoder–decoder framework by Zhang et al. (29). The universal adversarial signal from Stage 1 is encoded via a frozen CLIP encoder and decoded into an $L_\infty$ -bounded noise tensor. This noise is added to arbitrary clean photos (e.g., natural scenes, screenshots) to create realistic adversarial carriers. The perturbation budget is constrained to $L_\infty \le 16/255$ (PSNR $\approx$ 25.2 dB).

2. Dual-Dimension Evaluation (Stage 3):
Instead of a single ASR metric, the pipeline scores every (clean, adversarial) response pair along two independent axes using an LLM judge (DeepSeek-V4-Pro, calibrated against Claude Opus 4.7):

Influence (Drift): Measures if the response deviated from the clean baseline. Evaluated via a deterministic Ratcliff-Obershelp string similarity score (programmatic baseline) and a 4-tier ordinal LLM judgment (none, slight, substantial, complete).
Precise Injection (Payload Delivery): Measures if the specific target concept appeared. Evaluated via a 4-tier ordinal LLM judgment:
- None: No target content.
- Weak: Thematic fragments (e.g., "PRESIDENT" for an election target).
- Partial: Semantic-class variants (e.g., "account number" for "card number").
- Confirmed: Verbatim or near-verbatim target phrase.

Experimental Setup:
The study sweeps a $7 \times 7 \times 3$ matrix: 7 target prompts (ranging from literal URLs to semantic categories like misinformation), 7 test images (natural photos and document-style screenshots), and 3 surrogate ensemble configurations, evaluated across 4 open VLMs. This yields 6,615 response pairs.

Key Results

The central finding is a massive divergence between disruption and injection:

High Disruption, Low Injection: Across all 6,615 pairs, the programmatic disruption rate is 66.4%, and the LLM-judged "substantial or complete" disruption rate is 46.6%. However, the Precise Injection rate is drastically lower:
- Broad Injection (any non-none tier): 0.756% (50/6,615 pairs).
- Strict/Verbatim Injection (Confirmed tier): 0.030% (2/6,615 pairs).
- This represents a roughly 90× divergence between the model being disturbed and the payload being delivered.
Architectural Sensitivity:
- Transformer-style VLMs (Qwen2.5-VL, Qwen2-VL, DeepSeek-VL) are universally disrupted (100% programmatic disruption) but show minimal injection rates (0.09%–1.5%).
- BLIP-2 (using a Q-Former bottleneck) shows 0.00% detectable drift or injection across all 2,205 pairs, even when used as a Stage-1 surrogate. The authors hypothesize the Q-Former's information bottleneck and resolution downsampling filter out the perturbation.
Image and Payload Dependence:
- Injections that do occur cluster on screenshot/document-style images (e.g., code editors, bills, webpages) where the response space naturally invites text transcription or contains URL/account-shaped tokens.
- Natural photos (dog, cat) show high disruption but zero verbatim injections.
- Literal text payloads (URLs) survive Stage 2 fusion better than semantic payloads, but even then, exact string matches are rare.

Key Contributions

Dual-Dimension Framework: A methodology that decouples "drift" from "payload delivery," demonstrating that single-number ASR metrics conflate qualitatively different failure modes.
Systematic Sweep: A comprehensive evaluation of 6,615 pairs across four VLMs, revealing the ~90× gap between disruption and injection.
Architectural Observation: Identification of BLIP-2's immunity to these attacks at $L_\infty=16/255$ , suggesting that Q-Former-style bottlenecks may provide inherent adversarial robustness without retraining.
Public Dataset: Release of the full dataset (universal images, adversarial photos, response pairs, and judge caches) to enable bit-exact reproducibility without API keys.

Significance and Claims

The paper claims that the current narrative of "visual modality as a soft underbelly" for prompt injection is overstated when strictly defined by payload delivery. While universal adversarial perturbations are effective at disturbing model outputs (causing hallucinations or topic shifts), they are ineffective at reliably injecting specific attacker-chosen phrases into the response stream.

The authors conclude that:

Evaluation Standards: Future benchmarks must report both Influence and Precise Injection separately, as a single ASR metric hides the true difficulty of payload delivery.
Defense Implications: Architectural choices, specifically information bottlenecks like the Q-Former, may offer substantial robustness against $\epsilon$ -bounded attacks without the need for expensive adversarial fine-tuning.
Threat Model Reality: For an attacker seeking reliable payload delivery (e.g., exfiltrating data or injecting a specific URL), visual universal attacks on small open VLMs are currently an uncompetitive vector compared to non-adversarial channels, with success rates hovering near 0.2%.

The paper maintains a modest stance, noting that its findings are specific to the tested open VLMs and the $L_\infty=16/255$ budget, and that systematic transferability to frontier closed models (like GPT-4o) remains an open question, though initial anecdotal tests suggest the attack does not transfer.