InfraQR: Edge-Placed QR-Inspired Structured Patch Attacks on Infrared Vision-Language Models

Jul 16, 2026

Infrared vision-language models are increasingly deployed for perception under low-light and adverse conditions, yet robustness against localized structured perturbations is insufficiently studied. InfraQR introduces a QR-inspired structured patch attack that inserts a compact near-binary finder-style signal along image boundaries, without requiring a valid scannable QR code. Using learnable grid cells optimized with binary regularization and surrogate CLIP-style encoders, InfraQR is evaluated on infrared classification, caption transfer, and question–answer-aware VQA.

LanguageEnglish

CategoryResearch & Report

FormatPDF

Pages17

Reading Time43 min

Introduction

Problem Background and Motivation

Proposed Method: InfraQR

Evaluation Scope and Contributions

arXiv :2607 .07288v 1 [ cs .CV] 8 Jul 2026 InfraQR: Edge-Placed QR-Inspired Structured Patch Attacks on Infrared Vision-Language Models Xin Li 1 , Jiaju Han 1 ,3 , Ma Yaqi2 , Chengyin Hu 1 , Yingying Zhao 1 , Jiahuan Long4 , Fengyu Zhang 1 , and Yahui Chai 1 1 China University of Petroleum-Beijing at Karamay, Karamay, Xinjiang, China 2 Guizhou University, Guiyang, China 3 Shenzhen Research Institute of Big Data, Shenzhen, China 4 Shanghai Jiao Tong University, Shanghai, China Abstract. Infrared vision-language models are increasingly used for perception under low-light and adverse visual conditions, yet their robustness to localized structured perturbations remains underexplored. Existing infrared adversarial studies mainly focus on object detectors, leaving the security of infrared vision-language models less systematically examined. We present InfraQR, a QR-inspired structured patch attack for infrared vision-language models. Unlike localized attacks that attach perturbations to the target object, InfraQR places a compact structured patch along image boundaries and optimizes learnable grid cells through surrogate CLIP-style encoders. The resulting patch has a near-binary structured appearance, but is not required to be a valid or machine-readable QR code. We evaluate InfraQR on infrared classification, caption transfer, and question–answer-aware visual question answering (VQA) tasks. On a 300-image infrared benchmark, InfraQR sharply reduces the accuracy of multiple CLIP-style classifiers, including reducing OpenAI CLIP accuracy from 98 .67% to 0 .70% . The generated adversarial images also transfer to black-box captioning and VQA models, causing semantic degradation in captions and more error-prone answers under GPT-5 .4-based evaluation. These results show that infrared vision-language models remain vulnerable to structured edge-placed perturbations, motivating further study of cross-task robustness beyond direct object occlusion. Keywords: Infrared vision-language models · adversarial patch attacks · QR-inspired structured perturbations · visual question answering 1 Introduction Vision-language models (VLMs) have broadened visual perception by aligning images with natural-language descriptions, enabling open-vocabulary recognition, captioning, and visual question answering [13, 21] . Recent studies show that VLMs remain vulnerable to adversarial perturbations and transfer-based 2 X. Li et al. attacks in visible image domains [15, 28] . In contrast, the robustness of infrared VLMs remains less understood, even though infrared imagery is important for perception under low-light, nighttime, and adverse visual conditions. Existing infrared adversarial studies mainly focus on object detectors and physical-world perturbations, such as learnable infrared patches and infrared curves [10, 27] . These works reveal important vulnerabilities of thermal object detection, but they do not directly address whether structured perturbations can disrupt infrared vision-language understanding. This gap is important because errors in infrared multimodal perception may propagate from visual recognition to language generation and decision making. Adversarial patch attacks provide a practical way to study localized vulnerabilities by modifying only a small image region. Most patch settings place perturbations on or near the target object, directly overlapping the visual evidence used for recognition. In this work, we ask a complementary question: can a structured patch placed away from the main object still disrupt infrared visionlanguage understanding? This setting is especially relevant for digital robustness analysis, where the attacker can control image-level placement without attaching a physical patch to the object itself. In this work, we study this question through edge-placed structured perturbations. We introduce InfraQR, a QR-inspired structured patch attack for infrared VLMs. InfraQR uses a fixed f

FAQs

What is InfraQR and how is the adversarial patch placed?

InfraQR is a QR-inspired structured patch attack that places a compact structured patch along image boundaries. It searches candidate edge locations instead of attaching the perturbation to the target object.

Does InfraQR require the patch to be a valid or scannable QR code?

No. InfraQR encourages a near-binary structured appearance using binary regularization, but it is not required to form a valid or machine-readable QR code.

Which tasks are used to evaluate InfraQR’s impact on infrared vision-language models?

InfraQR is evaluated on infrared classification, caption transfer to black-box captioning models, and question–answer-aware visual question answering (VQA).

Jul 16, 2026

Upload by Seraphina