Black-box visual injections optimized on open-weight surrogates transfer to GPT-5.5 and Gemini-3.1-Pro at 43–46% retained ASR

Auto-published from arXiv:2609.04533 by the mine-arxiv pipeline. Reviewed by an LLM judge (Sonnet) against the archive bar — see CONTRIBUTING. Notes: cleared review (confidence 0.83, flags: [possible-zero-day, no-prompt-excerpt]) ⚠ needsDisclosureReview = true — review for undisclosed vulnerability before any public submission.

Category

indirect-prompt-injection

Model

GPT-5.5, Gemini-3.1-Pro (victims); Qwen3.6-27B, Qwen3-VL-32B-Instruct, InternVL3.5-38B-Instruct (surrogates)

Surface

VLM API (black-box commercial access)

Setup

Injections (image-rendered prefix instructions) are optimized entirely against open-weight surrogate models without any API access to the commercial victim. The optimized injected images are transferred to GPT-5.5 and Gemini-3.1-Pro without modification. A separate cross-sample transferability experiment tests whether injections optimized on one set of DocVQA images transfer to different images on the same commercial models.

Reproduction anchor

benchmark: DocVQA validation split (first 100 images); surrogate models: Qwen3.6-27B, Qwen3-VL-32B-Instruct, InternVL3.5-38B-Instruct; victim models: GPT-5.5, Gemini-3.1-Pro; AgentDojo + InjecAgent tool definitions; no code repository released

Observed behavior

Transferred injections retain 43–46% of the original ASR on commercial victims (e.g., ~40–45% absolute ASR where open-weight surrogate ASR was ~90–100%). Cross-sample transferability (different user prompts and images) retains 64–66% of ASR on the same commercial models. By contrast, gradient-based transfer baselines (ARE, CoTTA) achieve 0% ASR.

Expected behavior

Injections optimized on a different model family should not meaningfully transfer to production commercial VLMs, particularly for format-sensitive malicious tool calls.

Reproducibility

medium

Threat model

An attacker with no commercial API budget can optimize injections locally against free open-weight models and deploy them against production commercial VLMs, dramatically lowering the cost and detectability of attack campaigns. Targeted entities include any VLM-powered production service that ingests user-supplied or third-party images.

Novelty

First demonstration of practically exploitable black-box transfer (43–46% retained ASR) from open-weight surrogates to GPT-5.5/Gemini-3.1-Pro for visual prompt injection, establishing that commercial API access is not required to mount effective attacks.

Source

• arXiv: 2609.04533
• PDF: https://arxiv.org/pdf/2609.04533
• Categories: cs.CR, cs.AI
• Authors: Sizhe Chen, Yu-Lin Tsai, Ivan Evtimov, Kamalika Chaudhuri, Raluca Ada Popa, David Wagner, Arman Zharmagambetov

Triage notes (auto)

• paperType: red-team-vuln
• estimatedCaseCount: 3
• triage reason: Presents novel black-box visual prompt injection attacks achieving 80%+ ASR on frontier VLMs (Qwen3.6-27B, GPT-5.5) with reproducible failures: PII extraction, malicious tool calls, real-world OpenClaw agent exploitation (TOOLS.md overwrites). Submitted today against current-generation models without disclosed prior vendor notification.

─────────────────────────────────────────────────────────────────────