{"id":"https://openalex.org/W7163665114","doi":"https://doi.org/10.48550/arxiv.2606.06186","title":"Adversarial Attacks Already Tell the Answer: Directional Bias-Guided Test-time Defense for Vision-Language Models","display_name":"Adversarial Attacks Already Tell the Answer: Directional Bias-Guided Test-time Defense for Vision-Language Models","publication_year":2026,"publication_date":"2026-06-04","ids":{"openalex":"https://openalex.org/W7163665114","doi":"https://doi.org/10.48550/arxiv.2606.06186"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.06186","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.06186","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.06186","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5130989566","display_name":"Liangsheng Liu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Liu, Liangsheng","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137985103","display_name":"Si Chen","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chen, Si","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137979380","display_name":"Jiamin Wu","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Wu, Jiamin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137927933","display_name":"Weiwei Feng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Feng, Weiwei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137985288","display_name":"Zhixin Cheng","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Cheng, Zhixin","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5137952651","display_name":"Xiaotian Yin","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yin, Xiaotian","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5054606798","display_name":"Wenfei Yang","orcid":"https://orcid.org/0000-0003-3599-7659"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Yang, Wenfei","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137988021","display_name":"Tianzhu Zhang","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Zhang, Tianzhu","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9757999777793884,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9757999777793884,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.003700000001117587,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.0035000001080334187,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.9575999975204468},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.6712999939918518},{"id":"https://openalex.org/keywords/counterintuitive","display_name":"Counterintuitive","score":0.5683000087738037},{"id":"https://openalex.org/keywords/generalization","display_name":"Generalization","score":0.5472999811172485},{"id":"https://openalex.org/keywords/prior-probability","display_name":"Prior probability","score":0.527899980545044},{"id":"https://openalex.org/keywords/encode","display_name":"ENCODE","score":0.4390999972820282},{"id":"https://openalex.org/keywords/class","display_name":"Class (philosophy)","score":0.37770000100135803},{"id":"https://openalex.org/keywords/feature","display_name":"Feature (linguistics)","score":0.35910001397132874}],"concepts":[{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.9575999975204468},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.6712999939918518},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6662999987602234},{"id":"https://openalex.org/C101097943","wikidata":"https://www.wikidata.org/wiki/Q5176983","display_name":"Counterintuitive","level":2,"score":0.5683000087738037},{"id":"https://openalex.org/C177148314","wikidata":"https://www.wikidata.org/wiki/Q170084","display_name":"Generalization","level":2,"score":0.5472999811172485},{"id":"https://openalex.org/C177769412","wikidata":"https://www.wikidata.org/wiki/Q278090","display_name":"Prior probability","level":3,"score":0.527899980545044},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.47920000553131104},{"id":"https://openalex.org/C66746571","wikidata":"https://www.wikidata.org/wiki/Q1134833","display_name":"ENCODE","level":3,"score":0.4390999972820282},{"id":"https://openalex.org/C2777212361","wikidata":"https://www.wikidata.org/wiki/Q5127848","display_name":"Class (philosophy)","level":2,"score":0.37770000100135803},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3693000078201294},{"id":"https://openalex.org/C2776401178","wikidata":"https://www.wikidata.org/wiki/Q12050496","display_name":"Feature (linguistics)","level":2,"score":0.35910001397132874},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.34200000762939453},{"id":"https://openalex.org/C83665646","wikidata":"https://www.wikidata.org/wiki/Q42139305","display_name":"Feature vector","level":2,"score":0.3260999917984009},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.3068000078201294},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.290800005197525},{"id":"https://openalex.org/C111030470","wikidata":"https://www.wikidata.org/wiki/Q1430460","display_name":"Curse of dimensionality","level":2,"score":0.27970001101493835},{"id":"https://openalex.org/C200315206","wikidata":"https://www.wikidata.org/wiki/Q4733146","display_name":"Allorecognition","level":4,"score":0.26989999413490295},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.26829999685287476},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.2653000056743622},{"id":"https://openalex.org/C2778572836","wikidata":"https://www.wikidata.org/wiki/Q380933","display_name":"Space (punctuation)","level":2,"score":0.257999986410141}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.06186","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.06186","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.06186","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.06186","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"grobid_xml":false,"pdf":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision-Language":[0],"Models":[1],"(VLMs),":[2],"such":[3],"as":[4,31],"CLIP,":[5],"have":[6,28],"shown":[7],"strong":[8],"zero-shot":[9],"generalization":[10],"but":[11,148],"remain":[12],"highly":[13],"vulnerable":[14],"to":[15,37,73,127],"adversarial":[16,40,59,92,142,155,165],"perturbations,":[17],"posing":[18],"serious":[19],"risks":[20],"in":[21,61,71],"real-world":[22],"applications.":[23],"Test-time":[24],"defenses":[25],"for":[26],"VLMs":[27],"recently":[29],"emerged":[30],"a":[32,52,68,112,122],"promising":[33],"and":[34,120],"efficient":[35],"approach":[36],"defend":[38],"against":[39],"attacks":[41],"without":[42],"requiring":[43],"costly":[44],"large-scale":[45],"retraining.":[46],"In":[47],"this":[48,83,104],"work,":[49],"we":[50,106],"uncover":[51],"surprising":[53],"phenomenon:":[54],"under":[55],"diverse":[56],"input":[57],"transformations,":[58],"images":[60],"CLIP's":[62],"feature":[63],"space":[64],"consistently":[65],"shift":[66],"along":[67],"dominant":[69,84],"direction,":[70],"contrast":[72],"the":[74,87,91,117,151,172],"dispersed":[75],"patterns":[76],"of":[77],"clean":[78,146,160],"images.":[79],"We":[80],"hypothesize":[81],"that":[82,115,136,154,164],"shift,":[85,93],"termed":[86],"Defense":[88,110,118],"Direction,":[89],"opposes":[90],"pointing":[94],"features":[95],"back":[96],"toward":[97],"their":[98],"correct":[99],"class":[100],"centers.":[101],"Building":[102],"on":[103,132],"insight,":[105],"propose":[107],"Directional":[108],"Bias-guided":[109],"(DBD),":[111],"test-time":[113],"framework":[114],"estimates":[116],"Direction":[119],"employs":[121],"DB-score-based":[123],"two-stream":[124],"reconstruction":[125],"strategy":[126],"recover":[128],"robust":[129],"representations.":[130],"Experiments":[131],"15":[133],"datasets":[134],"demonstrate":[135],"DBD":[137],"not":[138],"only":[139],"achieves":[140],"SOTA":[141],"robustness":[143],"while":[144],"preserving":[145],"accuracy,":[147],"also":[149],"reveals":[150],"counterintuitive":[152],"result":[153],"accuracy":[156],"can":[157],"even":[158],"surpass":[159],"accuracy.":[161],"This":[162],"demonstrates":[163],"perturbations":[166],"inherently":[167],"encode":[168],"directional":[169],"priors":[170],"about":[171],"true":[173],"decision":[174],"boundary.":[175]},"counts_by_year":[],"updated_date":"2026-07-28T07:46:37.118299","created_date":"2026-06-06T00:00:00"}