The attacker-controlled surface in this study is a small portion of preference-training images. The authors describe modifying image content while leaving preference labels and associated text intact, then report attack success up to 98 percent with a 2 percent image poison budget under the tested vision-language configurations. This shows why a…
Inspect the ClaimsCase · DiggingBeagle record
DPOison-VL redirects preference tuning with altered training images
In controlled vision-language fine-tuning experiments, image-only poisoned samples are reported to change downstream safety preferences even though written prompts and choice labels remain untouched.
Scope
Training-data supply-chain study
Assessment profile
Assessment method- Setting
- evaluation
- Exploitation
- demonstrated
- AI role
- AGAINST AI
Basis and provenance
Assessment is limited to the selected canonical Claims and their Source locators in knowledge revision 152. Primary public URL retrieval was unavailable during this drafting pass, and the pinned index reports incomplete linked-record coverage without identifying missing IDs. No independent production impact, generalized exploit prevalence, or attributable victim count is inferred. Case setting is evaluation; evidence status records only the documented source-reported result, not external replication.
Assessed Oct 15, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-DPOISON-VL-01 · DPOison-VL: clean image poisoning of vision-language preference tuning
At a glance
Effect in independent fine-tuning pipelines, realistic training-data access, and theoretical assumptions outside reported model/optimizer combinations are unresolved.
Limits and uncertaintyFull account
The attacker-controlled surface in this study is a small portion of preference-training images. The authors describe modifying image content while leaving preference labels and associated text intact, then report attack success up to 98 percent with a 2 percent image poison budget under the tested vision-language configurations. This shows why a training-data review limited to written prompts and labels can miss changes to the model's effective preference signal.
The numbers are paper-reported evaluation outcomes, not a measured compromise of a public model service. The attacker must influence training examples, and the generality across data pipelines, models and optimizers is not established. This differs from benign preference-pair fine-tuning, which does not depend on image perturbations.
Claims & evidence
CLM-2026-DPOISON-VL-01The authors report attack success up to 98 percent with 2 percent modified preference-training images on tested vision-language settings.supported
Basis: reported finding
- supportsDPOison-VL: clean image poisoning of vision-language preference tuningprimary disclosure
Abstract: extensive experiments and poison budget
Unknowns and contradictions
- Effect in independent fine-tuning pipelines, realistic training-data access, and theoretical assumptions outside reported model/optimizer combinations are unresolved.
Sources and citation
Material revision history
- Oct 15, 2026 · Canonical change recorded · new in release · revision 153