{"id":"https://openalex.org/W4416862091","doi":"https://doi.org/10.48550/arxiv.2508.08521","title":"VISOR: Visual Input-based Steering for Output Redirection in Vision-Language Models","display_name":"VISOR: Visual Input-based Steering for Output Redirection in Vision-Language Models","publication_year":2025,"publication_date":"2025-08-11","ids":{"openalex":"https://openalex.org/W4416862091","doi":"https://doi.org/10.48550/arxiv.2508.08521"},"language":"en","primary_location":{"id":"pmh:oai:arXiv.org:2508.08521","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2508.08521","pdf_url":"https://arxiv.org/pdf/2508.08521","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"type":"preprint","indexed_in":["arxiv","datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://arxiv.org/pdf/2508.08521","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5035688362","display_name":"Mansi Phute","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Phute, Mansi","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5102929057","display_name":"Ravikumar Balakrishnan","orcid":"https://orcid.org/0000-0001-8490-8486"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Balakrishnan, Ravikumar","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":true,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8044000267982483,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8044000267982483,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.05979999899864197,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.013799999840557575,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.5336999893188477},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.5149000287055969},{"id":"https://openalex.org/keywords/overhead","display_name":"Overhead (engineering)","score":0.45899999141693115},{"id":"https://openalex.org/keywords/modalities","display_name":"Modalities","score":0.4309999942779541},{"id":"https://openalex.org/keywords/work","display_name":"Work (physics)","score":0.39739999175071716},{"id":"https://openalex.org/keywords/driving-simulator","display_name":"Driving simulator","score":0.35429999232292175},{"id":"https://openalex.org/keywords/range","display_name":"Range (aeronautics)","score":0.3504999876022339}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7470999956130981},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.5336999893188477},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.5149000287055969},{"id":"https://openalex.org/C2779960059","wikidata":"https://www.wikidata.org/wiki/Q7113681","display_name":"Overhead (engineering)","level":2,"score":0.45899999141693115},{"id":"https://openalex.org/C2779903281","wikidata":"https://www.wikidata.org/wiki/Q6888026","display_name":"Modalities","level":2,"score":0.4309999942779541},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.4251999855041504},{"id":"https://openalex.org/C18762648","wikidata":"https://www.wikidata.org/wiki/Q42213","display_name":"Work (physics)","level":2,"score":0.39739999175071716},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.3837999999523163},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.3711000084877014},{"id":"https://openalex.org/C2780689630","wikidata":"https://www.wikidata.org/wiki/Q2081815","display_name":"Driving simulator","level":2,"score":0.35429999232292175},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.3504999876022339},{"id":"https://openalex.org/C44154836","wikidata":"https://www.wikidata.org/wiki/Q45045","display_name":"Simulation","level":1,"score":0.3003000020980835},{"id":"https://openalex.org/C17500928","wikidata":"https://www.wikidata.org/wiki/Q959968","display_name":"Control system","level":2,"score":0.2935999929904938},{"id":"https://openalex.org/C151043444","wikidata":"https://www.wikidata.org/wiki/Q28253","display_name":"Lane departure warning system","level":2,"score":0.29190000891685486},{"id":"https://openalex.org/C2780226545","wikidata":"https://www.wikidata.org/wiki/Q6888030","display_name":"Modality (human\u2013computer interaction)","level":2,"score":0.2818000018596649},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.27869999408721924},{"id":"https://openalex.org/C2780527621","wikidata":"https://www.wikidata.org/wiki/Q7936593","display_name":"Visual control","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C79403827","wikidata":"https://www.wikidata.org/wiki/Q3988","display_name":"Real-time computing","level":1,"score":0.2687000036239624},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.25380000472068787}],"mesh":[],"locations_count":2,"locations":[{"id":"pmh:oai:arXiv.org:2508.08521","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2508.08521","pdf_url":"https://arxiv.org/pdf/2508.08521","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},{"id":"doi:10.48550/arxiv.2508.08521","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2508.08521","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"pmh:oai:arXiv.org:2508.08521","is_oa":true,"landing_page_url":"https://arxiv.org/abs/2508.08521","pdf_url":"https://arxiv.org/pdf/2508.08521","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision":[0],"Language":[1],"Models":[2],"(VLMs)":[3],"are":[4,37],"increasingly":[5],"being":[6],"used":[7],"in":[8,35],"a":[9,68,186],"broad":[10],"range":[11],"of":[12],"applications,":[13],"bringing":[14],"their":[15],"security":[16,188],"and":[17,40,56,120,180,210],"behavioral":[18,27,74,136,194],"control":[19,28,75,166,209],"to":[20,50,104,146,152],"the":[21,212],"forefront.":[22],"While":[23],"existing":[24],"approaches":[25],"for":[26,65,134,142,215],"or":[29],"output":[30],"redirection,":[31],"like":[32],"system":[33,158],"prompting":[34,159],"VLMs,":[36],"easily":[38],"detectable":[39],"often":[41],"ineffective,":[42],"activation-based":[43],"steering":[44,84,126,129,153,219],"vectors":[45],"require":[46],"invasive":[47],"runtime":[48,178],"access":[49,182],"model":[51,181,208],"internals--incompatible":[52],"with":[53],"API-based":[54],"services":[55],"closed-source":[57],"deployments.":[58],"We":[59,108],"introduce":[60],"VISOR":[61,91,110,162,184],"(Visual":[62],"Input-based":[63],"Steering":[64],"Output":[66],"Redirection),":[67],"novel":[69],"method":[70],"that":[71,86],"achieves":[72],"sophisticated":[73,193],"through":[76,196],"optimized":[77],"visual":[78,197,218],"inputs":[79],"alone.":[80],"By":[81],"crafting":[82],"universal":[83],"images":[85],"induce":[87],"target":[88],"activation":[89],"patterns,":[90],"enables":[92],"practical":[93],"deployment":[94],"across":[95,113],"all":[96],"VLM":[97],"serving":[98],"modalities":[99],"while":[100,138,167],"remaining":[101],"imperceptible":[102],"compared":[103,151],"explicit":[105],"textual":[106],"instructions.":[107],"validate":[109],"on":[111,171],"LLaVA-1.5-7B":[112],"three":[114],"critical":[115,187],"alignment":[116],"tasks:":[117],"refusal,":[118],"sycophancy":[119],"survival":[121],"instinct.":[122],"A":[123],"single":[124],"150KB":[125],"image":[127],"matches":[128],"vector":[130],"performance":[131,170],"within":[132],"1-2%":[133],"positive":[135],"shifts":[137,148],"dramatically":[139],"exceeding":[140],"it":[141],"negative":[143],"steering--achieving":[144],"up":[145],"25%":[147],"from":[149],"baseline":[150],"vectors'":[154],"modest":[155],"changes.":[156],"Unlike":[157],"(3-4%":[160],"shifts),":[161],"provides":[163],"robust":[164],"bidirectional":[165],"maintaining":[168],"99.9%":[169],"14,000":[172],"unrelated":[173],"MMLU":[174],"tasks.":[175],"Beyond":[176],"eliminating":[177],"overhead":[179],"requirements,":[183],"exposes":[185],"vulnerability:":[189],"adversaries":[190],"can":[191],"achieve":[192],"manipulation":[195],"channels":[198],"alone,":[199],"bypassing":[200],"text-based":[201],"defenses.":[202],"Our":[203],"work":[204],"fundamentally":[205],"re-imagines":[206],"multimodal":[207],"highlights":[211],"urgent":[213],"need":[214],"defenses":[216],"against":[217],"attacks.":[220]},"counts_by_year":[],"updated_date":"2026-07-08T06:17:01.165560","created_date":"2025-10-10T00:00:00"}