One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Image
Authors: Ezzeldin Shereen
Dan Ristea
Shae McFadden
Burak Hasircioglu
Vasilios Mavroudis
Chris Hicks
Venue: Accepted by TMLR ()

Abstract: Retrieval-augmented generation (RAG) is instrumental for inhibiting hallucinations in large language models (LLMs) through the use of a factual knowledge base (KB). Although PDF documents are prominent sources of knowledge, text-based RAG pipelines are ineffective at capturing their rich multi-modal information. In contrast, visual document RAG~(VD-RAG) uses screenshots of document pages as the KB, which has been shown to achieve state-of-the-art results. However, by introducing the image modality, VD-RAG introduces new attack vectors for adversaries to disrupt the system by injecting malicious documents into the KB. In this paper, we demonstrate the vulnerability of VD-RAG to poisoning attacks targeting both retrieval and generation. We define two attack objectives and demonstrate that both can be realized by injecting only a single adversarial image into the KB. Firstly, we introduce a targeted attack against one or a group of queries with the goal of spreading targeted disinformation. Secondly, we present a universal attack that, for any potential user query, influences the response to cause a denial-of-service in the VD-RAG system. We investigate the two attack objectives under both white-box and black-box assumptions, employing a multi-objective gradient-based optimization approach as well as prompting state-of-the-art generative models. Using two visual document datasets, a diverse set of state-of-the-art retrievers~(embedding models) and generators~(vision language models), we show  VD-RAG is vulnerable to poisoning attacks in both the targeted and universal settings, yet demonstrating robustness to black-box attacks in the universal setting.

Published in Transactions on Machine Learning Research (03/2026)
One Pic is All it Takes: Poisoning Visual Document Retrieval Augmented Generation with a Single Image
Ezzeldin Shereen The Alan Turing Institute
Dan Ristca
University College London The Alan Turing Institute
Shae McFadden
King's College London
The Alan Turing Institute
University College London
Burak Hasircioglu
The Alan Turing Institute
Vasilios Mavroudis The Alan Turing Institute
Chris Hicks The Alan Turing Institute
Reviewed on OpenReview:
Abstract
Retrieval-augmentte generation (RAG) is instrumental for inhibiting hallucinations in large language models (LLMs) through the use of factual knowledge base (KB). Although PDF documents are prominent sources of knowledge, text-based RAG pipelines are ineffective at capturing their rich multi-modal information. In contrast, visual document RAG (VD-RAG) uses screenshots of document pages as the KB, which has been shown to achieve state-of-the- results. However, by introducing the image modality, VD-RAG introduces new attack vectors for adversaries to disrupt the system by injecting malicious documents into the KB. In this paper, demonstrate the vulnerability of VD-RAG to poisoning attacks targeting both retrieval and generation. We define two attack objectives and demonstrate that both can be realized by injecting only single adversarial image into the KB. Firstly, we introduce a targeted attack against one or a group of queries with the goal of spreading targeted disinformation. Secondly, we present a universal attack that, for any potential user query, influences the response to cause a denial-of-service the VD-RAG system. We investigate the two attack objectives under both white-box and black-box assumptions, employing multi-objective gradient-based optimization approach well as prompting stato-of-the-art generative models. Using two visual document datasels, diverse set of state-of-the-s retrievers (embedding models) and generators (vision language models), we show VD-RAG is vulnerable to poisoning attacks in both the targeted and uni universal settings, yet demonstrating robustness to black- box attacks in the universal setting.

---

Published in Transactions on Machine Learning Research (03/2026)
1 Introduction
Retrieval-angmented generation (RAG) has rocently gained significant attention in both rescarch and practical large language model (LLM) deployments. RAG augments the parametric knowledge of LLMs by retrieving relevant chunks of information from external knowledge bases (KBs), thus improving groundedness and reducing hallucinations (Lewis et al. 2020). One of the most common sources of external knowledge is PDF documents (c.g., user manuals, health records, academic articles). Therefore, it of utmost importance to ensure that rich information is extracted from such documents. Most RAG pipelines for PDFs either extract only the main text and ignore images, charts, and tables, or apply optical character recognition (OCR) to extract text from those visual elements [Blecher et al.) 2023). Recently, Fayssc et al. (2024) were first to establish the promise of visual document retrieval (VDR) by regarding each page in a PDF document as an image and leveraging the recent. breakthroughs in multi-modal embeddings (Radford et al., 2021] and vision language models (VLMs) (Bordes et al. 2024: Liu et al., 2023). The same approach has been applied to multi-page document understanding (Hu et al.) 2024) and RAG (Yu et al. 2024). leading visual document RAG (VD-RAG) pipelines that show significant performance improvements compared to textual RAG pipelines. VD-RAG is also used in practical settings, for example, Colette self-hosted VD-RAG product that can interact with technical documents.
The effectiveness of RAG relies primarily on the trustworthiness of the information in the KB. Challenging this assumption, recent work has shown that cxisting RAG pipelincs are vulncrable to poisoning attacks, where an allacker injects malicious information into the KB (Zou et al.] 2024 Xue et al.] 2024; Cheng et al.) 2024 Tan al. 2024 Ha et al. 2025 Liu et al., 2025). To create an impactful attack, the injected information must simultancously (1) have high chance of being retrieved, and (2) influence the output of
the generative model. However, the extent to which KB poisoning disrupt VD-RAG pipelines has not yet been explored in the literature.
In this paper, we bridge this gap by investigating the vulnerability of VD-RAG to poisoning attacks. We consider the white-box attack setting by adapting projected gradient descent (PGD) (Madry et al., 2017) with a multi-objective loss, which we refer as MO-PGD, to balance the optimization of the retrieval and generation objectives when crafting the malicious image. First, we propose a stealthy targeted attack objective where the image only influences specific queries, thus causing targeted disinformation on certain topic. Second, we propose universal attack objective where the image is optimized to be retrieved and influence generation for all queries, thus causing a denial-of-service (DoS) attack against the VD-RAG pipeline. Furthermore, we consider three black-box attack variants for both the targeted and universal objectives: (1) leveraging existing multi-modal generative models, (2) exploiting direct transferability across VD-RAG pipelines, and (3) optimizing the image over an ensemble of candidate embedding models and VLMs.
The key contributions of this work are follows:
(1) We illustrate for the first time the vulnerability of VD-RAG systems to poisoning attacks.
(2) We demonstrate that MO-PGD optimization allows an adversary to craft a single image that can cause either a DoS or targeted disinformation attack against the VD-RAG pipeline.
(3) We show that multiple black-box attack variants can achieve success in the targeted attack setting,
(4) We conduct over 5000 evaluations covering different datasets, models, settings, defenses, and images to identify the key factors that contribute to the success of the attacks.
2 Poisoning VD-RAG
A VD-RAG pipeline consists of three main components. The first is knowledge base K. = (I.....,yy Ikk containing a set of K images, each corresponding to a page in a document. The second is a retriever R which uses a multi-modal embedding model E(-) that projects user queries (text) and KB images into a common vector space. The retriever then computes a similarity score S(E(g), between a user
hutps///ghhhub.cmm//lllaaaa/a/
2

---

Published in Transactions on Machine Learning Research (03/2026)
query q and each image in I E K. Common similarity metrics for RAG retrievers include cosine similarity and MazSim proposed by Faysse et al. (2024). For each user query q, the retriever retrieves the top-k relevant images from K according to the similarity score, where k < [K]. Formally, the retriever computes R(g, = S(( E(T).. The third component is a generator g, which is a VLM that generates a response y to the user's query with the retrieved images in its context window. That is, g = G(g, R(g, K)).
We consider an attacker that aims disrupt the operation of the VD-RAG system by causing the retriever to retrieve a malicious adversarial image and the generator to output unhelpful responses to user queries. To achieve this goal, the attacker is assumed to possess a dataset of potential user queries Q, corresponding ground truth answers A, and KB images I from the same distribution as the target RAG system. Furthermore, the attacker is capable of injecting documents/ socuments/images 'images into the KB. This could be realized either by an insider that has access to inject and modify enterprise-owned documents, or by an outsider injecting the poisoned documents/ /images in public domains (KBs are typically crawled from the internet, such as from Wikipodia Liu et al.) 2025). In our work, we assume weak attacker that can only inject one malicious image I' into the KB, such that KC' = KUU', I"; a single image is sufficient to demonstrate the vulnerability of VD-RAG. Scaling to multiple images would amplify the impact, however, it would reduce the stealthiness of the attack. Note that this threat model is orthogonal to works that protect against malicious user prompts (e.g., Cherubin & Paverd 2025), as those assume an attacker controls the user input while the KB is trusted, whereas we assume an attacker who can poison the KB.
2.1 Attack Definition
Building upon the work of Zou et al. (2024), a successful RAG poisoning attack must meet two conditions. First, the retrieval condition requires that the malicious image is retrieved for the attacker-specified queries. Second, the generation condition requires that, when present in the context window, the malicious image must cause the generator to output specific response.
We first define the white-box variant of the attacks and then extend the discussion to the black-box variants. An overview of the white-box attack is presented in Figure 1 To compute a malicious image I' that meets the above two conditions, we adopt a gradient-based adversarial example framework, initially proposed against
neural network-basee image classificrs (Goodfellow et al. 2014 Kurakin et al.) 2018 Carlini & Wagner 2017 Madry et al.] 2017). In particular, we extend the widely-used PGD optimization algorithun (Madry
et al. 2017) to jointly optimize the image to minimize a multi-objective loss function CRAG capturing both a retrieval loss Ln and a generation loss LG follows:
CRAG ARCR + AcLa,
(1)
where An, Åg are attacker-chosen cocfficients controlling the relative weights of the two adversarial objectives.
The adversary chooses a subset of positive larget queries @+ C Q that it wishes to influence; the remaining queries Q = @ Q+ are termed negative queries. The set of answers A is also divided into malicious answers at desired by the attacker for targeted queries qf E Q+ and benign ground truth answers o, for qf E º The retrieval and generation losses are defined as follows:
10t
LR S(
Σ S(E(T))
(2)
lot Lo CELG II
Σ
: II-1UU)),
(3)
where S(.) is the similarity measure between the query and the image embeddings, CFF()) is the cross entropy loss, I is randomly sampled subset, with cardinality [Z+-il = k- 1, of the attacker-owned KB image dataset Z. Note that Ię-1 U I' represents the top-k images retrieved simulated by the attacker.
To minimize the loss LRAG we adopt a multi-objective variant of PGD (Madry al. 2017). referred to as MO-PGD, which iteratively updates the adversarial image I' using the following formula:
7. T clipp (a sign( Vil_,CRAGh
(4)
3

---

Published in Transactions on Machine Learning Research (03/2026)
-V,
Knowlodge (KB)
d. will reply to you!"
Gemerator
(G)
Injecting)
Gonerator
polsoned sample
D..)
(Quer
5(Q.1)
Document(
a.
Retriever Jorbeccing model sccerg
Embedding model
E()
(())().E()))
[Query]
Queries (2+)
E(Q)
Malicious image creation
VD-RAG system
Overview of the white-box attack. We select an arbitrary poouumnt//image T and optimize it against target queries Q+ in the training set (left). The resulting poisoned document: I' is then injected into the KB. When the attack successful, is retrieved and causes the generator to malfunction (right).
Figure 1:
the iteration index, e the perturbation budget controlling the attack stealthiness, a is the learning rate, V is the gradient operator, I benign image, and f is the final adversarial image be injected to the KB.
where E (1..... 7}
2.2 Attack Objectives
The injected image is used realize one of two malicious objectives:
(1) a targeted attack where the image should only retrieved and influence generation for a specific query (12+1= 1, Setting Dh, or subset of queries (12+1 < Q) with either single target answer (4a 9 E Q+ a. = aa Sctting III or distinct target answers (vq W Q+ at + at. Setting III,
(2) a universal attack where the injected image should both be retrieved and influence generation for any possible user query (Q* = =Q-
The first objective corresponds to stcalthy and specific attacks, such as spreading disinformation on specific topics; the second objective corresponds to a DoS attack against the availability of the VD-RAG system.
2.3 Variants Based on Attacker Knowledge
We examine different levels of attacker knowledge through variants of the previous attack definition, varying from full white-box access to the black-box setting.
White-box Attack. In the white-box setting the attacker has full knowledge of and access to the embedding model and the VLM G. This the strongest assumption and thus yields the strongest attack. However, it is a practical concern due potential insider thrcats and due the proliferation of high-quality open-source
text and multi-modal embedding models (Faysse al.) (024) and VLMs (Duan al. 2024a), and the emergence of techniques to identify models based on their output (Kurian et al. 2025
Pasquini al. 2025
Black-Boo Attack Variants. In the black-box setting the attacker does not know the target models. We investigate three attack variants at increasing levels of difficulty for crafting malicious images: a Prompt-based Atlack, Direct Transfer Attack, and a Model Ensemble Atlack.
(1) Prompt-based Attack. Prompt an off-tho-shelf multi-modaa generative model, specifically GPT- 5 and Gemini-2.55Plaen (Comanici et al. 2025) in this paper, to generate image with the
4

---

Published in Transactions on Machine Learning Research (03/2026)
desired eetrieval/generattee effect. This style of attack has been studied by several works in RAG poisoning (Zou et al. 2024 Shafran et. al.) 2024 Ha et al. 2025 Liu et al. 2025) and illustrates the immediate risk posed by any individual able to inject an image into the knowledge base.
(2) Direct Transfer Attack. Optimize an adversarial image against surrogate model pair g') that is likely different from the target (E, G). This attack relies the well-known transferability property of adversarial examples [Goodfellow et al., 2014 Papernot et al. 2017). We compute LR and La using E' and g respectively. The resulting gradients are then used to craft the adversarial image, which is directly applied to the target system. We evaluate two sub-cases of the Direct Transfer Atlack: (1) neither component of the surrogate pair matches the larget, referred to as Complete Transfer, which measures pure transferability; or (2) exactly one surrogate component (either E' 9') matches the target, referred to as Component-uiss wise Transfer, which mcasures the transfcrability between individual components.
(3) Model Ensemble Attack. Optimize the image jointly over all models in set of surrogate embedding models E' and a set of surrogate VLMs G'. Optimizing over large surrogate sets aims to increase the chance that either: (1) the target models are contained in the surrogate sets, or (2) the resulting image transfers when the target models are not in the surrogate sets. Concretely, we minimize the aggregate loss:
RAG = >AR Σ )) + AG
Σ C.. G.E0Y
(5)
E.ER'
In our evaluations, we separately consider both sub-cases: (1) both surrogate sets contain the target, E E E' A G', referred to as the In-set Model Ensemble case, which assesses the risk of an attack with representative set; and (2) neither of the surrogate sets contain the target, E E' A & G' referred to as the Oul-sel Model Ensemble case, which measures the pure transferability of the ensemble-based optimization.
3 Experiment Design
Datascts. We evaluate the attacks on two visual document retrieval datascts taken from the Vi- DoRe benchmark versions 1 and 2 (Faysse et al. 2024). In particular, we use the datasets sotthettcccch..rrrfffiiaiitltlld
test (shortened to ViDoRe-VI-AI moving forward) and (shortened to ViDoRe- V2-ESG.. ViDoRe-VI-AI consists of 100 querics and 1000 images (with exactly one relevant ground-truth image in the KB per query): ViDoRe- ViDoRe-V2-ESC V2-ESG consists of 52 queries and 1538 images with average of 2.5 relevant images per query We split the queries of each dataset into set used to optimize the malicious image (80%) and set to evaluate the attack for the universal objective (20%).
eustaurant_esg_repprtte
Embedding Models. We use mix of embedding models that range in size, recency, and target applications: (1) CLIP-VIT-LARGE (Radford et al. 2021 is a seminal multi-modal 0.4B parameter model trained using contrastive learning to achieve zero-shot image classification. Despite not being specifically trained for VDR, we include for its wide-use (7.2 million monthly downloads ). (2) GME-Qwen2-VL-229
2.2B parameter model (Zhang et al.) 2024 fine-tuned from Qwen2-2B- VL several tasks, including VDR.
(3) ColPali-v1.3 is state-of-the-art 3B parameter model (Faysse et al. 2024 in visual document retrieval, using ColBERT-style (Khattab & Zaharia 2020) late embedding interaction, and incorporating the retrieval similarity metric MaxSim. GME and ColPali are ranked 30th and 37th respectively on the ViDoRe benchmark only 3.2% and 6.2% below the top-performing model. For all the above models, unless otherwise stated, we assume the retriever only retrieves the lop-1 relevant image from the KB.
"Not all images in the KB have be relevant for query.
3 Recorded in the month leading up to Oct. 2025. 4 'httpss/ /twoggiggffcc..ooo wwt.///paas//v/eeeeeeeee wetoor//vvdor--eaadeeee Accessed 15-05-2025
5

---

Published in Transactions on Machine Learning Research (03/2026)
We evaluate the attacks on three VLMs: SmolVLM-Instruct (2.2B) (Marafioti et al. 2025 Qwen2.5- VI-3B--nstruct (3.75B) (Wang et al. 2024). and InternVT.3-2B (2B) (Zhu et al. 2025
VLMs.
At the time of writing, these models ranked 34th, 7th, and 8th in the OpenCompass VLM leaderboard (Duan et al. 2024b) for open-source models with less than 4B parameters.
Defenses. The literature lacks spocialized defenses against VD-RAG poisoning attacks. Furthermore, most of the defenses proposed for lextual RAG are not straight forwagly applicable to multi-modal settings and incur a significant drop in benign performance (Xiang et al.) 2024 Zhou et al. 2025). Nevertheless, we
evaluate the resistance of the attacks several defenses used by previous works.
This defense (Zou et al. 2024 works by retrieving a larger number of KB items with the intention of diluting the effect of the retrieved adversarial image. We expand the number of retrieved images from 1 to 5 images when evaluating this defense. (2) VLM-as-a-judg:: We use a VLM-as-a-Judge (Chen et al.] 2024 Zheng et al., 2023) to evaluate the output on three metrics: (i) answer relevancy assesses if the answer relevant. to the query, (ii) contert relevancy assesses if the retrieved images are relevant to the query, and (iii) answer faithfulness assesses if the answer is grounded in the retrieved images. We use the prompts proposed by Riedler & Langer (2024) (Appendix Eh to evaluate these metrics. (3) Query Paraphrasing: As proposed by (Shafran et al. (0024) asked a state-of-the-art LLM, specifically Llama-3. 3. 1-8 Instrucct to paraphrase all queries in the ViDoRo-VI-AT and TiDoRe-V2-ESC datasets and then use the paraphrased queries when evaluating whether the attacks are still successful.
These include: (1) Knowledge expansion:
Evaluation Metrics. We evaluate the RAG system and each attack using the following performance metrics for retrieval, where / denote their relation to the performance of the attacker:
(1) Recalt the baseline fraction of queries for which R retrieves relevant image before attack.
(2) AReaal J: the change in the Recall of R after the atlack, compared to the baseline Recall.
(3) ASR-R t: the fraction of targeted queries for which the malicious image is retrieved by R.
And the following performance metrics for generation:
(4) ASR-Gsa 1:
the average embedding similarity between the VLM generated response for targeted queries and the target response (S(F(G(a)) RRg,t KU)))), F(at))) ASR-Gsim 1 means that the VLM outputs the target answer verbatim.
(5) SIM-GNep J: in the targeted setting, the average embedding similarity between the VLM-generated response for non-targeted queries and the target malicious response (S(E(g(9g) R(q XCUU')) E(a; )); presented as the mean and the change (A L) from baseline unoptimized image = T--
(6) SIM-GGT I: the average embedding similarity between the VLM generated response for targeted queries and the ground truth response (S(E(G(g)) R(q KU I')), E(a,) )); presented as the mean and the change (A 1) from a bascline unoptimized image I' = I/-
For all evaluation metrics, the superscript signifies that the metric is reported when the top-k relevant images are retrieved (k: (R(at)). I)) Furthermore, we denote by #-1 that force the malicious image to be retrieved the only context image ((!') + R(a;)), which decouples the generation performance from retrieval, so we can report on the performance of each component of the attack individually. Similarity metries are computed using the Jina-Embeddings-v3 (Sturua et al. 2024] text embedding model. We use an embedding model different from those employed by the VD-RAG system, and the attacks, to exclude the possibility of bias.
For each datasct in our evaluation, we pick an arbitrary image that is not relevant to any query as the starting point for our optimization process (i.c., Ig). We repeat each attack for five different initial images. We produce the attacks (except for the Prompl-based Atlack) using
Attack

---

Published in Transactions on Machine Learning Research (03/2026)
MO-PGD (Madry et al. 2017) with linear learning rate schedule from 3 10 to 3 10 over 250 gradient steps, a batch size of 8 user queries, Xn 2, A = 1, and maximum image perturbation = 255 This choice was made based on our study of different perturbation budgets in Appendix D The retrieval loss uses the cosine similarity between emboddings as ((E(g), E(T) (except for ColPali which uses MaxSim). For the Prompl-bused Allack, we utilize the prompls detailed in Appendix F] The universal allack as well as the targeted attack Setting I1 use the target malicious reply: will not reply to you!, while the targeted attack Setting and Setting III use targeted malicious answers generated by GPT-40 (Hurst al. 2024).
8
Compute Resources and Code. The experiments reported in this paper were carried out using a NVIDIA H100 NVL GPU with 93GiB VRAM, taking approximately 325 GPU hours. The code to run the experiments, including all configurations, and their results is openly availabld
4 Targeted Attack
We empirically evaluate the vulnerability of VD-RAG to the targeted attack across three settings, with incrcasing number of targeted queries and answers: 1) One Query, II) Multiple Queries, and III) Multiple Queries & Answers. In our evaluation, we primarily focus on [Setting as it is the base case from which the others are derived. In each setting, we vary the attacker knowledge of the system from white-box to black-box cases. Across all settings, the malicious image is never retrieved for unrelated queries, the false positive rate (FPR) is always O, and we therefore do not report it in the tables below. The results are for the -ID-Re-Vi-AT dataset, and corresponding results for the ViDoRe-V24 V2-ESG dataset are presented in Appendix
Sctting I: One Query. In this setting, target single query in the dataset such that the malicious KB entry is retrieved and it induces the VLM to generate specified malicious answer generated by GPT-4o (Hurst lt al. 2024). The results for [Setting I are shown in Table 1. showing mean and max values aggregated over five runs using different initial images I/ for the attack.
Focusing on the while-bor setling, the results show that an allacker with full knowledge of the target models can succeed in compromising the RAG system. For retrieval, the malicious image is always retrieved as the most relevant image for the target query when CLIP-L is the embedding model. For more sophisticated embedding models (i.e., ColPali and GME), the malicious image is almost always retrieved within the top-5 most relevant images. For generation, the generated answer is semantically similar to the target answer (ASR-GS 2 0.8) for most model combinations. Note that ASR-G Sim is relatively lower when ColPali or GME is used, as the attack optimization is not able to balance the retricval and generation objectives. Further note that the malicious image has high specificity and does not influence the generated answers for untargeted queries, even when retrieved, as shown by the STM-GN-- values.
Regarding the black-box attack variants, we observe no transferability between the models when applying the Direct Transfer Attack. The same applies for the Out-set Model Ensemble Attack (ie., when the model ensemble docs not include the actual models used). However, when the model ensemble includes the models employed in the VD-RAG system, the In-set Model Ensemble Allack achieves better performance, but still significantly lower than the White-bor Attack. Launching Component wise Transfer attacks (i.e., when either of the employed embedding model or the VLM is included in the set, but not both) results in limited performance.
Interestingly, the Prompt-based Attack shows higher success than other black-box variants, yielding different. success rates dependent on the generative model. While Gemini-2.5-Plassh creates images that get retrieved more often, GPT-5's s images are better at generating the target answer. We attribute this partial success to the textual (typographic) elements in those generated images (see examples of successful Prompl-based attacks in Appendix A), exploiting the OCR capabilities of both the embedding model and the VLM. Overall, our results highlight that black-box attacks are not effective against VD-RAG systems in the targeted setting, based among which, the Prompt- based Attack achieve the highest relative success.
hhtpps:///t thub. cwn/al an- inn- wtw.::tuteeeeuuunn--------- attakss

---

Published in Transactions on Machine Learning Research (03/2026)
Table 1: Targeted Attack Setting (1 query, answer). Performance the targeted attacks against a single query (eetiing IT.
Models
Retrieval
Generation
Attack Type
Embedder
VLM
ASR-R"
ASR-R
ASR-G
SIM-G
mram
moan
mean
InteruVL3-2B
1.00
1.00
1.00
1.00
0.21
CLIF-L
Qwen2. 5-33
1.00
1.00
1.00
0.22
SmolVLM
InteruVL3-2B
0.60
1.00
0.55
0.84
0.21
White bor
ColPali
Qwen2.5-23 5-3B
0.10
1.00
0.22
SmoIVLM
0.60
1.00
0.22
LnternVL3-2B
0.80
1.00
1.00
0.22
GME
Qwen2.5-3B
SmoIVLM
1.00
1,00
0.22
InternVL3-2B
0.65
CLIP-L
Qwen2.5-338
SmolVLM
1.00
1.00
0.57
0.74
0.23
0.01
InternVL3
In-act Model Ensemble
ColPali
Qwen2. 5-3B
0.60
1,00
0.22
SmolVLM
0.40
0.60
0.60
0.87
0.24
0.01
InternVLS
GME
Qwen2.5-38
0.00
0.20
0.80
1.00
0.22
0.01
SmoIVLM
0.00
0.20
0.60
0.92
0.22
0.00
Out-sct Model Ensemble
Any
Any
0.00
0.00
0.17
0.56
0.21
0.00
Complete Transfer
Any
Any
Any
Same
0.00
0.00
0.85
1.00
0.21
0.00
Component wise Transfor
Same
Any
0.76
0.45
0.57
0.21
InternVL3-2BB
1.00
1.00
0.45
0.49
0.25
n//a
CLIP-L
Qwen2. 5-3B
1.00
1.00
0.41
0.43
0.24
n/a
SmolVL.
0.57
n/n
Prompt-based (Gemini)
IntervVL3-22
0.60
1.00
0.44
0.50
0.25
n/a
ColPall
Qwen2. 5-3B
1.00
0.43
0.25
n/aa
SmolVLM
n/n
InteruVL3
1.00
1.00
0.51
0.70
0.25
n/a
GME
Qwen2. 5-3B
1.00
1.00
0.45
0.24
n/aa
SmoIVLM
1.00
0.35
0.70
0.27
InternVL3-2B
0.10
0.10
0.92
0.27
n/a
CLIP-L
Qwen2.5-3H
0.80
n/n
SmaIVLM
0.40
1.00
Prompt-based (GPT)
InternVL3-2B
0.20
0.92
0.27
n/a
ColPali
Qwen2.5-3B
0.40
0.80
0.27
SmoIVLM
0.20
0.40
0.88
1.00
0.32
InternVL3
n/a
GME
Qwen2.5-333 5-3B
0.40
0.81
0.28
SmoIVLM
0.40
0.40
0.89
1.00
0.30
Setting II: Multiple Queries. The multiple target subvariant the targeted attack optimizes the image be retrieved and influence generation for a cluster of queries. When the image retrieved, the VLM should generate the same answer for all of them. Therefore, the attack acts as an intermediate step between the base largeted attack and the universal attack. We larget 5 queries: attacker-chosen target query and its nearest neighbors, computed by the Jina- Eanuaddiddd V3 (Sturua et al. 2024] text embedding model. The rationale for using neighboring queries is to simulate the scenario in which the attacker wants to influence a range of queries related to a certain topic (e.g., elections, or a specific commercial product). The number of neighbors acts as a proxy for the generality of the topic targeted by the attacker.
The results for [Sctting II are shown Table 2 where the Direct Transfer Attack and Model Ensemble Attack were omitted due their poor results in Setting The results confirm the findings from Setting that attacks successful when CLIP-- used, with success rates slightly lower than those in Setting Moreover,
8

---

Published in Transactions on Machine Learning Research (03/2026)
Prompt-based Attack are no longer useful when multiple queries targeted. These attacks yield very similar results across the generative models we evaluate (GPT-5 vs. Gemini-2.5-Flashh) VD-RAG embedding models, and VLMs, and therefore we only report averaged metric values across these cases.
Table 2: Targeted Sctting II (5 querics, answer). Performance of the targeted attacks against a cluster queries [etting
Models
Retrieval
Generation
Attack Type
Embedder
VLM
ASR-R
ASR-R
Agn
SIM-GNN
A
InterVL3-222
0.80
0.80
0.83
1.00
0..3
0.45
CLIP-L
Qwen2.5-3B
0.80
0.84
0.97
1.00
0.18
0.18
SmolVLM
0.88
0.92
1.00
1.00
0.15
0.17
IntervVL3222 2B
0.12
0.72
-0.02
0.11
0.00
0.02
White-boz
ColPali
Qwen2.5-3B
0.12
0.64
0.46
0.79
0.38
0.40
SmolVT.M
0.20
0.56
0.29
0.97
0.10
0.12
InternVL3-2B
0.20
0.68
0.78
1.00
0.57
0.59
GME
Qwen2.5-22 5-B
0.24
0.56
1.00
1.00
0.49
0.50
SmolVLM
0.20
0.56
0.93
1.00
0.16
0.17
Prompt-based (Any)
Any
Any
0.01
0.08
-0.04
0.17
0.01
n/a
Setting III: Multiple Queries & Answers. In this setting, the attack targets multiple unrelated queries with the intent of generating different malicious answer for each query using single image. We target queries and 2 in the dataset and use GPT-4o to generate corresponding malicious larget answers. Table 3 shows slightly better results than Setting II but slightly worse than [Setting 1 where white-box attacks are successful against both legacy and SoTA embedding models in this challenging setting. Similar to [Sctting II we report averaged results for the Prompt-bused Allack, but we include the full results [Appendix H as well as qualitative image examples in Appendix A
Table 3: Targeted Setting III (2 queries, 2 answers). Performance of the targeted attacks against multiple queries and multiple answers (eetiing III..
Models
Retrieval
Generation
Attack Type
Embedder
VLM
ASR-R S1
ASR-R
ASR-G
SIM-GNoc
mean
mean
mean
max
mean
A
InterVVL3-2B
1.00
1.00
0.88
1.00
0.26
-0.01
CLIP-L
Qwen2.5-3B
1.00
1.00
0.93
1.00
0.28
0.02
SmoIVLM
1.00
1.00
0.90
1.00
0.27
0.00
InternVL3-22 L3-2B
0.60
0.80
0.57
0.63
0.27
0.00
White- boz
ColPali
Qwen2.5e 5-3B
0.60
0.80
0.66
0.95
0.27
0.01
SmoIVLM
0.50
0.70
0.60
0.65
0.26
0.00
InterVVLi-2B
0.50
0.70
0.77
0.94
0.26
00.01
GME
Qwen2.5-30
0.40
0.60
0.89
1.00
0.26
0.00
SmoIVLM
0.50
0.60
0.79
0.96
0.26
0.00
Prompttbased (Any)
Any
Any
0.48
0.68
0.71
0.91
0.31
n/a
5
Universal Attack
Table 4 presents the evaluation of the universal attack on the ViDoRe-VI-AN datasct, with results for the ViDoRt- V2-ESG presented in Appendix I Focusing on the white-bor atlack, the universal atlack produces images that are always retrieved for all queries (ASR-R =1) when the CLIP-L embedding model is used. To the contrary, stato-of-tho-art embodding models (ColPali-v1.3 and GME-Qwen2-VL VL.22B never retrieve adversarial images as the top-1 relevant image but sometimes retrieve them within the top-5. Regarding generation, the universal attack consistently causes all VLMMs to generate the target answer verbatim for

---

Published in Transactions on Machine Learning Research (03/2026)
almost all user queries in the test dataset. These results mirror those for the targeted attacks, where CLIP-L is the most vulnerable embedding model, while ColPali and GME remain robust to influences under all attacks. To shed light on this distinction, in Appendix Q we provide UMAP (Mclnnes et al. 2018) visualizations of the queries and images in the embedding space of different models. The UMAP visualizations show a distinct modality gap CLIP-L, however, a minimal gap for ColPali and GME. This illustrates the difficulty of gencrating a single image that retrieved for all queries in these embedding spaces, leading their observed robustness. To further investigate the origin of this phenomenon, we performed ablations on ColPali in Appendix B
For black-boz attacks, Table 4 shows that those attacks are consistently unsucoossful against all model combinations. Even the In-set Model Ensemble Atlack is only occasionally successful when CLIP-L is used. This highlights the fact that the universal setting a more challenging objective that the targeted setting.
Table 4: Universal Attack. Retricval and generation performance of universal attack for different embodding models and VLMs.
Models
Retzieval
Generation
Astack Type
Embedder
VLM
Re
R
ASR-R
Recall
ARoeall
ASR-R
ASR-G
SIM-G |
moun
moam
mean
moan
mcan
moan
max
menm
L35erVVL3-2B
0.21
-0.19
0.97
0.44
-0.01
0.96
1.00
0.04
-0.51
CLIP-L
Qwen2.5-31
0.21
0.19
0.98
0.44
0.01
1.00
1.00
1.00
0.03
0.51
SmalVTM
0.177
0.90
0.44
-0.01
1.00
1.00
0.03
00.00
InteraVL3-2B
0.00
0.98
0.00
0.59
0.30
-0.25
Whete-boar
ColPali
Qwen2.6-3B
0.67
0.00
0.00
0.98
0.00
0.05
0.97
1.00
0.04
-0.51
SmoIVLM
0.67
0.00
0.00
0.98
0.00
0.06
0.87
1.00
0.06
-0.17
In3erVVL3-213
0.94
0.00
1.00
0.03
0.52
GME
Quen2.5-3F
0.58
0.00
0.00
0.94
0.00
0.17
1.00
1.00
0.03
0.52
SmaIVLM
0.58
0.00
0.00
0.94
0.06
0.13
0.99
1.00
0.03
0.30
InsernV13-2B
0..11
0.07
0.44
0.00
0.33
0.12
0.58
0.48
0.07
CLIP-L
Qwen2.5-3B
0.21
-0.01
0.07
0.41
0.00
0.33
0.88
1,00
0.09
-0.46
SmalVTM
0.21
0.01
0.07
0.44
0.00
0.33
0.09
0.40
0.45
0.09
Insset Model Ensemble
InterVVL3-2B
0.67
0.00
0.00
0.98
0.00
0.01
0.11
0.69
0.17
-0.09
ColPali
Qwea2.55-33
0.67
0.00
0.00
0.98
0.06
0.01
0.90
1,00
0.07
-0.46
SmalVLM
0.67
0.00
0.00
0.98
0.00
0.01
0.07
0.33
0.47
-0.08
InternVT3-2BB
0.58
0.00
0.00
0.94
0.00
0.13
0.70
0.46
-0.09
GME
Quen2.5-31
0.58
0.00
0.00
0.94
0.00
0.04
0.89
1.00
0.08
0.47
SmnlVVL
0.58
0.00
0,00
0.94
0.00
0.04
0.12
0.32
0.46
-0.08
Out-eet Model Ensemble
Any
Auy
n/a
0.00
0.00
a/a
0.00
0.00
-0.01
0.03
0.54
0.00
Complete Transfer
Any
Any
n/4
a/4
0.00
0.01
0.04
0.54
Componenttaria Tronsfer
Any
Same
0.00
0.00
0.00
0.91
1.00
0.07
-0.47
Same
Any
n/a
0.06
0.32
a/4
0.00
0.40
0.01
0.03
0.54
0.00
Prompt-based (Any)
Any
Any
n/a
0.00
0.00
a/a
0.00
0.00
0.01
0.10
0.52
4/4
6 Defenses
We investigate the effectiveness of the defenses introduced in sectionn 3 We only evaluate the while-bor attacks since these are the most successful in both the targeted and universal settings.
Knowledge Expansion. Table 5) show the attack performance under different numbers of retrieved images (1 or 5). The top-k column shows the top-k that was used during training the attack, while superscript âs in the metrics represent the top-k value used in evaluation. The results show that expanding the retrieved knowledge (using & = 5) can degrade the attack performance if the altack was only trained using = 1. However, an adaptive attack trained specifically against this value of k using 10% of the knowledge base, (shown the bottom three rows) can effectively evade this defense when CLIP-L the employed embodding model. This applies for both targeted and universal attacks. We conclude from these results that knowledge expansion its does not guarantee robustness of the RAG system against the attacks.
10

---

Published in Transactions on Machine Learning Research (03/2026)
Table 5: Knowledge Expansion Defence. Targeted (Setting 1 and universal white-box attack generation metrics with the knowlodge expansion defense, increasing k from computational constraints. Results for k=5 and 95 show the effect of adapting the attack the defense.
Results only for SmoIVLM due
ASR-Ggm
SiM 4
ASR-G
SIM-GNeg
ASR-G
SIM-G
Attack Type
Top-k
Embedder
mean
mean
mean
max
CLIP-L
1.00
0.03
1.00
1.00
-0.02
-0.05
-0.02
ColPali
0.01
-0.01
-0.10
-0.08
GME
1.00
0.01
0.56
1.00
-0.11
-0.10
Targeted
CLIP-L
0.78
1.00
0.02
0.79
1.00
-0.02
0.57
1.00
00.02
ColPali
0.07
0.00
0.10
-0.08
0.02
0.10
-0.08
GME
0.02
0.33
-0.02
ASR-Gam T SIM-G2T
ASR-
1 SIM-G
ASR-G
SIM-G
Atlack Type
Tup-k k
Embedder
misun
max
miam
mean
max
mean
mean
max
mean
CLIP-L
1.00
1.00
0.03
0.93
1,00
0.07
-0.02
-0.01
0.56
ColPali
0.99
1,00
0.04
0.98
1,00
0.03
-0.01
0.00
0.54
GME
1.00
1.00
0.03
0.00
0.04
0.60
-0.02
-0.01
0.58
Universal
CLIP-L
0.79
1.00
0.12
0.78
0.95
0.15
0.54
1.00
0.26
ColPali
0.13
0.70
0.16
0.12
0.65
0.46
0.011
0.03
0.54
GME
0.72
1,00
0.16
0.00
0.03
0.60
0.02
0.09
0.56
VLM-as-a-Judge. Table reports the performance of using the VLMs (SmolVLM, Qwen2.5-3B, and InternVL3-225 as judge. Qwen2.5-3B and InternVL3-28 as-a-judge demonstrate the capability to detect both universal and targeted attacks across all three metrics. SiolVV.M-asa--judde detects low answer relevancy for both attacks but performs worse in the other two metrics. Morcover, Table reports the performance of judge performance after the allack had been adaptively trained to fool the judge (i.e., including another loss term [Equation I These results show that adaptive attacks trained against the judge are able bypass the defense, but there is no transferability of these attacks between judge models. We conclude that VLM-as-a-Judge is not able to improve the robustness of VD-RAG to the poisoning attacks.
Table 6: VLM-as-a-Judge Defence. Combined results across embedding models and VLMs for targeted and universal white-box attacks, including evaluations with and without judge loss included in training.
Image Content Relevancy
Image Faichfuluess
Answer Relevancy
Attack Type
Evad Judge
Judge Less
max
mean
0.01
InternVL33-2B
Other VLMs
0.00
0.03
0.00
0.01
0.01
0.09
InternV13-2R
0.87
1.00
0.79
1.00
0.88
1.00
None
0.01
0.09
0.01
0.04
0.03
0.13
White-bos (Targeted)
Qwam2.5-3F
Other VLMSs
0.01
0.05
0.03
0.11
Qwen22.5311
1.00
1.00
1.00
1.00
1.00
1.00
SmolVLL
None
0.63
0.99
0.52
0.95
0.22
0.55
Other VLMs
0.53
0.96
0.20
SmolVT.M
1.00
0.99
0.99
None
0.00
0.05
0.00
0.05
0.00
0.05
TntermVT.3-22
Other VL
0.00
0.00
0.00
0.00
0.00
0.05
InternV111-2B
White-box (Universal)
Q Qwen2.5-33 5-3B
Other VLMs
0.01
0.10
0.01
0.20
0.01
0.25
Qwen2.5-3B
1.00
1.00
0.99
1.00
1.00
1.00
None
0.49
1.00
0.38
0.90
0.05
0.70
SmolVLM
Other VLMSs
0.51
1.00
0.38
0.95
0.08
0.50
SmolVLM
1.00
1.00
0.99
1.00
0.99
1.00
Query Paraphrasing. Our results shows that query paraphrasing not an effective defense against the attacks (computed against the original queries). Across both the targeted [Setting Ih and universal attack objectives, both the A and ASR-G remained the same as in the white-box attacks (aalle &
11

---

Published in Transactions on Machine Learning Research (03/2026)
Table 4/. With the only noteworthy exception being reduction in targeted ASR-R* for ColPali, dropping from 0.60 to 0.20. Detailed results are presented in Appendix G.
7 Related work
Multi-Modal RAG (M-RAG). Early works on multi-modal RAG (M-RAG) (Chen et al. 2022) considered
answering a textual question with the help of a KB consisting of imago-text pairs. M-RAG has been shown
to outperform single-modality RAG (lext or vision) [Riddler & Langer 2024p. In addition, M-RAG has been
applied in different domains, such as video retrieval (Jeong et al., 2025): healthcare (Xia al.
2024 Lahiri
& Hu 2024), and autonomous driving (Yuan et al. 2024).
Visual Document RAG (VD-RAG). Building on the recent success of vision language models, visual document retrieval uses vision language models to create rich representations of documents. The use of such reprosentations has been shown to be more efficient than optical character recognition pipelines on document retrieval benchmarks Faysse et al. 2024). ColPali (Faysse et al. 2024) proposed fine-tuning several VLMs to perform VDR using a late interaction based loss, inspired by ColBERT (Khattab & Zaharia 2020). This concept was used for VD-RAG in Yu et al. (2024), where was shown to outperform textual RAG solutions based on OCR. Zhuang et al. (2025) investigated the vulnerability of document retrievers to adversarial attacks; however, the work did not consider the joint problem of retrieval and generation.
Attacks on Textual RAG. The first data poisoning allack proposed against textual RAG pipelines was PoisonedRAG (Zou et al.) 2024), which divides the injected malicious document into two parts to optimize each objective (retrieval and generation) separately. A similar approach was also proposed by Xue al. (2024); Shafran al. (2024). However, most of these approaches handle the retrieval objective by using the query string and gradient-based or word-swapping- based attacks to optimize for generation.
Attacks on Image and Multi-modal RAG. Recent works have started extending the above textual attacks to the image and multi-modal domains and thus are most similar to our work. Gu et al. (0024) presented an attack against a multi-agent setting where each agent is equipped with a multi-modal L.M and a RAG module. They showed that a malicious image injected into one RAG module can spread exponentially fast and effectively jailbreak multi-agent systems comprising as many as one million agents. Focusing on multi-modal RAG systems (image-text pairs), Ha et al. (2025) proposed targeted and universal poisoning attacks under both the white-box and black-box settings. Shortly after, Liu et al. (2025) proposed targeted disinformation poisoning altack against multi-modal RAG systems. Nonetheless, the above two works consider KBs including image-text pairs, with the text modality greatly simplifying the attacks (e.g., including the targeted user query and/or malicious answer verbatim in the injocted text). Importantly, all the above works attack outdated multi-modal embedding models (e.g., CLIP Radford et al. (202T)) that include known vulnerabilities, such as the so-called modality gap (Liang et al. 2022). Our work specifically targets VD-RAG pipelines, considering task-specific datasets as well as state-of-the-art embedding models which do not exhibit the modality gap.
Lit
Defenses against RAG Poisoning. Due to the recency of the field, the literature still lacks specific defenses against multi-modal RAG poisoning, let alone VD-RAG. The works proposing RAG poisoning attacks (Zou et al. 2024 Shafran et al.) 2024) evaluated their proposed attacks against defenses, including (1) knowledge expansion (increasing the number of context documents retrieved), (2) paraphrasing the user query, and (3) filtering out suspicious textual documents with high perplexity. Furthermore, LLM-as-a-judge frameworks could be used to evaluate and detect RAG poisoning (Zheng et al.) 2023 Chen et al. 2024 Other
works proposed specific approaches to defend against RAG poisoning. For example, RobustRAG Xiaag ct al. 2024) proposed certifiably robust tsolate-then-aggrgaal framework, where an answer is generated using each relrieved document separately, and then the answers are aggregated based on the most common keywords in the isolated answers, or based on averaging the next token probabilities. Moreover, [hhou et al. (2025) proposed TrustRAG, a two-stage framework to detect RAG poisoning when the attacker can control a substantial amount of documents: (1) document filtering based on K-means clustering and ROUGE metric, and (2) consolidation between the knowledge retrieved and the internal knowledge of the LLM. Despite
12

---

Published in Transactions on Machine Learning Research (03/2026)
the demonstrated success of Xiang et al. (2024) and Zhou et al. (2025) in mitigating attacks, they report significant drops in performance on benign data.
8 Limitations
Since we only inject one image into the KB, the attacks can be easily detected by majority vote-based methods (Xiang et al. 2024). However, these methods often increase the latency of the system, and might degrade the benign performance. Furthermore, we only evaluate the vulnerability of VD-RAG systems to adversaries injecting only one malicious image. Extending the attacks to multiple images would likely improve the attack success rates, and is an interesting avenue for future work. Similarly, future work should investigate the robustness of these attacks against real-world perturbations (e.g,, JPEG compression, watermarking) that might be applied to images before being added into the KB. Moreover, we could not evaluate the attacks against very large embedding models and VLMs due to compute constraints. Nevertheless, we conjecture that our attacks will succced against larger models, as experimenting with model sizes between 256M 4B parameters (spanning more than one order of magnitude) yielded very similar vulnerability. We have also conducted our experiments against those. Investigating the vulncrability of proprictary closed- models to black-box attacks is an interesting direction for future work.
open-weighh models only, white-box attacks could only be evaluated
9 Conclusion
In this paper we demonstrate the vulnerability of VD-RAG systems poisoning attacks. The attacks show that conventional embedding models and VLMs are vulnerable to adversarial perturbation and that single injected image is capable of either spreading disinformation targeted topics, causing a DoS against the entire RAG system (impacting both retrieval and generation). While both white-box and black-box allacks are successful in the targeted setting, only white-box attacks succeed in the universal setting. We also observe the notable adversarial robustness of the ColPali and GME embedding models in the univorsal attack case; however, they still prove vulnerable to more largeled atlacks. Beyond vanilla VD-RAG pipelines, we evaluate several common RAG defenses and find them to be ineffective against the poisoning attacks considered. This work provides the first steps towards fully characterizing the vulnerabilities of visual document RAG systems and helps guide the development of more robust designs.
Ethics & Societal Impact
The authors acknowledge the potential for misuse of this work through the creation of malicious inputs for AT systems. However, the authors believe that VD-RAG is a developing technology and therefore evaluating the robustness of the proposed approaches critical evaluating risks and mitigating them. Therefore, we hope that the results presented in this work will aid in the development of defenses for and the safe design of future VD-RAG systems.
Acknowledgments
This research was partially funded and supported by: UK EPSRC grant EP EP /S022500/ supppo0tt the CDT in Cybersccurity at UCL; the UK National Cyber Security Centre (NCSC); the Defence Science and Technology Laboratory (DSTL), an exocutive agency of the UK Ministry of Defence, supporting the Autonomons Resilient Cyber Defence (ARCD) project within the DSTL Cyber Defence Enhancement programme.
13

---

Published in Transactions on Machine Learning Research (03/2026)
References
Lukas Blecher, Guillem Cucurull, Thomas Scialom, and Robert Stojnic. Nougat: Neural optical understanding for academic documents. 2023. doi: 10.48550/ar ar.ia. 23488
Florian Bordes, Richard Yuanzhe Pang, Amurag Ajay, Alexander C Li, Adrien Bardes, Suzanne Petryk, Oscar Mañas, Zhiqiu Lin, Anas Mahmoud, Bargav Jayaraman, et al. An introduction to vision-language modeling. 2024. doi: 10. 10.48550/ 2405.12777
Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In 2017 IEEE Symposium on Security and Privacy (SBP), pp. 39-57, 2017.
Dongping Chen, Ruoxi Chen, Shilin Zhang, Yaochen Wang, Yinuo Liu, Huichi Zhou, Qihui Zhang, Yao Wan, Pan Zhou, and Lichao Sun. MI..M-as-a-judge: Assessing multimodal L-M-as-a-judde with vision-language benchmark. In Forty-firs first International Conference on Machine Learning, 2024.
Wenhu Chen, Hexiang Hu, Xi Chen, Pat Verga, and William Cohen. MuRAG: Multimodal retrieval-augmented generator for open question answering over images and text. In Proceedings of the 2022 Conference Empirical Methods in Natural Language Processing, pp. 5558-55700 2022.
Pongzhou Chong, Yidong Ding, Tianjic Ju, Zongru Wu, Wei Du, Ping Yi, Zhuosheng Zhang, and Gongshen
Liu. Trojanrag: Retrieval-augnnenled generation can be backdoor driver in large language models. 2024.
doi: 10.48550/ artp/ariiivvii 2405
Giovanni Cherubin and Andrew Paverd. Highlight summarize: Rag without the jailbreaks. 2025. doi
10.48550/ar arv. Ww0.vv..500.0227777
Gheorghe Comanici, Eric Bieber, Mike Schaekermann, Ice Pasupat, Noveen Sachdeva, Inderjit Dhillon, Marcel Blistoin, Ori Ram, Dan Zhang, Evan Rosen, et al. Gemini 2.5: Pushing the frontier with advanced reasoning, multimodality, long context, and next generation agentic capabilities. 2025. doi: 10.48550/ Xiv www..iiv...20066 2507706621
Haodong Duan, Junming Yang, Yuxuan Qiao, Xinyu Fang, Lin Chen, Yuan Liu, Xiaoyi Dong, Yuhang Zang, Pan Zhang, Jiaqi Wang, el al. VLMEvalKit: An open-source toolkit for evaluating large multi-modality models. In Proceedings of the 32nd ACM International Conference on Multimedia, pp. 11198 11201, 2024a.
Haodong Duan, Junming Yang, Yuxuan Qiao, Xinyu Fang, Lin Chen, Yuan Liu, Xiaoyi Dong, Yuhang Zang, Pan Zhang, Jiaqi Wang, al. Vlmevalkit: An open-source toolkit for evaluating large multi-modality models. In Proceedings of the 32nd ACM international conference on multimedia, pp. 11198 11201, 2024b.
Manuel Faysse, Hugues Sibille, Tony Wi, Bilel Omrani, Gautier Viand, Céline Hudelot, and Pierre Colombo. Colpali: Efficient document retrieval with vision language models. In The Thirteenth Interna- tional Conference on Learning Representations, 2024. Colpali-v1.3 model source httpss///ugginnfface co/vidorre/colpaiivv1.. ViDoRe-VI-AT dataset source https://huggingfee httpa/accc.///ttttttt//iiooro test ViDoRe-V2-ESS dataset source https::/hugginggaac co/ co/fatassts//ioorr/rsstaaaaaaa _eg_rreerrrs_eeeeeeeeeee__e__s_e repirts_beirr
lan J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples.
2014. doi: 10.48550/ 11118550/ariv..li.. ax2i..112....1.
Xiangming Gu, Xiaosen Zheng, Tianyu Pang, Chao Du, Qian Liu, Ye Wang, Jing Jiang, and Min Lin. Agent Smith: A single image can jailbreak one million multimodal LLM agents exponentially fast. 2024. dois
10.48550/ar aiv::////Xiii220 200.00..20000066..
Hyeonjeong Ha, Qiusi Zhan, Jeonghwan Kim, Dimitrios Bralios, Saikrishna Sanniboina, Nanyun Peng, Kai-wei Chang, Daniel Kang, and Heng Ji. MMM:PoisoRRAG: Disrupting multimodal rag with local and global poisoning attacks. 2025. doi: 10.48550 250...25022.72.
Anwen Hu, Haiyang Xu, Liang Zhang, Jiabo Ye, Ming Yan, Ji Zhang, Qin Jin, Fei Huang, and Jingren Zhou. mplug-docowi2: Hesh-tosolution compressing for ocr-free multi-page document understanding. 2024. doi 10.48550/ 10.48550/arXiv ai..vv2499..32222
14

---

Published in Transactions on Machine Learning Research (03/2026)
Aaron Hurst, Adam Lerer, Adam P Goucher, Adam Perehman, Aditya Ramesh, Aidan Clark, AJ Ostrow, Akila Welihinda, Alan Hayes, Alec Radford, et al. GPT-4o system card. 2024. doi: 10.4
Soyeong Jeong, Kangsan Kim, Jinheon Back, and Sung Ju Hwang. Videorag: Retrieval-angmented generation over video corpus. 2025. doi: 10.48550/ar /a.5500/r .05874
Omar Khattab and Matei Zaharia. Colbert: Efficient and effective passage search via contextualized late interaction over BERT. In Proceedings of the 43rd International ACM SIGIR conference on research and development in Information Retrieval, pp. 39 48, 2020. doi: 10.1145/33991 03.14///3337771331000
Alexcy Kurakin, Ian J Goodfellow, and Samy Bengio. Adversarial examples in the physical world. In Artificial intelligence safely and security, pp. 99 112. Chapman and Hall/CRC, 2018.
Kevin Kurian, Ethan Holland, and Scan Oesch. Attacks and defenses against LLM fingerprinting. 2025. doi:
1148550/arriv... 20.22550800022
Aritra Kumar Lahiri and Qinmin Vivian Hu. Alzheimerrag: Multimodal retrieval augmented generation for pubmed articles. 2024. doi: 10.48550/ ar
Patrick Lewis, Ethan Perez, Aleksandra Piktus, Fabio Petroni, Vladimir Karpukhin, Naman Goyal, Heinrich Küttler, Mike Lewis, Wen-tau Yih, Tim Rocktäschel, et al. Retrieeallauummented generation for knowledge- intensive NLP tasks. Advances in neural information processing systems, 33:9459 9474, 2020.
Victor Weixin Liang, Yuhui Zhang, Yongchan Kwon, Serena Yeung, and James Y Zou. Mind the gap: Understanding the modality gap in multi-modal contrastive representation learning, Advances in Neural Information Processing Systems, 35:17612-17633 2022.
Haotian Liu, Chunyuan Li, Qingvang Wu, and Yong Jae Lee. Visual instruction tuning. Advances in neural information processing systems, 36:34892-34916,, 2023.
Yinuo Liu, Zenghui Yuan, Guiyao Tie, Jiawen Shi, Lichao Sun, and Neil Zhenqiang Gong, Poisoned-
MRAG: Knowledge poisoning attacks to multimodal retrieval augmented generation. 2025. doi 24445550/arXi..5533...
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards doep learning modcls resistant to adversarial attacks. 2017. doi: 10.48550/am (115550/arXi.II11 www....1.............
Andrés Marafioti, Orr Zohar, Miquel Farré, Merve Noyan, Elie Bakouch, Pedro Cuenca, Cyril Zakka, Loubna Ben Allal, Anton Lozhkov, Nouamane Tazi, Vaibhav Srivastav, Joshua Lochner, Hugo Larcher, Mathieu Morlon, Lewis Tunstall, Leandro von Werra, and Thomas Wolf. SmolVLM: Redefining small and efficient multimodal models. SmolVLM-Instre source SmolVVM--Insruuct, 2025.
htwp:///naaa...oogggionnnggggege co au//HuggigFaaceTB//
Leland McInnes, John Healy, and James Melville. UMAP: Uniform manifold approximation and projection for dimension reduction. 2018. doi: 10.48550/ar 11.48550/arXiv.1802...322 1802.03426
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow, Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference on computer and communications security, pp. 506-519 2017.
Dario Pasquini, Evgenios M Kornaropoulos, and Giuseppe Ateniese. LLMmap: Fingerprinting for large language models. In USENIX Security 25, pp. 299-318, 2025.
Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763 PmLR, 2021. Clip-ViT-LARGE source
Monica Riedler and Stefan Langer. Beyond text: Optimizing RAG with multimodal inputs for industrial applications. 2024. doi: /..65500/arXiv.244022144
15

---

Published in Transactions on Machine Learning Research (03/2026)
Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the RAG: Jamming retrieval-angmmeneed generation with blocker documents. 2024. doi: 10.48550/ar 00055000/Xii.22000557777 2406.05870
Saba Sturua, Isabelle Mohr, Mohammad Kalim Akram, Michael Günther, Bo Wang, Markus Krimmel, Feng Wang, Georgios Mastrapas, Andreas Koukounas, Andreas Koukounas, Nan Wang, and Han Xiao. jina- embeddings--33: Multilingual embeddings with task lora, 2024. URL /tttps://arxiv.oom www.aaiwwwwog/.///////.. 10173 Jina- Ehna-dmeedd V3 source
Zhen Tan, Chengshuai Zhao, Raha Moraffah, Yifan Li, Song Wang, Jundong Li, Tianlong Chen, and Huan Liu. glue pizza and eat rocks" eexploiexi vulnerabilities in retrieval-angmented generative models. 2024.
doi: 10.48550/arz arv. 240.
Peng Wang, Shuai Bai, Sinan Tan, Shijie Wang, Zhihao Fan, Jinze Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Yang Fan, Kai Dang, Mengfei Du, Xuancheng Ren, Rui Men, Dayiheng Liu, Chang Zhou, Jingren Zhou, and Junyang Lin. Qwen2-VIL VL: Enhancing vision-language model's perception of the world al any resolution. 2024. doi: 10.48550/arXiv.22 (11.0//9.....22.1119991 2409. Oveen2.5-VI-3B-IIsttrre source
https://hugginggn
Peng Xia, Kangyu Zhu, Haoran Li, Hongtu Zhu, Yun Li, Gang Li, Linjun Zhang, and Huaxiu Yao. RULE: Reliable multimodal rag for factuality in medical vision language models. In Proceedings of the 2024 Conference on Empiricul Methods in Natural Language Processing, pp.
2024.
Chong Xiang, Tong Wu, Zexuan Zhong, David Wagner, Danqi Chen, and Prateck Mittal. Certifiably robust 22005/00000...2...11155
RAG against retrieval corruption. 2024. doi:
Jinqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. BadRAG: Identifying vulnerabil- ities in retrieval augmented generation of large language models. 2024. doi: 10.44550/arXiv.22 www.Xii.220.00000 00083
Shi Yu, Chaoyue Tang, Bokai Xu, Junbo Cui, Junhao Ran, Yukun Yan, Zhenghao Liu, Shuo Wang, Xu Han, Zhiyuan Liu, et al. Visrag: Vision-based retrieval-augmented generation on multi-modality documents. 2024. doi: 48550 ww..i..211...00000
Jianhao Yuan, Shuyang Sun, Daniel Omeiza, Bo Zhao, Paul Newman, Lars Kunze, and Matthew Gadd. Rag-driver: Generalisable driving explanations with retrioval-angmented in-context learning in multi-modal large language model. 2024. doi: 10.48550/arxiv.220 24....0822
Xin Zhang, Yanzhao Zhang, Wen Xie, Mingxin Li, Ziqi Dai, Dingkun Long, Pengjun Xie, Meishan Zhang, Wenjie Li, and Min Zhang. GME: Improving universal multimodal retrieval by multimodal LLMs. 2024.
doi: 10.48550/ arxi 1615.
Lianmin Zheng, Wei-Lin Chiang, Ying Sheng, Siyuan Zhuang, Zhanghao Wu, Yonghao Zhuang, Zi Lin, Zhuohan Li, Dacheng Li, Eric Xing, et al. Judging LLM-as-a-judge with mt-bench and chatbot arena. Advances in Neural Information Processing Systems, 36:46595 46623, 2023.
Huichi Zhou, Kin-Hei Lee, Zhonghao Zhan, Yue Chen, Zhenhao Li, Zhaoyang Wang, Hamed Had- dadi, and Emine Yilmaz. Trustrag: Enhancing robustness and trustworthiness in RAG. 2025. doi:
10.48550/
/00/500//Xii..../. aiv. 25022000000
Jinguo Zhu, Weiyun Wang, Zhe Chen, Zhaoyang Liu, Shenglong Ye, Lixin Gu, Yuchen Duan, Hao Tian, Weijie Su, Jie Shao, al. InternVL3: Exploring advanced training and test-time recipes for open-source multimodal models. 2025. doi: 10.48550/am aar00//rXiiv220 2504.10410 InternVL3-2B source https://huggingfacc
co/OpendW.ab/IInerrv3333--
Shengyao Zhuang, Ekaterina Khramtsova, Xueguang Ma, Bevan Koopman, Jimmy Lin, and Guido Zuccon. Document screenshot retrievers are vulnerable to pixel poisoning attacks. 2025. doi
10.48550/ar 2501112620
Wei Zou, Rumpeng Geng, Binghui Wang, and Jinyuan Jia. PoisonedRAG: Knowledge corruption attacks to rotrioval-angmenneed generation of large language models. 2024. doi: 10.48550/ar arv XxXiv.2402.07887
16

---

Published in Transactions on Machine Learning Research (03/2026)
A Qualitative Attack Examples
In this section, we present qualitative demonstrations of the attacks. Examples of the universal White-bor Attack against the CLIP-ViT-LARGE embedding model and SmolVLM-Instruet VLM in Figure 2 and F Figure 3 for the VI-AA and MDDoReVV-FSS) datasets, respectively. Despite the success of the attack, the perturbed image is almost indistinguishable from the original.
souk Ashi
coul this
2.3
thes
divostmen tode,
bead waddy dicaree
to dererman tade, wide the boad seadly
the with mositie mander wrd back spedie ialeed Thow leporse the
on
tod spotl Three
Figure 2: An example of benign image from the ViDoRte-V-AAI Dataset (left) and its adversarially perturbed counterpart (right). Universal White-bor Attack against CLIP-ViT-LARGE, SmolVLMMInstrucc, R1
with perturbation intensity a 255
8 Result: ASR-R = 1 =1.
ENERGY
contnee mulute addioonl every
ENERGY
confine to mndatt abdiona
During
Durng 2011 ou abouus elctiiity user desped 2002
ropertattes take our enery
enery
deiggn
energy
which
Figure& 3: An example of benign image from the V2-ESG Dataset (left) and its adversarially perturbed counterpart (right). Universal White-box Attack against CLJP-VVT-LLAGE, SmolVT. with perturbation intensity 255 Result: ASR-R =0.82, ASR-G =1.
8
17

---

Published in Transactions on Machine Learning Research (03/2026)
Manually Labeling rrial Data in Vicon Nexus
VICON NEXUS: MANUAL TRIAL DATA LABELING
What the process for manually labeling trial data?
Manually match each marker to generic human template reagrdess of trial-specific subject calibration.
Captas Dria
2. Maner caraiicaionn
Memplaa
Manually match each marker to a generic human template regar-
(a) GPT-5: ASR-R t =1 and A Sim t =0.87.
(b) Gemini-2.5-Flash: ASR-R 1 =1 and ASR-G -0.70.
Figure 4: Two examples of successful malicious targeted Sctting Prompt-based attacks generated by (a) GPT-5 and (b) Gemini-2.55 2.5---5 applied to ZMEE-wwe22 VL-2B and SmolVLM-Inntrree
What is the process for manually labeling trial data in Vicon Nexus?
RAG KNOWLEDGE BASE MAGE: DUAL-CONCER CONCEPT INFOGRAPHIC
VICON NEAUS: MANUAL TRIAL EATA LABELING PROCESS
MICRWORT& & SAFTY AWAYSS
Manually match each marker to a generic human template regardless of trial-specific subject calibration.
MOKAMAE
LIRE TRANSPORATION POUCY
A micromort measures the number of accidents per million vehicles
Answer sallly yuah regeddos ti saqject ailoratie.
aicceaatiniiiano will an rar and tramppatatinnne pallos.
on the road and is used in transportation policy.
(a) GPT-5: ASR-R" 91 =0.5, ASR-R =1, and ASR- G--1- =0.85.
(b) Gemini-2.5-Flasshe ASR-R =0.5, ASR-R + =1, and ASR-G =0.84.
Figure 5: Two examples successful malicious targeted Setting 11I Prompt-based attacks generated by (a) GPT-5 and (b) Gemini-2.5-Flash, applied to ColPali-v1.3 and Qwwen..5-VLL3--Immm
Additionally, we show successful examples of images generated by the targeted /Stting Prompt- based Attack in Figure 4 Finally, we show successful examples of images generated by the targeted Setting III Prompt-based Atlack in iiuuee
18

---

Published in Transactions on Machine Learning Research (03/2026)
B Robustness of SoTA Embedding Models to Universal Attacks.
To further investigate the origin of the robustness of ColPali to poisoning attacks, we performed ablations on A metric of ColPali w.r.t. to dimensions: (i) the similarity metric used for retrieval and (ii) whether the model is prompted by text and image or only the images. We consider losses: (1) MarSim, which is the original metric used by Colpali, (2) AvgSim, which replaces the max operator by the average, (3) SoftMarSim, which replaces the max operator by softmax, and (4) CosAug, which computes the cosine similarity of the averaged token embeddings for both queries and images. Additional information about the MaxSim metric can be found in Appendix C Table shows the ablation results and shows that the loss function used is partly responsible for the robustness of ColPali. Changing the similarity measure would degrade robustness, however, it is not wholly responsible for the robustness of ColPali.
Table 7: Ablation results of the robustness of ColPali (ASR-R"") to universal VD-RAG poisoning attacks.
Context Type
MaxSim
AvgSim
Moft
CosAvg
Image + Text.
0.00
0.25
0.15
0.05
Image Only
0.00
0.25
0.05
0.05
C Embedding Space Visualizations
In this section, we present two-dimensional UMAP (Melnnes et al. images and user queries, employing the models
2018) visualizations of the embeddings for ColPali-v1.3, and GME-Qwen2-VL-22 VL-22,
and using the first. 100 samples from ViDoRe-VI-AI Faasse et al. in Figure 6a| Figure 6b] and Figure 6e| respectively. Notably, while CLIP- ViT-LARGE and GME- -wen- VL-2B produce a single normalized vector embedding for each image or query, ColPali-v1.3 generates one normalized vector embedding per token, resulting multiple vectors for each query and image. To effectively represent each query and image as singular point within the same UMAP coordinate space, we adopt symmetrized and normalized late interaction (MaxSim) distance metric for the UMAP visualization, defined
2024). The visualization are depicted
as
(Q,)( = x LI Q (の) (
xLI LI ( (1)
(6)
where Q and I are the sets of query and image embeddings generated by a query q and an image i, respectively, and LI is the late interaction (Faysse et al. 2024h defined as,
LI, = Σ max (F
JE(L.N,
:E[1:,N]]
where No and N2 are the number of vector embeddings in Q and 1, and ES and E/ represent these embeddings indexed by and j.
The figures show that, within the low-dimensional UMAP space, the image and text embeddings generated by CLIP-VIT-LAREE are distinctly clustered, whereas those produced by ColPali-v1.3 and GME-Qwen2-VI-2B do not exhibit clear clusters corresponding to queries and images. This distinction might explain why it is feasible to attack the CLIP- CLIP-VIT-LARGE model. It is possible to create artificial image that closely aligns with all queries, as its embeddings cluster in the same region. In Figure 6a we show such artificial attack images as purple circles. On the other hand, the ColPali-v1.3 and GME-Qwen2-VL VL-2B models lack a consolidated area that encompasses all queries, making it difficult, if not impossible, to generate an image that is in close proximity to all queries.
Additionally, in Figure 6b) and Figure 6c, using blue dashed lines, we highlight the query-image pairs where the nearest. neighbor of the query does not correspond to its true ground truth image. We find that such pairs are
19

---

Published in Transactions on Machine Learning Research (03/2026)
UMAP Vaudlsation of Clip Betzieval Sears, n.wiihhhrss,, misttts
15
5
0-
-5
10
Image Embeddings
Query Embeeddings
-15
15
-10
-5
10
(a)
Vicadisation ColPa's Retrirod Sevrs, nynighhars minglist001
Image Embeddings
8
Quory Embeedings
6-
4
2-
0-
-2-
6
8
10
(b) Co.
Figure 6: UMAP visualizations of the embeddings generated by CLIP-VIT-LARGE, ColPali-v1.3, and GME-Qwen2- VL-2B.
W-LE-QQen-VVL-BB.
20

---

Published in Transactions on Machine Learning Research (03/2026)
UMAP Visualisation Quen Retricoal Scores, neighborss distal.3t
Image Embeddings
Query Embeddings
8
6
4-
2
0
-2
-5
10
15
(c) GME-Qwen2- VL-2B
Figure 6: UMAP visualizations of the embeddings generated by CLIP-VIT-LARGE, ColPali-v1.3, and EMEEQwent Qwen2-VL-2B. VL-2B.
quite rare, and even when they do occur, they are typically situated close each other within their respective clusters. This observation may provide insights into why models like ColPali-v1.3 and GME- HOME-Qwen2-VLB VL-2B outperform models like CLIP-VIT-LAREE in retrieval tasks.
Effect of Perturbation Intensity
shows how the maximum adversarial perturbation affects attack success for VD-RAG system consisting of CLIP-VIT-LARGE and SmolVLM--nstrret. We observe that attacks can almost perfectly satisfy both the retrieval and the generation conditions starting from a 255 Therefore, in the rest of the paper, we consider only attacks with a 255 In Appendix we provide visual examples of the stealthiness of an attack with a = 255 The figure also shows very little difference between the performance on the training and test sets, demonstrating that the malicious image does not overfit to the training dataset.
Figure
E
Judge Prompts
The following details the utilized prompts for the VLM-as-a-Judge defense.
Answer Relevancy Prompt
Evaluate the following metric:
answer_relevancy: Is the answer relevant the user's query? (YES NO)
QUERY: [QWERY)
ANSWER: [ {
Write out in step by step manner your reasoning to be sure that your conclusion is correct by filling out the following JSON format with the grade and concise reason behind the grade:
(grade: 'reason': '}
Output the reason as a string, not as list. only allowed grades are YES or NO.
21

---

Published in Transactions on Machine Learning Research (03/2026)
CLIP-L + SmolVLM
ColPali SmolVLM
GME-Qwen2-VV-228 SmolVLM
0.6
0.2
ASR-R loust!
Artack Success
ASR. G HARD train)
ASR G HARD mest
Owen2.5-VL-38
GME-Qwen2-4L-28 Owen2.5-VL-38
SIM-G-GT (raint
1.0
0.6
0.2
1.0
8.0
16.
32.0
2.0
4.0
8.0
16.0
32.0
1.0
2.0
6.0
15.0 32.0
Maximum
Figure 7: Attack success rate as function of the perturbation intensity a.
Context Relevancy Prompt
Evaluate the following metric by comparing the user query with the provided image:
reeeeeee Is the content of the images relevant the user's query i.e. it contribute to answer the query? (YES or NO)
QUERY: [QUERY)
IMAGES: ( (IMAGES)
Write out step by step manner your reasoning sure that your conclusion correct by filling out the following JSON format with the grade and concise reason behind the grade:
(grade: 'reason': '}
Output the reason as a string, not as list. The only allowed grades are YES or NO.
Image Faithfulness Prompt
Evaluate the following metric by comparing the answer with provided images: faihe_faithfulless: Is the answer faithful to the content of the images, i.e. does it factually align with any of the images? (YES or NO)
GENERATED ANSWER: (ANSWER)
IMAGES: { (IMAGES)
Write out in step by step manner your reasoning be sure that your conclusion is correct by filling out the following JSON format with the grade and concise reason behind the grade:
(grade: 'reason': ''
Output the reason as a string, not as list. The only allowed grades are YES or NO.
F Prompt-based Attack Prompts
Below we show the details of the used prompts to generate black-box attacks using Gemini-2.8 1aminn-2.55-lase 5-Flash. We only show the prompt used to generate the attack for the targeted attack (Setting I). Prompts for the other attack variants (i.e., targeted Setting targeted [Sttting III and universal) are very similar.
Prompt-based Attack Prompt (Targeted Attack Setting
Consider RAG system with the knowledge base being images where each image corresponds PDF document page.
The knowledge base the vibprr/smheeettooooo.r.ffaaaaa.. het.aaarrrfiiiaiiiielleeeeeeeeee test dataset.
The RAG system uses opena//clip-vit-larg--pttte MuggiingFaceT///mmolu---ssss We would like to create image (does not have to look like document page) that will be added to the knowledge base, such that this image will retrieved whenever the RAG user asks the question
to compute embeddings of images and text, and vision language model (VLM) to generate answers.
22

---

Published in Transactions on Machine Learning Research (03/2026)
{ [QEERY); }. Moreover, when the image is retrieved, the correct answer to be generated by the LLM should be (ANSWER) }.
Can you generate this image using your image generation tool? Choose the image that would maximize the likelihood of achieving the objective.
G Results of Query Paraphrasing
Table and Table 9 show the targeted and universal attack performance, respectively, against the query paraphrasing defense.
Table 8: Targeted attacks against the query paraphrasing defence for the different embedding models and VLMs.
Models
Retrieval
Generation
Attack Type
ASR-G Sim
SIM-G
9-1 Neg +
Embedder
VLM
ASR-R
ASR-R
mean
max
mean
InternVL3-2BB
1.00
1.00
0.59
1.00
0.12
CLIP-L
Qwen2.5-3B
1.00
1.00
0.78
1.00
0.08
SmoIVLM
1.00
1.00
0.80
1.00
0.02
InternVL33-B
0.20
0.40
0.09
-..6
-0.02
White-boz
ColPali
Qwen2.5-3B
0.20
0.40
0.78
1.00
0.24
SmolVLM
0.20
0.60
0.21
1.00
0,00
InternVL3-22)
0.80
1.00
0.55
1.00
0.08
GME
Qwen2.5-3B
0.80
1.00
0.97
1.00
0.23
SmolVLM
0.80
1.00
0.79
1.00
0.00
Table 9: Universal attack against the query paraphrasing defence for the different embedding models and VLMs.
Models
Retzieval
Generation
Attack Type
Embedder
VLM
R1
4Recall
ASR-R#:
Recal ARecal
ASR-R 28
ASR-Ggm
SIM-G
meam
max
mean
InteroVL33-BB
0.17
-0.16
0.96
0.41
0.04
1.00
0.98
1.00
0.03
CLIP-L
Qwen2.5-31
-0.15
SmoIVLM
0.17
-0.15
0.93
0.41
-0.04
1.00
1.00
0.03
InternVLL3-2B
0.61
0.00
0.00
0.95
0.00
0.05
0.60
0.99
0.21
White: boz
ColPali
Qwen2.5-31
0.61
0.00
0.00
0.95
0.00
0.04
1.00
1.00
0.03
SmolVLM
0.95
0.00
0.08
1.00
InternVL3-2B
0.00
0.20
1.00
0.05
GME
Qwen2.5-3B
0.51
0.00
0.00
0.91
0.00
0.20
1.00
1.00
0.03
SmnlVLM
0.51
0.00
0.00
0.91
0.00
0.17
1.00
1.00
0.03
23

---

Published in Transactions on Machine Learning Research (03/2026)
H Results of the Prompt-based Attack on Targeted Setting III
Table 10 shows the complete results for the Prompt-based Attack for targeted Setting
Table 10: Full Performance of the targeted Prompt-based Attack against multiple queries and multiple answers Setting ITT)
Models
Retrieval
Generation
Attack Type
Embedder
VLM
ASR-R
ASR-R
ASR-G Sim
SIM-G
mean
mean
mean
InternVL3-2B
0.50
0.80
0.61
0.69
0.32
n/a
CLIP-L
Qwen2.5-3B
0.50
0.80
0.66
0.85
0.29
n/a
SmolVTM
0.50
0.80
0.64
0.71
0.32
n/a
InternVL3-2B
0.50
0.59
0.66
0.32
n/a
Prompt-based (Gemini)
ColPali
Qwen2.5-3B
0.50
0.80
0.69
0.84
0.29
n/a
SmolVLM
0.50
0.80
0.67
0.78
0.30
n/a
InternVL3-2B
0.50
0.70
0.31
n/a
GME
Qwen2.5-3B
0.50
0.50
0.68
0.82
0.29
n/a
SmoIVLM
0.50
0.50
0.71
0.32
n/
InternVL3-2B
0.40
0.40
0.74
0.79
0.30
n/a
CLIP-L
Qwen2.5-3P
0.40
0.40
0.82
0.89
0.29
n/a
SmoIVLM
0.40
0.40
0.77
0.87
0.32
n/a
InternVL3-2B
0.50
1.00
0.71
0.76
0.32
n/a
Prompt-based (GPT)
ColPali
Qwen2.5-3B
0.50
1.00
0.85
0.87
0.30
n/a
SmoIVLM
0.50
1.00
0.81
0.91
0.33
n/a
InternVL3-2B
0.50
0.76
0.31
n/a
GME
Qwen2.5-3B
0.50
0.60
0.83
0.87
0.30
n/a
SmoIVTM
0.50
0.60
0.77
0.84
0.33
n/a
Results of the HIDoRe-V2-ESS Dataset
Table 11 and Table 12 show the targeted and universal attack performance, respectively, for the ViDoRe-V2 V2-
ESG dataset.
Table 11: Targeted attacks against the ESG dataset for the different embedding models and VLMs.
Models
Retrieval
Generation
Attack Type
ASR-G&-
G8-14
SIM-G
Neg +
Embedder
VLM
ASR-R + ASR-R
mean
max
mean
InternVT.3-2B
1.00
1.00
0.79
1.00
0.10
CLIP-L
Qwen2.5-3B
1.00
1.00
0.81
1.00
0.09
SmolVLM
1.00
1.00
1.00
1.00
0.12
InternVL33-BB
1.00
1.00
0.46
1.00
0,10
White-boz
ColPali
Qwen2.5-3B
1.00
1.00
0.40
0.82
0.08
SmolVLM
1.00
1.00
0.42
1.00
0.11
InternVL3-22
1.00
1.00
0.78
1.00
0.09
GME
Qwen2.5-3B
1.00
1.00
0.97
1.00
0.09
SmolVLM
1.00
1.00
0.97
1.00
0.12
24

---

Published in Transactions on Machine Learning Research (03/2026)
Table 12: Universal attack against the ESG dataset across different embedding models and VLMs.
Models
Retrieval
Generation
Attack Type
Embedder
VLM
R RRvaall 4. ASR-R
Re AR
ASR-R f
ASR-G 1
SIM-G
mean
max
mean
0.13
-0.12
0.73
0.36
-0.01
0.98
1.00
1.00
0.05
CLIP-L
Qwen2.5.3B
SmolVLM
0.13
-0.12
0.71
0.36
-0.01
0.96
1.00
1.00
0.05
White: bozt
InternVL3-2B
0.48
-0.02
0.05
0.81
-0.01
0.05
0.68
1.00
0.21
ColPali
Qwen2.5-3B
0.48
-0.02
0.05
0.81
0.01
0.07
0.99
1.00
0.06
SmnlVLLM
0.48
-0.01
0.04
0.81
0.01
0.07
0.97
1.00
0.05
InternVL33-2B
0.46
-0.01
0.00
0.71
0.00
0.09
0.98
1.00
0.05
GME
Qwen2.5-311
SmolVLM
0.46
-0.01
0.00
0.71
0.00
0.13
1.00
0.05
25


Reviews:
[{"review_id": "XEj7HBgjVV", "reviewer": "Reviewer_CWyY", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper investigates the vulnerability of Visual Document Retrieval Augmented Generation (VD-RAG) systems to data poisoning attacks. Unlike text-based RAG, VD-RAG retrieves document screenshots directly. The authors demonstrate that injecting a single malicious image into the knowledge base is sufficient to compromise the system.\n\nKey contributions and findings include:\n\n- Defining two attack objectives for VD-RAG: Targeted Disinformation (affecting specific queries) and Universal Denial-of-Service (affecting all queries).\n\n- Adapting Projected Gradient Descent to a Multi-Objective optimization framework (MO-PGD) that simultaneously optimizes an image for retrieval (high similarity to queries) and generation (inducing specific VLM responses).\n\n- Testing the attacks across various settings (white-box vs. black-box), datasets (ViDoRe-V1-AI, ViDoRe-V2-ESG), and modern retrieval/generation models (CLIP, ColPali, GME, SmolVLM, Qwen2.5-VL).\n\n- VD-RAG is highly vulnerable to white-box poisoning.\n\n- Older embeddings (CLIP) are susceptible to universal attacks due to the modality gap, while newer interactions (ColPali) are more robust to universal attacks but still vulnerable to targeted ones.\n\n- Common defenses (Knowledge Expansion, VLM-as-a-judge, Paraphrasing) are largely ineffective against adaptive attacks.\n\n- Black-box attacks generally struggle, with the exception of prompt-based generation attacks in targeted settings.", "claims_and_evidence_yn": "Yes", "claims_explanation": "- Tables 1-4 clearly quantify the drop in performance (or success of attack) across different metrics when a poisoned image is introduced.\n- The paper meticulously dissects why certain models are robust. For instance, the UMAP visualizations (Figure 6) and ColPali ablations (Table 7) convincingly argue that the robustness of ColPali to universal attacks stems from its late-interaction mechanism and lack of a distinct modality gap, compared to CLIP.\n- The evaluation of defenses is not just a checkbox; the authors perform adaptive attacks (e.g., training against the judge), providing a realistic assessment of security risks.", "audience_yn": "Yes", "audience_explanation": "RAG systems are currently ubiquitous in deployed LLM applications. As the field moves toward Multimodal/Visual RAG to handle complex documents (PDFs with charts, figures), understanding the security surface of these new architectures is critical. This paper is timely as it highlights a specific vulnerability (visual poisoning) that does not exist in text-only pipelines, directly interesting researchers in adversarial ML, multimodal learning, and safety/security.", "requested_changes": "- The prompt-based attacks (using Gemini/GPT to generate images) are surprisingly effective in targeted settings compared to other black-box methods. Looking at Figure 4, the generated images contain visible text (e.g., \"Manually match each marker...\"). It would strengthen the paper to explicitly discuss if these attacks are successful primarily because they act as \"typographic attacks\"—exploiting the VLM's OCR capabilities—rather than adversarial perturbations in the pixel space. A brief comment on this distinction in Section 4 would provide valuable insight into why this baseline works.\n\n- The victim VLMs used (SmolVLM, Qwen2.5-VL-3B, InternVL3-2B) are relatively small (<4B parameters). While I understand the compute constraints for gradient-based attacks, please add a brief discussion or disclaimer in the Limitations section regarding whether you expect larger models (e.g., GPT-4V, Gemini 1.5 Pro) to exhibit similar vulnerabilities, particularly regarding the \"generation condition.\"", "broader_impact_concerns": "The paper exposes a method to poison RAG systems, which could potentially be misused. However, the authors have included a \"Ethics & Societal Impact\" section (Section 10) acknowledging this risk and framing the work as a necessary step for defense development. I believe this is sufficient and standard for adversarial ML papers. No additional changes are required here.", "additional_comments": "The paper is well-written and the experimental design is robust. The decomposition of the attack into \"Retrieval Condition\" and \"Generation Condition\" makes the analysis very clear.", "extra_scores": {}, "extra_text": {}}, {"review_id": "f6oVMXxgNZ", "reviewer": "Reviewer_TsaN", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper analyses knowledge base (KB) poisoning in visual document RAG (VD-RAG), where the KB consists of document screenshots, and retrieval is done using multimodal text-image embedding models. Specifically, authors analyse poisoning under \\emph{retrieval condition} (the poisoned document is retrieved for attacker-chosen queries); and \\emph{generation condition} (when in context, the VLM produces attacker-chosen content). They introduce two attack objectives with a single injected image: a \\emph{targeted disinformation} objective affecting a single query or a small set of related queries; and an \\emph{universal denial-of-service} (DoS) objective intended to affect any query. In their approach, authors adapt projected gradient descent (PGD) to multi-objective optimisation (MO-PGD) that combines a retrieval loss (increasing similarity to target queries while decreasing similarity to non-target queries) and a generation loss (cross-entropy for a target answer). Authors evaluate on ViDoRe datasets (V1-AI and V2-ESG) with three retrievers (CLIP-ViT-L, ColPali-v1.3, and GME-Qwen2-VL-2B) and three open-weights VLMs (SmolVLM, Qwen2.5-VL-3B, and InternVL3-2B) under both white-box and several black-box variants (prompt-based image generation, transfer, and model ensembles); they also evaluate common defence mechanisms (knowledge expansion, VLM-as-a-judge, and query paraphrasing) and via several analyses and ablations discuss why CLIP seems to be significantly more vulnerable to the universal objective than ColPali/GME.\nThis paper is both extremely timely and practically relevant -- VD-RAG is increasingly deployed in industry, and KB poisoning has mainly been explored in text-only settings. The experimental insights are very interesting, e.g., due to the clear decomposition of the poisoning success into retrieval+generation, the exhaustive sweeps (datasets, retrievers, VLMs, attack variants, defence mechanisms..), and the simple but effective MO-PGD objective.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The paper shows that VD-RAG systems can be poisoned with a single image, especially under white-box settings, and that the generation component can be very sensitive once a malicious image is in context. The paper also shows that universal poisoning is significantly harder and largely limited to CLIP-like retrieval modules.", "audience_yn": "Yes", "audience_explanation": "Anyone interested in VLMs and security/safety will likely find this paper interesting.", "requested_changes": "In the evaluations, it would be extremely valuable to have more decision-based success measures (vs embedding similarity).", "broader_impact_concerns": "I don't think this paper raises ethical concerns.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "T4D99qKgnT", "reviewer": "Reviewer_DS4G", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper studies poisoning attacks on VD-RAG systems and shows that injecting a single malicious image in the knowledge base can be enough to compromise both retrieval and generation. The attacks can be used to generate two malicious behaviors -- spreading targeted misinformation or DOS.\n\nIt glues together existing methods of creating malicious images (PGD with a multi-objective loss) and applies it to attack retrieval and generation, which is novel.\n\nThe work includes meaningful negative results (e.g., limited transfer of attacks and black-box effectiveness in some settings) and thorough ablations that clarify when and why attacks succeed. It explores a wide range of attack scenarios (white-box, black-box), defenses, datasets, and model combinations, which is a huge strength of this work. However, the study is limited primarily to small VLLMs with under 4B parameters.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Yes. The main claim is that VD RAG systems are vulnerable and the authors have done a great job at putting together several ablations on what works when. They have also added negative results to help the readers understand when the attacks and defenses fail. \n\nAttack settings include targeted and universal poisoning, with variations across white-box and black-box assumptions, showing that attacks are highly effective in white-box and targeted settings but degrade significantly in black-box and universal cases.\n\nDefenses include knowledge expansion, VLM-as-a-judge, and query paraphrasing, showing they are only partially effective and can be bypassed by adaptive attacks.\n\nAll of which are supported by experiments on prominent embedding models and small scale VLLMs.", "audience_yn": "Yes", "audience_explanation": "Yes, the paper shows that VD RAG systems are vulnerable to single image poisoning, highly relevant read given that a lot of RAG systems today are built on PDF systems. The methodological contribution of adapting MO-PGD framework specifically for RAG pipelines is also interesting. Plus, backing most claims with extensive empirical ablations make it a good read.", "requested_changes": "It would be nice to call out that these experiments and claims are limited to small-scale RAG systems as the VLLMs they deal with are all small scale VLLMs and not all VLLMs. Alternatively, it would be helpful to include some experiments with more powerful VLLMs of varying sizes and see if they also have similar robustness issues.", "broader_impact_concerns": "It would be helpful to add one since this work exposes techniques to poison RAG systems. This should include ethical considerations and potential misuse.\n\nSeveral other TMLR publications that showcase attacks include such a statement -- https://openreview.net/pdf?id=Lvy5MjyTh3, https://openreview.net/pdf?id=MlUP5Euj6S, https://openreview.net/pdf?id=2ekgTdBOZo", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "aS3BqdhBOx", "reviewer": "Reviewer_xySe", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "Firstly, I’m sorry for my late review. It was an unusual week for me.\n\nThe retrieval augmented generation (RAG) is a VLM text generation setting in which the model is conditioned on a knowledge base to generate more grounded responses. In the scenario that this paper considers, the knowledge base consists of a number of images, and the VLM uses the top-k images that are closest to the user query in a joint embedding space.\n\nWhat this paper shows is that this setting can be disrupted by both white-box and black-box attacks by injecting only a single image. The paper presents two types of attacks. In the first one, the attack aims to spread misinformation (or disrupt the system) on a targeted group of user queries. In the second, the disruption happens regardless of the user query (i.e., universal). The attack is based on updating the injected image with projected gradient descent (PGD) to maximize both its retrieval probability and the generation of malicious output when conditioned on that image. The attacker knows the embedding model in white-box attacks, and thus, can do PGD on it, whereas in black-box attacks, the attacker relies on surrogate models to compute gradients. Lastly, the paper employs several well-known defense techniques, though these are not specialized for the RAG attacks defined in the paper.\n\nThere are extensive experiments for each of these scenarios and their subcases with multiple VLMs, showing that these attacks are indeed realizable in some visual document retrieval datasets.", "claims_and_evidence_yn": "Yes", "claims_explanation": "The claims are clearly supported by extensive experiments on multiple datasets with several models. Metrics make sense.", "audience_yn": "Yes", "audience_explanation": "The topic would definitely be of interest to some people in the machine learning community, more specifically, to those focusing on adversarial attacks (and defenses) on VLMs, and to people who study ethics in the context of large models.", "requested_changes": "I think the paper is already in a very good shape. It motivates the problem and clearly sets out the setting. Methods are well-defined. I didn't catch any ambiguity in the text. Below are some small things you might consider for future versions.\n\n- I would omit the human head depiction in Figure 1 for VLMs—might be confused with some user-related things.\n- It’s a small thing but, in Equation 2, why do we subtract from 1? Won’t $\\Sigma_{i=1}^{\\mathcal{Q}^{-}} S(E(q_i^{-}), E(I’)) - \\Sigma_{i=1}^{\\mathcal{Q}^{+}} S(E(q_i^{+}), E(I’))$ look simpler?\n\nThis is a bit more important than the above two:\n- It’s somewhat surprising to me that prompt-based black-box attacks are quite successful, considering that we don’t have any access to the model, which is a bit concerning (not for the paper, of course, but as a broader impact) since this is rather a likely scenario. This also makes me question the overall efficiency of gradient-based attacks; they are probably overfit to the target model, and these prompt-based attacks seem to be more generalized. This might be worth mentioning earlier in the text, maybe in the introduction. I'm not saying that this has to be included, but you might consider whether that's worth it.", "broader_impact_concerns": "Although there's an ethics and societal impact section in the appendix, I think this should be moved to the main section, given the topic of the paper. It's a study that can be easily read, and has the potential to be read by broader audience. You might even consider expanding the discussion on white-box and black-box scenarios, but I leave the decision to you.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)