On Evaluating Adversarial Robustness of Large Vision-Language Models

Large vision-language models (VLMs) such as GPT-4 have achieved unprecedented performance in response generation, especially with visual inputs, enabling more creative and adaptable interaction than large language models such as ChatGPT. Nonetheless, multimodal generation exacerbates safety concerns, since adversaries may successfully evade the entire system by subtly manipulating the most vulnerable modality (e.g., vision). To this end, we propose evaluating the robustness of open-source large VLMs in the most realistic and high-risk setting, where adversaries have only black-box system access and seek to deceive the model into returning the targeted responses. In particular, we first craft targeted adversarial examples against pretrained models such as CLIP and BLIP, and then transfer these adversarial examples to other VLMs such as MiniGPT-4, LLaVA, UniDiffuser, BLIP-2, and Img2Prompt. In addition, we observe that black-box queries on these VLMs can further improve the effectiveness of targeted evasion, resulting in a surprisingly high success rate for generating targeted responses. Our findings provide a quantitative understanding regarding the adversarial vulnerability of large VLMs and call for a more thorough examination of their potential security flaws before deployment in practice. Code is at https://github.com/yunqing-me/AttackVLM.

Paper

References (100)

Scroll for more · 38 remaining

Similar papers

Peer review

Reviewer zQtG7/10 · confidence 4/52023-06-11

Summary

This paper aims to assess the adversarial robustness of vision components in large vision-language models, which is an increasingly significant issue due to the prevalence of such models. The experiments conducted in this study are extensive, encompassing evaluations on UniDiffuser, BLIP, BILP-2, Img2Prompt, MiniGPT-4, and LLaVA. The research investigates transfer-based attacks and also employs black-box queries to enhance the effectiveness of the evaluation method.

Strengths

The paper conducts extensive experiments on six prominent large vision-language models. By evaluating the adversarial robustness on these models, the study provides a comprehensive analysis that covers a wide range of architectures, ensuring the results are representative and applicable to the broader landscape of vision-language models. One of the key strengths is that the paper demonstrates effective and realistic attacks specifically tailored for these models. By employing transfer-based attacks and utilizing black-box queries, the study goes beyond traditional methods to showcase the vulnerabilities and potential risks faced by large vision-language models in real-world scenarios.

Weaknesses

This is an evaluation paper. It would be nice to see how baseline defense, such as adversarial training on CLIP [1], would help mitigate the adversarial vulnerability of the proposed attack. The method focuses on the vision part, which is easier to attack, what about attacks on the language? [1] Mao et al. Understanding Zero-Shot Adversarial Robustness for Large-Scale Models. ICLR 2023.

Questions

What are the computational resources used to reproduce the paper?

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

None.

Reviewer UbWE6/10 · confidence 4/52023-06-15

Summary

The paper evaluates the pixel-space adversarial robustness of large vision-language models (VLMs), where the targeted attack has only black-box access to the large VLM systems. The paper introduces two adversarial strategies: transfer-based and query-based. The transfer-based strategy performs white-box attacks on surrogate models like CLIP and BLIP and transfers to large VLMs including MiniGPT-4 and LLaVA. The query-based strategy uses transfer-based priors to improve the efficacy of targeted evasion against these VLMs. The authors demonstrate the effectiveness of these strategies through comprehensive evaluations.

Strengths

1. The paper is well-presented with good motivation, and the authors provide a clear storyline with visual demonstrations to validate the proposed approach. 2. It is novel to optimize the adversarial objective by matching image-image features (MF-ii) on large VLMs. The following Query-based attacking strategy (MF-tt) further enhances the effectiveness of the attack. 3. The authors analyze the approach from multiple perspectives. The paper includes discussions on the influences of the perturbation, and the Grad-CAM interpretation visualizes the model decision well.

Weaknesses

1. The black-box setting is questionable. Although the adversary only has black-box access to the victim system $p_{\theta}$, the transfer-based attack has white-box access to foundation components like CLIP. There is a high chance that the victim system shares mutual information (e.g., $p_{\theta}$ contains CLIP / $p_{\theta}$ trains on the same vision-language dataset / $p_{\theta}$ has similar model architecture) with these white-box components. It will be beneficial if the authors elaborate more on the source of transferability. 2. Although the Query-based attacking strategy (MF-tt) is feasible, the cost of such a process can be high. What is the forward inference cost (e.g., time of API call) per query, and how many queries are needed per attack? Authors should show the cost effectiveness of query attacks. 3. The experiments mainly focus on imposing MF-ii as a prior for the following MF-tt queries. It will be constructive If authors demonstrate more on the sole use of MF-tt (which aligns with the black-box setting and is more computationally lightweight) without a strong MF-ii prior for the query attack.

Questions

1. The authors give Section 4.3 the title *VLMs induce semantic adversarial perturbations*. However, what Fig. 5 shows is not semantic adversarial examples but inference results of pixel-wise adversarial noises. The term semantic adversarial perturbation commonly indicates semantic variations that fail the model [1]. Is Fig. 5 trying to discuss *does VLM adversarial perturbations induce semantic meanings*? 2. Since the pixel-space adversarial noises are not intuitive/interpretable to human observers, are there any future discussions on generating VLM attacks based on physically-observable attributes or languages [1,2,3,4]? 3. To conclude, this paper is a timely contribution to the field. I will consider revising the rating based on the soundness of the authors' responses. [1] ICCV 2019, Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers. [2] ECCV 2020, Semanticadv: Generating adversarial examples via attribute-conditioned image editing [3] CVPR 2023, Zero-shot Model Diagnosis [4] ICLR 2023, Diagnosing and Rectifying Vision Models using Language

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

4 excellent

Contribution

3 good

Limitations

Yes, the authors have stated the potential limitations of the work.

Reviewer Xvuc7/10 · confidence 4/52023-07-02

Summary

This paper focuses on black-box targeted adversarial attacks on multimodal vision/language models via transfer. They observe particular vulnerability to transfer attacks because an adversarial image can be constructed in a fully-differentiable manner w.r.t. a model like CLIP and then transferred over to the black box target model. Their final approach involves matching the adversarial image features to both text and image features in the surrogate models used for training.

Strengths

I think the combined method MF-it and MF-ii is clever, and I think the results are impressive. I find the paper clearly valuable and timely since models with these vulnerabilities are currently being deployed and their vulnerabilities could pose risks. I appreciate the discussion of this in the conclusion. I think that the experiments are compelling. I do not spot errors.

Weaknesses

(Minor) I find the figs to be generally cluttered. I would have liked to see experiments related to real-world concerns such as ones that were meant to illustrate real ways that these attacks could cause problems. For example, evading NSFW filters or making language models provide misinformation about an image that is used in a query.

Questions

Could these vulnerabilities have been foreseen (probably yes)? Have they been addressed at all by the people open-sourcing VLMs? What are the most immediate risks posed by deployed VLMs? What does this mean for AI norms and governance? I would welcome more discussion of these in the discussion section.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

This paper did not focus on defenses for these attacks, but I would not have expected it to. The use of GradCAM to analyze the attacks is limited and based on visual inspection. Also GradCAM and similar methods are well known to have many problems. Given my familiarity with some of the problems with feature attribution methods, these experiments don't really add much to the paper in my opinion.

Reviewer csPu7/10 · confidence 4/52023-07-09

Summary

The authors propose to generate adversarial attacks on different vision-language models (VLM) like BLIP, MiniGPT4, and UniDiffuser. The proposed method is simple and straightforward. To perturb the image, the authors propose to maximise the similarity (inner dot product) between the image-image / text-text / image-text features of CLIP. The attacked image is then transferred to the black box VLM models, which generates some text on these images. The similarity between the generated and the target text is calculated using unnormalised cosine similarity on the CLIP text encoder outputs. Maximising the similarity between the CLIP encodings of clean and target text and CLIP encodings of the clean and generated images of target text doesn't require any gradient approximation. But maximising the similarity between the target text encodings and generated text requires zero-order optimisation to get the gradients on the image. The authors demonstrate that the proposed attack completely fools the VLM models to generate text very similar to the target text.

Strengths

* The proposed method is incredibly simple and, therefore highly valuable for the community * The proposed method evaluates different types of VLM models, which makes the claims of the proposed method stronger. * The problem identified is timely and highlights the importance of building robust VLM models in future.

Weaknesses

* The proposed method shows the results of the PGD-100 attack, while in most of the black box attacks, it is observed that stronger attacks can overfit to the surrogate model resulting in worse transferability. Therefore, it would be good if the authors can also share the results on weaker attacks like PGD-10 and FGSM. * I think comparing the text quality using the CLIP score may not give the true picture. I would be nice if the authors can try some other metrics to compare the text quality. * For some of the approaches like LLaVA and MiniGPT-4 in Table-2, the results obtained using the proposed attacks like MF-it and MP-ii are very close (almost similar) to the clean image. Does this mean that the model is not able to get fooled? It would be nice if the authors can present results using some metrics which can quantify whether the model is fooled or not. This will help in getting a deeper understanding of the proposed method.

Questions

It would be great if the authors can address the raised concerns in the weakness section.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

4 excellent

Presentation

4 excellent

Contribution

3 good

Limitations

The authors have properly addressed the limitations and negative societal impact of their work.

Reviewer Xvuc2023-08-10

Reply

Thank you for the updates and comments. I have few further comments to discuss. I think my rating will most likely stay at a 6 but may increase to a 7. I will be paying attention to the rebuttal process and other reviews in the next week. What if any changes are being made to the paper regarding 3 and 4? Could the authors paste the updates in response to 6 into a reply?

Authorsrebuttal2023-08-11

Thank you for your feedback

Thank you for your timely feedback. ***Q (a): What if any changes are being made to the paper regarding 3 and 4?*** Since an additional content page is allowed for the final revision of NeurIPS (if our paper is accepted), we will add additional subsections or paragraphs in Section 5 to involve the contents we responded to *Q3* and *Q4*. These contents include discussions such as adversarial vulnerabilities that could be foreseen but have not yet been addressed by the people open-sourcing VLMs; as well as AI norms, governance and the immediate risks posed by deployed VLMs. (We are unsure whether we understand this question correctly. Please let us know if there are any additional details you'd like to discuss.) ***Q (b): Could the authors paste the updates in response to 6 into a reply?*** We will include more discussions about the motivation for visual inspection and the limitations of using GradCAM in Section 4.3 (after Lines 221-226), as summarized below: As to the motivation, we followed Img2Prompt [1] and used GradCAM to compute and visualize the relevancy score of image patches with respect to the question (i.e., `query’), as demonstrated in our interpreting analyses (Figure 7 in the main paper and Figure VI in the Appendix). We clarify that this visual inspection only provide an *intuitive* way to interpret our attacking mechanism. Nonetheless, we emphasize that the use of GradCAM as a feature attribution method has limitations [2]. GradCAM's inability to localize multiple occurrences of an object in an image has been observed. While multiple occurrences of the same object in an image are common, GradCAM causes inaccurate localisation of a heatmap for an object (due to the global average pooling operation). On the other hand, the continuous upsampling and downsampling processes may also result in signal loss prior to visualization. ***References:*** \ [1] Guo et al. From Images to Textual Prompts: Zero-shot Visual Question Answering with Frozen Large Language Models. CVPR 2023 \ [2] Chattopadhay et al. Grad-Cam++: Generalized Gradient-Based Visual Explanations for Deep Convolutional Networks. WACV 2018

Reviewer UbWE2023-08-11

I appreciate the revision and the insights provided by the rebuttal. The experiments are sufficiently good. I will raise the rating to 6.

Authorsrebuttal2023-08-12

Thank you for your feedback

We appreciate your detailed comments and suggestions. We will polish our paper further and incorporate new results into the final revision. Thank you again!

Reviewer csPu2023-08-19

I want to thank the authors for providing a comprehensive rebuttal. I appreciate the authors for accepting that their method is difficult to apply for larger VLMs. I think this work shows a very interesting direction and would be valuable for the community. I will keep up my score.

Authorsrebuttal2023-08-19

Thank you for your feedback

We appreciate your detailed comments and suggestions. We will polish our paper further and incorporate new results into the final revision. Thank you again!

Reviewer zQtG2023-08-19

A follow up question

The reviewer thanks the author, and the rebuttal answered my question 2,3. For Q1, I have a follow-up question, what adversarial variant does the experiment in Table E use? Is it the prompting or finetuning? Since the adversarial training is not almost not defending the attack, the reviewer is worried that the adversarial training experiment is not optimally conducted. More details should be provided, like what dataset the method finetuned on, how many epochs, and explanations on why the defense results are worse than the finding in [1].

Authorsrebuttal2023-08-20

Thank you for your feedback

Thank you for your feedback. We used the checkpoint corresponding to the adv-CLIP called `TeCoA w/ Finetuning’, as provided in https://github.com/cvlab-columbia/ZSRobust4FoundationModel (the official code released by [1]). In Table E, we applied adv-CLIP to defend our transfer-based MF-ii (i.e., using adv-CLIP as the surrogate model for MF-ii), and we left the clean-CLIP encoder in Unidiffuser unchanged because we observe that **substituting it with adv-CLIP will significantly degrade the clean performance of Unidiffuser**. Nevertheless, we focus on the robust performance in this response, and in Table F below, we report additional results of using adv-CLIP to defend our query-based MF-tt (i.e., substituting the clean-CLIP encoder in Unidiffuser with adv-CLIP), or defending both MF-ii and MF-tt. ***Tabel F: Results of attacking Unidiffuser*** | Method | RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble | |---------------|:-----------:|-----------:|-----------:|-----------:|-----------:|-----------:| | Clean image | 0.417 | 0.415 | 0.429 | 0.446 | 0.305 | 0.402 | | MF-ii (adv-CLIP) + MF-tt (adv-CLIP) | 0.584 | 0.549 | 0.583 | 0.611 | 0.456 | 0.557 | | MF-ii (clean-CLIP) + MF-tt (adv-CLIP) | 0.698 | 0.679 | 0.719 | 0.731 | 0.632 | 0.691 | | MF-ii (adv-CLIP) + MF-tt (clean-CLIP) | 0.739 | 0.724 | 0.755 | 0.766 | 0.675 | 0.731 | | MF-ii (clean-CLIP) + MF-tt (clean-CLIP) | 0.748 | 0.734 | 0.759 | 0.773 | 0.684 | 0.739 | Please note that for transfer-based MF-ii, **the adversary can freely choose its surrogate model (e.g., either clean-CLIP or adv-CLIP)**, so the results in Table F demonstrate that even if the encoder in Unidiffuser is enhanced by adv-CLIP (i.e., MF-tt (adv-CLIP)), our attacks can still apply clean-CLIP in MF-ii (i.e., MF-ii (clean-CLIP)) to conduct a good initialization and efficiently evade Unidiffuser by combining with MF-tt (i.e., **the results in the row of MF-ii (clean-CLIP) + MF-tt (adv-CLIP)**). The reason why adv-CLIP may be less effective at protecting large VLMs such as Unidiffuser is that the CLIP encoder only occupies a small portion of these VLMs (e.g., the CLIP encoder has 300M parameters, Unidiffuser has 1.4B parameters, and MiniGPT-4/LLaVA has more than 13B parameters). As a result, a strong defense may necessitate improving both the CLIP encoder and the language model in these VLMs. We will incorporate these discussions into the revision and conduct additional experiments on other large VLMs enhanced by [1]. ***Reference:*** \ [1] Mao et al. Understanding Zero-Shot Adversarial Robustness for Large-Scale Models. ICLR 2023

Reviewer zQtG2023-08-20

Thank you for your clarification

The reviewer thanks the authors' reply. After checking paper [1], the released model are trained for 1/255 robustness, while this work's attack is 8/255 which is a larger bound. This can explain the why defense is not effective under the proposed attack because they are not adversarially trained on 8/255 attack. The author ideally should run [1] with the proposed 8/255 bounded attack for adversarial training, which might defend some of the attack in vision model in this work. Or launch their attack with 1/255 against the VLM + CLIP model to reuse the checkpoint in [1].

Authorsrebuttal2023-08-20

Thank you for the further comments

Thank you for the further comments. We need to emphasize that, because we aim to fool large VLMs into returning *targeted* responses under *black-box* settings, we cannot achieve this difficult goal with a perturbation budget of 1/255, as ablated in Figure 6 of the main paper. We would like to evaluate the clean and robust performance of enhancing large VLMs with adv-CLIP under the 8/255 threat model, but because the authors of [1] only released 1/255 checkpoint, we are unable to meet the rebuttal deadline (only 1 day left) to retrain adv-CLIP models under the 8/255 threat model (we note that there are no results in [1] for the 8/255 threat model, so we must communicate with the authors to ensure that we correctly reimplement their model for fair comparison). We will conduct these experiments and report the full results in the revision.

Reviewer zQtG2023-08-20

The authors addressed my questions

Thank you for clarification. The plan makes sense.

Authorsrebuttal2023-08-20

Thank you

Thank you for the insightful discussion and raising the rating. :-)

Authorsrebuttal2023-08-20

Thank you for raising the rating

Thank you for your detailed comments, we will incorporate these discussions and changes in the final revision. We also appreciate your decision to raise the rating to a 7, and if possible, *could you please also edit the rating in the original review?* :-) Thank you again!

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC