{"authors":[{"id":"orcid_______::b5a3d6146ea8062fb0cfbb1032b65e07","fullName":"Dario Lazzaro","name":null,"surname":null,"rank":1,"pid":{"id":{"scheme":"orcid","value":"0009-0007-5125-2290"},"provenance":null}},{"id":"orcid_______::6e133cd29a2e9d1197ae7c336416823f","fullName":"Raffaele Mura","name":null,"surname":null,"rank":2,"pid":{"id":{"scheme":"orcid","value":"0009-0005-8719-3048"},"provenance":null}},{"id":"orcid_______::e8eceabd53ba30b5ad003ea4a176fc0b","fullName":"Antonio Emanuele Cinà","name":null,"surname":null,"rank":3,"pid":{"id":{"scheme":"orcid","value":"0000-0003-3807-6417"},"provenance":null}},{"id":null,"fullName":"Giuseppe Laurita","name":null,"surname":null,"rank":4,"pid":null},{"id":null,"fullName":"Gianni Viardo Vercelli","name":null,"surname":null,"rank":5,"pid":{"id":{"scheme":"orcid_pending","value":"0000-0002-5032-4228"},"provenance":null}},{"id":"orcid_______::47ac2583ee1f2f0afdd7e82616b75fb0","fullName":"Luca Oneto","name":null,"surname":null,"rank":6,"pid":{"id":{"scheme":"orcid","value":"0000-0002-8445-395x"},"provenance":null}},{"id":"orcid_______::a07b6975c17f18ea0f7fcf02718f5aef","fullName":"Battista Biggio","name":null,"surname":null,"rank":7,"pid":{"id":{"scheme":"orcid","value":"0000-0001-7752-509x"},"provenance":null}},{"id":"orcid_______::8c8ac3b95372eb225ccc3e3bd65a4fb3","fullName":"Fabio Roli","name":null,"surname":null,"rank":8,"pid":{"id":{"scheme":"orcid","value":"0000-0003-4103-9190"},"provenance":null}}],"openAccessColor":"hybrid","publiclyFunded":false,"eoscIfGuidelines":null,"type":"publication","language":{"code":"eng","label":"English"},"countries":[{"code":"IT","label":"Italy","provenance":null}],"subjects":[{"subject":{"scheme":"keyword","value":"Machine learning security; Data poisoning; Text-to-image retrieval; Vision-language models; Expectation over queries; Robustness"},"provenance":null},{"subject":{"scheme":"FOS","value":"0202 electrical engineering, electronic engineering, information engineering"},"provenance":null},{"subject":{"scheme":"FOS","value":"02 engineering and technology"},"provenance":null},{"subject":{"scheme":"keyword","value":"Data poisoning; Expectation over queries; Machine learning security; Robustness; Text-to-image retrieval; Vision-language models"},"provenance":null}],"mainTitle":"Poison once, fool many: Practical poisoning attacks against text-to-image retrieval systems","subTitle":null,"descriptions":["Text-to-Image retrieval (IR) systems are widely used to match images to specific textual queries, often leveraging publicly available Vision-Language Pretrained models (VLPs) for their generalization capabilities. However, due to the diverse and open nature of the image data they rely on, these systems remain vulnerable to data poisoning attacks, where malicious images are injected into the database to manipulate retrieval results. Prior work has demonstrated the effectiveness of attacks when the exact user query is known at retrieval time. However, this assumption is often impractical, as users tend to express similar intents using varied, semantically equivalent queries (e.g., through synonyms), which reduces the effectiveness of existing attacks. In this paper, we address this gap by proposing an attack that remains effective even when users issue semantically varied queries. We introduce Collisio, a novel poisoning method that crafts a single poisoned image to be retrieved under any semantically equivalent form of a target query. To achieve this, Collisio leverages an Expectation over Queries (EoQ) strategy, generating a diverse set of synthetic and selectively transformed query variants, and then optimizes the poisoned image to align with them. We extensively evaluate Collisio on the Flickr30k and MSCOCO datasets across multiple VLPs, demonstrating the severity of Collisio under realistic query variations. Given the implications of this vulnerability, we examine countermeasures based on adversarially trained models and a data preprocessing defense, highlighting both their mitigation potential and the trade-offs involved."],"publicationDate":"2026-02-01","publisher":"Elsevier BV","embargoEndDate":null,"sources":["Crossref"],"formats":["application/pdf"],"contributors":null,"coverages":null,"bestAccessRight":{"code":"c_abf2","label":"OPEN","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/"},"container":{"name":"Knowledge-Based Systems","issnPrinted":"0950-7051","issnOnline":null,"issnLinking":null,"ep":null,"iss":null,"sp":"115090","vol":"334","edition":null,"conferencePlace":null,"conferenceDate":null},"documentationUrls":null,"codeRepositoryUrl":null,"programmingLanguage":null,"contactPeople":null,"contactGroups":null,"tools":null,"size":null,"version":null,"geoLocations":null,"id":"doi_dedup___::ce2cd45600b601f6761dd53b061ba1ce","originalIds":["S0950705125021288","10.1016/j.knosys.2025.115090","50|doiboost____|ce2cd45600b601f6761dd53b061ba1ce","50|dblp________::d41a15acd417b65d52dbe2ea14010200","oai:iris.unica.it:11584/465706","50|od______3705::c138b8f58e816dc25d5ab7da81b00cc9","50|od______3710::5517851a49bf43ef069b8959bb6f1b40","oai:unige.iris.cineca.it:11567/1297270"],"pids":[{"scheme":"doi","value":"10.1016/j.knosys.2025.115090"},{"scheme":"handle","value":"11584/465706"},{"scheme":"handle","value":"11567/1297270"}],"dateOfCollection":null,"lastUpdateTimeStamp":null,"indicators":{"citationImpact":{"citationCount":0.0,"influence":2.2251732E-9,"popularity":2.7165745E-9,"impulse":0.0,"citationClass":"C5","influenceClass":"C5","impulseClass":"C5","popularityClass":"C5"}},"projects":[{"id":"corda_____he::1c53907b78bb7a7765ce158190572b73","code":"101120393","acronym":"Sec4AI4Sec","title":"Cybersecurity for AI-Augmented Systems","funder":"European Commission","pids":[{"scheme":"doi","value":"10.3030/101120393"}]},{"id":"miur________::1e5e62235d094afd01cd56e65112fc63","code":"unidentified","acronym":null,"title":"unidentified","funder":"Ministero dell'Istruzione dell'Università e della Ricerca","pids":null},{"id":"corda_____he::11de478d3259cb6c919efec4eea8ae9b","code":"101070617","acronym":"ELSA","title":"European Lighthouse on Secure and Safe AI","funder":"European Commission","pids":[{"scheme":"doi","value":"10.3030/101070617"}]}],"organizations":[{"legalName":"University of Cagliari","acronym":"University of Cagliari","id":"openorgs____::9be673852bd7263f5619812856adc52a","pids":[{"scheme":"Wikidata","value":"Q39918611"},{"scheme":"fundref","value":"501100002772"},{"scheme":"OrgReg","value":"IT0013"},{"scheme":"wikidata","value":"Q39918611"},{"scheme":"PIC","value":"999841663"},{"scheme":"GRID","value":"grid.7763.5"},{"scheme":"wikidata","value":"Q2067315"},{"scheme":"ISNI","value":"0000000417553242"},{"scheme":"OrgRef","value":"4958826"},{"scheme":"fundref","value":"100013003"},{"scheme":"Wikidata","value":"Q2067315"},{"scheme":"ROR","value":"https://ror.org/003109y17"},{"scheme":"FundRef","value":"100013003"},{"scheme":"mag_id","value":"172446870"},{"scheme":"FundRef","value":"501100002772"}]},{"legalName":"University of Genoa","acronym":"UniGe","id":"openorgs____::53df715e03d652944df3d336afe1181a","pids":[{"scheme":"PIC","value":"999976687"},{"scheme":"OrgReg","value":"IT0028"},{"scheme":"ISNI","value":"0000000121513065"},{"scheme":"Wikidata","value":"Q593321"},{"scheme":"ROR","value":"https://ror.org/0107c5v14"},{"scheme":"FundRef","value":"501100004702"},{"scheme":"mag_id","value":"83816512"},{"scheme":"fundref","value":"501100004702"},{"scheme":"wikidata","value":"Q593321"},{"scheme":"GRID","value":"grid.5606.5"},{"scheme":"OrgRef","value":"456119"}]}],"communities":null,"collectedFrom":[{"key":"opendoar____::2cfa3753d6a524711acb5fce38eeca1a","value":"Archivio istituzionale della ricerca - Università di Cagliari"},{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"},{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"},{"key":"opendoar____::5505712229fb1eb500efadddc0353264","value":"Archivio istituzionale della ricerca - Università di Genova"}],"instances":[{"pids":[{"scheme":"doi","value":"10.1016/j.knosys.2025.115090"}],"license":"CC BY","accessRight":{"code":"c_abf2","label":"OPEN","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":"hybrid"},"type":"Article","urls":["https://doi.org/10.1016/j.knosys.2025.115090"],"publicationDate":"2026-02-01","refereed":"peerReviewed","hostedBy":{"key":"issn___print::767908623cdc7f04f275d12a7d8f3901","value":"Knowledge-Based Systems"},"collectedFrom":{"key":"openaire____::081b82f96300b6a6e3d282bad31cb6e2","value":"Crossref"}},{"alternateIdentifiers":[{"scheme":"doi","value":"10.1016/j.knosys.2025.115090"}],"type":"Article","urls":["https://doi.org/10.1016/j.knosys.2025.115090"],"publicationDate":"2026-01-01","refereed":"nonPeerReviewed","hostedBy":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"},"collectedFrom":{"key":"openaire____::d8b68cc0a53121f6f896883a7d60c1db","value":"DBLP"}},{"pids":[{"scheme":"handle","value":"11584/465706"}],"alternateIdentifiers":[{"scheme":"urn","value":"WOS:001645887400001"},{"scheme":"urn","value":"https://hdl.handle.net/11584/465706"},{"scheme":"doi","value":"10.1016/j.knosys.2025.115090"},{"scheme":"urn","value":"2-s2.0-105024993056"}],"accessRight":{"code":"c_abf2","label":"OPEN","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Article","urls":["https://hdl.handle.net/11584/465706","https://doi.org/10.1016/j.knosys.2025.115090"],"publicationDate":"2026-01-01","refereed":"nonPeerReviewed","hostedBy":{"key":"opendoar____::2cfa3753d6a524711acb5fce38eeca1a","value":"Archivio istituzionale della ricerca - Università di Cagliari"},"collectedFrom":{"key":"opendoar____::2cfa3753d6a524711acb5fce38eeca1a","value":"Archivio istituzionale della ricerca - Università di Cagliari"}},{"pids":[{"scheme":"handle","value":"11567/1297270"}],"alternateIdentifiers":[{"scheme":"doi","value":"10.1016/j.knosys.2025.115090"},{"scheme":"urn","value":"2-s2.0-105024993056"}],"accessRight":{"code":"c_14cb","label":"CLOSED","scheme":"http://vocabularies.coar-repositories.org/documentation/access_rights/","openAccessRoute":null},"type":"Article","urls":["https://doi.org/10.1016/j.knosys.2025.115090","https://hdl.handle.net/11567/1297270"],"publicationDate":"2026-01-01","refereed":"nonPeerReviewed","hostedBy":{"key":"opendoar____::5505712229fb1eb500efadddc0353264","value":"Archivio istituzionale della ricerca - Università di Genova"},"collectedFrom":{"key":"opendoar____::5505712229fb1eb500efadddc0353264","value":"Archivio istituzionale della ricerca - Università di Genova"}}],"links":[{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"corda_____he::1c53907b78bb7a7765ce158190572b73","relatedRecordType":"project","relationProvenance":"sysimport:actionset","trust":"0.91"},"collectedfrom":[{"dsId":"openaire____::3f264f93cf3b0cfc4ede188a6300455c","dsName":"CORDA - COmmon Research DAta Warehouse - Horizon Europe"}],"projectTitle":"Cybersecurity for AI-Augmented Systems","code":"101120393","funding":{"funder":{"id":"ec__________::EC","shortname":"EC","name":"European Commission","jurisdiction":{"code":"EU","label":"European Union"},"pid":null},"level0":{"id":"ec__________::EC::HE","description":"Horizon Europe Framework Programme","name":"HE"},"level1":{"id":"ec__________::EC::HE::HORIZON-RIA","description":"HORIZON  Research and Innovation Actions","name":"HORIZON-RIA"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2023-10-01","endDate":"2026-09-30"},{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"miur________::1e5e62235d094afd01cd56e65112fc63","relatedRecordType":"project","relationProvenance":"sysimport:actionset","trust":"0.91"},"collectedfrom":[{"dsId":"openaire____::6af21b0579ec78dd1ee8bf1b276ce5c2","dsName":"Ministero dell'Istruzione dell'Università e della Ricerca"}],"projectTitle":"unidentified","code":"unidentified","funding":{"funder":{"id":"miur________::MIUR","shortname":"MIUR","name":"Ministero dell'Istruzione dell'Università e della Ricerca","jurisdiction":{"code":"IT","label":"Italy"},"pid":null},"level0":{"id":null,"description":null,"name":null},"level1":{"id":null,"description":null,"name":null},"level2":{"id":null,"description":null,"name":null}}},{"header":{"relationType":"resultProject","relationClass":"isProducedBy","relatedIdentifier":"corda_____he::11de478d3259cb6c919efec4eea8ae9b","relatedRecordType":"project","relationProvenance":"sysimport:actionset","trust":"0.91"},"collectedfrom":[{"dsId":"openaire____::3f264f93cf3b0cfc4ede188a6300455c","dsName":"CORDA - COmmon Research DAta Warehouse - Horizon Europe"}],"projectTitle":"European Lighthouse on Secure and Safe AI","code":"101070617","funding":{"funder":{"id":"ec__________::EC","shortname":"EC","name":"European Commission","jurisdiction":{"code":"EU","label":"European Union"},"pid":null},"level0":{"id":"ec__________::EC::HE","description":"Horizon Europe Framework Programme","name":"HE"},"level1":{"id":"ec__________::EC::HE::HORIZON-RIA","description":"HORIZON  Research and Innovation Actions","name":"HORIZON-RIA"},"level2":{"id":null,"description":null,"name":null}},"startDate":"2022-09-01","endDate":"2026-08-31"}],"otherTitles":null,"inDiamondJournal":false,"green":true,"isGreen":true,"isInDiamondJournal":false}