Summary
The paper evaluates the pixel-space adversarial robustness of large vision-language models (VLMs), where the targeted attack has only black-box access to the large VLM systems. The paper introduces two adversarial strategies: transfer-based and query-based. The transfer-based strategy performs white-box attacks on surrogate models like CLIP and BLIP and transfers to large VLMs including MiniGPT-4 and LLaVA. The query-based strategy uses transfer-based priors to improve the efficacy of targeted evasion against these VLMs. The authors demonstrate the effectiveness of these strategies through comprehensive evaluations.
Strengths
1. The paper is well-presented with good motivation, and the authors provide a clear storyline with visual demonstrations to validate the proposed approach.
2. It is novel to optimize the adversarial objective by matching image-image features (MF-ii) on large VLMs. The following Query-based attacking strategy (MF-tt) further enhances the effectiveness of the attack.
3. The authors analyze the approach from multiple perspectives. The paper includes discussions on the influences of the perturbation, and the Grad-CAM interpretation visualizes the model decision well.
Weaknesses
1. The black-box setting is questionable. Although the adversary only has black-box access to the victim system $p_{\theta}$, the transfer-based attack has white-box access to foundation components like CLIP. There is a high chance that the victim system shares mutual information (e.g., $p_{\theta}$ contains CLIP / $p_{\theta}$ trains on the same vision-language dataset / $p_{\theta}$ has similar model architecture) with these white-box components. It will be beneficial if the authors elaborate more on the source of transferability.
2. Although the Query-based attacking strategy (MF-tt) is feasible, the cost of such a process can be high. What is the forward inference cost (e.g., time of API call) per query, and how many queries are needed per attack? Authors should show the cost effectiveness of query attacks.
3. The experiments mainly focus on imposing MF-ii as a prior for the following MF-tt queries. It will be constructive If authors demonstrate more on the sole use of MF-tt (which aligns with the black-box setting and is more computationally lightweight) without a strong MF-ii prior for the query attack.
Questions
1. The authors give Section 4.3 the title *VLMs induce semantic adversarial perturbations*. However, what Fig. 5 shows is not semantic adversarial examples but inference results of pixel-wise adversarial noises. The term semantic adversarial perturbation commonly indicates semantic variations that fail the model [1]. Is Fig. 5 trying to discuss *does VLM adversarial perturbations induce semantic meanings*?
2. Since the pixel-space adversarial noises are not intuitive/interpretable to human observers, are there any future discussions on generating VLM attacks based on physically-observable attributes or languages [1,2,3,4]?
3. To conclude, this paper is a timely contribution to the field. I will consider revising the rating based on the soundness of the authors' responses.
[1] ICCV 2019, Semantic Adversarial Attacks: Parametric Transformations That Fool Deep Classifiers.
[2] ECCV 2020, Semanticadv: Generating adversarial examples via attribute-conditioned image editing
[3] CVPR 2023, Zero-shot Model Diagnosis
[4] ICLR 2023, Diagnosing and Rectifying Vision Models using Language
Rating
6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
Confidence
4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.
Limitations
Yes, the authors have stated the potential limitations of the work.