Why it matters
NVIDIA's AI Red Team updates classical classifier-evasion methods for vision-language models, showing how projected-gradient attacks can target arbitrary generated tokens and how adversarial patches can survive realistic transformations. The article walks through threat-model choices, SigLIP and PaliGemma mechanics, optimization objectives, and defenses such as input and output filtering, adversarial training, and Expectation over Transformation for physical-world robustness.
My takeaway: Evaluate the entire multimodal pipeline, not only the base model: define which pixels an attacker controls, test imperceptible and localized or physical patches against the actual tokenizer and decoding path, vary transformations, and include layered sanitization and adversarial training in regression tests.