---
title: "Leave My Images Alone — paper by Shao et al. (2026)"
description: "Open-weight multi-modal large language models (MLLMs) make it cheap to mine personal photos at scale for identities… 55 references."
authors: ["Zedian Shao", "Hongbin Liu", "Yuepeng Hu", "Neil Zhenqiang Gong"]
year: 2026
venue: "Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)"
source: "https://aclanthology.org/2026.acl-long.72/"
doi: "10.18653/v1/2026.acl-long.72"
licence: "CC BY 4.0 (ACL Anthology)"
licence_url: "https://creativecommons.org/licenses/by/4.0/"
summary_licence: "Elamur Cosmic License"
canonical: "https://research.elamur.ai/free/en/papers/shao-2026-leave-my-images-alone-preventing/"
---
[Elamur Research](https://md.research.elamur.ai/free/en/) · [this page in HTML](https://research.elamur.ai/free/en/papers/shao-2026-leave-my-images-alone-preventing/)

[home](https://md.research.elamur.ai/free/en/) / [papers](https://md.research.elamur.ai/free/en/papers/) / [2026](https://md.research.elamur.ai/free/en/papers/2026/page/34/) / Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection

# Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection

**Authors:** Zedian Shao, Hongbin Liu, Yuepeng Hu and [Neil Zhenqiang Gong](https://md.research.elamur.ai/free/en/authors/neil-zhenqiang-gong/) · **Year:** 2026 · **Venue:** [Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)](https://md.research.elamur.ai/free/en/venues/acl/) ([ACL 2026](https://md.research.elamur.ai/free/en/venues/acl/2026/)) · **Publisher:** [Association for Computational Linguistics](https://md.research.elamur.ai/free/en/publishers/association-for-computational-linguistics/) · **Licence:** [CC BY 4.0 (ACL Anthology)](https://creativecommons.org/licenses/by/4.0/)

**Links:** [Publisher's page](https://aclanthology.org/2026.acl-long.72/) · [PDF](https://aclanthology.org/2026.acl-long.72.pdf) · [DOI 10.18653/v1/2026.acl-long.72](https://doi.org/10.18653/v1/2026.acl-long.72) · [OpenAlex](https://openalex.org/W7166876835)

**Citations:** 0 citations (OpenAlex, 2026-10-14)

## Summary
Open-weight multi-modal large language models (MLLMs) make it cheap to mine personal photos at scale for identities, locations and other private details. The authors frame a new task: stopping MLLMs from analyzing an image at all. Their tool, ImageProtector, runs on the user's side before an image is shared. It adds a small, nearly invisible perturbation that works as a visual prompt injection, so the model replies with a refusal whatever question it is asked. The perturbation comes from constrained optimization. A cross-entropy loss pushes the model toward refusal tokens across a set of "shadow questions", while a bound on perturbation size keeps the image visually intact. The search uses gradient-based updates (BIM). Experiments on six MLLMs and four datasets show high refusal rates. Three defenses (Gaussian noise, DiffPure and adversarial training) weaken the protection, but they cost accuracy or compute. The work turns prompt injection, normally an attack, into an opt-in privacy safeguard for image owners.

## Key points
- Evaluated models include LLaVA-1.5, MiniGPT-4 and Qwen-VL-Chat, with VQAv2 among the datasets. A single universal perturbation per image can be optimized jointly against several MLLMs.
- Generalization stabilizes once training uses at least 40 shadow questions and a mini-batch of at least 3. The method also holds up across different sampling temperatures.
- DiffPure with one timestep drops refusal rates from above 0.90 to below 0.20, but accuracy falls from 0.92 to 0.82. With two timesteps, refusals fall to near zero and accuracy to 0.78, while inference time rises by 8.0% and 13.1%.
- Adversarial training (LLaVA-1.5, VQAv2) still leaves refusal rates around 60% after three epochs, and it reduces accuracy and is computationally expensive.
- Limitations:
  - **White-box access:** the method needs access to model internals, so it does not directly apply to closed-source, API-only models.
  - **Multi-round dialogue:** with general probing questions, refusal rates fall from 88% to roughly 70% over multi-round dialogues.
  - **Other modalities:** audio and video inputs remain unexplored.

*Our summary of the paper, in our own words — not its text. The work belongs to its authors; read it at the links above.*

## Institutions

- [Georgia Institute of Technology](https://md.research.elamur.ai/free/en/universities/georgia-institute-of-technology/) — University, Atlanta, United States · 133 works · 24,497 citations
- [Duke University](https://md.research.elamur.ai/free/en/universities/duke-university/) — University, Durham, United States · 28 works · 15,077 citations

📚 Shelves (3): [🖥️ Computer Science](https://md.research.elamur.ai/free/en/shelves/computer-science/) · 16,667 works · [🤖 Artificial Intelligence](https://md.research.elamur.ai/free/en/shelves/computer-science/artificial-intelligence/) · 16,194 works · [👁️ Computer Vision and Pattern Recognition](https://md.research.elamur.ai/free/en/shelves/computer-science/computer-vision-and-pattern-recognition/) · 2,869 works

🧭 Topics (2): [🧠 Language models & pretraining](https://md.research.elamur.ai/free/en/topics/language-models/) · 3,320 works · [🖼️ Vision & language](https://md.research.elamur.ai/free/en/topics/multimodal/) · 657 works

## Cite

Cite as: Zedian Shao, Hongbin Liu, Yuepeng Hu and Neil Zhenqiang Gong. 2026. Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection. Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers).

The paper itself, not this page. BibTeX from the library's record of the work.

```bibtex
@inproceedings{shao2026leave,
  title = {{Leave My Images Alone: Preventing Multi-Modal Large Language Models from Analyzing Images via Visual Prompt Injection}},
  author = {Zedian Shao, Hongbin Liu, Yuepeng Hu and Neil Zhenqiang Gong},
  booktitle = {Proceedings of the 64th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers)},
  year = {2026},
  doi = {10.18653/v1/2026.acl-long.72},
  url = {https://doi.org/10.18653/v1/2026.acl-long.72}
}
```

- [← previous Learning Uncertainty from Sequential Internal Dispersion in Large Language Models](https://md.research.elamur.ai/free/en/papers/srey-2026-learning-uncertainty-sequential-internal-dispersion/)
- [next → LEDGER: Scaling Agentic Document Editing with Dependency-aware Graph Retrieval](https://md.research.elamur.ai/free/en/papers/wang-2026-ledger-scaling-agentic-document-editing/)
- [↑ back to papers of 2026](https://md.research.elamur.ai/free/en/papers/2026/page/34/)

## References

55 references, 26 of them with a card of ours. ↗ leads to the work, «find» searches for one we have no id for yet.

1. Abdelrahman Abouelenin, Atabak Ashfaq, Adam Atkinson, Hany Awadalla, Nguyen Bach, Jianmin Bao, Alon Benhaim, Martin Cai, Vishrav Chaudhary, Congcong Chen, and 1 others. 2025. [Phi-4-mini technical report: Compact yet powerful multimodal language models via mixture-of-loras](https://md.research.elamur.ai/free/en/papers/microsoft-2025-phi-4-mini-technical-report/). arXiv preprint arXiv:2503.…
2. Josh Achiam, Steven Adler, Sandhini Agarwal, Lama Ahmad, Ilge Akkaya, Florencia Leoni Aleman, Diogo Almeida, Janko Altenschmidt, Sam Altman, Shyamal Anadkat, and 1 others. 2023. [Gpt-4 technical report](https://md.research.elamur.ai/free/en/papers/openai-2023-gpt-4-technical-report/). arXiv.
3. Moustafa Alzantot, Yash Sharma, Ahmed Elgohary, Bo-Jhang Ho, Mani Srivastava, and Kai-Wei Chang. 2018. [Generating natural language adversarial examples](https://md.research.elamur.ai/free/en/papers/alzantot-2018-generating-natural-language-adversarial-examples/). In EMNLP.
4. Stanislaw Antol, Aishwarya Agrawal, Jiasen Lu, Margaret Mitchell, Dhruv Batra, C. Lawrence Zitnick, and Devi Parikh. 2015. VQA: Visual Question Answering. In ICCV. [find](https://scholar.google.com/scholar?q=Stanislaw+Antol%2C+Aishwarya+Agrawal%2C+Jiasen+Lu%2C+Margaret+Mitchell%2C+Dhruv+Batra%2C+C%2E+Lawrence+Zitnick%2C+and+Devi+Parikh%2E+2015%2E+VQA%3A+Visual+Question+Answering%2E+In+ICCV%2E)
5. Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. 2023. (ab) using images and sounds for indirect instruction injection in multimodal llms. arXiv. [find](https://scholar.google.com/scholar?q=Eugene+Bagdasaryan%2C+Tsung%2DYin+Hsieh%2C+Ben+Nassi%2C+and+Vitaly+Shmatikov%2E+2023%2E+%28ab%29+using+images+and+sounds+for+indirect+instruction+injection+in+multimodal+llms%2E+arXiv%2E)
6. Jinze Bai, Shuai Bai, Yunfei Chu, Zeyu Cui, Kai Dang, Xiaodong Deng, Yang Fan, Wenbin Ge, Yu Han, Fei Huang, and 1 others. 2023a. [Qwen technical report](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-technical-report/). arXiv.
7. Jinze Bai, Shuai Bai, Shusheng Yang, Shijie Wang, Sinan Tan, Peng Wang, Junyang Lin, Chang Zhou, and Jingren Zhou. 2023b. [Qwen-vl: A versatile vision-language model for understanding, localization, text reading, and beyond](https://md.research.elamur.ai/free/en/papers/bai-2023-qwen-vl-versatile-vision-language/). arXiv.
8. Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, and 1 others. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923. — [Qwen2.5-VL Technical Report](https://md.research.elamur.ai/free/en/papers/bai-2025-qwen2-5-vl-technical/)
9. Luke Bailey, Euan Ong, Stuart Russell, and Scott Emmons. 2023. Image hijacks: Adversarial images can control generative models at runtime. arXiv. [find](https://scholar.google.com/scholar?q=Luke+Bailey%2C+Euan+Ong%2C+Stuart+Russell%2C+and+Scott+Emmons%2E+2023%2E+Image+hijacks%3A+Adversarial+images+can+control+generative+models+at+runtime%2E+arXiv%2E)
10. Xiaoyu Cao and Neil Zhenqiang Gong. 2017. Mitigating evasion attacks to deep neural networks via region-based classification. In ACSAC. [find](https://scholar.google.com/scholar?q=Xiaoyu+Cao+and+Neil+Zhenqiang+Gong%2E+2017%2E+Mitigating+evasion+attacks+to+deep+neural+networks+via+region%2Dbased+classification%2E+In+ACSAC%2E)
11. Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. 2024. Are aligned neural networks adversarially aligned? In NeurIPS. [find](https://scholar.google.com/scholar?q=Nicholas+Carlini%2C+Milad+Nasr%2C+Christopher+A+Choquette%2DChoo%2C+Matthew+Jagielski%2C+Irena+Gao%2C+Pang+Wei+W+Koh%2C+Daphne+Ippolito%2C+Florian+Tramer%2C+and+Ludwig+Schmidt%2E+2024%2E+Are+aligned+neural+networks+adversa)
12. Ting Chen, Simon Kornblith, Mohammad Norouzi, and Geoffrey Hinton. 2020. [A simple framework for contrastive learning of visual representations](https://md.research.elamur.ai/free/en/papers/chen-2020-simple-framework-contrastive-learning-visual/). In ICML.
13. Valeriia Cherepanova, Micah Goldblum, Harrison Foley, Shiyuan Duan, John Dickerson, Gavin Taylor, and Tom Goldstein. 2021. Lowkey: Leveraging adversarial attacks to protect social media users from facial recognition. arXiv preprint arXiv:2101.07922. — [arXiv:2101.07922](https://arxiv.org/abs/2101.07922) [find](https://scholar.google.com/scholar?q=Valeriia+Cherepanova%2C+Micah+Goldblum%2C+Harrison+Foley%2C+Shiyuan+Duan%2C+John+Dickerson%2C+Gavin+Taylor%2C+and+Tom+Goldstein%2E+2021%2E+Lowkey%3A+Leveraging+adversarial+attacks+to+protect+social+media+users+from+fac)
14. Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E. Gonzalez, Ion Stoica, and Eric P. Xing. 2023. Vicuna: An open-source chatbot impressing gpt-4 with 90%* chatgpt quality. [find](https://scholar.google.com/scholar?q=Wei%2DLin+Chiang%2C+Zhuohan+Li%2C+Zi+Lin%2C+Ying+Sheng%2C+Zhanghao+Wu%2C+Hao+Zhang%2C+Lianmin+Zheng%2C+Siyuan+Zhuang%2C+Yonghao+Zhuang%2C+Joseph+E%2E+Gonzalez%2C+Ion+Stoica%2C+and+Eric+P%2E+Xing%2E+2023%2E+Vicuna%3A+An+open%2Dsource+cha)
15. Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale N Fung, and Steven Hoi. 2024. [Instructblip: Towards general-purpose vision-language models with instruction tuning](https://md.research.elamur.ai/free/en/papers/dai-2023-instructblip-towards-general-purpose-vision/). In NeurIPS.
16. Jinyuan Jia and Neil Zhenqiang Gong. 2018. Attriguard: A practical defense against attribute inference attacks via adversarial machine learning. In USENIX Security Symposium. [find](https://scholar.google.com/scholar?q=Jinyuan+Jia+and+Neil+Zhenqiang+Gong%2E+2018%2E+Attriguard%3A+A+practical+defense+against+attribute+inference+attacks+via+adversarial+machine+learning%2E+In+USENIX+Security+Symposium%2E)
17. Jinyuan Jia, Ahmed Salem, Michael Backes, Yang Zhang, and Neil Zhenqiang Gong. 2019. Memguard: Defending against black-box membership inference attacks via adversarial examples. In ACM conference on computer and communications security. [find](https://scholar.google.com/scholar?q=Jinyuan+Jia%2C+Ahmed+Salem%2C+Michael+Backes%2C+Yang+Zhang%2C+and+Neil+Zhenqiang+Gong%2E+2019%2E+Memguard%3A+Defending+against+black%2Dbox+membership+inference+attacks+via+adversarial+examples%2E+In+ACM+conference+on+c)
18. Erik Jones, Anca Dragan, Aditi Raghunathan, and Jacob Steinhardt. 2023. Automatically auditing large language models via discrete optimization. In ICML. [find](https://scholar.google.com/scholar?q=Erik+Jones%2C+Anca+Dragan%2C+Aditi+Raghunathan%2C+and+Jacob+Steinhardt%2E+2023%2E+Automatically+auditing+large+language+models+via+discrete+optimization%2E+In+ICML%2E)
19. Andrej Karpathy and Li Fei-Fei. 2015. [Deep visual-semantic alignments for generating image descriptions](https://md.research.elamur.ai/free/en/papers/karpathy-2014-deep-visual-semantic-alignments-generating/). In CVPR.
20. Prafulla Dhariwal and Alexander Nichol. 2021. Diffusion models beat gans on image synthesis. In NeurIPS. [find](https://scholar.google.com/scholar?q=Prafulla+Dhariwal+and+Alexander+Nichol%2E+2021%2E+Diffusion+models+beat+gans+on+image+synthesis%2E+In+NeurIPS%2E)
21. Alexey Kurakin, Ian J Goodfellow, and Samy Bengio. 2018. Adversarial examples in the physical world. In Artificial intelligence safety and security. Chapman and Hall/CRC. [find](https://scholar.google.com/scholar?q=Alexey+Kurakin%2C+Ian+J+Goodfellow%2C+and+Samy+Bengio%2E+2018%2E+Adversarial+examples+in+the+physical+world%2E+In+Artificial+intelligence+safety+and+security%2E+Chapman+and+Hall%2FCRC%2E)
22. Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdhery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, and 1 others. 2023. Palm-e: An embodied multimodal language model. arXiv. [find](https://scholar.google.com/scholar?q=Danny+Driess%2C+Fei+Xia%2C+Mehdi+SM+Sajjadi%2C+Corey+Lynch%2C+Aakanksha+Chowdhery%2C+Brian+Ichter%2C+Ayzaan+Wahid%2C+Jonathan+Tompson%2C+Quan+Vuong%2C+Tianhe+Yu%2C+and+1+others%2E+2023%2E+Palm%2De%3A+An+embodied+multimodal+langu)
23. Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. 2023. [Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models](https://md.research.elamur.ai/free/en/papers/li-2023-blip-2-bootstrapping-language-image/). In ICML.
24. Yuxin Fang, Wen Wang, Binhui Xie, Quan Sun, Ledell Wu, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. 2023. Eva: Exploring the limits of masked visual representation learning at scale. In CVPR. [find](https://scholar.google.com/scholar?q=Yuxin+Fang%2C+Wen+Wang%2C+Binhui+Xie%2C+Quan+Sun%2C+Ledell+Wu%2C+Xinggang+Wang%2C+Tiejun+Huang%2C+Xinlong+Wang%2C+and+Yue+Cao%2E+2023%2E+Eva%3A+Exploring+the+limits+of+masked+visual+representation+learning+at+scale%2E+In+CVP)
25. Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. 2025. Figstep: Jailbreaking large vision-language models via typographic visual prompts. In AAAI. [find](https://scholar.google.com/scholar?q=Yichen+Gong%2C+Delong+Ran%2C+Jinyuan+Liu%2C+Conglei+Wang%2C+Tianshuo+Cong%2C+Anyu+Wang%2C+Sisi+Duan%2C+and+Xiaoyun+Wang%2E+2025%2E+Figstep%3A+Jailbreaking+large+vision%2Dlanguage+models+via+typographic+visual+prompts%2E+In+A)
26. Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. [Explaining and harnessing adversarial examples](https://md.research.elamur.ai/free/en/papers/goodfellow-2014-explaining-harnessing-adversarial-examples/). In ICLR.
27. Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Lu Wang, and Weizhu Chen. 2022. [Lora: Low-rank adaptation of large language models](https://md.research.elamur.ai/free/en/papers/hu-2021-lora-low-rank-adaptation-large/). In ICLR.
28. Wen Huang, Hongbin Liu, Minxin Guo, and Neil Zhenqiang Gong. 2024. Visual hallucinations of multimodal large language models. In ACL Findings. [find](https://scholar.google.com/scholar?q=Wen+Huang%2C+Hongbin+Liu%2C+Minxin+Guo%2C+and+Neil+Zhenqiang+Gong%2E+2024%2E+Visual+hallucinations+of+multimodal+large+language+models%2E+In+ACL+Findings%2E)
29. Hezheng Lin, Xing Cheng, Xiangyu Wu, and Dong Shen. 2022. Cat: Cross attention in vision transformer. In ICME. [find](https://scholar.google.com/scholar?q=Hezheng+Lin%2C+Xing+Cheng%2C+Xiangyu+Wu%2C+and+Dong+Shen%2E+2022%2E+Cat%3A+Cross+attention+in+vision+transformer%2E+In+ICME%2E)
30. Haotian Liu, Chunyuan Li, Yuheng Li, and Yong Jae Lee. 2024a. [Improved baselines with visual instruction tuning](https://md.research.elamur.ai/free/en/papers/liu-2023-improved-baselines-visual-instruction-tuning/). In CVPR.
31. Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2024b. [Visual instruction tuning](https://md.research.elamur.ai/free/en/papers/liu-2023-visual-instruction-tuning/). NeurIPS.
32. Hongbin Liu, Wenjie Qu, Jinyuan Jia, and Neil Zhenqiang Gong. 2024c. Pre-trained encoders in self-supervised learning improve secure and privacy-preserving supervised learning. In S&P Workshops. [find](https://scholar.google.com/scholar?q=Hongbin+Liu%2C+Wenjie+Qu%2C+Jinyuan+Jia%2C+and+Neil+Zhenqiang+Gong%2E+2024c%2E+Pre%2Dtrained+encoders+in+self%2Dsupervised+learning+improve+secure+and+privacy%2Dpreserving+supervised+learning%2E+In+S%26P+Workshops%2E)
33. Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. 2015. Deep learning face attributes in the wild. In ICCV. [find](https://scholar.google.com/scholar?q=Ziwei+Liu%2C+Ping+Luo%2C+Xiaogang+Wang%2C+and+Xiaoou+Tang%2E+2015%2E+Deep+learning+face+attributes+in+the+wild%2E+In+ICCV%2E)
34. Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. 2024a. An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models. In ICLR. [find](https://scholar.google.com/scholar?q=Haochen+Luo%2C+Jindong+Gu%2C+Fengyuan+Liu%2C+and+Philip+Torr%2E+2024a%2E+An+image+is+worth+1000+lies%3A+Adversarial+transferability+across+prompts+on+vision%2Dlanguage+models%2E+In+ICLR%2E)
35. Drew A Hudson and Christopher D Manning. 2019. [Gqa: A new dataset for real-world visual reasoning and compositional question answering](https://md.research.elamur.ai/free/en/papers/hudson-2019-gqa-new-dataset-real-world/). In CVPR.
36. Weidi Luo, Siyuan Ma, Xiaogeng Liu, Xiaoyu Guo, and Chaowei Xiao. 2024b. Jailbreakv-28k: A benchmark for assessing the robustness of multimodal large language models against jailbreak attacks. arXiv. [find](https://scholar.google.com/scholar?q=Weidi+Luo%2C+Siyuan+Ma%2C+Xiaogeng+Liu%2C+Xiaoyu+Guo%2C+and+Chaowei+Xiao%2E+2024b%2E+Jailbreakv%2D28k%3A+A+benchmark+for+assessing+the+robustness+of+multimodal+large+language+models+against+jailbreak+attacks%2E+arXiv%2E)
37. Gabriel Ilharco, Mitchell Wortsman, Nicholas Carlini, Rohan Taori, Aniruddh Dave, Vaishaal Shankar, Hongseok Namkoong, John Miller, Hannaneh Hajishirzi, Ali Farhadi, and Ludwig Schmidt. 2021. Openclip. [find](https://scholar.google.com/scholar?q=Gabriel+Ilharco%2C+Mitchell+Wortsman%2C+Nicholas+Carlini%2C+Rohan+Taori%2C+Aniruddh+Dave%2C+Vaishaal+Shankar%2C+Hongseok+Namkoong%2C+John+Miller%2C+Hannaneh+Hajishirzi%2C+Ali+Farhadi%2C+and+Ludwig+Schmidt%2E+2021%2E+Openclip)
38. Weidi Luo, Qiming Zhang, Tianyu Lu, Xiaogeng Liu, Yue Zhao, Zhen Xiang, and Chaowei Xiao. 2025. Doxing via the lens: Revealing privacy leakage in image geolocation for agentic multi-modal large reasoning model. arXiv preprint arXiv:2504.19373. — [arXiv:2504.19373](https://arxiv.org/abs/2504.19373) [find](https://scholar.google.com/scholar?q=Weidi+Luo%2C+Qiming+Zhang%2C+Tianyu+Lu%2C+Xiaogeng+Liu%2C+Yue+Zhao%2C+Zhen+Xiang%2C+and+Chaowei+Xiao%2E+2025%2E+Doxing+via+the+lens%3A+Revealing+privacy+leakage+in+image+geolocation+for+agentic+multi%2Dmodal+large+reason)
39. Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2018. [Towards deep learning models resistant to adversarial attacks](https://md.research.elamur.ai/free/en/papers/madry-2017-towards-deep-learning-models-resistant/). In ICLR.
40. Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. 2022. Diffusion models for adversarial purification. In ICML. [find](https://scholar.google.com/scholar?q=Weili+Nie%2C+Brandon+Guo%2C+Yujia+Huang%2C+Chaowei+Xiao%2C+Arash+Vahdat%2C+and+Anima+Anandkumar%2E+2022%2E+Diffusion+models+for+adversarial+purification%2E+In+ICML%2E)
41. Maxime Oquab, Timothée Darcet, Théo Moutakanni, Huy Vo, Marc Szafraniec, Vasil Khalidov, Pierre Fernandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, and 1 others. 2023. [Dinov2: Learning robust visual features without supervision](https://md.research.elamur.ai/free/en/papers/oquab-2023-dinov2-learning-robust-visual-features/). arXiv.
42. Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In AAAI. [find](https://scholar.google.com/scholar?q=Xiangyu+Qi%2C+Kaixuan+Huang%2C+Ashwinee+Panda%2C+Peter+Henderson%2C+Mengdi+Wang%2C+and+Prateek+Mittal%2E+2024%2E+Visual+adversarial+examples+jailbreak+aligned+large+language+models%2E+In+AAAI%2E)
43. Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, and 1 others. 2021. [Learning transferable visual models from natural language supervision](https://md.research.elamur.ai/free/en/papers/radford-2021-learning-transferable-visual-models-natural/). In ICML.
44. Hugo Touvron, Louis Martin, Kevin Stone, Peter Albert, Amjad Almahairi, Yasmine Babaei, Nikolay Bashlykov, Soumya Batra, Prajjwal Bhargava, Shruti Bhosale, and 1 others. 2023. [Llama 2: Open foundation and fine-tuned chat models](https://md.research.elamur.ai/free/en/papers/touvron-2023-llama-2-open-foundation-fine/). arXiv.
45. Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. 2017. [Attention is all you need](https://md.research.elamur.ai/free/en/papers/vaswani-2017-attention-all-need/). In NeurIPS.
46. Xiaohua Zhai, Basil Mustafa, Alexander Kolesnikov, and Lucas Beyer. 2023. [Sigmoid loss for language image pre-training](https://md.research.elamur.ai/free/en/papers/zhai-2023-sigmoid-loss-language-image-pre/). In Proceedings of the IEEE/CVF international conference on computer vision, pages 11975–11986.
47. Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. 2024. On evaluating adversarial robustness of large vision-language models. In NeurIPS. [find](https://scholar.google.com/scholar?q=Yunqing+Zhao%2C+Tianyu+Pang%2C+Chao+Du%2C+Xiao+Yang%2C+Chongxuan+Li%2C+Ngai%2DMan+Man+Cheung%2C+and+Min+Lin%2E+2024%2E+On+evaluating+adversarial+robustness+of+large+vision%2Dlanguage+models%2E+In+NeurIPS%2E)
48. Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. 2024. [Minigpt-4: Enhancing vision-language understanding with advanced large language models](https://md.research.elamur.ai/free/en/papers/zhu-2023-minigpt-4-enhancing-vision-language/). In ICLR.
49. Machel Reid, Nikolay Savinov, Denis Teplyashin, Dmitry Lepikhin, Timothy Lillicrap, Jean-baptiste Alayrac, Radu Soricut, Angeliki Lazaridou, Orhan Firat, Julian Schrittwieser, and 1 others. 2024. [Gemini 1.5: Unlocking multimodal understanding across millions of tokens of context](https://md.research.elamur.ai/free/en/papers/gemini-team-2024-gemini-1-5-unlocking-multimodal/). arXiv.
50. Christian Schlarmann and Matthias Hein. 2023. On the adversarial robustness of multi-modal foundation models. In ICCV. [find](https://scholar.google.com/scholar?q=Christian+Schlarmann+and+Matthias+Hein%2E+2023%2E+On+the+adversarial+robustness+of+multi%2Dmodal+foundation+models%2E+In+ICCV%2E)
51. Shawn Shan, Emily Wenger, Jiayun Zhang, Huiying Li, Haitao Zheng, and Ben Y Zhao. 2020. Fawkes: Protecting privacy against unauthorized deep learning models. In 29th USENIX security symposium (USENIX Security 20), pages 1589–1604. [find](https://scholar.google.com/scholar?q=Shawn+Shan%2C+Emily+Wenger%2C+Jiayun+Zhang%2C+Huiying+Li%2C+Haitao+Zheng%2C+and+Ben+Y+Zhao%2E+2020%2E+Fawkes%3A+Protecting+privacy+against+unauthorized+deep+learning+models%2E+In+29th+USENIX+security+symposium+%28USENIX+)
52. Amanpreet Singh, Vivek Natarjan, Meet Shah, Yu Jiang, Xinlei Chen, Devi Parikh, and Marcus Rohrbach. 2019. Towards vqa models that can read. In CVPR. [find](https://scholar.google.com/scholar?q=Amanpreet+Singh%2C+Vivek+Natarjan%2C+Meet+Shah%2C+Yu+Jiang%2C+Xinlei+Chen%2C+Devi+Parikh%2C+and+Marcus+Rohrbach%2E+2019%2E+Towards+vqa+models+that+can+read%2E+In+CVPR%2E)
53. Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. 2021. [Score-based generative modeling through stochastic differential equations](https://md.research.elamur.ai/free/en/papers/song-2020-score-based-generative-modeling-through/). In ICLR.
54. Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. 2014. [Intriguing properties of neural networks](https://md.research.elamur.ai/free/en/papers/szegedy-2013-intriguing-properties-neural-networks/). In ICLR.
55. Alon Talmor, Jonathan Herzig, Nicholas Lourie, and Jonathan Berant. 2019. [CommonsenseQA: A question answering challenge targeting commonsense knowledge](https://md.research.elamur.ai/free/en/papers/talmor-2019-commonsenseqa-question-answering-challenge-targeting/). In NAACL.

*Updated 1 November 2026*