Adversarial Evaluation of Multimodal Models under Realistic Gray Box Assumption

This work examines the vulnerability of multimodal (image + text) models to\nadversarial threats similar to those discussed in previous literature on\nunimodal (image- or text-only) models. We introduce realistic assumptions of\npartial model knowledge and access, and discuss how these assumptions differ\nfrom the standard "black-box"/"white-box" dichotomy common in current\nliterature on adversarial attacks. Working under various levels of these\n"gray-box" assumptions, we develop new attack methodologies unique to\nmultimodal classification and evaluate them on the Hateful Memes Challenge\nclassification task. We find that attacking multiple modalities yields stronger\nattacks than unimodal attacks alone (inducing errors in up to 73% of cases),\nand that the unimodal image attacks on multimodal classifiers we explored were\nstronger than character-based text augmentation attacks (inducing errors on\naverage in 45% and 30% of cases, respectively).\n