[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-82697-en":3,"doc-seo-82697-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},82697,4810365810221,"Aurora","https://ap-avatar.wpscdn.com/davatar_155a257f0dc6eb9ab79c44ca47cae57d",8,"Research & Report","Vision Token Manipulation Attacks on Cloud-Edge Inference of Large Vision-Language Models","Cloud-edge Large Vision-Language Model (LVLM) inference accelerates deployment by partitioning computation between edge devices and cloud servers, while transmitting intermediate vision tokens across the network. This communication channel creates a new threat surface for representation-level adversaries. The study investigates vision token manipulation attacks (VTMAttack) under a black-box man-in-the-middle model, proposing four naive strategies and an optimization-based token selection method. Experiments on six LVLMs across four benchmarks show that altering only 10% of vision tokens can reduce accuracy by up to 88.31%.","Vision Token Manipulation Attacks on Cloud-Edge Inference of Large Vision-Language Models  \nZikai Zhang 1 , Rui Hu 1 , Olivera Kotevska2 , Jiahao Xu 1  \n1Department of Computer Science and Engineering, University of Nevada, Reno, Reno, USA  \n2 Oak Ridge National Laboratory, Oak Ridge, USA  \n[zikaiz@unr.edu](zikaiz@unr.edu), [ruihu@unr.edu](ruihu@unr.edu), [kotevskao@ornl.gov](kotevskao@ornl.gov), [jiahaox@unr.edu](jiahaox@unr.edu)  \narXiv :2607 .028 19v 1 [ cs .CR] 2 Jul 2026  \nAbstract—Cloud-edge Large Vision-Language Model (LVLM) inference enables efficient deployment by splitting computation between edge devices and cloud servers. In this process, intermediate vision tokens are transmitted from the edge to the cloud over a communication link, thereby exposing a new attack surface. We study vision token manipulation attack (VTMAttack) under a black-box man-in-the-middle setting, where an adversary intercepts and manipulates a subset of transmitted vision tokens under a budget constraint. We propose four na¨ıve attack strategies and an optimization-based token selection method. Experiments on 6 state-of-the-art LVLMs (3B-72B) across 4 benchmarks show that manipulating only 10% of vision tokens can reduce accuracy by up to 88.31% . These results reveal a critical vulnerability in cloud-edge LVLM inference.  \nIndex Terms—Cloud-Edge Inference System, Large VisionLanguage Model, Secure Inference, Edge Intelligence  \nI. INTRODUCTION  \nLarge Vision-Language Models (LVLMs) [1], [17] have recently achieved remarkable progress on a wide range of vision-language tasks, including optical character recognition (OCR) [11], visual question answering (VQA) [10], instruction following [6], and mathematical reasoning [13] . By coupling a vision encoder with a Large Language Model (LLM), LVLMs can transform visual inputs into semantic representations and perform vision-language interaction.  \nDue to their strong capabilities and broad applicability, LVLMs are increasingly being deployed in practical cloudedge environments [9], [16] . In such architectures, resourceconstrained edge devices perform lightweight visual encoding and generate vision tokens, which are then transmitted to cloud servers for further vision-language interactions. Computationally intensive components, including the text encoderand the LLM backbone, are deployed in the cloud. This design substantially reduces the computational cost on resourceconstrained edge devices without sacrificing performances.  \nHowever, this cloud-edge architecture introduces a new attack surface absent in centralized deployments: the communication link that transmits vision tokens from the edge to the cloud. This link is particularly vulnerable to man-in-the-middle adversaries [2], who can intercept and manipulate messages (e.g., vision tokens) transmitted over communication channels. Notably, vision tokens form a compact, high-dimensional representation that directly encodes semantic content, making them an effective target for manipulation at the representation level. For example, an adversary can manipulate the ordering  \nof transmitted vision tokens to disrupt the structural consistency of the visual representation, thereby misleading the LVLM’s understanding of spatial relationships. Meanwhile, the attacker can alter a small portion of tokens that encode critical semantic cues, effectively shifting the representation of the original visual input. These properties highlight the potential risks of the communication link in cloud-edge LVLM inference systems.  \nExisting studies on LVLM security [5], [8] mainly focus on attacks on visual inputs. For instance, adversarial perturbations [5] aim to mislead the model by modifying raw images through carefully crafted noise, while backdoor attacks [8] embed specific visual patterns to induce targeted model behaviors. These approaches assume direct access to raw visual data and operate entirely in the input space before encoding. Meanwhile, existing work","cbCaip1wZoWDE675","https://ap.wps.com/l/cbCaip1wZoWDE675","pdf",875859,1,11,"English","en",105,"# Introduction\n## Cloud-edge LVLM inference and attack surface\n## Related work on LVLM security and intermediate representations\n## Proposed VTM-Attack threat model and methods\n## Experimental evaluation and results","[{\"question\":\"What vulnerability does the paper identify in cloud-edge LVLM inference?\",\"answer\":\"The communication link transmitting intermediate vision tokens from edge to cloud exposes a representation-level attack surface, enabling man-in-the-middle manipulation.\"},{\"question\":\"How is the vision token manipulation attack modeled in the paper?\",\"answer\":\"An adversary intercepts and modifies a subset of transmitted vision tokens in a black-box man-in-the-middle setting under a budget constraint before forwarding them to the cloud.\"},{\"question\":\"What is the impact of manipulating vision tokens on model accuracy?\",\"answer\":\"Experiments on six LVLMs across four benchmarks show that modifying only 10% of vision tokens can reduce accuracy by as much as 88.31%, with sign flip attacks causing drastic drops in reported cases.\"}]",1784182351,28,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"vision-token-manipulation-attacks-on-cloud-edge-inference-of-large-vision-language-models","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/vision-token-manipulation-attacks-on-cloud-edge-inference-of-large-vision-language-models/82697/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What vulnerability does the paper identify in cloud-edge LVLM inference?","Question",{"text":75,"@type":76},"The communication link transmitting intermediate vision tokens from edge to cloud exposes a representation-level attack surface, enabling man-in-the-middle manipulation.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How is the vision token manipulation attack modeled in the paper?",{"text":80,"@type":76},"An adversary intercepts and modifies a subset of transmitted vision tokens in a black-box man-in-the-middle setting under a budget constraint before forwarding them to the cloud.",{"name":82,"@type":73,"acceptedAnswer":83},"What is the impact of manipulating vision tokens on model accuracy?",{"text":84,"@type":76},"Experiments on six LVLMs across four benchmarks show that modifying only 10% of vision tokens can reduce accuracy by as much as 88.31%, with sign flip attacks causing drastic drops in reported cases.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,135],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":132,"doc_module":4,"doc_module_name":45,"category_name":133,"show_sort_weight":132,"slug":134},10,"Lifestyle","lifestyle",{"id":136,"doc_module":4,"doc_module_name":45,"category_name":137,"show_sort_weight":106,"slug":138},19,"General","general"]