Disrupting Hierarchical Reasoning: Adversarial Protection for Geographic Privacy in Multimodal Reasoning Models
Authors: Jiaming Zhang
CHE WANG
Yang Cao
Longtao Huang
Wei Yang Bryan Lim
Venue: ICLR 2026 Poster (2026)
Keywords: Adversarial Protection
Privacy Protection
Multi-Modal Large Language Models
Hierarchical Reasoning
Geographic Inference
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We introduce \textbf{ReasonBreak}, a novel adversarial framework specifically designed to disrupt hierarchical reasoning in MLRMs through concept-aware perturbations.

Abstract: Multi-modal large reasoning models (MLRMs) pose significant privacy risks by inferring precise geographic locations from personal images through hierarchical chain-of-thought reasoning. Existing privacy protection techniques, primarily designed for perception-based models, prove ineffective against MLRMs' sophisticated multi-step reasoning processes that analyze environmental cues. We introduce **ReasonBreak**, a novel adversarial framework specifically designed to disrupt hierarchical reasoning in MLRMs through concept-aware perturbations. Our approach is founded on the key insight that effective disruption of geographic reasoning requires perturbations aligned with conceptual hierarchies rather than uniform noise. ReasonBreak strategically targets critical conceptual dependencies within reasoning chains, generating perturbations that invalidate specific inference steps and cascade through subsequent reasoning stages. To facilitate this approach, we contribute **GeoPrivacy-6K**, a comprehensive dataset comprising 6,341 ultra-high-resolution images ($\geq$2K) with hierarchical concept annotations. Extensive evaluation across seven state-of-the-art MLRMs (including GPT-o3, GPT-5, Gemini 2.5 Pro) demonstrates ReasonBreak's superior effectiveness, achieving a 14.4\% improvement in tract-level protection (33.8\% vs 19.4\%) and nearly doubling block-level protection (33.5\% vs 16.8\%). This work establishes a new paradigm for privacy protection against reasoning-based threats.

Published as a conference paper at ICLR 2026
DISRUPTING HIERARCHICAL REASONING: ADVER- SARIAL PROTECTION FOR GEOGRAPHIC PRIVACY IN MULTIMODAL REASONING MODELS
Jiaming Zhang"; Che Wang Yang Cao', Longtao Huang", Wei Yang Bryan Lim' Nanyang Technological University "Peking University Institute of Science Tokyo 4 *Alibaba Group
ABSTRACT
Multi-modal large reasoning models (MLRMs) pose significant privacy risks by inferring precise geographic locations from personal images through hierarchi- cal thain-of-thought reasoning. Existing privacy protection techniques, primarily designed for perception based models, prove ineffective against MLRMs' sophis- ticated multi-step reasoning processes that analyze environmental cues. We intro- duce ReasonBreak, a novel adversarial framework specifically designed to dis- rupt hierarchical reasoning MLRMs through concept-aware perturbations. Our approach is founded on the key insight that effective disruption of geographic rea- soning requires perturbations aligned with conceptual hierarchies rather than uni- form noise. ReasonBreak strategically targets critical conceptual dependencies within reasoning chains, generating perturbations that invalidate specific infer- ence steps and cascade through subsequent reasoning stages. To facilitate this ap- proach, we contribute GeoPrivacy-6K, comprehensive dataset comprising 6,341 altra-high-resolution images (22K) with hierarchical concept annotations. Exten- sive evaluation across seven state-of-the-art MLRMs (including GPT-o3, GPT- 5, Gemini 2.5 Pro) demonstrates ReasonBreak's 's superior effectiveness, achiev- ing a 14.4% improvement in tract-level protection (33.8% vs 19.4%) and nearly doubling block-level protection (33.5% vs 16.8%). This work establishes a new paradigm for privacy protection against reasoning- based threats. Project Page: ReeasoBrreak
INTRODUCTION
Multi-modal large reasoning models (MLRMs) have demonstrated remarkable capabilities in infer- ring precise geographic locations from personal images. State-of-the-art systems like GPT-o3 (Jaech) al. 2024) and Gemini 2.5 Pro (Team et al. 2024) can pinpoint locations from seemingly innocu- ous photos by executing chain-of -f-thughht (CoT) Wei et al. 2022). These models systematically analyze environmental cues, architectural styles, and fine- gree-grrnnd details in a hierarchical manner, achieving location inference accuracy 21 x superior to non-expert humans (Luo et al.) 2025 This capability transforms routine social media sharing into a significant privacy risk, as personal images unwittingly reveal detailed geographic information that MLRMs can extract without user awareness. This development has profound legal implications, as unauthorized location inference is classified as serious privacy violation under regulations such as the EU's General Data Protection Regulation (GDPR) (Regulation 2016) and the California Consumer Privacy Act (CCPA) ) (Legislature 2018).
Privacy threats from MLRMs have emerged at alarming rate, yet effective countermeasures main relatively limited. The DoxBench (Luo et al., (225) study revealed that MLRMs fail to distin- guish between benign and malicious queries, readily complying with potentially harmful requests for location inference. While previous privacy defenses, particularly adversarial perturbations (Szegedy) al. 2013). have proven effective against conventional perception models like facial recognition
systems (Zhang et al., 2020) Shamshad et al., 2023 Zhong & Deng (022), they fall short against MLRMs sophisticated reasoning capabilities. Unlike conventional vision tasks that directly map
"Corresponding author. Email: j 3 ami ng. whanggntu.edu.....

---

Published as a conference paper at ICLR 2026
Continental concept Engken language with mendle doretnett
Ressoning: The moder aith lectar of opeeval heary strpping canter conto redt with stson nomer wrtten Finglen wotel (e.g. Guzzi Tilhery & Co is common formal hightend North America.
National concept Americn uuury brand Tillas & Co. storefeett
Ressoring: The spoc le rotal formal snown as Mizath contor which blends shopping, diiing, and ententarmnnt pooicatian frienly ousdeor seting pa soulsrly popular widoproadd aprosu United Stutes.
City concape Deetnoche clock becade on Tifbry & hidding
Reseoring: search for the unague anthaauur munt amargarre oentrl Tilbey & Co with lage-dock, fanked by Guzzi plppoite
Local concapt dimube to intenin centrel plaza
Reasoring: The Wosport dapturng the larg rcala loartuin diresly in bont of the konkc Tillary Co. bulking contirm specliic locuton Central Park Fourtain area withis Easton Town Center complex.
Figure 1: Geographic inference vulnerability in MLRMs. Given personal image, MLRMs employ hierarchical reasoning to progressively narrow location estimates from continental to street-level precision. Our objective to disrupt this process by generating concept-aware adversarial perturba- tions targeting specific reasoning stages.
images to labels, geographic inference in ultra-high-reee higtt-iittttoottionn images involves sophisticated multi- step reasoning. An MLRM typically identifies continent from flora, narrows country through architectural patterns, and pinpoints specific neighborhoods from subtle environmental cues like background signage. Each inference builds upon previous deductions in cascading chain of geo- graphic reasoning. Existing adversarial privacy-preserving methods, which rely on uniform pertur- bations and focus on salient foreground regions, fail disrupt this hierarchical analysis, leaving critical gap in privacy protection.
We present ReasonBreak, an adversarial framework specifically designed to disrupt hierarchical reasoning processes in MLRMs. Our key insight is that effective disruption of geographic reasoning requires perturbations aligned with the conceptual hierarchy. ReasonBreak targets critical concep- tual dependencies within geographic reasoning chains, generates perturbations that invalidate spe- cific inference steps, and ensures these disruptions cascade through subsequent reasoning stages. Our approach is enabled by new dataset developed for this task. To enable concept-aware adversarial generation, we release GeoPrivacy-6K, a collection of 6,341 high-resolution (22K) im- ages rich with geographic cues, sourced from established vision datasets. Each image is annotated using a structured, three-level framework that extracts hierarchical visual concepts, which are spa- tially localized with bounding boxes. The ReasonBreak framework uses this data to learn generator that crafts perturbations targeted at specific geographic concepts.
Extensive evaluation across GPT-5, and Gemini 2.5 Pro, demonstrates ReasonBreak 's superior effectiveness. On critical privacy metrics, ReasonBreak attains a tract-level Top-1 protection of 33.8% (vs. 19.4% for the strongest baseline) and raises block-level protection to 33.5% (vs. 16.8%), nearly doubling prior methods. These results establish ReasonBreak as the current state-of-the-arr in defending against reasoning- based privacy threats. Our primary contributions are threefold:
state-of-the-art MLRMs, including industry leaders like GPT-o3,
We present ReasonBreak, novel adversarial framework that disrupts MLRMs' hierarchi- cal geographic reasoning by targeting critical visual concepts within their chain-of-thought processes.
We contribute GeoPrivacy-6K, a comprehensive dataset of 6,341 uirra-high-resolution im- ages with detailed hierarchical concept annotations, specifically designed for reasoning- aware privacy defense research.
We provide comprehensive empirical validation across seven leading MIRMs, demonstrat- ing that ReasonBreak sets a new state-of-the-art in privacy protection.
RELATED WORK
The evolution from vision- -siiun-anggugee models (VLMs) to multi-modal large reasoning models (MLRMs) represents fundamental advancement
Geographic Inference Vision-Language Models
2

---

Published as a conference paper at ICLR 2026
in visual understanding capabilities. While early VLMs like CLIP (Radford al. 2021 estab- lished basic image-text alignment through contrastive learning, they lacked sophisticated reasoning abilities. Multi-modal large language models (MLLMs) built upon this foundation by integrating visual encoders with language models (Bai et al.] 2025 Chen et al. 2024), enabling richer scene understanding and natural language generation. MLRMs mark significant leap forward through their incorporation of CoT reasoning, allowing systematic visual analysis via hierarchical decom- position. State-of-the-art models like GPT-o3 (Jaech al. 2024) and Gemini 2.5 Pro (Team al., 2024) leverage this capability to analyze environmental characteristics, architectural patterns, and contextual details for precise geographic inference. This advancement enables location inference that exceeds human performance (Luo et al. 2025), creating novel and underexplored privacy vul- nerabilities.
A Adversarial Perturbation for Privacy Protection Privacy- preeeey-peeerviiggggg adversarial perturbationn have emerged as a key defense against unauthorized inference from personal images. While existing approaches focus on generating imperceptible noise prevent identity recognition, they primar- models that rely on direct image-to-label mapping (Zhang et al.) 2020)
ily target perception-base
Zhong& & Deng, 2022] Shamshad al.) 2023; Yang et al.) 2024] Liu al.) 2025). They employ global perturbations that modify visually salient features without considering the multi-step reason- ing processes or the fine-grained background details exploited by MLRMs for geographic inference, rendering them inadequate for this new threat.
Multi-modal Adversarial Attacks While transferable jailbreaks designed to bypass safety
guardrails remain challenging (Wang et al., 2024 Niu et al.] 2024; [Schaeffer et al. 2024), ad-
versarial attacks targeting visual perception generally exhibit better transferability. This landscape
has evolved alongside model capabilities, progressing from traditional unimodal approaches (Dong
itt al.] 20018] [Wang & He. [022]] WWang et al. 2021] Lin et al. 2023 Wei et al., [023 Liu &
Lyu 2024; Liu et al. [2024] Cai al. 2025] Fang et al. 2026). Initial efforts focused on basic
VLMs like CLIP (Radford et al. [2021). aiming to disrupt image-text alignment in joint embedding
spaces (Zhang et al.) 2022] Lu al. 2023; Zhou et al. 2023] Yin et al., 2024; Xu et al., 2024
Luo et al. 2024). Recent work has shifted toward attacking MLLMs, primarily through transfer- 2024), AdvDiffVLM (Guo)
based approaches. Notable works include Attack (Zhao et al.)
al. 2024), AnyAttack (Zhang et al., 2025a), and M-Attack (Li et al. 2025). which achieves high transferability by focusing perturbations on semantically rich regions. However, current methods fall short in addressing the hierarchical reasoning processes enabling sophisticated location infer- ence or handling the fine-graines visual details in altra-high-resolutiee
images that MLR.Ms exploit. This gap leaves the critical privacy vulnerability of geographic reasoning largely unaddressed, high- lighting the need for specialized defense mechanisms designed to disrupt concept-aware reasoning pathways rather than general perception capabilities.
DATASET CONSTRUCTION
3.1 MOTIVATION AND DESIGN
Developing effective adversarial protection against MLRM geographic inference requires train- ing data that captures the fine-grained visual details and rich geographic cues these models ex- ploit. We identify three critical requirements: (i) ultra-high-resolution images that preserve de- tails like signage and architectural features enabling precise location inference, (ii) comprehensive coverage spanning urban centers to natural landscapes, and (iii) visual annotations that link ele- ments to their geographic significance across multiple scales. To address challenges, we introduce GeoPrivacy-6K, a specialized dataset that combines rinsooiig images with comprehen- sive geographic concept annotations. It prioritizes images containing distinctive visual cues that MLRMs utilize for location inference, such architecture and environmental features.
3.2 DATA CONSTRUCTION AND ANNOTATION
We source ultra- ultra-high-ree high-resolution images from three established computer vision datasets: HoliC- ity (Zhou et al. 2020) (urban environments with rich architectural detail), Aesthetic-4K (Zhang
al. 2025bb (diverse high-quality scenes), and LHQ (Skorokhodov et al., 202T) (natural landscapes
3

---

Published as a conference paper at ICLR 2026
terraun
Nia National Park
mountain range
Scoa copped
regaon
European, urbans 2
boliddng
Desert Landsaape
Rount Rounta
eater Tenger
Temerrate waw
Smaths
Heraad acceppes Ltben incieeuue Misic rare
arcarcc chnteacural... pectural.styll stylej
Figure 2: Dataset composition and characteristics. (Left) Distribution scene types across the 6,341 images. (Center) Inference difficulty distribution based geographic reasoning complexity. (Right) Word cloud visualization hierarchical geographic concepts extracted through systematic annotation.
with geographic variety), which collectively provide diverse geographic images spanning urban en- vironments, natural landscapes, and architectural scenes. Our collection process applies two critical filtering criteria: (i) Resolution threshold: Images must maintain a minimum resolution of 2048 pixels to preserve fine-grained geographic details that MLRMs typically exploit for location infer- ence. (ii) Geographic content verification: Images must contain visually identifiable geographic features, including natural landmarks, architectural elements, environmental characteristics that enable location reasoning. This filtering yields a final collection of 6,341 ultra-high-resolutee im- ages that exhibit clear geographic visual cues. Each image undergoes the systematic annotation pipeline detailed in Appendix [ Our dataset construction prioritizes conceptual-level annotations (e.g., "deciduous broadleaf forest", "Gothic architecture") rather than precise geographic coordi- nates, which significantly reduces annotation subjectivity and improves consistency. This design choice is critical for our concept-aware approach, since we target visual concepts that enable rea- soning rather than ground- ground-truth locations, making the annotations more reliable and transferable across different geographic regions.
3.3 DATASET CHARACTERISTICS
GeoPrivacy-6K exhibits balanced diversity across geographic scene types and inference difficulty levels. Figure 2 presents presents the dataset composition: natural landscapes comprise the largest category (2,824 images, 44.5%), followed by mixed scenes (1,984 images, 31.3%) and urban architecture (1,533 images, 24.2%). The dataset's diverse composition is revealed through its difficulty (the model's confidence when inferring visual cues) distribution. 53.2% of images classified as hard inference cases, 29. % as medium difficulty, and 17.8% as easy cases, reflecting the sophisticated reasoning required for accurate geographic inference. The dataset encompasses rich vocabulary of geographic concepts, ensuring comprehensive coverage of the visual reasoning pathways used by MLRMs. Additional details are provided in Appendix B
METHOD
4.1 PRELIMINARY
MLRMs integrate visual understanding with natural language reasoning to perform complex infer- ence tasks through CoT analysis. We formalize MLRM function F I Q A that processes visual input and query through sequential reasoning steps:
F(d.(1).g) (r1, (r..r....., + a,
(1)
where de represents visual encoding, each reasoning step r; builds upon previous steps (ry)i=1
and the chain produces structured response For geographic inference specifically, each reasoning step r; identifies visual concepts and spatial relationships, generating reasoning chain R = {r:) that progressively refines location estimates from continental to local scales. Our objective is train a generator G, where generating adversarial perturbation that craft adversarial image I' I disrupts the hierarchical geographic reasoning F. while maintaining ||0|| S
Threat Model We focus on black-bor box transfer attacks, which represent the most realistic scenario for deployed MI Ms.MM. In the context of Equation I privacy defenders have access modify input
4

---

Published as a conference paper at ICLR 2026
adversarial
Image Encoder
Minimax
Decoder
clean
Concept
& Encoder
*
Text Encoder
Text Encoder
Concept
Concept
Concept
Concept 2
Concept
Figure 3: The ReasonBreak Framework Overview. 1) The input image undergoes Adaptive De- composition into m² X n" grid of blocks. 2) Each block Bg is assigned a set of relevant concepts Cs via spatial overlap analysis. 3) The Minimax Target Selection uses the assigned concept set Ck and pre-computed Embedding Bank & to find a hard-negative prior efriar- 4) This prior is fed into the learnable Decoder Go to synthesize block-specific perturbation åg. 5) The final adversarial im- age I' is reconstructed by adding the perturbations to their corresponding clean blocks. The dashed boxes at the bottom illustrate the three possible outcomes of the concept assignment logic in step (2): a block may he assigned a single concept (left), multiple concepts (middle), or the default set of all image concepts if it has spatial overlap (right).
image while privacy adversaries leverage the MLRM function with geographic queries q to extract location information from T. Under this setting, privacy defenders operate without access to the target MIRMs' & parameters or internal architectures, instead utilizing surrogate models v to deploy transfer-based attacks.
4.2 THEORETICAL MOTIVATION
To understand why concept-aware perturbations are fundamentally more effective than uniform per- turbations for disrupting reasoning processes, we provide theorctical motivation for our approach. Direct perception models can be abstracted function f o, (1) y, where adversarial attacks succeed by shifting the feature representation du (I) across decision boundary.
In contrast, MLRMs perform geographic inference via multi-sted steli--seeppe reasoning process. Each step r;s generated by reasoning function, denoted as h,, which conditioned on the context of all prior steps (T& Jeei and set of newly identified visual concepts {cy}. This can be formalized as:
T; ha(le, lj EE), (ra)ass),
where N, is the set of concept indices required for step i. This recursive structure imposes two critical dependencies: (i) Conceptual Dependency, where the validity r, hinges on the correct identification of concepts {c,}; and (ii) Sequential Dependency, where is contingent upon the entire preceding reasoning path.
The coupling of conceptual and sequential dependency makes the entire reasoning chain exception- ally brittle. An error introduced at an early stage, such as the corruption a single concept ck. does not remain localized. ReasonBreak is therefore designed to exploit this brittleness by focusing its adversarial budget, inducing an efficient collapse the reasoning process.
4.3 REASONBREAK
Framework Overview ReasonBreak generates privacy- preceyyire images by targeting specific visual-conceptual relationships through concept-aware adversarial perturbations. The entire pipeline

---

Published as a conference paper at ICLR 2026
is illustrated in Figure 3 and detailed in Algorithm 1 Our framework consists of three key stages. First, we perform adaptive decomposition and concept assignment to isolate localized geographic cues within the input image. Next, for each image block, we employ minimax target selection to identify a hard-negative prior, which guides our trained decoder in synthesizing concept-specific perturbations. Finally, we reconstruct these perturbed blocks into the complete high-resolution ad- versarial image.
Adaptive Image Decomposition and Concept Assignment Our approach builds upon the GeoPrivacy-6K dataset, where each image 7 from dataset 'D is annotated with key geographic con- cepts e and their corresponding spatial bounding boxes g. To effectively capture fine-grained details in ultra-high hiira-high-resolution images, existing MILMs typically partition images into tiles and process each compressed tile through their visual encoders (Chen et al., 2024). Inspired by this approach, we introduce an adaptive decomposition strategy for perturbation generation, ensuring that subtle visual cues are not overlooked. This approach systematically segments images into optimal blocks, ensuring the preservation of detailed visual cues across multiple scales. Formally, the decomposition transforms image into an optimal block configuration defined as:
W
m n
T(T) = (B (m", n,) )- = arg min
mn S N max+
H
(m..)
where W and H denote the original image dimensions and Nmux is a hyperparameter for the maxi- mum allowed blocks. This optimization finds m grid whose aspect ratio (m/n) is closest to the original image's aspect ratio (W/H), thereby minimizing distortion when the image is resized and partitioned into N m²n blocks. Each block Bx E Ráxxxx is processed the standard input resolution / of the surrogate encoders th. The concept assignment phase follows the segmentation process. For each block Bg, we determine concept assignments through spatial overlap analysis with ground truth annotations from g. Specifically, we identify the intersection between the block's ss spatial extent (mapped back to the original image's coordinates) and the bounding boxes in g. as- signing the corresponding concepts from to form a concept subset Ct- Our method ensures that all blocks are perturbed. Blocks that do not have a spatial intersection with any specific concept bounding box assigned the complete set of all concepts associated with the entire image. This conservative assignment ensures that even blocks without specific fine-grained details (e.g.. patches of sky road) are perturbed to disrupt the model's more general, image-level reasoning.
Minimax Target Selection Our objective is to dismantle, not merely mislead, the model's rea- soning process. For each block BR, our approach generates perturbation designed invalidate its entire associated concept set Cs. To achieve this, we first identify a powerful repulsive signal by selecting hard-negative prior from a pre-computed embedding bank & that is maximally distant from all concepts in the block:
Eprioe = arg min max cos( (z())))). cEC₂
(4)
egE
where constructed by encoding images from the dataset DD using a frozen image encoder vias i..., E (D)) and th represents frozen text encoder. This equation formalizes search for the hard-negative prior. is important to note that & serves as a large, diverse vocabulary of real-world semantic embeddings, not a 1-to-1 matching database. The resulting ofrir represents conceptual "void"; a point in the embedding space far from any correct interpretation of the block. This prior serves as a conceptual directive for our generator, design choice with critical implications. Instead of being rigid target in the loss function, it conditions learnable decoder Go (see Appendix A for architecture details) to synthesize the perturbation:
(5) Notably, the decoder Go does not take the image block By direct input. Its role is to act semantic-to- conuantic-to-visuee toviiuall translator, learning a general mapping from an abstract conceptual directive (the prior) an effective pixel-level perturbation. The visual content of B₁ exerts its influence implicitly by determining the concept set Cs, which turn dictates the choice of priorr
82 = Go ( (
B¹ = Bv + 6R.
| S..
Ensemble Training and Reconstruction Finally, we ensure robust transferability through ensem- ble training across diverse surrogate models by minimizing the cosine similarity between original

---

Published as a conference paper at ICLR 2026
Table 1: Privacy protection performance across geographical granularities on DoxBench 16/ (6/255). Best results are in bold. Key metrics for Tract and Block granularities are highlighted in gray. Higher values indicate better privacy protection.
Top-1
Protection Rate (%)
Top-3
Protection Rate (%)
Model
Attack
Region
Metro.
Tract
Block
Region
Metro.
Tract
Block
AtyAttack
10.7
12.9
25.6
18.5
11.5
16.2
21.2
18.9
GPT-o3
M-Attack
7.6
10.8
15.9
14.8
9.6
10,9
18.3
24.3
OURS
11.5
13.7
31.7
25.9
42.6
44.6
46.2
32.4
AnyAttack M-Attack
6.5
9.8
20.0
29.0
5.5
9.8
23.7
12.2
GPT-5
4.6
8.9
17.6
22.6
5.0
5.0
15.3
14.6
OURS
8.0
9.8
32.9
29.0
10.0
12.4
35.6
19.5
Gemini 2.5 Pro
Any Attack
3.2
8.9
15.9
0.0
4.2
6.0
19.7
15.6
M-Attack
4.8
9.9
20.6
0.0
4.0
8.1
20.5
2.2
OURS
6.9
10.6
30.8
23.3
5.6
12.1
36.2
33.3
QVQ
AnyAttack
42.9
41.9
26.2
15.4
32.0
30.4
29.0
23.8
M-Attack
30.1
29.0
23.8
23.1
17.5
17.0
26.1
14.3
Max
OURS
46.2
46.7
28.6
25.0
27.0
40.9
33.5
34.2
Q VI
AnyAttack
38.0
38.3
26.7
33.3
28.6
30.4
26.7
27.3
M-Attack
34.0
35.0
31.1
40.0
25.1
28.1
26.7
22.7
Max
OURS
55.3
55.8
39.5
40.0
30.5
30.8
44.4
42.9
QI 2.5 72B
AnyAttack
41.2
32.5
17.9
21.4
29.6
30.4
29.0
26.1
M-Attack
32.7
26.7
17.9
14.3
23.2
22.7
34.8
26.1
OURS
46.3
49.2
40.0
33.3
38.3
38.2
46.0
35.0
InternVL
AnyAttack
4.9
0.0
3.4
0.0
4.5
2.8
0.0
22.2
M-Attack
5.2
0.0
0.0
2.6
3.8
0.0
11.1
3.0 72B
OURS
10.8
0.0
33.3
58.3
12.0
7.6
31.0
33.3
and adversarial representations:
N
((0) = ES,S
1bs (os(t),(B)))) (Bx).
(6)
N
where v/, represents the visual encoder of surrogate model and N m²n". In this formulation, the hard-negative prior shapes the synthesis direction through conditioning, while the untargeted loss reduces the representation consistency between the original and perturbed blocks across surrogate models. The final step reconstructs the full-resolution adversarial image by reassembling the perturbed blocks via the inverse transformation T-1,
5
EXPERIMENTS
5.1 EVALUATION SETUP
Evaluation Benchmark We evaluate ReasonBreak DOXBENCII (Luo al., 2025). a curated dataset of 500 real-world images with ground truth coordinates, designed to assess geolocation infer- ence in MLRMs. DoxBench introduces hierarchical evaluation protocol at four geographic levels: state (region), metropolitan area, census tract, and census block. Tract approximate neighborhood- level areas, while block capture street-level resolution, these metrics are particularly critical for evaluating privacy protection effectiveness. Ground-truth accuracy is computed by mapping coor- dinates to standardized regions via the Google Geocoding API, ensuring consistent and objective evaluation.
Metric Privacy protection measured by Privacy Protection Rate (PPR), which captures the reduction in successful location inference after perturbation:
Norig
Naay
PPR
x 100%,
Nong
where Nori represents the number correct predictions on original images and Nua denotes cor- rect predictions adversarial examples. It's worth noting that while existing works use attack

---

Published as a conference paper at ICLR 2026
success rate (1 adversarial accuracy) as their evaluation metric, this approach can conflate model inherent errors with successful attacks. Our metric specifically measures the reduction in correct predictions, climinating this confounding factor. While this results in numerically lower reported values, it provides a more precise measure of true privacy protection effectiveness. 'he PPR is nor- malized from 0% to 100%, with higher values indicating better protection performance. We report both Top-I I accuracy (exact match) and Top-3 accuracy (correct answer within top three predictions) each geographic granularity.
Target Models Following the performance analysis in DOXBENCHI we evaluate on state-of-the- art MLRMs, including GPT-o3, Gemini 2.5 Pro, and QVQ-Max, and additionally supplement our evaluation with GPT-5, QwenVL Max. VL-2.52-2 and Intern VL-3.----3 All models are tested with their latest public versions under default parameter settings (e.g., temperatures). For geographic queries, we use the standardized prompt from DOXBENCH: "Where is it?" followed by output format instructions. Direct questioning yields better performance for GPT-o3, GPT-5, and Gemini 2.5 Pro, while CoT prompts prove more effective for other models.
Baselines We compare ReasonBreak against strong adversarial methods: Any (Zhang et al, 2025a) and M-Attack (Li et al., 2025). For AnyAttack, we utilize the officially released generator. For M-Attack, we employ CLIP ViT-B/32, VIT-L/14, and RN50 as ensemble surrogate models, with 50e All baselines and our method are evaluated under Loe constraints with e 8/255, 16/ 62555.
Implementation Details For surrogate set S, we use CLIP ViT-B/32, ViT-B/16, ViT-H/14, and ViT- L/14. We freeze CLIP ViT-B/32 the image encoder 6 and text encoder 4/2 The learnable decoder Go adopts the architecture from Attack with pre-trained weight initialization. It is trained on GeoPrivacy-6K for epochs with Nmax 64 using AdamW with learning rate 1 x 10-5, For images in DOXBENCH that are not part of our training dataset, we utilize Gemini Pro 2.5 with the same three-stage annotation protocol described in Section 3 to automatically extract geographic concepts C and their corresponding spatial bounding boxes This ensures consistent concept- region mapping between training and testing phases. The training process is conducted on a single NVIDIA A800 80GB GPU.
5.2
MAIN RESULTS
Table evaluates ReasonBreak across seven state-of-the-art MLRMs using Top-1 and Top-3 accu- racy metrics at four geographical granularities, demonstrating consistent superiority over existing adversarial methods (e 16). At the Tract and Block levels, where privacy threats are the most se- vere, ReasonBreak shows remarkable effectiveness. Our method achieves an average Top-I PPR of 33.8% at the tract level, surpassing the strongest baseline (19.4%) by 14.4%. the Block level, Rea- sonBreak nearly doubles the protection rate of baselines (33.5% vs. 16.8%). ). Notably, our method's strong performance against commercial APIs demonstrates its particular effectiveness against pow- erful, closed-source models. For instance, on GPT-o3, our method boosts the Top-1 Tract-level PPR to 31.7%, compared to 25.6% from AnyAttack and 15.9% from M-Attack, and on Gemini 2.5 Pro, it achieves 30.8% where baselines only reach around 20%. Remarkably, while baseline methods fail to provide any protection at the Top-1 Block-level against Gemini 2.5 Pro, our method achieves a 23.3% PPR. These results validate our core hypothesis that targeting hierarchical reasoning pro- cesses through concept-awas aware perturbations provides fundamentally stronger defense than methods based on disrupting general perceptual features.
5.3 ADVERSARIAL SCALING PROPERTIES
To assess the robustness and imperceptibilityy trade-off, we evaluate performance under stricter perturbation budget (c = 8/255). The results, visualized in Figure reveal two key insights. First, ReasonBreak demonstrates superior perturbation efficiency. While all methods show predictable performance drop from e = 16 (solid bars) to e = 8 (hatched bars), the advantage of ReasonBreak over the baselines becomes even more pronounced. For instance, challenging models like Gemini 2.5 Pro, while the protection offered by baselines nearly vanishes at = 8, ReasonBreak maintains consistently superior PPR. This indicates that concept-aware approach can induce reasoning failures with more subtle, less perceptible noise, offering a better trade-off between privacy and visual quality.
8

---

Published as a conference paper at ICLR 2026
60-
Protection Rate (N)
80
80
Protection Iate
-00
Protection
Protection
20
20-
Region Metro
Tract Block
Region Metro Tract Blook
Rogion Metro Tract Block
Region Metro
Tract
Block
(a) GPT-o3
(b) GPT-5
(c) Gemini 2.5
(d) QVQ-Max
Eo
80
Protesion Ruta
30
Protedion Rate
80-
Protection Rate
60
10
20
AryyPtaad (s- 101
M4dack ( +-1)
AnyAtooss (1-
Our (16)
NSAtadk 16)
Dur
Region Metro Tract
Block
Metro
Block
Metro
Tract
Block
(c) QwenVI. Max
(1) Qwen 72B
(g) Intern 3.0 72B
Figure Privacy protection rates across different geographic granularity levels under different noise 8). Higher values indicate better privacy protection.
levels (c = 16 and
Second, we uncover counter-intuitive scaling phenomenon unique reasoning models. For In- te (Fig. 4g), ReasonBreak's protection at the Tract and Block levels is substantially higher with the smaller perturbation (e 8) than with the larger one (c 16). This anomalous result, which is not observed for perception-focusee baselines, suggests a distinct adversarial mechanism. We pro- vide detailed analysis of this phenomenon in Appendix C This finding underscores the fundamental difference between attacking perception and attacking reasoning, opening a compelling direction for future research.
5.4 ABLATION STUDY
Influence of Adaptive Decomposition A key component of our framework is the adaptive de- composition mechanism, controlled by the hyperparameter Nmaz- To validate its importance, we conduct ablation study analyzing how partitioning granularity affects protection performance against InternVL 3.0 72B. The results, shown in Figure 5 reveal distinet unimodal perfor- mance curve for fin-grained geographic levels, confirming critical trade-off governed by N Nman- When partitioning is too coarse (Nmar 4), we ob- serve suboptimal protection at the Block and Tract levels (NVmaz
represents complete removal of the adaptive decomposition mechanism). This leads to concept entanglement where distinct visual cues (e.g., storefront sign and a unique architectural style) merged into single block. Conversely, overly fine-grained partitioning (Nmaz > 64) causes sharp performance degradation. This concept frag- mentation breaks semantically coherent objects into meaningless patches, preventing our method from targeting the complete visual concepts that form the basis of the MLRM's reasoning steps. For exam- ple, landmark building is no longer recognized as a whole, but as collection of disconnected textures macroscopic
Block
60
-O-
Tract
Privacy Protection Rate
Region
40
20
18
1024
Nixx
Figure 5: Ablation study on adaptive decomposition mechanism. Top-1 PPR across different values of Nmaz
and edges. Notably, performance metrics like Region and Metro. remains compara- tively strong coarse granularities (Nm < 4). as they do not depend on such fine-grained features. Performance peaks in the optimal range of 16 Nmar 64. This analysis validates choice of Nmaz 64, which strikes the optimal balance between isolating concepts and preserving their meaning.

---

Published as a conference paper at ICLR 2026
Influence of Minimax Target Selection Another critical component of our frame- work is the minimax target selection. To validate its effectiveness, we conduct an ablation study analyzing its impact pri- vacy protection performance. Specifically, compare our approach using prior from Equation against baseline where ef is replaced with eb; (Bx), effectively reduc- ing to general untargeted adversarial attack. Table 2 presents the Top-1 PPR results on Intern VL 3.0 72B. The results
Table Ablation study on minimax target selec- tion. Top-1 PPR w/ and w/ minimax target se- lection.
Privacy Protection Rate (%)
Method
Region
Metro.
Tract
Block
w/ Minimax
10.8
0.0
33.3
58.3
w/o Minimax
9.3
0.0
26.7
33.3
Improvement A
+1.5
+6.6
+25.0
demonstrate that our minimax target selection strategy significantly improves protection effective- ness, particularly at finer geographic granularitics. The improvement is most pronounced at the Block level (+25.0%) and remains substantial the Tract level (+6.6%), while maintaining com- parable performance at coarser scales. These findings confirm that our concept-aware targeting ap- proach more effectively disrupts the model's hierarchical reasoning process compared to traditional untargeted perturbations.
5.5 LIMITATIONS AND FAILURE CASE ANALYSIS
To rigorously define the boundary conditions of our method, we conducted failure case analysis on images where protection failed across all seven target MLRMs. This analysis revealed only two such instances in the DoxBench dataset, shown in Figure 6 A qualitative inspection reveals common property: both images contain dominant, high-saliency, machine-readable text (c.g.. "1565, B46, Google".) .) that explicitly names the location. This highlights fundamental dichotomy in the MLRM's inference modality.
ReasonBreak is designed disrupt hierar- chical geographic reasoning by targeting the fragile visual-conceptual links (e.g., architectural style - region). In these cases, the MLRMs shift their inference modality. They bypass the conceptual rea- soning chain and instead leverage their op- tical character recognition (OCR) capabil- ities to extract the location directly from the text. Our framework was not de- signed to target this OCR modality. De- feating robust OCR module under a strict imperceptibilityy constraint is an orthogo- nal challenge, likely requiring perceptible, text-targeted modifications. This analysis thus defines a clear boundary for our approach: Reason- Break does not counter direct text- bxsed identification, which we identify as distinct problem for future work.
Google
Figure 6: The two failure cases from DoxBench where all seven MLRMs correctly inferred the lo- cation. Both images contain machine-readable text that explicitly names the location.
CONCLUSION
In this work, we identified and addressed a critical privacy vulnerability in modern MLRMs: their ability to infer precise geographic locations by reasoning over visual concepts. We argued that ex- isting privacy defenses, which target perception, are insufficient for this new threat. We proposed ReasonBreak, a novel adversarial framework that, for the first time, disrupts the model's hierarchical reasoning process directly. By targeting specific visual concepts in the model's chain-of-thour ReasonBreak provides significantly better protection than state-of-the-art baselines. To facilitate this, we also constructed and released GeoPrivacy-66 an ultra-hig wwaa--iigh--reouttii conceptual annotations. Our extensive experiments seven leading MLRMs demonstrate the ef- fectiveness and robustness of our approach. This work opens a new direction for privacy research, shifting the focus from perceptual disruption to reasoning-level intervention.
dataset with rich
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENT
This research is supported by the NTU startup grant and the RIE2025 Industry Alignment Fund-Industry Collaboration Projects (IAF-ICP) (Award 12301E0026), administered by A*STAR, as well as supported by Alibaba Group and NTU Singapore through Alibaba-NTU Global e- Sustainability CorpLab (ANGEL).This research is also supported by the Ministry of Education, Singapore, under its Academic Research Fund Tier 2 (Award MOE-T2EP20125-0N
REPRODUCIBILITY STATEMENT
To ensure reproducibility and practical deployment, provide comprehensive computational quirements and resource specifications: (i) Training Efficiency: The complete training of Rea- sonBreak GeoPrivacy-6k requires approximately 6-8 hours single A800 80GB GPU. The lightweight decoder architecture and efficient ensemble training make the method accessible to re- searchers with standard GPU resources. (ii) Inference Requirements: For practical deployment, will release pre-trained generator weights that enable direct adversarial image generation. The infer- ence process requires only 24GB of GPU memory and generates adversarial examples in under < seconds per image, making it suitable for real-time privacy protection applications. Ealluutto Costs: The primary computational expense lies in evaluation across multiple MLRMs. Commer- cial API calls, particularly GPT-o3, GPT-5, and Gemini 2.5 Pro, incur non-trivial costs, generally on the order of one to several thousand dollars. Deploying open-source models like InternVI. 3.0 72B requires approximately 144GB of GPU memory (lypically two A800 80GB GPUs with tensor parallelism). We will release the code, pre-trained model weights, and the GeoPrivacy-6K dataset.
ETHICAL CONSIDERATIONS
While ReasonBreak provides crucial privacy protection against unauthorized geographic inference, acknowledge the dual-use potential of adversarial techniques. Our method could potentially be misused to evade legitimate content moderation. We establish concrete guidelines for responsible use: (i) ReasonBreak should only be used protect legitimate privacy rights of individuals sharing personal content: (ii) The technology should not be employed to circumvent legal investigations or regulatory compliance; (iii) Platform providers should consider implementing detection mechanisms for adversarially modified content when legally required. This work contributes to the broader goal of preeeeeiig AI by demonstrating that reasoning- based privacy threats can be effectively countered, encouraging the development of privacy-aware MLRM architectures.
REFERENCES
Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.1323 13923, 2025.
Xiaowen Cai, Daizong Liu, Xiaoye Qu, Xiang Fang, Jianfeng Dong, Keke Tang, Pan Zhou, Lichao Sun, and Wei Hu. Towards building htteel/prommttttanffereee attackers against large vision- language models. In Advances in Neural Information Processing Systems, 2025.
Zhe Chen, Weiyun Wang, Yue Cao, Yangzhou Liu, Zhangwei Gao, Erfei Cui, Jinguo Zhu, Shen- glong Ye, Hao Tian, Zhaoyang Liu, al. Expanding performance boundaries of open- multimodal models with model, data, and test-time scaling. arXiv preprint arXiv:2412.05271, 2024.
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 9185-9193, 2018
Xiang Fang, Wanlong Fang, and Changshuo Wang. Unveiling the fragility of lision-language mod- els: Multi-modal adversarial synergy via texture- constraiedd perturbations and cross- moosl opti- mization. In Proceedings of the AAAI Conference on Artificial Intelligence, 2026.

---

Published as a conference paper at ICLR 2026
Qi Guo, Shanmin Pang, Xiaojun Jia, Yang Liu, and Qing Guo. Efficient generation of targeted and transferable adversarial examples for lasion-lagguage models via diffusion models. IEEE Transactions Information Forensics and Security, 2024.
Aaron Jaech, Adam Kalai, Adam Lerer, Adam Richardson, Ahmed El-Kishky, Aiden Low, Alec Helyar, Aleksander Madry, Alex Beutel, Alex Carney, et al. Openai ol system card. arXiv preprint arXiv:2412. 16720, 2024.
California State Legislature. 1798100, 2018.
California consumer privacy act (copa). California Civil Code,
Zhaoyi Li, Xiaohan Zhao, Dong-Dong Wu, Jiacheng Cui, and Zhiqiang Shen. A frustratingly simple yet highly effective attack baseline: Over 90% success rate against the strong black-box models of 8/t-4.5/4o/ol. arXiv preprint arXiv:2503.10633 2025.
Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In International Conference on Learning Representationss 2023.
Daizong Liu, Mingyu Yang, Xiaoye Qu, Pan Zhou, Xiang Fang, Keke Tang, Yao Wan, and Lichao Sun. Pandora's 's box: Towards building universal attackers against real-world large vision- language models. In Advances in Neural Information Processing Systems, 2024.
Junlin Liu and Xinchen Lyu. Boosting the transferability of adversarial examples via local mixup and adaptive step size. arXiv preprint arXiv:2401.13200 2024.
Xuannan Liu, Yaoyao Zhong, Xing Cui, Yuhang Zhang, Peipei Li, and Weihong Deng, Adveloak: Customized adversarial cloak for privacy protection. Pattern Recognition, 158:11 10::110000 1050, 2025.
Dong Lu, Zhiqiang Wang. Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 102-111, 2023.
Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image worth 1000 lies: Transfer- ability of adversarial images across prompts vision-language models. In International Confer- ence on Learning Representations, 2024.
Weidi Luo, Tianyu Lu, Qiming Zhang, Xiaogeng Liu, Bin Hu, Yue Zhao, Jieyu Zhao, Song Gao, Patrick McDaniel, Zhen Xiang, al. Doxing via the lens: Revealing location-related privacy leakage on multi-modal large reasoning models. arXiv preprint arXiv:2504. S.Xi::2504.19733 2025.
Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. Jailbreaking attack against multimodal large language model. arXiv preprint 2xXiv:2402.02309, 2024.
Alec Radford, Jong Wook Kim. Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp- 8748-8763. PMLR, 2021.
Protection Regulation. Regulation (eu) 2016/679 of the european parliament and of the council. Regulation (eu), 679(2016):00-13, 2016.
Rylan Schaeffer, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Durante, Joe Benton, Brando Miranda, Henry Sleight, John Hughes, et al. Failures to find transferable image jailbreaks between vision-language models. arXiv preprint 1rXiv:2407.15211, 2024.
Fahad Shamshad, Muzammal Naseer, and Karthik Nandakumar. Clip2protect: Protecting facial privacy using text-guided makeup via adversarial latent search. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 20595-20600 2023.
Ivan Skorokhodov, Grigorii Sotnikov, and Mohamed Elhoseiny. Aligning latent and image spaces to connect the unconnectable. In Proceedings of the IEEE/CVF international conference on com- pufer vision, pp. 20144-1415. 2021.
12

---

Published as a conference paper at ICLR 2026
Christian Szegedy, Wojeiech Zaremba, llya Sutskever, Joan Bruna, Dumitru Erhan, lan Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013.
Gemini Team, Petko Georgiev, Ving Ian Lei, Ryan Burnell, Libin Bai, Anmol Gulati, Garrett Tanzer, Damien Vincent, Zhufeng Pan, Shibo Wang, et al. Gemini 1.5: Unlocking multimodal under- standing across millions of tokens of context. arXiv preprint arXiv:2403.055: 2024.
Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against large vision-language models. arXiv preprint arXiv:2405.17894, 2024.
Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 1923-1933, 2021.
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. (6158-16167,1 2021.
Jason Wei, Xuezhi Wang, Dale Schuurmans, Maarten Bosma, Fei Xia, Ed Chi. Quoe V Le, Denny Zhou, et al. th-tout prompting elicits reasoning in large language models. Advances in neural information processing systems, 35:24824-2435 2022.
Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Enhancing the self univeeniiyyyyltty for transferable targeted attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 12281-12290 2023.
Wenzhuo Xu, Kai Chen, Ziyi Gao, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Highly trans- ferable diffusion-basee unrestricted adversarial attack on pre-trained vision-language models. In ACM Multimedia, 2024.
Zixuan Yang, Yushu Zhang, Tao Wang, Zhongyun Hua, Zhihua Xia, and Jian Weng. alcalfor-all: Efficient visual face privacy protection via person-specific veils. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 7705-7713, 2024.
Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Vlattack: Multimodal adversarial attacks on vision-language tasks via pre- trained models. Advances in Neural Information Processing Systems, 36, 2024.
Jiaming Zhang, Jitao Sang, Xian Zhao, Xiaowen Huang, Yanfeng Sun, and Yongli Hu. Adversarial srivacy-preservigg filter. In Proceedings of the 28th ACM International Conference Multime- dia, pp. 1423-1431, 2020.
Jaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 5005- 5013, 2022.
Jiaming Zhang. Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Chen Yunhao, Jitao Sang, and Dit- Yan Yeung. Anyattack: Towards large-scall scale self supervipe adversarial attacks vision- language models. In Proceedings of the IEEE/CVE Conference on Computer Vision and Pattern Recognition, 2025a.
Jinjin Zhang, Qiuyu Huang, Junjie Liu, Xiefan Guo, and Di Huang. Diffusion-4k. Ultra-high- resolution image synthesis with latent diffusion models. In Proceedings of the Computer Vision and Puttern Recognition Conference, pp. 23464-23473 2025b.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36, 2024.
Yaoyao Zhong and Weihong Deng. Opom: Customized invisible cloak towards face privacy protec- tion. IEEE Transactions Pattern Analysis and Machine Intelligence, (5(3):3590-3603 2022.
13

---

Published as a conference paper at ICLR 2026
Yichao Zhou, Jingwei Huang, Xili Dai, Shichen Liu, Linjie Luo, Zhili Chen, and Yi Ma. Holicity: A city-scale data platform for learning holistic 3d structures. arXiv preprint arXiv:2008.03286, 2020.
Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advclip: Downstrean-aggnstie adversarial examples in multimodal contrastive learning. In Proceedings of the s1 ACM International Conference on Multimedia, pp. 2023.
14

---

Published as a conference paper at ICLR 2026
LLM USAGE
We employed LLMMs as a general-purpose assistive tool of this work. Specifically, LLMs were used to (i) suggest alternative phrasings and improve the clarity of exposition, and (ii) assist in coding.
Algorithm ReasonBreak Adversarial Image Generation
Input: Image I, geographic concepts e and bounding boxes g for I, trained decoder Go, pre- computed embedding bank E, pre-trained text encoder v/, perturbation budget e, max blocks Nmax-
2: Output: Adversarial image l'.
3: procedure REASONBREAK GENEEEAKKGEEERAEL,,,, c, Go, ehe: E, Nmax)
4:
{Ba] f- AdaptiivDDecompsttionn.... Nmax)
Equation
5:
[Ca)k=1 AssignConceetss( c,
6: [B= + empty list
To store perturbed blocks
7:
for each block B& and concept set Cj do
8:
c prior t arg min max cos (()e()) c)
Equation
EEE
9:
6 +- Go(e
10:
B₁ + By + 6n
11:
B& + Clip(By, Bik e, Bk
Enforce Loo constraint
Append B& {Bx}
13: end for
I' + Reconstructlmage (Bx²)
15: return /'
end procedure
A DECODER ARCHITECTURE
The architecture our learnable decoder Go. which translates a conceptual prior embedding into an adversarial perturbation, is detailed in Algorithm The decoder is primarily composed of series of residual blocks (ResBlock, and upsampling blocks (UpBlock), as specified in Algorithms and
Algorithm 2 Decoder Architecture (Go)
Require: Input embedding e IR BxD, where B is batch size and where D is embedding size Target image size H, W, and target channels C
Require:
Ensure: Adversarial perturbation 5 E BBxCxHxW
1: hu H/16
2: I - Linear(e)
3: I Reshape(z, (B, 256, himity hini)
4: Σ < ResBlock(r, in_ch- = 256, out_ch 256)
5: x
inc 256, out-ch 128)
6: Σ + ResBlock(z, ch 128, out ch 128)
7: æ <- UpBlock ch 128, out ch 64)
8: T < inc 64, = 64)
9: H f (2Block(z,innchh = out = 322)
10: <- ResBlock(z,in.d)
32, out_ch 33)
11: X < UpBlock in = 32, out = =16)
12:
ResBlock(z,in.ch) in.ch 16, out_ch 16)
13: x + Conv2d xz = 16, out ch C, kernel 3, padding = 1)
14: 8 Tanh(x))
15: return
15

---

Published as a conference paper at ICLR 2026
Algorithm 3 ResBlock Module
I: procedure RESBLOCK((,, in.ch, out.ch)
2: Conv2d(2, in. in_ch, out ch, kernel =
3: h 4 Conv2d(ar in ch, out ch, kernel 3, padding = 1)
4:
+- BatchNorm2d(h)
5:
h + (ca, a 0.2)
6:
+ (hn out ch, out ch, kernel = 3, padding 1)
7:
h BatchNorm22(1))
8:
- EfficienttAttention(()
9:
h + h +
10: h - Lea,, a 0.2)
return h
12: end procedure
Algorithm UpBlock Module
1: procedure UPBloCK((; in_ch, out_ch)
2: h - Upsample(z; factor 2, mode= modee''naresst" nearest")
3: h Conv2d(h, in_ch, out.ch, kernel padding =
4: h < (atch))rm2d(h))
5: + (Ua,y a 0.2)
6: return h
7: end procedure
B DATASET CONSTRUCTION DETAILS
B. THREE-STAGE ANNOTATION PIPELINE
The construction of GeoPrivacy-6K employs systematic three-stage annotation pipeline imple- mented using QwenVL 2.5 72B as the annotation model. To mitigate potential factual inaccuracies from model limitations, our annotation process focuses exclusively on visual feature characteriza- tion rather than specific geographic location identification. This multi-stage approach progressively refines image content from basic geographic filtering to detailed hierarchical concept analysis and precise spatial reasoning chain extraction, ensuring comprehensive capture of the visual-conceptual relationships that MLRMs exploit during geographic inference while maintaining annotation quality and consistency.
B.1.1 STAGE 1: GEOGRAPHIC CONTENT FILTERING
The initial filtering stage identifies images containing real-world geographical features suitable for location inference training. This stage operates through automated resolution screening followed by content- based evaluation that excludes abstract patterns, studio portraits with plain backgrounds, or isolated object close-ups while retaining images with identifiable natural landmarks, architectural elements, environmental characteristics.
The system evaluates whether images contain real-world ge- ographical features (natural or man-made elements related places on Earth) while excluding abstract patterns, studio portraits, or isolated object close-ups. The assessment produces a boolean decision with reasoning explanation in JSON format.
Stage Prompt:
B.1.2 STAGE HIERARCHICAL SCENE ANNOTATION
Images passing the geographic filter undergo comprehensive hierarchical categorization that cap- tures the conceptual structure employed by MLRMs during visual analysis. This stage establishes the foundational semantic framework through three-level hierarchical classification and detailed at- tribute annotation across environmental, architectural, and atmospheric dimensions.
16

---

Published as a conference paper at ICLR 2026
The hierarchical framework begins with L1 Environmental Domain classification, distinguish- ing between Natural Enviromment and Built Environment contexts. This guides subsequent L2 Contextual Setting refinement, where natural environments are classified into mountainous, forest/- woodland, plains/grassland, water body, desert, or coastal categories, while built environments en- compass urban/city, rural/suburban, transportation infrastructure, or industrial settings. The L.3 Scene Specification level provides granular scene categorization, subdividing urban environments into street views, skylines, plazas/parks, residential areas, commercial districts, historic districts, while mountainous regions distinguish between peaks/ridges, valleys, or plateaus.
Beyond hierarchical scene classification, the annotation framework captures detailed descriptive attributes including environmental elements (both natural features such as vegetation, trees, rock formations, water bodies, and man-made elements including buildings, roads, vehicles, infrastruc- ture), architectural characteristics (styles ranging from modern to classical/historic, and construction materials from brick/stone to glass curtain walls), and atmospheric conditions (temporal factors like lighting, weather and environmental characteristics).
The system categorizes images using a three-level hierarchy (LI: Environmental Domain, L2: Contextual Setting, L3: Scene Specification) while capturing detailed descriptive attributes across environmental elements (nat- ural and mann-made), architectural characteristics (styles and materials), and atmo- spheric conditions (lighting, weather).
Stage Prompt:
B.1.3 STAGE 3: GEOGRAPHIC REASONING CHAIN EXTRACTION
The final and most critical stage generates the hierarchical reasoning chains that mirror MLRM geographic inference processes. This stage produces the concept-region mappings essential for training ReasonBreak by systematically analyzing visual evidence through four geographic scales: continental, national, city, and local levels. Each reasoning step identifies specific visual concept and its precise spatial location through normalized square bounding boxes.
The system performs hierarchical geographic reasoning analysis (Continental National - City - Local) identifying key visual concepts at each level with precise spatial localization. Each reasoning step produces descriptive concept phrases (5-10 words) with normalized square bounding boxes [center x. center-y, size] and confidence scores, generating the concept-region mappings es- sential for adversarial training.
Stage 3 Prompt:
B.2 DATA COLLECTION AND SOURCE INTEGRATION
Our data collection process sources high-quality images from three established computer vision datasets that provide complementary geographic coverage. HoliCity (Zhou et al.] 2020) contributes diverse urban scenes with detailed architectural elements and city landscapes, Acsthetic-4K (Zhang et al.] 2025b) provides visually compelling natural and built environments with strong compositional quality, and LHQ (Skorokhodov al. 2021) offers hitra-high-resoluttin landscape images spanning diverse geographical regions and environmental conditions.
The technical filtering process ensures all images maintain a minimum resolution of 2048 pixels along at least one dimension. Subsequently, the three-stage annotation pipeline transforms raw images into a comprehensive dataset with hierarchical scene categorization, detailed attribute anno- tation, and precise concept-region mappings through geographic reasoning chain extraction.
B.3 INFERENCE DIFFICULTY ASSESSMENT
Inference difficulty ratings are determined based on confidence scores generated during the geo- graphic reasoning analysis stage. Easy cases (17.8% feature obvious, globally distinctive landmarks or features that enable straightforward location inference. Medium difficulty cases (29.1%) require regional-level geographic knowledge and more sophisticated visual analysis. Hard cases (53.2%) demand fine- grainer local geographic reasoning and represent the most challenging scenarios for both human experts and automated systems.
17

---

Published as a conference paper at ICLR 2026
Confidence score
Continental
National
City
Local
Geographic level
Figure 7: Distribution confidence scores across geographic inference levels. scores indicate greater certainty in geographic predictions. The predominance of high confidence scores at the city and local levels demonstrates the sophisticated reasoning capabilities required for precise location inference.
Higher confidence
Figure illustrates the confidence score distribution across different geographic inference levels, demonstrating the challenging nature of our dataset composition. The prevalence of high-confidence scores at city and local levels reflects the sophisticated reasoning capabilities required for precise location inference and validates the complexity of our curated dataset.
This comprehensive three-stage annotation structure enables precise concept-region mapping essen- tial for training ReasonBreak's 's concept-aware adversarial generator, providing the granular super- vision necessary for targeted perturbation generation across diverse geographic inference scenarios while maintaining the spatial precision required for effective reasoning pathway disruption.
where it?
Output exactly this format with your predictions:
ciue_list:
"iist
I'cluet", "clue2", "clue3"]
Rental
address_Jist list:
"Fist
1op- complete
here")
Each address format: (Street Number] [Street Name] [Street Type), [Cityl. Abbreviation] Code]
Do not add explenations or reasoning.
Figure 8: Demonstration of input sensitivity in MLRMs. Adding a single line break to the prompt causes Intern VL 3.0 72B to generate drastically different location inferences.
C COUNTER-INTUIIVVE SCALING PHENOMENA IN REASONING MODELS
Our experiments reveal two intriguing phenomena rarely observed in traditional perception mod- els but consistently present MLRMs, particularly open-source models like InternVL. 3.0 72B. First, Inverted Scaling Relationship: unlike traditional adversarial attacks where larger perturba- tions typically yield stronger effects, we observe instances in MLRMs where smaller perturbations occasionally produce more effective attacks. Second, the Adversarial Enhancement Effect: while adversarial noise typically degrades model performance traditional perception models, we oc- casionally observe anomalous cases in MLRMs where adversarial perturbations actually improve
18

---

Published as a conference paper at ICLR 2026
model performance, resulting in negative protection rates. In Table 1 normalize these occa- sional negative values to zero while discussing this phenomenon separately here.
We attribute these phenomena two key factors: First, the inherent randommess introduced by the LLM component MLRMs. For instance, model temperature settings introduce inherent stochas- ticity in outputs, making some performance variations expected. More surprisingly, the second factor relates to input sensitivity in reasoning models. Figure demonstratees this phenomenon: on In 3.0 72B, even with temperature=0,, simply adding line break the end of the prompt transforms the output from [Renial Car sign", Highway view", Urban landscape" J,, address list: 1100 Rental Car Center. San Francisco, CA 94130"]" [Rental Car", highway view", train sta- tion" J. address list: [1000 Broadway, Oakland, CA 94607"1". Similarly, this sensitivity extends to image inputs, where ostensibly adversarial perturbations can occasionally trigger patterns that improve model accuracy.
These observations highlight the complex nature of the reasoning processes of MLRMs. Under- standing and addressing these unique characteristics presents important direction for future search in privacy protection against reasoning- -based models.
D VISUAL QUALITY ANALYSIS
We provide qualitative analysis of the visual quality of adversarial examples generated by Reason- Break and baseline methods across different perturbation budgets. Figure presents representa- tive examples of adversarial images generated under = 8/255 and e 16 255 constraints. All methods produce perturbations that remain largely imperceptible to human observers, ensuring that privacy protection does not compromise image usability for legitimate sharing purposes. While the overall visual impact is minimal across methods, we observe distinct perturbation patterns. Base- line methods (Any Attack, M-Attack) exhibit subtle block-like artifacts, particularly noticeable in high-resolution images. This occurs because these methods generate perturbations at lower resolu- tions and resize them to match the target image dimensions, leading to slight pixelation effects. In contrast, our concept-aware approach produces more naturally distributed perturbations that align with semantic boundaries and geographic features, avoiding the block artifacts inherent in resize- based approaches.
AnyAttack
MAttack
Ours
Original
8=8 = 16
Figure 9: Visual comparison of adversarial examples generated by different methods.
E QUALITATIVE EXAMPLES OF GEOPRIVACY-6K
To facilitate deeper understanding of the GeoPrivacy-6K dataset and validate the effectiveness of our automated annotation pipeline, we present representative visualizations in Figure 10 These examples demonstrate the diversity of scenes covered, ranging from dense urban environments to remote natural landscapes. As illustrated, the annotations generated by QwenVL 2.5 72B follow a structured geographic reasoning chain. The process initiates with broad environmental classifi- cation (e.g.. "Furopean-style urban infrastructure") and progressively narrows down localized,
19

---

Published as a conference paper at ICLR 2026
discriminative features (e.g., specific road markings distinet mountain peaks). Crucially, each reasoning step is grounded by a normalized square bounding box parameterized as [center.x, center y, size] alongside confidence score.
step_1 | key.concept: "European-style urban infrastructure" equare_bbbx: (0,5,0.5,1.0] confidence: 0.9
step_2 key.concepp: doubie-decker bus Icon)" square_bbox: (0.700.4,,01] confidence: 0.95
step_3 key_concept: "London-specite" square_abox [0.5,0.6,0.2]] confidence: markings"
step_4 4 key.kkkccceee concept: "Achilles Way' street sign'
square_bbox: (0.75,p.5,0.05] confidence:
step_1 | key_concept:
"High-aititude snow-capped
mountains" square_abox: [0.5,0.3,0.2] confidence: 0.95
step_2| key.concept:
"Prominent Himalayan peak with
sharp ridges | squara_bbox: (0.45,0.3,0.1 confidence: D.9
step_3 key_concept:
"Himalayan foothills
visibillity square_bbox: [0.5,0.6,022] confidence:
step 4 key, concept "Central peak resembling Kangchanjunga" [squar_hbbxx (0.45,0.3,0.]] confidence: 0.8
Figure 10: Visualization of hierarchical annotations in GeoPrivacy- The figure displays two samples with their corresponding automated reasoning chains.
Table 3: Privacy protection rates under different JPEG compression quality factors (Q) on Intern VL
3.0 72B. The method demonstrates strong stability even under aggressive compression (Q 50).
Quality Factor
Region
Metro.
Tract
Block
Q (Default)
10.8
0.0
33.3
58.3
Q = 75
11.1
0.0
33.3
58.3
Q 50
9.3
0.0
30.0
58.3
F COMPUTATIONAL EFFICIENCY ANALYSIS
We evaluate the computational efficiency of ReasonBreak against the baseline methods, focusing on both training overhead and inference latency. Regarding training costs, there are substantial disparities among approaches. The generator-based baseline, Attact,,k, requires a computationally intensive pre-training phase spanning approximately one week on three NVIDIA A A100 GPUs. In contrast, ReasonBreak significantly reduces this overhead, converging in 6 hours and 30 minutes single GPU. The PGD-style baseline, M-Attack, incurs no training cost as it computes perturbations dynamically inference time.
For inference, we measured the time required to generate adversarial examples for DoxBench (s:500 images). M-Attack exhibits the highest latency (43 minutes and seconds) due to the necessity of iterative gradient optimization for each input. Generator-based methods demonstrate a marked advantage in deployment efficiency: Attack completes the process in minutes and 30 seconds, while ReasonBreak requires 5 minutes and 20 seconds. The marginal increase in our inference time compared to AtyAttack is attributable to the adaptive decomposition and concept assignment pre-proeee peepprocessing steps. This indicates that ReasonBreak achieves favorable balance, offering protec- tion rates comparable to computationally expensive methods while maintaining the near real-time inference capabilities of generator-basse based architectures.
20

---

Published as a conference paper at ICLR 2026
G ROBUSTNESS TO JPEG COMPRESSION
To verify the practicality of ReasonBreak in real-world social media environments, where uploaded images typically undergo lossy compression, we evaluated the resilience of our generated perturba- tions against varying levels of JPEG compression. It important to note that all experimental results reported in the main were conducted using a standard JPEG quality factor (Q) of 95 simulate a realistic baseline. In this section, we perform stress test by further reducing the quality factor to Q 75 and Q 50. We utilize Intern VL 3.0 72B the target model for this evaluation.
As shown in Table 3 ReasonBreak exhibits remarkable stability. Reducing the quality factor from 95 to results virtually no degradation protection performance. Even under aggressive com- pression (Q = 50). the decline in protection rates is minimal. This resilience suggests that the concept-aware perturbations generated by our method are structurally robust and can survive the standard image processing pipelines employed by major social platforms.
21


Reviews:
[{"review_id": "rjTLeFjINE", "reviewer": "Reviewer_XjM5", "summary": "This paper studies the problem of protecting the geographic privacy of images due to the ability of multimodal large reasoning models (MLRMs) to perform image geolocation. The authors first create a new GeoPrivacy-6K dataset consisting of high-resolution images of locations and bounding-box-based concept or feature annotations that are used during the defense strategy. The proposed defense ReasonBreak is motivated by the supposed step-by-step geolocation reasoning of reasoning models in inferring geolocation. If perturbations can affect any step in this reasoning process, the disruption can cascade to cause incorrect geolocation outputs from MLLMs. ReasonBreak works by identifying relevant concepts in each block of the image, and then finding a suitable perturbation that pushes the embedding of the perturbed block far from the original concepts it contained. The authors conduct an analysis of the effectiveness of their method across numerous open and closed source models and note its defensive effectiveness against baselines. Finally, the authors also perform ablations on the perturbation budget, block size, and the use of their target selection algorithm.", "questions": "1. If you do not use the ensemble training, how diminished are the results on various MLRMs? \n\n2. Is there a correlation between protection with ReasonBreak and how famous or well-known an input image is? For instance, can you successfully protect the location of a famous landmark like the Eiffel Tower?\n\n3. Prior work found that universally transferable image jailbreaks are hard to find [1]. How do you think your work fits in with these claims?\n\n\n[1] Schaeffer, Rylan, Dan Valentine, Luke Bailey, James Chua, Cristobal Eyzaguirre, Zane Durante, Joe Benton et al. \"Failures to find transferable image jailbreaks between vision-language models.\" arXiv preprint arXiv:2407.15211 (2024).", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. The paper introduces a novel method to disrupt the geolocation reasoning of MLRMs. To my knowledge, this is the first paper that explicitly targets the reasoning ability of MLRMs, by focusing on especially important concepts used in the reasoning process. It seems like this general paradigm would be extended outside of the domain of image geolocation to other intensive MLLM reasoning tasks. \n\n2. ReasonBreak seems to significantly outperform the more general-purpose attack baselines, while remaining imperceptible, which is important for image geolocation, especially, i.e., many real-world attack use-cases may use social media images.\n\n3. ReasonBreak does not require model weights to create defenses. This is a significant benefit, given that the most powerful and accessible MLRMs are closed source.", "weaknesses": "1. The theoretical motivation is a bit confusing. In lines 208-209, you mention that the model \"progressively refines its location,\" and in lines 235 - 236, you mention that \"an error introduced at an early state ... does not remain localized\". While there have been methods that induce this sort of least to most reasoning for image geolocation through prompting [1], generally, R1-style reasoning models can backtrack and revisit conclusions made earlier in their reasoning trace.\n\n2. The dataset construction, especially the scene annotation phase, is missing quite a few details. Did a model perform the annotation? If so, what model and what was the prompt for the model? How are bounding boxes identified by a model if it is used? It seems like the method requires similar concept annotations on any inference image, is this true? If so, how expensive are these image annotations for each image? Do you have an ablation on the model used for concept annotation with overall performance i.e., it would be great if this works well even with an open source VLM annotator?\n\n3. Some parts of the method are unclear / could use an improvement in their description. For instance, the definition of N_max has to be inferred from the partitioning in equation 1. It would be good to define this clearly since there is a later ablation on this variable. The concept assignment section is also a bit confusing. What is the default concept? Does it have a specifically chosen embedding? How much overlap does there need to be between a concept and a block for the concept to be assigned?\n\n4. The training set images are high resolution. Why was the choice made? It seems many social media images may be highly compressed, and these are often the images that adversaries may want to geolocate for malicious purposes. It would be necessary to verify that the method also works on images that are not high resolution in other geolocation datasets like IM2GPS.\n\n5. JPEG compression is a known workaround for adversarial attacks on vision models. Does your defense hold up to JPEG compression?\n\n6. While the current approach works well for MLRMs, it would be interesting to see if it can also work for specifically designed image geolocation models like [2].\n\n[1] Mendes, Ethan, Yang Chen, James Hays, Sauvik Das, Wei Xu, and Alan Ritter. \"Granular privacy control for geolocation with vision language models.\" arXiv preprint arXiv:2407.04952 (2024).\n\n[2] Haas, Lukas, Michal Skreta, Silas Alberti, and Chelsea Finn. \"Pigeon: Predicting image geolocations.\" In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 12893-12902. 2024.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "J8JQ57qkFo", "reviewer": "Reviewer_MzBe", "summary": "This paper presents ReasonBreak, an innovative adversarial framework that effectively counters geographic privacy threats posed by Multi-modal Large Reasoning Models (MLRMs) by disrupting their hierarchical reasoning processes through concept-aware perturbations. Unlike conventional methods that apply uniform noise, our approach strategically targets critical conceptual dependencies within reasoning chains, causing cascading failures in location inference. The framework is enabled by GeoPrivacy-6K, a comprehensive dataset of 6,341 ultra-high-resolution images with hierarchical annotations. Extensive evaluation across seven state-of-the-art MLRMs demonstrates remarkable effectiveness, achieving 33.8% tract-level and 33.5% block-level protection rates - nearly doubling baseline performance and establishing a new paradigm for reasoning-aware privacy defense against sophisticated AI threats.", "questions": "1.The scenario of the paper is very clear. However, it does not clearly point out the technical difficulties of the problems in this scenario. It is hoped that the problems under this scenario will be analyzed.\n2.It is recommended to additionally supplement a module diagram in the framework overview of Section 4.3 on page 5 to visually display the ReasonBreak framework.\n3.The author only conducted training on the datasets they proposed and performed black-box testing on open-source datasets. It is recommended that the author provide white-box experimental results.\n4.The author states that the training set used has a high resolution. What would be the impact if a low-resolution dataset were used?", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.The paper introduces the first concept-aware adversarial framework, ReasonBreak, specifically designed to target the hierarchical reasoning chains of multimodal large models. It achieves a paradigm shift in defense from the perception layer to the reasoning layer through a minimax target selection strategy.\n2.The black-box transfer capability of this framework has been successfully validated on commercial APIs, including state-of-the-art models such as GPT-5 and Gemini 2.5 Pro, demonstrating its practical effectiveness in real-world scenarios.", "weaknesses": "1.The scenario of the paper is very clear. However, it does not clearly point out the technical difficulties of the problems in this scenario. It is hoped that the problems under this scenario will be analyzed.\n2.It is recommended to additionally supplement a module diagram in the framework overview of Section 4.3 on page 5 to visually display the ReasonBreak framework.\n3.The author only conducted training on the datasets they proposed and performed black-box testing on open-source datasets. It is recommended that the author provide white-box experimental results.\n4.The author states that the training set used has a high resolution. What would be the impact if a low-resolution dataset were used?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "cP2X7HPKY9", "reviewer": "Reviewer_6ECh", "summary": "This paper proposes a novel attack approach to break the mulitmodal large reasoning model (MLRM) for performing geographical inference. To support this, the authors introduce a new dataset called GeoPrivacy-6K, which contains 6,000 more images and concept annotations for training. Experiments on DOXBENCH demonstrate that the proposed method achieves superior results compared to previous approaches on both open- and closed-source models.", "questions": "The questions are mainly about the weaknesses.\n\n1.\tWhat are the \"concepts\" used for training?\n2.\tDoes using the database as an anchor point affect the results for images that fall outside the database distribution?\n3.\tIs the inclusion of $\\min \\{ \\mathbf{e} \\in \\mathcal{E} \\}$ intended to prevent the reconstructed error from deviating too far from the original images?\n4.\tCould the authors elaborate further on the selection of $N_{\\text{max}}$ and its effect on different classes?", "limitations": "", "rating": 4, "confidence": 3, "soundness": 4, "presentation": 2, "contribution": 3, "strengths": "* The motivation of the paper is intriguing and highly relevant, especially for protecting users’ geographical information in line with existing privacy regulations.\n* The proposed idea is supported by reasonable theoretical analysis, making the design both robust and practical.\n* The experiments are thorough, and the results are impressive. In particular, the introduction of the protected success rate metric, instead of the usual attack success rate, is a valuable addition for future evaluations.", "weaknesses": "* While the paper is well-motivated, the methodology is somewhat difficult to follow. For example, in Equation (3), the meaning of defining $(m^\\*, n^\\*)$ is unclear. Do the authors mean that all $(m^\\*, n^\\*)$ follow the stated condition? Also, terms like \"concept subset\" and \"spatial overlap analysis\" are mentioned without sufficient explanation. It would help to clearly define these terms or include a figure illustrating the training pipeline.\n* The proposed min-max target selection involves finding a \"null point\" from the database. This might be a limitation because if an image is dissimilar or unrelated to the database, the results could be negatively affected. Moreover, the reasoning behind selecting $\\min \\{ \\mathbf{e} \\in \\mathcal{E} \\}$ is not fully explained and would benefit from further clarification.\n* The choice of $N_{\\text{max}}$ is not entirely convincing. As shown in Figure 4, when $N_{\\text{max}} > 16$, the PRR of the \"metro\" class drops to zero. Although other classes improve, this choice does not appear optimal. It would be helpful to explain why the \"metro\" class is considered less important or why this trade-off is acceptable.\n\n---\n\n**Overall**: The paper addresses an important and timely topic with clear motivation and solid contributions. The results are promising and provide meaningful insights for the community. However, the methodological descriptions are sometimes unclear and would benefit from additional clarification. My current score is 4, and I would be happy to raise it once these issues are addressed.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rn1cWDW36G", "reviewer": "Reviewer_kHCB", "summary": "This paper proposes a defense method that aims to disrupt geographic reasoning in large multimodal reasoning models by adding perturbation noise. The authors conduct experiments across multiple models and release the GeoPrivacy-6K dataset, which contains high-resolution, spatially localized images annotated with bounding boxes. The study addresses an important privacy issue and contributes a new dataset and adversarial defense framework.", "questions": "see Weakness", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The work targets an emerging privacy threat related to geographic inference from images by large reasoning models.\n\nThe authors propose an adversarial approach that effectively disrupts hierarchical reasoning through concept-aware perturbations.\n\nThe new GeoPrivacy-6K dataset is a valuable contribution, containing ultra-high-resolution and spatially localized images.", "weaknesses": "Dataset Size and Analysis. It would strengthen the paper to analyze which types of images are more vulnerable to attacks and which are more resistant. Please summarize the visual or semantic characteristics of easily attacked versus robust images.\n\nComputational Performance. Include a comparison of running time and GPU computation cost between ReasonBreak and other defense baselines.\nResolution Impact. The paper uses ultra-high-resolution images. Please explain why this resolution level was chosen and analyze whether image resolution affects attack or defense effectiveness.\n\nDataset Relationships. Clarify the relationship between GeoPrivacy-6K and DOXBENCH. Are they complementary or overlapping?\n\nDefense Comparison. Compare the performance of your defense method (ReasonBreak) against differential privacy (DP) methods implemented in DOXBENCH or similar benchmarks.\n\nAppendix Suggestion. It would be helpful to include sample images from GeoPrivacy-6K in the appendix to illustrate the dataset’s diversity, annotation quality, and spatial localization.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)