attack arXiv Nov 25, 2025 · Nov 2025
Changyue Li, Jiaying Li, Youliang Yuan et al. · The Chinese University of Hong Kong · University of Electronic Science and Technology of China +1 more
Universal adversarial image perturbation semantically routes MLLM inputs to multiple distinct attacker-defined targets simultaneously
Input Manipulation Attack Prompt Injection visionmultimodalnlp
Multimodal Large Language Models (MLLMs) are increasingly deployed in stateless systems, such as autonomous driving and robotics. This paper investigates a novel threat: Semantic-Aware Hijacking. We explore the feasibility of hijacking multiple stateless decisions simultaneously using a single universal perturbation. We introduce the Semantic-Aware Universal Perturbation (SAUP), which acts as a semantic router, "actively" perceiving input semantics and routing them to distinct, attacker-defined targets. To achieve this, we conduct theoretical and empirical analysis on the geometric properties in the latent space. Guided by these insights, we propose the Semantic-Oriented (SORT) optimization strategy and annotate a new dataset with fine-grained semantics to evaluate performance. Extensive experiments on three representative MLLMs demonstrate the fundamental feasibility of this attack, achieving a 66% attack success rate over five targets using a single frame against Qwen.
vlm llm multimodal The Chinese University of Hong Kong · University of Electronic Science and Technology of China · Ant Group
ML Security Papers