← 研踪 PaperTrailCVF · CVPR 2026:cvf:e18b690d11222c2e3db213ddba2928f7 · 记录 #1
PureProof: Diffusion-Resistant Black-box Targeted Attack on Large Vision-Language Models
来源日期（仅到年份） 2026
来源记录日期 2026
雷达观测 2026-11-05 03:37
摘要
Large Vision-Language Models (VLMs) are increasingly deployed across diverse applications, such as AI agents, yet remain vulnerable to targeted adversarial attacks. However, the practical robustness of such attacks often remains unclear with limited evaluation under defenses. Diffusion-based purification (DBP), a widely adopted black-box defense, effectively blocks current attacks by removing adversarial perturbations via generative diffusion. Prior DBP evasion attacks target white-box image classifiers and are ill-suited to VLMs, incurring high computational costs and gradient instability when adapted. In this paper, we present PureProof, a black-box targeted attack on VLMs resilient to DBP. It consists of three core components. Stochastic Reverse Alignment (SRA) guides adversarial optimization via single-step reverse prediction, avoiding costly full-trajectory backpropagation. Adaptive Re-noising Augmentation (ARA) mitigates diffusion stochasticity through timestep-adaptive re-noising. Self-Consistency Regularization (SCR) stabilizes optimization by promoting local temporal coherence. Extensive experiments on open-source and commercial VLMs show that PureProof consistently outperforms prior attacks against DBP and achieves strong noise resilience, revealing critical vulnerabilities in VLMs and offering broader safety implications for real-world VLM deployments, including emerging agentic settings.
论文发现出处
这些页面提供论文线索，不代表同行评审或质量认证。
观测到的版本
平台记录号代表本站观测到的元数据变化，不是作者修订号。来源日期仅到月份或年份时，按该月或该年首日存档。
记录 #1 · 2026 · 最新观测版本
PureProof: Diffusion-Resistant Black-box Targeted Attack on Large Vision-Language Models
Large Vision-Language Models (VLMs) are increasingly deployed across diverse applications, such as AI agents, yet remain vulnerable to targeted adversarial attacks. However, the practical robustness of such attacks often remains unclear with limited evaluation under defenses. Diffusion-based purification (DBP), a widely adopted black-box defense, effectively blocks current attacks by removing adversarial perturbations via generative diffusion. Prior DBP evasion attacks target white-box image classifiers and are ill-suited to VLMs, incurring high computational costs and gradient instability when adapted. In this paper, we present PureProof, a black-box targeted attack on VLMs resilient to DBP. It consists of three core components. Stochastic Reverse Alignment (SRA) guides adversarial optimization via single-step reverse prediction, avoiding costly full-trajectory backpropagation. Adaptive Re-noising Augmentation (ARA) mitigates diffusion stochasticity through timestep-adaptive re-noising. Self-Consistency Regularization (SCR) stabilizes optimization by promoting local temporal coherence. Extensive experiments on open-source and commercial VLMs show that PureProof consistently outperforms prior attacks against DBP and achieves strong noise resilience, revealing critical vulnerabilities in VLMs and offering broader safety implications for real-world VLM deployments, including emerging agentic settings.
查看此版本解读 →查看此版本原文 ↗