{"id":"https://openalex.org/W7161591911","doi":"https://doi.org/10.48550/arxiv.2605.16090","title":"A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation","display_name":"A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation","publication_year":2026,"publication_date":"2026-05-15","ids":{"openalex":"https://openalex.org/W7161591911","doi":"https://doi.org/10.48550/arxiv.2605.16090"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2605.16090","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.16090","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2605.16090","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5136394321","display_name":"Hao Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Hao","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136409657","display_name":"Zhuo Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, Zhuo","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136436469","display_name":"Yang Liu","orcid":"https://orcid.org/0000-0002-9647-6913"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Yang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5136383226","display_name":"Yilong Yang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Yilong","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5103073505","display_name":"Guancheng Wang","orcid":"https://orcid.org/0000-0002-4338-8813"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wang, Guancheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5136363275","display_name":"JianFeng Ma","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ma, JianFeng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7953000068664551,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.7953000068664551,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.07620000094175339,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.01730000041425228,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/perturbation","display_name":"Perturbation (astronomy)","score":0.675599992275238},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.5952000021934509},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.4657999873161316},{"id":"https://openalex.org/keywords/singular-perturbation","display_name":"Singular perturbation","score":0.40799999237060547},{"id":"https://openalex.org/keywords/software-deployment","display_name":"Software deployment","score":0.39320001006126404},{"id":"https://openalex.org/keywords/optimization-problem","display_name":"Optimization problem","score":0.36149999499320984}],"concepts":[{"id":"https://openalex.org/C177918212","wikidata":"https://www.wikidata.org/wiki/Q803623","display_name":"Perturbation (astronomy)","level":2,"score":0.675599992275238},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6051999926567078},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.5952000021934509},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.4657999873161316},{"id":"https://openalex.org/C165160513","wikidata":"https://www.wikidata.org/wiki/Q7524249","display_name":"Singular perturbation","level":2,"score":0.40799999237060547},{"id":"https://openalex.org/C105339364","wikidata":"https://www.wikidata.org/wiki/Q2297740","display_name":"Software deployment","level":2,"score":0.39320001006126404},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3767000138759613},{"id":"https://openalex.org/C137836250","wikidata":"https://www.wikidata.org/wiki/Q984063","display_name":"Optimization problem","level":2,"score":0.36149999499320984},{"id":"https://openalex.org/C73586568","wikidata":"https://www.wikidata.org/wiki/Q2600211","display_name":"Parameter space","level":2,"score":0.3280999958515167},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.3158999979496002},{"id":"https://openalex.org/C160633673","wikidata":"https://www.wikidata.org/wiki/Q355198","display_name":"Pixel","level":2,"score":0.30799999833106995},{"id":"https://openalex.org/C126255220","wikidata":"https://www.wikidata.org/wiki/Q141495","display_name":"Mathematical optimization","level":1,"score":0.2992999851703644},{"id":"https://openalex.org/C2780226545","wikidata":"https://www.wikidata.org/wiki/Q6888030","display_name":"Modality (human\u2013computer interaction)","level":2,"score":0.27079999446868896},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.26460000872612}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2605.16090","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.16090","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2605.16090","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2605.16090","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Large":[0],"vision-language":[1],"models":[2],"(LVLMs)":[3],"have":[4],"emerged":[5],"as":[6,222],"a":[7,34,70,162,211],"powerful":[8],"paradigm":[9],"for":[10,40,188],"multimodal":[11,56,130,173],"intelligence,":[12],"but":[13,57],"their":[14],"growing":[15,27],"deployment":[16],"also":[17],"expands":[18],"the":[19,37,45,80,98,105,108,114,124,144,149,155,168,178,185,194,197,201,205,223],"attack":[20,75],"surface":[21],"of":[22,48,83,107,196],"prompt":[23,39,62,73,91,110,190],"injection.":[24,92],"Despite":[25],"this":[26,66],"concern,":[28],"existing":[29],"attacks":[30,54],"still":[31],"suffer":[32],"from":[33,113,177],"critical":[35,171],"limitation:":[36],"injected":[38,109],"one":[41],"modality":[42],"only":[43,120],"steers":[44],"model's":[46,81],"interpretation":[47,82],"that":[49,166,184,218,238],"singular":[50],"input.":[51],"Alternatively,":[52],"these":[53],"remain":[55],"fail":[58],"to":[59,123,142,172,226],"achieve":[60],"cross-modal":[61,72],"perturbation.":[63],"To":[64,153,203],"bridge":[65],"gap,":[67],"we":[68,103,160,209],"introduce":[69,161],"novel":[71],"injection":[74],"CrossMPI,":[76],"which":[77],"can":[78],"steer":[79],"both":[84],"textual":[85],"and":[86,133,235],"visual":[87,115],"inputs":[88],"via":[89],"image-only":[90],"Our":[93],"design":[94],"is":[95],"underpinned":[96],"by":[97,148],"following":[99],"key":[100],"breakthroughs.":[101],"First,":[102],"turn":[104],"focus":[106],"perturbation":[111,191,207,214],"optimization":[112,145],"embedding":[116],"space":[117,128],"(typically":[118],"with":[119,134],"$10^5$":[121],"parameters)":[122],"model":[125,157,198],"hidden":[126],"state":[127],"(for":[129],"information":[131],"integration":[132],"$10^7$":[135],"parameters).":[136],"Then,":[137],"two":[138],"strategies":[139],"are":[140],"adopted":[141],"mitigate":[143],"challenges":[146],"posed":[147],"larger":[150],"parameter":[151,158],"space.":[152],"constrain":[154,204],"optimized":[156],"space,":[159,208],"layer":[163],"selection":[164],"strategy":[165,217],"identifies":[167],"layers":[169,187],"most":[170],"integration.":[174],"Interestingly,":[175],"deviating":[176],"past":[179],"experience,":[180],"our":[181,239],"analysis":[182],"reveals":[183],"optimal":[186],"LVLM":[189],"reside":[192],"in":[193],"middle":[195],"rather":[199],"than":[200],"last.":[202],"image":[206],"propose":[210],"new":[212],"distance-decremental":[213],"budget":[215],"assignment":[216],"allocates":[219],"budgets":[220],"decrementally":[221],"pixel":[224],"distance":[225],"semantic-critical":[227],"regions":[228],"increases.":[229],"Extensive":[230],"experiments":[231],"across":[232],"multiple":[233],"LVLMs":[234],"datasets":[236],"show":[237],"method":[240],"significantly":[241],"outperforms":[242],"baseline":[243],"approaches.":[244]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-05-19T00:00:00"}