VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models

Abstract

Universal adversarial attacks on aligned multimodal large language models are increasingly reported with attack success rates in the 60-80% range, suggesting the visual modality is highly vulnerable to imperceptible perturbations as a prompt-injection channel. We argue that this number conflates two distinct events: (i) the model's output was perturbed (Influence), and (ii) the attacker's chosen target concept was actually emitted (Precise Injection). We compose two existing techniques -- Univer

Categories

Framework mappings

Suggested from the entry's categories.

@misc{liu2026visinject,
  title = {{VisInject: Disruption != Injection -- A Dual-Dimension Evaluation of Universal Adversarial Attacks on Vision-Language Models}},
  author = {Pang Liu and Yingjie Lao},
  year = {2026},
  month = may,
  eprint = {2605.01449},
  archivePrefix = {arXiv},
  url = {https://arxiv.org/abs/2605.01449}
}