Visual Information Manipulation Attacks

• Visual Information Manipulation (VIM) attacks are adversarial interventions that subtly alter visual content to induce erroneous semantic interpretations in models and human observers.
• They utilize varied methodologies including pixel perturbations, steganographic injections, AR overlay manipulations, and text rendering alterations to achieve malicious outcomes.
• Empirical evaluations report high attack success rates with metrics such as ASR, while defense strategies focus on adversarial training, anomaly detection, and multimodal consistency checks.

Visual Information Manipulation (VIM) attacks are adversarial interventions that alter visual information so that a vision system, a vision-LLM (VLM), or a human observer infers the wrong semantics or takes the wrong action. Recent work uses the term in several closely related ways: hiding malicious instructions or compliance directives inside an image for VLM jailbreaks (Liu et al., 9 Oct 2025); crafting adversarial images $x' = x + \delta$ that induce semantically wrong or malicious outputs in multimodal LLMs (Janowczyk et al., 2024); altering or augmenting real-world visual elements through an AR rendering pipeline so that users are misled (Xiu et al., 3 Sep 2025); and manipulating rendered text through combining diacritical marks or visually similar glyphs to fool OCR or vision-based text models (Boucher et al., 2023, Liu et al., 2020). Across these settings, the common mechanism is not a single perturbation model but the exploitation of the visual channel as the carrier of deceptive, hidden, spurious, or selectively suppressed information.

1. Definitions, formalizations, and threat models

A recurring formalization treats VIM as the construction of an adversarial image $x' = x + \delta$ subject to a perceptual or norm constraint such as $\|\delta\|_p \le \epsilon$, with the constraint that the manipulated image remains visually similar while the model’s output changes toward an attacker objective (Janowczyk et al., 2024). In the specific case of VisualDAN, a perturbation $\delta$ is added to a benign seed image $X_0$ so that the combined multimodal input $(\tilde X = X_0+\delta, Q_j)$ yields a desired DAN-style malicious target $T_j$; the attack minimizes a negative log-likelihood objective plus a norm regularizer (Liu et al., 9 Oct 2025).

In augmented reality, the formal object is not merely a perturbed bitmap but a manipulated rendered scene. One definition writes the manipulated scene as $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$, where $I(x,y)$ is the real-world scene and $O_{\text{adv}}$ is an AR overlay designed to distort semantic or spatial cues without the user’s awareness (Xiu et al., 3 Sep 2025). This formulation makes explicit that the attack surface is the rendering pipeline, not only the learned model.

In text-rendering settings, the adversarial object is a Unicode string whose rendering induces a manipulated image. A rendered-text attack defines a perturbed string $x' = x + \delta$0, generated by inserting combining diacritical marks, and a rendered image $x' = x + \delta$1; the objective is then to find $x' = x + \delta$2 with $x' = x + \delta$3 that causes a victim vision model or OCR pipeline to misbehave (Boucher et al., 2023). A related line of work replaces characters with visually similar alternatives from character embedding spaces, again preserving human readability while changing the model’s prediction (Liu et al., 2020).

Threat models vary substantially. Some papers assume white-box access to the VLM and its gradients, as in VMA and VIP (Wang et al., 26 May 2025, Meftah et al., 11 Jul 2025). Others assume black-box access together with knowledge of standard preprocessing, as in steganographic prompt embedding (Pathade, 30 Jul 2025). AR work assumes access to the rendering pipeline, world-coordinate tracking, and overlay insertion privileges (Xiu et al., 3 Sep 2025). Poisoning and backdoor work instead assumes supply-chain control over fine-tuning data or training-time triggers (Xu et al., 2024, Wu et al., 1 Jul 2025, Romero et al., 9 Apr 2026). The diversity of threat models is itself a defining property of the area.

2. Taxonomies and attack objectives

A 2025 survey of VLM attacks organizes the space by underlying objectives—jailbreak, camouflage, and exploitation—while also emphasizing the role of data manipulation methodologies, defense mechanisms, evaluation metrics, and future robustness directions (Dai et al., 10 Feb 2025). That objective-centered framing is compatible with, but not identical to, several more domain-specific taxonomies.

In AR, Xiu and Gorlatova classify VIM along two axes: “Format” and “Purpose.” The format axis comprises character manipulation, phrase manipulation, and pattern manipulation; the purpose axis comprises information replacement, information obfuscation, and extra wrong information, yielding seven realistic attack types in the AR-VIM benchmark (Xiu et al., 27 Jul 2025). A separate AR demonstration paper groups attacks by the manipulated cue—text manipulation, signage manipulation, and obstacle insertion—and further notes that these categories can be sub-taxonomized by intent, such as misdirection versus obstruction, and by permanence, such as static versus dynamic overlays (Xiu et al., 3 Sep 2025).

For web-trained VLMs, artifact-based attacks generalize typographic attacks to any visual artifact $x' = x + \delta$4 that a model has spuriously associated with a target class $x' = x + \delta$5. The artifact classes are non-matching text fragments, graphics with embedded text, and graphics without text (Qraitem et al., 17 Mar 2025). This taxonomy is important because it explicitly moves beyond exact class-name insertion and instead targets correlations learned from logos, symbols, misspellings, and branding content.

Other taxonomies are task-specific. Shadowcast distinguishes a Label Attack, which swaps class labels such as “Donald Trump” and “Joe Biden,” from a Persuasion Attack, which exploits the generative capacity of VLMs to induce a coherent destination narrative such as portraying junk food as healthy (Xu et al., 2024). Work on VLM-based scanpath prediction distinguishes fixed-path attacks, input-aware spatial-redirect attacks, and scanpath-duration attacks (Romero et al., 9 Apr 2026). Work on visual-modality jailbreaks defines four attack types: visual cipher instructions, visual object substitution, visual text erasure and replacement, and visual analogy puzzles (Azulay et al., 1 May 2026). The taxonomic heterogeneity reflects application structure rather than disagreement about the core phenomenon.

3. Mechanistic families of VIM attacks

The most familiar family uses direct optimization of image perturbations. VisualDAN constructs a single adversarial image trained on a DAN-style harmful corpus in which each malicious target is prepended with an affirmative prefix such as “Sure, I can help you with that,” then reuses the learned image at inference with fresh harmful prompts (Liu et al., 9 Oct 2025). VMA generalizes this logic into a sequence-level manipulation framework: the attacker chooses a target output token sequence and optimizes an adversarial image through a differentiable sigmoid-projection together with first-order and second-order momentum updates, enabling jailbreaking, hijacking, privacy breaches, denial-of-service, sponge examples, and watermark injection (Wang et al., 26 May 2025). VIP applies optimization to a different objective: rather than forcing harmful output, it minimizes early-layer attention to ROI tokens and suppresses the associated value vectors so that a VLM fails to detect or describe sensitive image regions while preserving the rest of the image’s semantics (Meftah et al., 11 Jul 2025).

A second family hides prompts or directives inside images. “Invisible Injections” decomposes a textual prompt into three parts and embeds them into a cover image through spatial, frequency, and neural steganographic channels, recombining the outputs with weights $x' = x + \delta$6 into a stego-image $x' = x + \delta$7 (Pathade, 30 Jul 2025). VisualDAN is not strictly steganographic, but it shares the same principle that compliance instructions can be carried by the visual modality rather than the text prompt (Liu et al., 9 Oct 2025). Visual-modality jailbreaks extend the idea further by replacing harmful concepts with visual ciphers, benign object substitutes, edited text, or analogy puzzles whose prohibited meaning must be inferred from the image (Azulay et al., 1 May 2026).

A third family exploits spurious correlations rather than hidden text. Artifact-based attacks mine CC12M for textual or graphical artifacts that cause a downstream model to predict a chosen target class when those artifacts are pasted onto unrelated images; the attack is formulated as retrieval plus ranking over a large pretraining dataset, with effect estimation and placement optimization (Qraitem et al., 17 Mar 2025). This mechanism does not require imperceptible noise and is fundamentally about dataset-induced shortcut learning.

A fourth family operates at training time through poisoning or backdoors. Shadowcast injects a small number of visually indistinguishable image-text poison pairs into visual-instruction tuning data. Each poison image is optimized so that its vision-encoder representation approaches an original concept $x' = x + \delta$8, while its paired text describes a destination concept $x' = x + \delta$9, causing the fine-tuned model to later misread benign original-concept images (Xu et al., 2024). BadViM targets Vision Mamba with a Resonant Frequency Trigger, derived from a frequency-sensitivity heatmap, together with a Hidden State Alignment loss that pulls poisoned examples toward the target-class hidden-state centroid (Wu et al., 1 Jul 2025). In gaze prediction, “Follow My Eyes” poisons a fraction of the training set so that a triggered model outputs attacker-chosen fixation trajectories or durations while preserving clean behavior (Romero et al., 9 Apr 2026).

A fifth family exploits conversational persistence. Visual Memory Injection perturbs a single image so that the LVLM behaves normally on an anchor prompt but emits a prescribed target message when a triggering prompt appears after many unrelated turns. The optimization jointly maximizes benign anchoring and malicious triggering across multiple context lengths through context-cycling (Schlarmann et al., 17 Feb 2026). This mechanism differs from single-turn jailbreaks because the manipulated image remains in the model’s visual memory across the conversation.

Human-targeted VIM in AR forms an additional family. Here the attack is not necessarily to fool a learned model first, but to change the semantic content of a user’s visual scene by replacing labels, inserting false road signs, or overlaying virtual obstacles in physically plausible positions (Xiu et al., 3 Sep 2025). The same category extends naturally to browser-based behavior manipulation pages and visualization tampering, where the manipulated display is the attack payload (King et al., 21 Oct 2025, Song et al., 21 Dec 2025).

4. Evaluation protocols and empirical findings

Evaluation is correspondingly heterogeneous. VLM jailbreak work commonly reports Attack Success Rate (ASR), but the concrete judge can be keyword-based, classifier-based, LLM-based, or manual. VisualDAN uses keyword heuristics, Llama-Guard2, GPT4-Eval, and Manual-Eval, and augments them with toxicity analysis from Perspective API and Detoxify (Liu et al., 9 Oct 2025). Steganographic prompt injection reports ASR together with PSNR, SSIM, and LPIPS to quantify imperceptibility, and also measures human detection (Pathade, 30 Jul 2025). Artifact attacks report ASR with an occlusion control that verifies the model still predicts the correct class when the artifact region is masked, preventing trivial successes due only to content occlusion (Qraitem et al., 17 Mar 2025). AR work measures error rate, response time $\|\delta\|_p \le \epsilon$0, detection latency, and user confusion (Xiu et al., 3 Sep 2025, Xiu et al., 27 Jul 2025).

Reported effectiveness is often substantial. On the Manual-40 corpus, VisualDAN raises Manual-Eval ASR from $\|\delta\|_p \le \epsilon$1–$\|\delta\|_p \le \epsilon$2 without attack to $\|\delta\|_p \le \epsilon$3–$\|\delta\|_p \le \epsilon$4 across models; on MiniGPT-v2, Llama-Guard2 ASR rises from $\|\delta\|_p \le \epsilon$5 to $\|\delta\|_p \le \epsilon$6 on SafetyBench and from $\|\delta\|_p \le \epsilon$7 to $\|\delta\|_p \le \epsilon$8 on AdvBench. On RealToxicityPrompts, Perspective toxicity rates rise from $\|\delta\|_p \le \epsilon$9 for a blank image to $\delta$0 for vanilla VisualDAN and $\delta$1 when a small toxic corpus is added (Liu et al., 9 Oct 2025). VMA reports ASR around $\delta$2 on a 500-triple manipulation setting, $\delta$3 jailbreak ASR at $\delta$4, $\delta$5 privacy-breach ASR at $\delta$6 except for a lower result on DeepSeek-VL, $\delta$7 DoS ASR at $\delta$8, and sponge examples that make inference $\delta$9–$X_0$0 slower (Wang et al., 26 May 2025).

Steganographic embedding is weaker in raw ASR but much stronger in imperceptibility. “Invisible Injections” reports an overall attack success rate of $X_0$1 with neural steganography reaching $X_0$2, while maintaining PSNR $X_0$3 dB and SSIM $X_0$4; open-source models such as MiniGPT-4 and LLaVA are more vulnerable than GPT-4V and Claude 3.5 Sonnet in the reported evaluation (Pathade, 30 Jul 2025). Artifact attacks achieve approximately $X_0$5 average ASR for text-only artifacts, $X_0$6 for graphics-text, $X_0$7 for graphics-no-text, and near $X_0$8 when artifacts are combined; transferability across models reaches $X_0$9–$(\tilde X = X_0+\delta, Q_j)$0, with SigLIP reported as the most resistant but still around $(\tilde X = X_0+\delta, Q_j)$1 (Qraitem et al., 17 Mar 2025).

Training-time attacks can be extremely strong. Shadowcast exceeds $(\tilde X = X_0+\delta, Q_j)$2 success on Trump$(\tilde X = X_0+\delta, Q_j)$3Biden and $(\tilde X = X_0+\delta, Q_j)$4 on Engine-Light$(\tilde X = X_0+\delta, Q_j)$5Fuel-Light at 50 poisons, while leaving benchmark utility unchanged within $(\tilde X = X_0+\delta, Q_j)$6 on GQA and VizWiz; persuasion attacks reach approximately $(\tilde X = X_0+\delta, Q_j)$7 and $(\tilde X = X_0+\delta, Q_j)$8 at the same poison count, with $(\tilde X = X_0+\delta, Q_j)$9 human agreement with GPT-3.5 success labels (Xu et al., 2024). BadViM reports ASR consistently above $T_j$0 with negligible clean data accuracy drop below $T_j$1, and remains above $T_j$2 under PatchDrop, PatchShuffle, and JPEG compression (Wu et al., 1 Jul 2025).

Human-facing manipulations also show measurable effects. In a pilot AR study with $T_j$3, two of three participants ($T_j$4) followed the manipulated “hotel” label that actually pointed to the hospital, and manipulated cues increased mean $T_j$5 by approximately $T_j$6 seconds (Xiu et al., 3 Sep 2025). In rendered-text attacks, $T_j$7 diacritic insertions drop CANINE SQuAD QA F1 from $T_j$8 to $T_j$9, while human word-reading accuracy remains $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$0–$I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$1 and toxicity-label accuracy stays above $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$2 (Boucher et al., 2023). In multi-turn LVLM settings, VMI attains roughly $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$3 combined success up to 15 turns and roughly $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$4 at 25 turns in a stock-manipulation scenario, with similar $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$5–$I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$6 curves in a political scenario (Schlarmann et al., 17 Feb 2026).

5. Defenses, detection, and mitigation

Defenses in the literature are layered rather than singular. VisualDAN proposes multimodal adversarial training with DAN-injected examples, image purification or anomaly detection, cross-modal consistency checks, and architectural changes such as gating layers that separate vision-derived tokens from text tokens or dual-stream transformers with independent safety monitors (Liu et al., 9 Oct 2025). A review of visual-pathway exploitation in MLLMs discusses SmoothVLM, pixel-wise randomization, and MirrorCheck as representative defenses, and emphasizes adaptive defenses, better evaluation tools, and security approaches that protect both visual and text data (Janowczyk et al., 2024).

For covert prompt embedding, the most explicit defense stack is the multi-layer pipeline in “Invisible Injections”: adaptive Gaussian filtering, selective JPEG recompression, noise injection, steganalysis-based statistical tests, neural detectors, and behavioral monitoring. Reported layerwise mitigation ranges from $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$7 to $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$8, while the combined system reaches about $I'(x,y)=I(x,y)+O_{\text{adv}}(x,y)$9 total mitigation with an Interaction Factor $I(x,y)$0, at an overhead of $I(x,y)$1 ms per image, $I(x,y)$2 compute, and about $I(x,y)$3 drop in benign accuracy (Pathade, 30 Jul 2025). For artifact attacks, artifact-aware prompting—extended from OCR-only settings to graphical artifacts—reduces success rates by up to $I(x,y)$4 percentage points relative to standard prompts (Qraitem et al., 17 Mar 2025).

Rendered-text attacks admit unusually direct countermeasures. “When Vision Fails” identifies Unicode-level stripping of combining diacritical marks before rendering as the simplest effective countermeasure (Boucher et al., 2023). “Visual Attack and Defense on Text” instead hardens the model by replacing identity-based character embeddings with a vision-based character model and then applying adversarial training on visually perturbed text; the reported result is improved robustness without sacrificing clean-text accuracy (Liu et al., 2020).

AR and human-facing settings motivate dedicated detectors. VIM-Sense combines OCR grounding with VLM-based semantic reasoning on the AR-VIM dataset of 452 raw/AR video pairs, achieving $I(x,y)$5 attack detection accuracy and average latency of $I(x,y)$6 seconds in simulated video processing and $I(x,y)$7 seconds in a real-world Android AR application (Xiu et al., 27 Jul 2025). The miniature-city AR demo proposes OCR and VLM cross-validation against a trusted geospatial map, digital signatures for overlays, and multimodal consistency checks with depth and inertial sensing (Xiu et al., 3 Sep 2025). On the web, PP3D deploys a client-side visual-and-OCR detector inside a browser extension and reports above $I(x,y)$8 detection rate at $I(x,y)$9 false positives, with above $O_{\text{adv}}$0 detection on fresh campaigns collected months after training (King et al., 21 Oct 2025). For chart tampering, VizDefender combines a semi-fragile watermark with MLLM-based intent inference and reports higher image fidelity and tampering-localization performance than EditGuard on the summarized benchmarks (Song et al., 21 Dec 2025).

6. Open problems, misconceptions, and dual-use implications

A common misconception is that VIM is reducible to imperceptible pixel noise. The current literature includes imperceptible perturbations (Wang et al., 26 May 2025), visually explicit but semantically plausible artifacts (Qraitem et al., 17 Mar 2025), hidden steganographic prompts (Pathade, 30 Jul 2025), AR overlays that change the apparent physical world (Xiu et al., 3 Sep 2025), training-time poison pairs (Xu et al., 2024), frequency-domain backdoor triggers (Wu et al., 1 Jul 2025), and multi-turn conversational memory injections (Schlarmann et al., 17 Feb 2026). Any narrow definition misses substantial parts of the attack surface.

Transferability remains uneven. VisualDAN reports that adversarial images optimized on one VLM rarely transfer to another because vision encoders and LLM backbones differ, although universal image attacks remain feasible once the target model is known (Liu et al., 9 Oct 2025). By contrast, artifact attacks transfer strongly across models, at $O_{\text{adv}}$1–$O_{\text{adv}}$2 success in the reported setting (Qraitem et al., 17 Mar 2025). Steganographic prompt injection suggests that open-source VLMs are more vulnerable than heavily guarded commercial offerings (Pathade, 30 Jul 2025). CFGPatch, in a visible-infrared setting, shows that adversarial samples optimized for zero-shot classification can transfer to image captioning and visual question answering, indicating cross-task transferability rather than just cross-model transfer (Chen et al., 21 May 2026).

Several papers identify deeper alignment issues. Visual jailbreaks through the visual modality explicitly expose a cross-modality alignment gap: text-based safety training does not automatically generalize to harmful intent conveyed visually, and on Claude-Haiku-4.5 a visual cipher achieves $O_{\text{adv}}$3 ASR versus $O_{\text{adv}}$4 for an equivalent textual cipher (Azulay et al., 1 May 2026). VMI shows that a single perturbed image can survive as “visual memory” over more than 10,000 text tokens in a 27-turn conversation (Schlarmann et al., 17 Feb 2026). Backdoor work on scanpath prediction demonstrates that no evaluated defense simultaneously suppresses the attacks and preserves clean performance across all configurations, even after quantization and deployment on commodity smartphones (Romero et al., 9 Apr 2026).

The field is also explicitly dual-use. VIP frames privacy preservation in VLMs as an adversarial attack problem and reports up to $O_{\text{adv}}$5 reduction in detecting targeted ROIs while maintaining global image semantics intact (Meftah et al., 11 Jul 2025). VMA likewise notes that the same optimization machinery used for jailbreaking and privacy breaches can be used for watermark injection (Wang et al., 26 May 2025). This suggests that “manipulation” in VIM is not inherently malicious; it can also function as user-side concealment or protection. At the same time, the survey literature emphasizes that robust multimodal defense, comprehensive evaluation metrics, and continued exploration of future research directions remain necessary for VLM robustness and safety (Dai et al., 10 Feb 2025).