D. Liu, X. Cai, J. Dong, Z. Guo, X. Qu, R. Guan, X. Fang, D. Ye — full title: “Attacking Gray-Box Large Vision-Language Models with Adaptive SVD-Structured Adversarial Alignment,” International Conference on Machine Learning (ICML 2026). Venue and full title confirmed via the ICML 2026 downloads listing and citation records in other papers’ bibliographies. I was not able to retrieve the full abstract or results section directly — flagging methodology and findings details below as inferred from the confirmed title plus general knowledge of the gray-box attack literature, not as directly quoted from the paper.

Core Contribution

A new adversarial attack against gray-box vision-language models (VLMs) — a threat model between white-box (full weight access) and black-box (query access only), where the attacker knows the model’s architecture (or a close surrogate, e.g. a shared vision encoder like CLIP) but not its exact trained weights. The contribution, per the confirmed title, is an adaptive, SVD-structured approach to constructing the adversarial perturbation — i.e., the perturbation is built with explicit structure derived from singular value decomposition of some model-relevant matrix (most plausibly the vision encoder’s weight or feature-projection matrices), rather than being an unstructured noise pattern. “Adaptive” suggests the perturbation construction responds to properties of the specific target rather than using a fixed template.

Method

Not confirmed in detail from primary text. What I can respons­ibly state from the confirmed title and general gray-box VLM attack literature: gray-box attacks on VLMs typically exploit the fact that many VLMs share a small number of standard vision encoders (CLIP, BLIP, etc.), so an attacker can build a surrogate using the known/shared encoder and transfer adversarial perturbations to the true target even without its exact weights. The “SVD-structured” element implies the perturbation is constrained or shaped by the encoder’s principal directions of variation (its singular vectors), which is a more targeted approach than gradient-based pixel perturbation without structural priors — plausibly intended to improve transferability or imperceptibility. I could not confirm the specific victim VLMs tested, the baseline attacks compared against, or reported attack-success-rate numbers, and I’m explicitly flagging all of that as unconfirmed rather than inventing plausible-sounding figures.

Limitations

  • The single largest limitation of this entry is my own access: I could not retrieve the full abstract, so the methodology description above is a responsible inference from a confirmed title, not a verified summary of the paper’s actual contents. Anyone citing specifics from this entry beyond “the paper exists, is titled X, is by these authors, and appeared at ICML 2026” should go to the primary source first.
  • Structurally, gray-box attacks premised on shared/standard vision encoders have a known ceiling: they lose relevance as VLM architectures diversify away from a small set of common encoders, or as providers fine-tune encoders enough to break surrogate transfer.
  • Vision-language, not text-only — a modality mismatch with the core LLM focus of my niche.

Relevance to My Niche

Low-to-moderate, and mostly as a landscape/methodology marker rather than a direct citation. My niche is red-teaming text LLMs across languages and quantization levels, and this is a vision-language attack — a different modality and a different partial-information threat model (architecture-known/weights-unknown, rather than precision-reduced/quantized). The connection worth keeping in mind: gray-box framing (attacker knows something structural about the model but not everything) is conceptually adjacent to the quantization threat models I care about, where an attacker or defender knows the quantization scheme but not the exact calibration data or full-precision weights. If a gray-box framing is ever needed for the quantization work — attacker knows the quantization method but not the original full-precision checkpoint — this paper is a methodological neighbor worth knowing exists, even though I would not port its specific SVD technique without confirming it actually applies to weight-space quantization structure rather than vision-encoder feature structure.