ECCV2026 AI Safety AI paper notes paper summaries Adversarial Robustness Multimodal/VLM Federated Learning Alignment/RLHF Video Generation

🛡️ AI Safety¶

🎞️ ECCV2026 · 44 paper notes

📌 Same area in other venues: 🧠 NeurIPS2026 (2) · 📷 CVPR2026 (145) · 🔬 ICLR2026 (141) · 💬 ACL2026 (5) · 🧪 ICML2026 (114) · 🤖 AAAI2026 (45)

🔥 Top topics: Adversarial Robustness ×18 · Multimodal/VLM ×4 · Federated Learning ×3 · Alignment/RLHF ×2 · Video Generation ×2

Scaling Laws for Black-box Adversarial Attacks: After mitigating gradient conflict among surrogate models, visual adversarial transfer success grows approximately linearly with the logarithm of ensemble size within a finite regime, a conditional empirical relationship examined on classifiers, defended models, and multimodal models.
Contextual Image Attack: How Visual Context Exposes Multimodal Safety Vulnerabilities: CIA rewrites a harmful query into a visually coherent scene — a teaching demonstration on a blackboard, steps along a roadmap, an entry in a paper, a comic dialogue panel — so that a multimodal large language model mistakes the harmful content for a routine task to complete, reaching attack success rates of 86.83% on GPT-4o and 91.02% on Qwen2.5-VL-72B.
Stealthy Multi-task Adversarial Attacks: The paper proposes SMTA2, which casts "degrade one task of a multi-task model while leaving the other tasks intact" as a constrained multi-objective optimization problem, relaxes it into an ordinary first-order iterative attack via a weighted loss with positive weights on the targeted task and negative weights on the non-targeted tasks, and resolves the remaining weight-selection difficulty with an per-iteration automated weight search; on NYUv2 and Cityscapes it degrades the targeted task heavily while holding non-targeted tasks at their clean baselines, on both undefended and adversarially trained models.
SPQR: A Multi-Dimensional Benchmark for Safety Alignment under Benign Model Adaptation: SPQR formalizes post-deployment benign fine-tuning as an unintentional attack and turns it into an evaluation axis, combining four normalized metrics — Safety, Prompt adherence, Quality and Robustness after fine-tuning — into a single harmonic-mean score; benchmarking 11 safety-alignment methods on SD v1.5/XL/v3 exposes a "utility rises while safety silently collapses" failure mode that single-axis benchmarks cannot see.
Unsafe by Reciprocity: How Generation–Understanding Coupling Undermines Safety in Unified Multimodal Models: This paper treats the reciprocity between understanding and generation in Unified Multimodal Models (UMMs) as a structural attack surface, and proposes RICE — a framework that needs no external model and no gradient optimization, shipping unsafe intermediate signals along the internal G→U and U→G loops to reach the highest ASR on five jailbreak benchmarks and three unsafe-image-generation benchmarks (89.62% / 92.69% on AdvBench for Bagel / Janus-Pro-7B).
A Classifier-Agnostic Zero-Shot Adversarial Attack Detection via CLIP: Proposes A4D, a completely black-box, zero-shot adversarial attack detection framework. By exploiting the sensitivity of CLIP to micro-perturbations, the framework compares the cosine similarity of image embeddings with a set of carefully crafted text prompts, and then aggregates them into a single detection score via PCA. This detects adversarial examples without needing to know the attack type or classifier architecture, achieving SOTA performance across multiple attacks, datasets, and classifiers.
Adversarial Attack and Disturbance Detection by Hadamard-Coded Output Representations for Object Detection and Semantic Segmentation: HadamardNet replaces conventional class outputs with redundant codewords and uses probability-simplex projection to produce both class probabilities and an inconsistency residual, enabling single-pass perturbation detection without guaranteeing that predictions on disturbed inputs are correct.
Anti-Prompt: Image Protection against Text-Guided Image-to-Video Generation: Anti-Prompt protects an owner's images with small perturbations that weaken text conditioning, increase the relative dominance of visual pathways, and disrupt image encoding; on white-box CogVideoX evaluation, its video assessment average is 3.25 versus 3.92 for reproduced I2VGuard, where lower scores indicate stronger protection.
Capacity Overflow: A Blind Spot for Backdoor Attacks in Vision MoE: This paper uncovers that the token dropping mechanism in Vision Mixture-of-Experts (Vision MoE), governed dynamically by batch size and capacity factor, constitutes an overlooked attack surface, and proposes the first load-conditioned supply-chain backdoor that stays dormant during small-batch audits and achieves high activation success under large-batch deployment.
Defending from GeoLocalization through Adversarial Road Trips: This paper introduces RoadTrip Attack (RTA), an adversarial defense method against retrieval-based visual geolocalization that reconceptualizes the attack as finding an optimal journey composed of intermediate geographic targets, utilizing adaptive-radius sampling and beam search to achieve state-of-the-art targeted deception and black-box transferability at minimal perturbation budgets.
Exploiting Local Flatness for Efficient Out-of-Distribution Detection: This paper provides the first systematic analysis of the difference in loss landscape curvature between OOD and ID samples, discovering that OOD inputs exhibit larger Hessian curvature which increases as the distribution shift intensifies. Based on this, a lightweight OOD detector, Fold, is proposed, which replaces expensive parameter-space curvature approximations with a feature-space Hessian. This is paired with partial feature normalization to enhance ID-OOD separability, and a self-supervised logit masking scheme (AutoFold) is introduced to automatically calibrate the normalization parameter. Fold achieves an average AUROC improvement of 1.63% and a 2.30% reduction in FPR95 across multiple benchmarks, with a computational overhead comparable to a single forward pass.
GeoDetect: Geometric Adversarial Detection for VLPs: Addressing the vulnerability of vision-language pre-trained models (VLPs) to multimodal adversarial attacks and the prohibitive cost of adversarial training, GeoDetect investigates the anisotropic geometry of VLP embeddings, theoretically demonstrates that adversarial examples inevitably deviate from clean manifolds with increased expected geometric distances, and employs lightweight geometric metrics (LID, k-NN, Mahalanobis, KDE) to achieve highly accurate, fine-tuning-free adversarial detection across multiple architectures and tasks.
GeoMix: Descriptor-Free Visual Localization via Global Context and Multi-Detector Training: Addressing the insufficient discriminability and detector overfitting of geometry-only matching in descriptor-free visual localization, GeoMix integrates local directional/distance geometric embeddings, learnable global context nodes, and a multi-detector mix-training strategy to deliver high-precision 2D-3D correspondence matching and 6-DoF camera pose estimation while preserving privacy and minimizing map storage.
Improving Adversarial Robustness via Activation Amplification and Attenuation: This paper proposes A3 (Activation Amplification and Attenuation), a lightweight learnable activation scaling module that implements two modes—activation amplification and attenuation—using the same set of parameters. During training, the degraded predictions from the amplification mode are utilized as negative references to construct contrastive and ranking losses. During inference, only the attenuation mode is employed to enhance adversarial robustness without introducing significant computational overhead.
IREU: Identity-Related Encoder-Only Unlearning for Customized Portrait Generation: IREU introduces the identity unlearning problem for Customized Portrait Generation (CPG) for the first time. By leveraging Face-Swap to localize identity-related dimensions in the embedding space and executing feature perturbations strictly along these dimensions, it establishes an unlearning pipeline that only updates the image encoder to erase target identity generation capabilities while preserving the fidelity of other identities. Furthermore, the unlearned encoder can be transferred to different CPG generators with zero fine-tuning.
LangLoc: “Tell Me What You See”: LangLoc is the first indoor localization pipeline that estimates an observer's 2D floor position and heading direction directly from natural language descriptions without any camera images, combining dual-branch GATv2 scene retrieval, ray-cast visibility floor scoring, and an interactive Bayesian dialog module to achieve sub-meter median accuracy.
Moiré Video Authentication: A Physical Signature Against AI Video Generation: This paper proposes using moiré interference patterns as a physical signature to authenticate video authenticity: a compact double-layer grating structure is placed in the shooting scene, and the Pearson correlation coefficient between the fringe phase change and the translational displacement of the grating image is calculated to distinguish real videos from AI-generated ones. In real videos, these two are strictly coupled by the laws of optical geometry (mean correlation coefficient of 0.87), whereas even the strongest current video generation models (Veo 3.1, Grok Imagine, LTX-2) fail to precisely reproduce this coupling even under optimal configurations (mean correlation coefficient of 0.57, Cohen's d of 1.71, indicating highly significant differences).
On the Plasticity Collapse in Continual Machine Unlearning: This paper uncovers and theoretically characterizes the fundamental phenomenon of "plasticity collapse" in continual machine unlearning, demonstrating that sequentially accumulating geometric constraints in parameter space causes operator-product expansion that generically forces forward failure (diminishing forgetting efficacy) and backward failure (spontaneous re-memorization).
Preserving Knowledge across Space and Time for Continual Video Deepfake Detection: Addressing catastrophic forgetting caused by entangled spatial and temporal forgery artifacts in continual video deepfake detection, this paper proposes Modality-Specific Frequency Distillation (MSFD), which decomposes features into spatial, temporal, and spatiotemporal spectra with adaptive masking and cross-modality decorrelation, substantially outperforming prior SOTA methods across diverse incremental benchmarks.
ProtoFair: Fair Self-Supervised Contrastive Learning via Pseudo-Counterfactual Pairs: ProtoFair proposes a plug-and-play fairness regularization term. Without modifying existing self-supervised contrastive learning objectives, it discovers "same semantic content but different sensitive group" pseudo-counterfactual pairs via momentum-updated unsupervised clustering prototypes. By pulling these cross-group samples closer in the embedding space, it forces the encoder to learn representations invariant to sensitive attributes. When paired with SimCLR / SupCon / BarlowTwins / BYOL, it significantly reduces Equalized Odds on CelebA, UTKFace, and NIH Chest X-rays while maintaining competitive accuracy.
Ranked Activation Shift for Post-hoc Out-of-Distribution Detection: Addressing the failure modes of existing scaling- and pruning-based post-hoc activation editing methods on non-rectified architectures (ConvNeXt, ViT) and their dependence on hyperparameter tuning, RAS proposes a hyperparameter-free plug-and-play method that replaces sorted penultimate-layer activations with a fixed in-distribution reference profile, aligning global feature histograms and compressing score variance while preserving in-distribution accuracy.
Robustness Meets Uncertainty: Evidential Adversarial Training for Robust Selective Classification: To address the pervasive issue where standard adversarial training degrades uncertainty ranking and induces confident misclassifications, this paper proposes Evidential Adversarial Training (EV-AT), which constrains Dirichlet predictive representations in log-concentration space to shift the Pareto frontier of robustness and selective risk.
RoME: Robust Mixture of Low-Rank Experts against Multiple Adversarial Perturbations: To overcome the cross-threat robustness trade-offs and routing collapse in Multi-Perturbation Adversarial Training (MAT), RoME decouples threat-common representations into a shared backbone and threat-specific features into low-rank experts, guided by dual-scale gating and gating diversification to achieve state-of-the-art union robustness and natural accuracy.
Seeing Through the Weights: Privacy Leakage in Scene Coordinate Regression: Disproves the widespread assumption that Scene Coordinate Regression (SCR) models are inherently privacy-preserving by introducing a query-based attack that reconstructs accurate 3D scene geometry and visual appearance using only unrelated proxy images.
AracNet: Revealing Debiasing Signals across Layers with Shallow Monitors: AracNet trains shallow monitors on a frozen biased classifier, selects the layer whose ground-truth confidence distribution best exposes bias, and reweights training of a reinitialized classifier, reaching \(91.27\pm0.56\%\) worst-group accuracy on Waterbirds without relying on a narrowly timed early-stopping point for bias mining.
Breaking Rigidity in Adversarial Patch Attacks: Addressing the pervasive reliance on rigid geometric shapes (such as squares and circles) in existing adversarial patch attacks and defenses, this paper proposes SmuDPatch—a universal smooth deformable adversarial patch generation framework utilizing centripetal Catmull-Rom splines and a two-stage evolutionary search—which demonstrates strong cross-architecture transferability across CNNs, ViTs, and VLMs, while exposing critical blind spots in state-of-the-art defense detectors.
COLA: Continual Orthogonal Low-Rank Adaptation for Class-Incremental Learning: To eliminate unbounded parameter growth and heavy replay storage in class-incremental learning, COLA introduces a rehearsal-free continual learning framework that tracks principal feature covariance structures online via an Oja-inspired learning rule and dynamically projects novel task representations onto complementary orthogonal subspaces within a shared, fixed-capacity LoRA adapter.
Compositional Non-Face Re-Identification Pressure under Cumulative Vision Releases: Addressing the flaw where conventional vision privacy audits evaluate isolated static disclosures while neglecting cumulative leakage from evolving data, model weights, and retrieval indices, this paper formalizes compositional non-face re-identification risk, proposes the Vision Re-Identification Pressure Index (\(\text{vRPI}_\alpha\)) derived from Arimoto conditional Rényi entropy, proves its monotonicity and operational guessing bounds, and empirically demonstrates sustained non-face leakage across cumulative release stages on Market-1501-Tau and CUHK03-Tau.
Data-Free Client Contribution Estimation via Logit Maximization for Federated Learning: Addressing the challenge of evaluating client contributions under severe non-IID label skew without raw data, auxiliary validation sets, or self-reported metadata, CELM probes client models via server-side class-level logit maximization, builds a debiased evidence matrix with relative share normalization, and accurately rewards rare-class holders (Mavericks) while penalizing free-riders.
Data-Free Client Contribution Estimation via Logit Maximization for Federated Learning: Addressing the challenge of evaluating client contributions under severe non-IID and label skew conditions without accessing raw data, validation sets, or self-reported metadata, this paper proposes CELM (Contribution Estimation from Logit Maximization), which probes client models via class-wise logit maximization, de-biases evidence against a global baseline, and normalizes class shares to fairly reward informative rare-class holders (Mavericks) while suppressing non-contributing free-riders.
Distribution-Aware Feature Selection for Post-hoc Out-of-Distribution Detection: Addressing the issue that post-hoc feature-based out-of-distribution (OOD) detectors treat all high-dimensional feature dimensions uniformly, this paper introduces a distribution-aware marginal feature selection strategy (MFS) via the Wasserstein-1 distance using cross-domain mixup proxy data, consistently enhancing detection performance while drastically slashing inference latency without model retraining.
Gradient sparsity regularization for training unlearning-compatible models: Addressing the severe performance gap in approximate machine unlearning and the theoretical barrier of cumulative curvature in unrolling SGD, this paper proposes adding an \(\ell_1\)-norm gradient regularizer during pre-training to minimize worst-case loss sharpness, producing flatter optimization trajectories and yielding models that are inherently unlearning-compatible while dampening backdoor gradient spikes.
If It's Not Efficient, It's Not Usable: Real-Time OOD Detection with Latent De-Biasing and High-Quality Negative Samples: Addressing resource-constrained edge devices, this paper introduces an unsupervised VAE-based on-device real-time OOD detection framework that internalizes pixel-intensity de-biasing into the latent space during training and generates feature-aligned hard negative samples, surpassing prior accuracy-SOTA at only ~35 MFLOPs and 0.12 ms latency.
Improving Adversarial Robustness by Mitigating Instability through Relearning: Addressing severe robust overfitting where adversarial training degrades sharply after learning rate decay, this paper reveals the counterintuitive phenomenon of robust instability across adjacent training epochs, formalizes it via the Robust Stability Rate (RSR), and proposes Relearning Adversarial Training (RAT) to establish a new min-max dynamic with temporal ensembling soft labels that eliminates overfitting without extra models.
Indelible Backdoors: On the Limits of Post-Training Defenses: By identifying task-critical neurons via Fisher Information and explicitly maximizing the gradient cosine similarity between backdoor and clean samples on these parameters, this paper presents an indelible backdoor attack that forces fine-tuning and pruning defenses to destroy clean accuracy whenever they attempt to suppress backdoor effects.
Leveraging Dark Knowledge for Intrinsic Multimodal Out-of-Distribution Detection: This paper proposes a Self Multimodal OOD Distillation framework that translates dark knowledge from unimodal experts' logits into likelihood-weighted uncertainty-aware soft targets and supervises a shared joint classification head via decoupled distillation, substantially strengthening intrinsic multimodal OOD detection without retraining heavy backbones.
One Trap to Block Them All: Defending Encoder Stealing via Isotropic Uniformity: Addressing advanced contrastive model stealing attacks against self-supervised encoders deployed as Encoder-as-a-Service (EaaS), UniTrap introduces a single-module active geometric perturbation based on a Gaussian potential function. By strictly enforcing an isotropic, uniform feature distribution on the unit hypersphere, it mathematically forces the attacker's contrastive optimization gradients to cancel out in the tangent space, inducing gradient vanishing and stalling surrogate training while preserving high target utility.
Proteus: Model Leakage-Induced Adversarial Attack in Federated Learning: Addressing the overlooked vulnerability stemming from federated learning's requirement to broadcast intermediate models in plaintext, this paper proposes Proteus to generate temporally persistent adversarial examples that bypass subsequent training dynamics, achieving an 85.40% attack success rate on the final deployed model even with a model leaked after only 30% of training rounds.
ReTarget: Representation Transformation via Adversarial Regularization for Geometric Misalignment: Addressing the vulnerability of edge-cloud split inference (SI) to data reconstruction attacks (DRA) that recover sensitive raw inputs from transmitted intermediate activations, ReTarget shifts away from traditional information suppression assumptions and proposes a lightweight residual transformation with adversarial regularization and class-prototype guidance, perturbing the predictable local geometric organization of representations while preserving downstream utility.
Rethink Backdoor Robustness in Vision Transformers: This paper demonstrates that previous claims regarding Vision Transformers' susceptibility to backdoor attacks and vulnerability to defense collapse stem from flawed defense adaptations; after aligning optimizers and pruning granularity, standard attacks are easily neutralized, leading the authors to propose CAT—an enhanced attack that suppresses trigger channel activation discrepancies to bypass post-training defenses.
Revisiting Deepfake Detection: BCNet for Robust Generalization Beyond Semantic Dependence: Addressing the severe semantic bias where Vision Foundation Models (VFMs) over-rely on high-level category semantics rather than intrinsic synthesis traces, this paper proposes the Basis Correction Network (BCNet) that asymmetrically applies Attention-Guided Semantic Erasure and Normalized-Gradient Perturbation Enhancement to fake samples, achieving 96.7% generalization accuracy on the real-world WildRF benchmark.
SRRA: Stable-Rank-Based Residual Adaptation for Generalizable Deepfake Detection: Addressing the generalization bottleneck caused by rigid uniform residual rank assignment across layers in fine-tuning pretrained Vision Transformers, this paper proposes Stable-Rank-Based Residual Adaptation (SRRA), which adaptively assigns low ranks to shallow layers and higher ranks to deeper layers via Stable Rank, combined with residual energy and orthogonality constraints to achieve state-of-the-art cross-domain deepfake detection.
Tricam-rPPG: A Multimodal Multispectral Dataset for Remote Photoplethysmography: To address severe systemic sensing bias where conventional visible-light rPPG degrades significantly on darker skin tones due to melanin absorption, this work introduces Tricam-rPPG, the first synchronized multimodal dataset containing high-resolution RGB, dual-band near-infrared (850 nm and 940 nm), and Meta Aria smart glasses streams, demonstrating that cross-spectral integration substantially improves signal-to-noise ratio and mitigates demographic disparity.
Why Feature Magnitude Deceives OOD Detectors: An Angular Separation Perspective: Uncovering a critical failure mode where distance-based OOD detectors are deceived by small feature magnitudes, this paper proposes Angular Separation Learning (ASL)—applying scaled \(\ell_2\)-normalization directly before a bias-free linear classifier to induce hyperspherical contrastive learning with minimal computational overhead.