Laundering AI Authority with Adversarial Examples

Jie Zhang, Pura Peetathawatchai, Florian Tramèr, Avital Shafran

Keywords: transfer attack, vision-language models

TL;DR: We demonstrate that visual adversarial examples have evolved into a practical security threat enabling "AI authority laundering," where we can manipulate an AI system's visual perception to produce authoritative, yet incorrect outputs.

Abstract:

Vision-language models (VLMs) are increasingly deployed as trusted authorities---fact-checking images on social media, comparing products, and moderating content. Users implicitly trust that these systems perceive the same visual content as they do. We show that adversarial examples break this assumption, enabling \emph{AI authority laundering}:
an attacker subtly perturbs an image so that the VLM produces confident and authoritative responses about the \emph{wrong} input.
Unlike jailbreaks or prompt injections, our attacks do not compromise model alignment; the attack operates entirely at the perceptual level.
We demonstrate that standard attacks against publicly available
CLIP models transfer reliably to production VLMs---including
GPT-5.4, Claude Opus~4.6, Gemini~3, and Grok~4.2. Across four attack
surfaces, we show that authority laundering can amplify misinformation, disparage individuals, evade content moderation, and manipulate product recommendations. Our attacks have high success rates: In hundreds of attacks targeting identity manipulation and NSFW evasion, we measure success rates of $22 - 100\%$ across six models. No
novel attack algorithm is required: basic techniques known for over a decade suffice, establishing a lower bound on attacker capability that should concern defenders. Our results demonstrate that visual adversarial robustness is now a practical---and still largely unsolved---safety
problem.

Track: Regular Paper (9 pages)

Email Sharing: We authorize the sharing of all author emails with Program Chairs.

Data Release: We authorize the release of our submission and author names to the public in the event of acceptance.

Submission Number: 193