[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-83110-en":3,"doc-seo-83110-105":30,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":21,"is_downloadable":21,"audit_status":21,"page_count":22,"language":23,"language_code":24,"site_id":25,"html_lang":24,"table_of_contents":26,"faqs":27,"seo_title":13,"seo_description":14,"update_tm":28,"read_time":29},83110,1099514067415,"Rowan","https://ap-avatar.wpscdn.com/avatar/100002539d78ffe74a7?x-image-process=image/resize,m_fixed,w_180,h_180&k=1779092875211072502",8,"Research & Report","AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models","Vision-language models (VLMs) are increasingly applied to infrared (IR) remote-sensing imagery in security-sensitive contexts, yet their adversarial robustness remains largely unexplored. AirflowAttack presents the first adversarial attack tailored to IR remote-sensing VLMs by generating a thermal-airflow turbulence perturbation prior. A lightweight, input-agnostic generator produces a physically plausible airflow-regularized perturbation. Transfer across multiple CLIP backbones and six VLMs substantially degrades scene classification accuracy while sometimes increasing IR-cue confidence.","arXiv :2607 .06485v 1 [ cs .CV] 7 Jul 2026  \nAirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models  \nCong Su2 , Jiaju Han 1 , Xuemeng Sun 1 , Chengyin Hu 1 , Qike Zhang 1 , Jiujiang Guo2 , Yiwei Wei 1 , and Jiahuan Long3  \n1 China University of Petroleum-Beijing at Karamay, Karamay, Xinjiang, China  \n2 Tianjin University, Tianjin, China  \n3 Shanghai Jiao Tong University, Shanghai, China  \nAbstract. Vision-language models (VLMs) are increasingly deployed on infrared (IR) remote sensing imagery in security-critical settings, yet their adversarial robustness remains unexamined. We present AirflowAttack, to our knowledge the first adversarial attack for IR remotesensing VLMs and the first to weaponize thermal-airflow turbulence asthe perturbation prior. A lightweight generator synthesizes a single inputagnostic perturbation regularized toward physically plausible airflow patterns. Optimized on one surrogate CLIP model, it attains a mean zeroshot scene-classification attack success rate (ASR, the fraction of samples whose top-1 class changes) of 48.5% across five diverse CLIP backbones, far exceeding four IR-specific physical baselines (27.7–37.0%) . Applied to six state-of-the-art VLMs, it cuts scene-classification accuracy by up to 38.2%(relative)—yet paradoxically makes some models more confident in their IR analysis, confabulating the perturbation as genuine thermal evidence such as temperature gradients and convection. Ablations show the airflow prior raises physical plausibility at no measurable cost to attack success. Together with a benchmark spanning eleven models and four tasks, these findings expose critical vulnerabilities in the rapidly expanding IR VLM ecosystem.  \nKeywords: Adversarial attack · Infrared remote sensing · Vision-language model · Transferable perturbation · Thermal airflow  \n1 Introduction  \nInfrared remote sensing underpins critical applications from disaster monitoring and environmental surveillance to military reconnaissance, operating under conditions where visible-spectrum imaging fails—nighttime, fog, smoke, and thermal camouflage detection. The recent adaptation of vision-language models (VLMs) to the IR domain promises a step change in automated scene understanding: models such as GeoRSCLIP [46], RemoteCLIP [21], and RS5M [47]  \n2 C. Su et al.  \nFig. 1: Overview of AirflowAttack. A lightweight generator Gθ maps a low-dimensional latent code to a single-channel thermal-airflow perturbation, optimized on a surrogate IR-finetuned CLIP model under an L∞ ≤ ε constraint using a confidence loss Lconf and an airflow-correlation loss Lair. The resulting perturbation transfers, without targetmodel access, to five CLIP backbones and six VLMs across four vision-language tasks.  \ncan now jointly reason about IR imagery and natural language, enabling openvocabulary retrieval, descriptive captioning, and visual question answering over thermal scenes. However, the security implications of deploying VLMs in IRsensitive contexts remain entirely unexamined.  \nAdversarial attacks—imperceptible input perturbations that cause models to fail—have been extensively studied in the RGB domain, spanning white-box [15], black-box [29], and universal [27] regimes. Yet IR imagery differs fundamentally from RGB: thermal sensors capture emitted radiation rather than reflected light, producing single-channel intensity maps governed by Planck’s law where pixel values encode physical temperature. This physical grounding both constrains and motivates a new class of attacks: rather than crafting arbitrary digital noise, an adversary can simulate physically plausible thermal phenomena—such as airflowinduced temperature distortions—that are simultaneously harder to detect and more likely to transfer across models.  \nIn this paper, we introduce AirflowAttack, to the best of our knowledge the first adversarial attack designed for IR remote-sensing VLMs. While universal perturbati","cbCainJ9YLcS0zmC","https://ap.wps.com/l/cbCainJ9YLcS0zmC","pdf",7870855,4,1,41,"English","en",105,"# Introduction\n# Related Work\n## Infrared Remote Sensing Vision-Language Models","[{\"question\":\"What problem does AirflowAttack address for infrared remote-sensing vision-language models?\",\"answer\":\"It targets the unexamined adversarial robustness of IR remote-sensing VLMs by introducing an attack specifically designed for the thermal-IR modality rather than generic digital noise.\"},{\"question\":\"How is the adversarial perturbation generated in AirflowAttack?\",\"answer\":\"A lightweight generator synthesizes a single input-agnostic thermal-airflow perturbation, optimized with constraints for physically plausible airflow patterns.\"},{\"question\":\"What is the impact of AirflowAttack on model performance and behavior?\",\"answer\":\"A perturbation optimized on one surrogate CLIP model transfers to multiple backbones and VLMs, reducing scene-classification accuracy by up to 38.2% relative; some models also become more confident while producing confabulated thermal evidence.\"}]",1784185335,103,{"code":4,"msg":31,"data":32},"ok",{"site_id":25,"language":24,"slug":33,"title":13,"keywords":34,"description":14,"schema_data":35,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":28},"airflowattack-thermal-airflow-adversarial-perturbations-against-infrared-remote-sensing-vision-language-models","",{"@graph":36,"@context":85},[37,53,68],{"@type":38,"itemListElement":39},"BreadcrumbList",[40,44,48,51],{"item":41,"name":42,"@type":43,"position":21},"https://docshare.wps.com","Home","ListItem",{"item":45,"name":46,"@type":43,"position":47},"https://docshare.wps.com/document/","Document",2,{"item":49,"name":12,"@type":43,"position":50},"https://docshare.wps.com/document/research-report/",3,{"item":52,"name":13,"@type":43,"position":20},"https://docshare.wps.com/document/airflowattack-thermal-airflow-adversarial-perturbations-against-infrared-remote-sensing-vision-language-models/83110/",{"url":52,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":24,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":41,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-24","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What problem does AirflowAttack address for infrared remote-sensing vision-language models?","Question",{"text":75,"@type":76},"It targets the unexamined adversarial robustness of IR remote-sensing VLMs by introducing an attack specifically designed for the thermal-IR modality rather than generic digital noise.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How is the adversarial perturbation generated in AirflowAttack?",{"text":80,"@type":76},"A lightweight generator synthesizes a single input-agnostic thermal-airflow perturbation, optimized with constraints for physically plausible airflow patterns.",{"name":82,"@type":73,"acceptedAnswer":83},"What is the impact of AirflowAttack on model performance and behavior?",{"text":84,"@type":76},"A perturbation optimized on one surrogate CLIP model transfers to multiple backbones and VLMs, reducing scene-classification accuracy by up to 38.2% relative; some models also become more confident while producing confabulated thermal evidence.","https://schema.org",{"og:url":52,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":52},"index,follow",{"doc_id":7,"site_id":25},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":21,"doc_module":4,"doc_module_name":46,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":47,"doc_module":4,"doc_module_name":46,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":20,"doc_module":4,"doc_module_name":46,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":46,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":46,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":46,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":46,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":46,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":46,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":46,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":46,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]