ML Security PapersGeoShield: Safeguarding Geolocation Privacy from Vision-Language Models via Adversarial Perturbations
Xinwei Liu 1,2, Xiaojun Jia 3, Yuan Xun 1,2, Simeng Qin 4, Xiaochun Cao 5
Published on arXiv
2508.03209
Input Manipulation Attack
OWASP ML Top 10 — ML01
Prompt Injection
OWASP LLM Top 10 — LLM01
Key Finding
GeoShield consistently surpasses prior adversarial perturbation methods in black-box settings against advanced VLMs while maintaining minimal degradation in visual and semantic image quality.
GeoShield
Novel technique introduced
Vision-Language Models (VLMs) such as GPT-4o now demonstrate a remarkable ability to infer users' locations from public shared images, posing a substantial risk to geoprivacy. Although adversarial perturbations offer a potential defense, current methods are ill-suited for this scenario: they often perform poorly on high-resolution images and low perturbation budgets, and may introduce irrelevant semantic content. To address these limitations, we propose GeoShield, a novel adversarial framework designed for robust geoprivacy protection in real-world scenarios. GeoShield comprises three key modules: a feature disentanglement module that separates geographical and non-geographical information, an exposure element identification module that pinpoints geo-revealing regions within an image, and a scale-adaptive enhancement module that jointly optimizes perturbations at both global and local levels to ensure effectiveness across resolutions. Extensive experiments on challenging benchmarks show that GeoShield consistently surpasses prior methods in black-box settings, achieving strong privacy protection with minimal impact on visual or semantic quality. To our knowledge, this work is the first to explore adversarial perturbations for defending against geolocation inference by advanced VLMs, providing a practical and effective solution to escalating privacy concerns.
Key Contributions
- Feature disentanglement module that separates geographical from non-geographical image features to target perturbations precisely
- Exposure element identification module that localizes geo-revealing image regions for focused adversarial perturbation
- Scale-adaptive enhancement module jointly optimizing perturbations at global and local levels for effectiveness across image resolutions
🛡️ Threat Analysis
Primary contribution is a novel adversarial perturbation framework (GeoShield) that crafts image perturbations to cause VLMs to fail at geolocation inference — this is adversarial input manipulation at inference time used as a privacy defense. The paper proposes three new modules (feature disentanglement, exposure element identification, scale-adaptive enhancement) advancing the adversarial perturbation methodology itself.