🤖 AI

Breaking the weakest link to evade vision language models

This paper proposes a computationally efficient, gradient-based attack method that targets only the vision encoder of Vision Language Models (VLMs) to generate imperceptible adversarial perturbations capable of disrupting or hijacking the models' textual interpretations, thereby exposing significant vulnerabilities in current multimodal AI systems.

Original authors: Ilan Zini, Boussad Addad, Katarzyna Kapusta

Published 2026-08-20

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ilan Zini, Boussad Addad, Katarzyna Kapusta

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

In the rapidly evolving landscape of artificial intelligence, a new generation of systems has emerged that can see and speak at the same time. These machines, known as vision-language models, are designed to look at an image and describe what they see, or to answer questions about a photograph. They work by taking a picture, converting its visual details into a mathematical representation, and then passing that information to a language engine that constructs sentences. This technology powers everything from automated image captions to safety systems in self-driving cars, creating a bridge between the visual world and human communication. However, just as any complex system has weak points, these models are not immune to manipulation. Researchers have long known that digital images can be altered in ways invisible to the human eye, yet capable of confusing a computer's perception. The question now is whether these sophisticated new systems, which combine sight and speech, are any more secure than the older, simpler models they replaced.

A team of researchers at Thales and ESILV set out to test the durability of these vision-language models against such hidden manipulations. Their goal was to see if they could trick the models into seeing things that were not there, or into ignoring what was clearly visible. They focused on two specific types of tricks. The first was a broad disruption, where the attacker simply wanted to confuse the model so it could no longer describe the image correctly. The second was a precise deception, where the attacker wanted the model to describe a specific object that was completely different from the one in the photo. For instance, they wanted to see if they could make a model look at a picture of a military tank and confidently describe it as an ambulance. To do this, they did not try to break the entire system at once. Instead, they identified the most efficient path to the vulnerability: the part of the system that first processes the image.

The researchers discovered that they could generate these deceptive images by focusing their efforts solely on the visual component of the model, rather than the entire language-processing machinery. This approach proved to be a masterstroke of efficiency. While previous methods required the computer to calculate changes through the massive, complex language brain of the model—a process that was slow and demanded enormous computing power—the new method only needed to adjust the initial image processing stage. By doing this, the researchers reduced the memory required for the attack by a significant margin and cut the time needed to create a single deceptive image from over twenty minutes down to roughly one hundred and sixty seconds. This efficiency meant they could test their ideas on a wide variety of modern, open-source models, including systems named Qwen, Granite, FastVLM, and Phi.

The results of these experiments were striking and revealed a deep fragility in how these models understand the world. When the researchers attempted to simply confuse the models, making them fail to describe the image correctly, the attacks were almost universally successful. Even with tiny, invisible changes to the pixels, the models failed to recognize the content of the image more than ninety-three percent of the time. In some cases, nearly every single attempt succeeded, suggesting that the visual representations these models rely on are incredibly unstable. When the researchers tried the more difficult task of forcing the model to see a specific wrong object, the results varied more by model but remained concerning. One model, Granite-Vision, was fooled into describing a tank as an ambulance in nearly half of the attempts, even though the two objects are completely unrelated. Another model, Phi-3.5-Vision, proved to be much more resistant, rarely falling for the trick, but the majority of the systems tested showed significant weakness.

These findings suggest that the current generation of vision-language models is highly susceptible to manipulation, particularly when the goal is to disrupt their understanding of an image. The fact that such powerful systems can be misled by changes too small for a human to notice raises serious questions about their reliability in real-world situations. If a self-driving car or a medical imaging system relies on a model that can be easily tricked into misidentifying a vehicle or a condition, the consequences could be severe. The study does not claim to have solved the problem of security for these systems, but it has clearly mapped the terrain of the danger. By showing that the weakest link is often the initial visual processing stage, the researchers have provided a clear target for future defenses. The work underscores that as these models become more integrated into critical infrastructure, ensuring they can withstand such subtle, invisible attacks is not just a technical challenge, but a fundamental requirement for safety.

Technical Summary: Breaking the Weakest Link to Evade Vision Language Models

Problem Statement

Vision-Language Models (VLMs) have become critical components in multimodal AI systems, enabling joint reasoning over visual and textual inputs for applications ranging from image captioning to safety-critical domains like autonomous driving. However, the robustness of these models against adversarial threats remains insufficiently explored. Specifically, there is a lack of understanding regarding how small, human-imperceptible perturbations applied to visual inputs can disrupt the multimodal alignment, causing the model to generate incorrect or misleading textual descriptions.

Current adversarial attack methods against VLMs often require backpropagation through the entire multimodal architecture (both vision and language components). This approach is computationally expensive and resource-intensive, limiting the scalability of such attacks and the ability to evaluate robustness across diverse model families.

Methodology

The authors propose a novel, efficient gradient-based attack method that targets the "weakest link" of the VLM architecture: the vision encoder. The core hypothesis is that optimizing perturbations exclusively on the visual encoder is sufficient to manipulate the final textual output, thereby avoiding the computational overhead of optimizing through the full multimodal pipeline.

Threat Model

The study operates under a white-box threat model, assuming the attacker has full access to the vision encoder of the target VLM. This is considered realistic given that many competitive VLMs (e.g., Qwen, Granite, Phi) are released as open-source systems.

Attack Design

The attack strategy is divided into two settings:

Targeted Attacks: The adversary aims to force the VLM to generate a specific semantic description corresponding to a target image, distinct from the source image. The optimization minimizes the Mean Squared Error (MSE) between the embedding of the adversarial image ( $h_{adv}$ ) and the embedding of the target image ( $h_{target}$ ) produced by the vision encoder.
Untargeted Attacks: The goal is to disrupt the model's interpretation of the original image without a specific target. The optimization maximizes the distance between the adversarial image embedding and the source image embedding.

In both cases, the optimization (using I-FGSM) is performed by backpropagating gradients only through the vision encoder. The perturbation is applied to the input image, clipped to a valid range, and constrained by a perturbation budget ( $\epsilon$ ).

Evaluation Protocol

The authors evaluated their approach on four open-source VLMs: Qwen2.5-VL-3B, Granite-Vision-3.2-2B, FastVLM-7B, and Phi-3.5-Vision-Instruct.

Dataset: A subset of ImageNet was used, with 1,000 random source-target pairs for targeted attacks.
Success Criteria: An "LLM-as-a-Judge" approach was employed. A separate language model (Granite-4.0-micro) evaluated whether the VLM's generated description of the adversarial image matched the target (for targeted attacks) or differed significantly from the original (for untargeted attacks).

Key Results

Attack Effectiveness

Untargeted Attacks: The attack proved extremely effective across all models. Even with minimal perturbations ( $\epsilon = 0.05$ ), success rates exceeded 93% for all models, reaching nearly 100% for Granite-Vision and FastVLM. This indicates that current VLMs are highly sensitive to minor visual noise when the goal is simply to disrupt semantic coherence.
Targeted Attacks: While more challenging due to the random semantic distance between source and target pairs, the attack still achieved significant success.
- Granite-Vision showed the highest vulnerability, with success rates exceeding 45% at higher perturbation budgets ( $\epsilon = 0.20$ ).
- FastVLM achieved success rates between 26% and 29%.
- Qwen2.5-VL demonstrated resilience at low budgets but became increasingly vulnerable as $\epsilon$ increased (reaching 25%).
- Phi-3.5-Vision remained highly robust, with success rates consistently around 2%, suggesting architectural differences significantly impact vulnerability.

Computational Efficiency

A primary contribution of the work is the reduction in resource requirements. By restricting backpropagation to the vision encoder (which constitutes only 1.6% to 18% of total parameters depending on the model):

VRAM Usage: Reduced from ~44–47% (full VLM) to 13–16% on an NVIDIA H100 GPU.
Generation Time: On Qwen2.5-VL, generating an adversarial example via the full pipeline took >20 minutes (and often failed), whereas the vision-encoder-only approach required approximately 100 seconds.

Significance and Claims

The paper claims that modern VLMs, despite their advanced multimodal capabilities, remain fundamentally vulnerable to adversarial visual manipulation. The significance of the work lies in three areas:

Efficiency: The proposed method demonstrates that high-effectiveness adversarial attacks can be generated with a fraction of the computational cost of previous state-of-the-art methods by focusing solely on the vision encoder.
Vulnerability Exposure: The results highlight a critical security gap, particularly in untargeted scenarios where disrupting model output is trivial. This poses serious risks for safety-critical applications (e.g., autonomous driving, medical imaging) where input integrity cannot be guaranteed.
Architectural Variance: The study reveals that robustness is not uniform across architectures; some models (like Phi-3.5-Vision) exhibit significantly higher resistance than others, suggesting that architectural choices play a pivotal role in adversarial defense.

The authors conclude that improved robustness and security mechanisms are necessary for the safe deployment of multimodal AI systems in real-world environments.