Adversarial Attack Framework Against Vision-Language Model Unlearning

1 Introduction

Large Vision-Language Models (VLMs) enable multimodal interaction with users by integrating visual perception into language models [Dai et al., 2023; Liu et al., 2023]. Through extensive training on image-text corpora, VLMs produce semantically grounded responses that interpret complex visual concepts [Willemsen et al., 2023]. As vast training corpora may contain sensitive or proprietary content (e.g., personal attributes), VLMs inevitably internalize associations that manifest in responses, leading to undesirable privacy disclosure [Bai et al., 2025]. VLM unlearning enables targeted forgetting of content and suppresses the undesirable responses [Li et al., 2024; Huo et al., 2025], and has gained prominence for supporting privacy protection in realworld vision-language applications [Dontsov et al., 2025; Zou et al., 2025]. VLM unlearning involves fine-tuning with a forget objective that reduces the likelihood of faithfully generating responses on forget-target inputs and a retain objective that preserves utility on non-targets [Liu et al., 2025b].

∗Corresponding author: Peng Jiang

While VLM unlearning avoids the reproduction of forgotten content to mitigate privacy disclosure, it is still vulnerable to adversarial inputs [Zhang et al., 2025b; Yuan et al., 2025; Doshi and Stickland, 2024; Schwinn et al., 2024], where crafted perturbations to the visual modality of forget inputs manipulate the unlearned VLM's output towards the supposedly forgotten content. The existence of adversarial inputs exposes security risks in deploying unlearned VLMs in realworld applications, allowing attackers to intentionally bypass the expected post-unlearning behavior [Gu et al., 2025; Patil et al., 2024]. Despite the advancements in crafting adversarial visual inputs, they have to pre-set some restricted assumptions. For example, SUA requires the unlearned VLM's model internals, including architecture, parameters, or output logits via repeated queries [Zhang et al., 2025b]. In practice, the construction of unlearned VLM encodes proprietary expertise, making model details inaccessible. Moreover, intensive queries cost much and inevitably trigger suspicion. Such attacks that require internal access are often tailored to a specific model and also tend to transfer poorly across VLMs.

In this paper, we take the first step in exploring transferable adversarial attacks against VLM unlearning. We focus on a transformer-rooted phenomenon in VLMs, known as visual sink tokens, whose formation generalizes across VLMs [Kang et al., 2025; Luo et al., 2025; Wang et al., 2025]. We present an illustrative example in Figure 1 to visualize answer-to-visual attention maps on an original VLM and its unlearned variants (see Section 2.4 for detailed settings). As Figure 1(a-c) shows, unlearning suppresses the correct name output, while leaving highly attended visual sink tokens (red boxes) preserved and still capable of influencing generation. Figure 1(d) further provides a diagnostic intervention: injecting a forget-target semantic direction into a single sink token increases the model's agreement with the suppressed target. This suggests that sink tokens can serve as exploitable anchors for semantically guided elicitation in unlearned VLMs.

We propose SISA, a generic adversarial attack framework against VLM unlearning that requires only access to a surrogate, pre-trained VLM. SISA enables the crafting of transferable adversarial input that manipulates an unlearned VLM's generation toward intended output by exploiting the formation and persistence of visual sink token for semantic alignment. SISA consists of two modules: Sink Induction and Semantic Anchoring. The Sink Induction module constructs a stable structural anchor that influences generation. This is realized by inducing a visual token to exhibit the sink regime with the columnar attention pattern and aggregated visual embedding resemblance. The Semantic Anchoring module stabilizes the anchor through semantic alignment that elicits the intended target. This is realized by optimizing embeddingspace semantic similarity between the model output and the target, while conditioning attention on the induced sink token. Simultaneously, the generalizable formation and unlearning persistence of sink token, along with the sink-conditioned semantic alignment, ensure that crafted adversarial inputs can be transferred to manipulate the victim unlearned VLM's generation toward supposedly forgotten content. Finally, we assess three potential countermeasures.

The main contributions of this paper are twofold.

• We propose SISA, a generic adversarial attack framework against VLM unlearning, which does not require access to the victim unlearned VLM's architecture, parameters, or output logits. SISA consists of two modules: Sink Induction, which induces a visual sink token, and Semantic Anchoring, which reinforces sinkconditioned output alignment. Together, SISA crafts transferable adversarial visual inputs that manipulate the victim's generation towards intended targets.
• We implement a prototype of SISA and conduct experiments to evaluate the performance. Extensive experiments across diverse VLM backbones and unlearning algorithms confirm that SISA consistently elicits supposedly forgotten content, achieving 89.23% attack success rate, and outperforming baselines by up to 41.59%.

Results under three potential countermeasures show that SISA generally survives existing defenses.

2 Problem Statement

2.1 Vision-Language Models and Visual Sinks

Large Vision-Language Models (VLMs) comprise three components: (1) a vision encoder that extracts visual features from an input image; (2) a connector that maps visual features into the token space of the LLM, yielding visual tokens; and (3) a language model, an autoregressive transformer that takes a token sequence of length N (with index sets Isys, Ivis, and Itxt for system, visual, and query tokens, respectively, and output positions Iout for generated tokens) [Kang et al., 2025; Xiao et al., 2023; Barbero et al., 2025]. Each token i ∈ {1, . . . ,N} has a hidden state hℓi ∈ Rd at layer ℓ, updated by causal multi-head attention and feed-forward networks [Sun et al., 2024]. Following [Wang et al., 2025], the causal attention matrix at layer ℓ is denoted by Aℓ ∈ RN×N , where Aℓi,j quantifies the strength with which token i attends to token j, Aℓi,j = 0 for j > i and ∑j≤i Aℓi,j = 1.

Recent studies report visual sink tokens that emerge from the transformer attention mechanism in VLMs [Kang et al., 2025]. Visual sinks exhibit an observed regime in which they attract attention from subsequent tokens, forming verticalcolumn patterns in attention maps, and behave as lowsemantic global summaries, with hidden states that lie close to aggregated visual embeddings [Darcet et al., 2023; Luo et al., 2025; Wang et al., 2023]. Moreover, visual sinks show distinctive characteristics, such as large feature norms or dimension activations, which can serve as identification criteria ϕ(·) (e.g., ∥hℓ-1 j ∥2, max1≤ˆ d≤d ∣∣RMSNorm(hℓ-1 j )[ ˆ d]∣∣ [Darcet et al., 2023; Sun et al., 2024]).

2.2 VLMUnlearning

VLM unlearning algorithmically suppresses outputs that would otherwise reproduce to-be-forgotten content (e.g., identity-related answers about President Donald Trump), while preserving general utility on non-target (retain) data [Liu et al., 2025a; Dontsov et al., 2025]. Let ximg , xtxt , y denote the visual input, textual prompt, and ground truth answer, respectively. The objective is formulated as:

where Df and Dr are the forget and retain sets, respectively. The loss ℓf is designed to reduce the likelihood of generating yf on Df (e.g., by maximizing the negative log-likelihood of yf ), while ℓr is a standard prediction loss (e.g., cross-entropy) on Dr, andMU denotes the resulting unlearned VLM.

2.3 Adversarial Attacks in VLMUnlearning

Following prior work [Zhang et al., 2025b; Yuan et al., 2025; Wang et al., 2025], we consider an attacker A who aims to manipulate a victim unlearned VLM MU to generate outputs aligned with a target completion that is suppressed under clean forget inputs. We assume A has no access toMU's parameters, gradients, output logits, the original version of MU, or the unlearning algorithms. Instead, A has whitebox access to a surrogate, pre-trained VLMMsur and crafts transferable adversarial perturbations on the visual modality. Definition of Adversarial Attacks. Following [Schwinn et al., 2024; Zhang et al., 2025b], given the visual input ximg , textual prompt xtxt , perturbation δ is optimized such that the output ofMU(ximg +δ, xtxt ) elicits a target completion s1:T that would otherwise be suppressed on (ximg , xtxt ). Formally, we define the optimization problem as:

where I(·, ·) ∈ {0, 1} indicates whether successfully elicits s inMU's output in a clear and unambiguous manner.

2.4 Insight: Sink as Semantic Anchor

We visualize attention maps for an original VLM and its unlearned variants. As shown in Figure 1(a), unlearning reduces the model's tendency to output the forgotten target. Despite this behavioral suppression, we observe visual sink tokens (highlighted in red box) that structurally persist after unlearning. Consistent with prior analyses of visual sinks [Kang et al., 2025; Luo et al., 2025], these tokens retain the columnar pattern (Figure 1(b)) and summary behavior (Figure 1(c)).

Given that visual sink tokens are typically semantically weak [Xiao et al., 2023], we adopt [Rimsky et al., 2024] to extract a semantic steering direction dir as a residual-stream activation difference between the target sequence s1:T and a clean baseline completion from intermediate residual-stream activations of MU. We intervene at an identified sink position j by editing its hidden state: ˜hℓj = hℓj +dir. As shown in Figure 1(d), this intervention increases the Agreement Score (AS) with the suppressed s1:T . This indicates that target semantic guidance through a persistent anchor can manipulate outputs that would otherwise be suppressed. Building on this insight, a viable transferable attack can proceed by inducing a sink token while conditioning on semantics.

3 SISA: Detailed Construction

3.1 Sink Induction

Given each perturbed sample (ximg + δ, xtxt ) with surrogate forwarding, we begin by identifying a candidate token via:

where ϕ(·) is the sink criterion following [Luo et al., 2025], Ivis indexes the visual tokens, and hℓ-1 i ∈ Rd is the hidden state of token i at layer ℓ - 1.

Attention Column Formation. To promote a columnar attention pattern on the visual token at j ⋆ , we encourage subsequent tokens to allocate attention to j ⋆ by:

where I→(j ⋆ ) = { i | i > j ⋆ } denotes positions allowed to attend to j ⋆ , Aℓi,j ⋆ denotes the attention mass that subsequent token position i assigns to the visual token at index j ⋆ , derived fromAℓ ∈ RN×N is the attention matrix at layer ℓ with overall length N, and ξ > 0 is a small constant to avoid log 0. Visual Summary Absorption. Since higher resemblance of visual aggregation facilitates the formation of sinks [Wang et al., 2025; Luo et al., 2025], we compute the visual summary embedding: hℓg = 1 |Ivis | ∑u∈Ivis hℓu . We then encourage the token at j ⋆ to absorb the summary via cosine similarity:

The overall sink-induction loss is formulated as:

3.2 Semantic Anchoring

Building on the induced sink token at j ⋆ as a structural anchor, we enhance it by imposing the desired semantics. Since directly hidden-state injection at j ⋆ typically requires access to the victimmodelMU (cf. Section 2.4), the output is forced to align the overall semantics of target completion s1:T .

Semantic Target Alignment. Prior alignment methods typically rely on cross-entropy to enforce an exact target sequence: LCE = - ∑Tt=1 log pθ(st | x, s<t) . Instead, we relax the objective to reward semantic similarity between the model output and the target completion, promoting transferable adversarial patterns. Concretely, we project each the surrogateMsur's next-token prediction and the target token into a shared embedding space for semantic comparison.

Let zt ∈ R|V| and st denote Msur's output logits (conditioned on (ximg+δ, xtxt , s<t)) and the target token at position t. The expected and target embeddings are computed as:

where W ∈ R|V|×d is the embedding matrix of the LLM backbone in surrogate VLMMsur, |V| is the vocabulary size and d is the embedding dimension. The neighbourhood of semantically similar targets is then formed by perturbing the target embedding et with Gaussian noise:

We add sinusoidal positional encoding PEd(·) [Vaswani et al., 2017] to emphasize semantically relevant future tokens:

and compute the attention weights over target positions:

where τsem > 0 is a temperature controlling sharpness and Mfuture ∈ RT×T is a mask with -∞ for j < t and 0 otherwise, ensuring each query t attends only to itself and future tokens. With the weighted target embedding eatt t = ∑Tj=t watt t,j ˜ ej, the semantic alignment loss is formulated as:

Sink Semantic Condition. To enforce semantic alignment to be anchored by visual token at j ⋆ , we further modulate the loss Lsem at target position t with a sink-conditioned weight:

where N - T + t is the index of t-th target output token in overall length-N sequence, ρ ≥ 1 controls the strength, and gt preserves the semantic objective while penalizing insufficient anchoring to j ⋆ , inspired by focal-style modulating factors [Lin et al., 2017; Li et al., 2022]. The overall semantic alignment loss is formulated as:

4 Evaluation

4.1 Setting

Datasets. We adopt two established benchmarks for VLM unlearning following [Zhang et al., 2025b; Huo et al., 2025].

Algorithm 1 SISA Crafting

• 1: function CRAFTING(Msur, ximg , xtxt , s1:T ) ▷ α, β, γ, σ: weights; Λ: constraint; V : mutation. 2: V ← 0, δ0 ← 0, k ← 1 3: while k ≤K do 4: ForwardMsur(ximg +V, xtxt ); compute logits {zt}Tt=1 with zt = logits( · | s<t, ximg +V, xtxt ); extract hidden states {hℓi}Ni=1, {hℓ-1 i }Ni=1 and attention matrix Aℓ ∈ RN×N . 5: Select j ⋆ ← argmaxi∈Ivis ϕ(hℓ-1 i ) 6: Compute Lsink, Lanch sem as Sections 3.1, 3.2 7: δk ← arg minδk α · Lsink + β · Lanch sem + γ∥δk∥p, s.t. ∥V + δk∥p ≤ Λ 8: δk ← σ · δk-1 + δk, V ← V + δk, k ← k + 1 9: V ← Clip(ximg + V ) - ximg 10: end while 11: return ximg + V 12: end function

MLLMU-Bench [Liu et al., 2025a] contains 500 fictitious and 153 real-world celebrity profiles with portraits and attributeoriented QA pairs. CLEAR [Dontsov et al., 2025] is built on the TOFU corpus with around 200 fictitious individuals and 3.7k QA pairs. Both benchmarks include a forget/retain split and a test set with paraphrased and image-transformed concept instances for unlearning efficacy and generality evaluation [Li et al., 2024; Liu et al., 2025b].

Following prior attacks [Zhang et al., 2025b; Yuan et al., 2025], we evaluate SISA on a forget-target set D = {(ximg , xtxt , s1:T )}, formed by randomly sampling half of the forget set for case (i), or half of the test set for case (ii), to evaluate elicitation on seen and unseen cases after unlearning.

Models. We employ widely used VLM backbones: InternVL2.5-8B [Zhu et al., 2025], Qwen2.5-VL-3B-Instruct [Bai et al., 2025], Molmo-7B-D [Deitke et al., 2025], KimiVL-A3B-Instruct [Team et al., 2025], LLaVA-v1.6-mistral7b-hf [Liu et al., 2023], and GLM-4.1V-9B-Thinking [Hong et al., 2025]. The unlearned VLM is constructed by adopting the original settings of each algorithm, including Gradient Ascent with KL (GA+KL) [Yao et al., 2024], Preference Optimization (PO) [Maini et al., 2024], SIU [Li et al., 2024], MMUnlearner [Huo et al., 2025] and MANU [Liu et al., 2025b]. By default, Qwen2.5-VL-3B-Instruct is used as the surrogate VLM, Kimi-VL-A3B-Instruct as the victim unlearned VLM, with SIU as the unlearning algorithm.

Metrics. SISA is evaluated using Attack Success Rate (ASR) and Agreement Score (AS), following [Zhang et al., 2025b; Liu et al., 2025a]. ASR directly measures attack effectiveness, calculated as 1 |D| ∑ I (MU(ximg +V, xtxt ), s) , where I(·, ·) ∈ {0, 1} is an LLM-as-judge indicator of whether SISA successfully elicits the target completion s in MU's output in a clear and unambiguous manner. AS quantifies the degree of semantic agreement with target s, calculated as 1 |D| ∑ J (MU(ximg +V, xtxt ), s) , where J(·, ·) ∈ {1, . . . , 10} is an LLM-as-judge score, with higher values indicating more consistent expression of target s.

Implementations. Following [Wang et al., 2025], layer ℓ is set to the second-to-last layer for InternVL2.5-8B, Qwen2.5- VL-3B-Instruct, and Molmo-7B-D, and to the third-to-last layer for Kimi-VL-A3B-Instruct, LLaVA-v1.6-mistral-7b-hf, and GLM-4.1V-9B-Thinking. Sink identification defaults to a norm-based criterion. For semantic alignment, Gaussian noise ε ∼ N(0, ϵ2 I) is added to target embeddings with ϵ = 10-4 , and the semantic-loss temperature is set to τsem = 0.5. Following [Cui et al., 2024], perturbations are optimized with a perturbation budget of Λ = 8/255 for K = 20 iterations, with λ1 = 1, λ2 = 1, and ρ = 2.

Baselines. We establish Clean by evaluating unlearned VLMs on the clean set D (i.e., perturbation V = 0), reflecting post-unlearning behavior. We compare SISA against diverse VLM attacks that craft adversarial inputs on surrogateMsur to elicit completion s, including SUA-Grad/Logit [Zhang et al., 2025b], jailbreak methods (FigStep [Gong et al., 2025], VAJM [Qi et al., 2024], UMK [Wang et al., 2024]), and feature alignment methods (FOA-Attack [Jia et al., 2025], AnyAttack [Zhang et al., 2025a], M-Attack [Li et al., 2025]).

4.2 Overall Performance

Table 1 reports SISA performance compared with baselines. Relative to Clean, all attack variants achieve higher ASR and AS, reflecting viable elicitation of the suppressed target by perturbations. Instead of relying on the victim model internals, SISA consistently outperforms SUA-Grad/Logit, improving ASR by up to 31.90% and AS by up to 2.98. This can be attributed to SISA inducing a visual sink as a stable anchor while enforcing sink-conditioned semantic alignment. Moreover, SISA also outperforms jailbreak-style and transferable feature alignment methods by at least 11.17% in ASR and 0.49 in AS, highlighting the importance of explicitly aligning generation with semantics, beyond relying solely on nonpredefined steering or visual feature-level alignment.

4.3 Parameter Analysis

Effect of the Surrogate Model. As shown in Table 2, SISA remains effective across different VLM architectures.

Effect of Semantic Loss and Attention Temperature. Figure 3 visualizes 2D slices of the loss landscapes. Compared with the cross-entropy (CE) loss, semantic alignment loss Lanch sem exhibits a smoother surface with coherent low-loss regions, which typically suggests better generalization in nonconvex optimization [Keskar et al., 2016]. As τsem → 0 (i.e., attending only to the current token), the surface becomes highly spiky and approaches CE, whereas increasing τsem yields broader low-loss basins. As τsem →∞, the attention spreads more evenly across future tokens, weakening semantic focus and potentially leading to irrelevant yet easily optimized solutions [Andriushchenko et al., 2023].

Effect of Candidate Identification. We compare different sink identification criteria ϕ(·) adopted from [Luo et al., 2025], along with a random-token baseline, for selecting the candidate token j ⋆ in Section 3.1. Table 3 shows that SISA remains effective across different sink criteria, whereas random selection yields a performance drop. Nevertheless, the random selection still achieves an ASR of 73.4% and an AS of 7.0 on MLLMU-Bench, indicating that sink-regime induction and sink-conditioned semantic anchoring are functional. Effects of Hyperparameters. As shown in Figure 4, increasing λ2 from 0.3 to 1.0 improves the average ASR by about 13.5%, while further gains beyond 1.0 become marginal. Increasing ρ to 2 improves the average ASR by about 2.4%, after which the marginal gains decrease as ρ increases further. Varying λ1 shows a favorable region near 1.0, with small drops at larger values. Results indicate that default hyperparameter choices are reasonable.

4.4 Ablation and Case Study

Component Ablation. We assess Attention Column Formation (ACF), Visual Summary Absorption (VSA) Semantic Target Alignment (STA), and Sink Semantic Condition (SSC), designing SISA variants to test performances. As shown in Table 4, all components contribute to the attacks.

Visualization. We compare the sink-regime behavior induced by SISA at position j ⋆ against the Clean baseline by similarly adopting the columnar-attention strength ACFℓ (j ⋆ ) = 1 |I→(j ⋆ )| ∑i∈I→(j ⋆ ) Aℓi,j ⋆ and the visualsummary resemblance VSAℓ (j ⋆ ) = cos(hℓj ⋆, hℓg ). Unless stated otherwise, all results are reported on MLLMU-Bench (case(i)), where all victim models are unlearned using SIU. As shown in Figure 5, SISA consistently increases both ACFℓ (j ⋆ ) and VSAℓ (j ⋆ ) across victim architectures, and the paired frequency Pr[SISA ≥ Clean] is high for both metrics.

4.5 Results against Countermeasures

We evaluate three potential countermeasures: (i) CIDER [Xu et al., 2024] detects malicious inputs by measuring the embedding-space image-text alignment shift before and after denoising, and returns a refusal upon detection. (ii) OPERA [Huang et al., 2024] is a decoding-time mitigation designed to suppress attention-sink/columnar behaviors by introducing sink-aware logit penalties during beam-search decoding. (iii) Early-stopping [Wang et al., 2025] is an adaptive mitigation that detects the attention-sink phenomenon during generation and terminates output before sink tokens appear.

Results: Figure 6 shows that CIDER modestly mitigates SISA. This is expected because SISA constrains perturbations within the budget and promotes semantic consistency rather than image-text misalignment, which reduces the shift used for detection. OPERA attenuates SISA by suppressing columnar behaviors. Nevertheless, SISA remains effective, as semantic anchoring still provides guidance towards the desired output beyond sink-regime induction, with ASR and AS above 75.8% and 7.7 on MLLMU-Bench. Early-stopping reduces the incidence of elicited target, yet it increases perplexity (adapted from [Wang et al., 2025]) by 45.36% on average.

5 RelatedWork

Adversarial Inputs in VLMs. Recent work has shown that VLMs can be manipulated by adversarial image-text inputs. Jailbreak-style methods primarily disguise malicious intent and elicit non-predefined responses by bypassing refusal behaviors. Typography-based attacks such as FigStep [Gong et al., 2025] embed structured yet incomplete textual patterns into images and prompt the model to continue them, weakening safety-aligned refusals. Optimization-based methods iteratively tune inputs to induce harmful responses. For example, VAJM [Qi et al., 2024] shows that a single optimized image can jailbreak multiple prompts, while UMK [Wang et al., 2024] jointly optimizes adversarial text-image pairs to improve robustness across prompts and models.

A concurrent line of work studies transferable attacks that steer VLM behaviors via targeted feature alignment. These methods optimize perturbations such that the perturbed input is encoded closer to a chosen target in representation space (e.g., concept/image/text embedding). For instance, AnyAttack [Zhang et al., 2025a] leverages large-scale selfsupervised pretraining for transferability, M-Attack [Li et al., 2025] improves transfer via random cropping and resizing during optimization, and FOA-Attack [Jia et al., 2025] jointly aligns global and local patch-token features via clustering.

Despite these advances, existing VLM attacks are not specially tailored to target elicitation under VLM unlearning, which is essential for evaluating the reliability of expected unlearning behavior [Yuan et al., 2025; Schwinn et al., 2024]. Adversarial Inputs in VLM Unlearning. There is limited literature on adversarial attacks against unlearned VLMs. SUA was proposed to craft perturbations on the visual modality that trigger unlearned VLMs to reveal supposedly forgotten content [Zhang et al., 2025b]. SUA assumes whitebox access to the victim unlearned VLM (e.g., architecture and parameters) for gradient-based optimization, or graybox access (e.g., output-logit queries) for zeroth-order updates. However, unlearned VLMs are often proprietary, making such access unavailable or repeated queries suspicious.

Recent research has identified a transformer-rooted phenomenon across VLMs, known as visual sink tokens, where certain visual tokens attract disproportionate attention during generation and behave as low-semantic, summary-like visual aggregators [Kang et al., 2025; Luo et al., 2025]. Leveraging the generalizability of sink-token formation across VLMs, recent work explores transferable hallucination attacks [Wang et al., 2025]. In this paper, we propose SISA, a surrogateonly attack framework exploiting the visual sink token. SISA crafts transferable adversarial inputs by inducing a sink token as a structural anchor and enforcing sink-conditioned semantic alignment for targeted elicitation.

6 Conclusion

In this paper, we propose SISA, the first adversarial attack framework against VLM unlearning under a more relaxed access setting. Unlike prior attacks, SISA does not rely on the unlearned model's architecture, parameters, or output-logit queries. SISA induces a sink-like behavior at a visual token and aligns model output to the target while conditioning attention on the induced sink token. The persistence of sink token and sink-conditioned semantic alignment enable crafting transferable adversarial inputs, thereby undermining the reliability of expected forgetting behavior. Extensive experiments demonstrate that SISA achieves notable performance across settings and outperforms state-of-the-art attacks.

Acknowledgments

This work was supported by NSFC (Grant No. U2241213), Guangxi Key Research and Development Project (Guike AB25069120), NSFC (Grant No. 62272038).