VLATTACK: Multimodal Adversarial Attacks on Vision-Language Tasks via Pre-trained Models

Vision-Language (VL) pre-trained models have shown their superiority on many multimodal tasks. However, the adversarial robustness of such models has not been fully explored. Existing approaches mainly focus on exploring the adversarial robustness under the white-box setting, which is unrealistic. In this paper, we aim to investigate a new yet practical task to craft image and text perturbations using pre-trained VL models to attack black-box fine-tuned models on different downstream tasks. Towards this end, we propose VLATTACK to generate adversarial samples by fusing perturbations of images and texts from both single-modal and multimodal levels. At the single-modal level, we propose a new block-wise similarity attack (BSA) strategy to learn image perturbations for disrupting universal representations. Besides, we adopt an existing text attack strategy to generate text perturbations independent of the image-modal attack. At the multimodal level, we design a novel iterative cross-search attack (ICSA) method to update adversarial image-text pairs periodically, starting with the outputs from the single-modal level. We conduct extensive experiments to attack five widely-used VL pre-trained models for six tasks. Experimental results show that VLATTACK achieves the highest attack success rates on all tasks compared with state-of-the-art baselines, which reveals a blind spot in the deployment of pre-trained VL models. Source codes can be found at https://github.com/ericyinyzy/VLAttack.

Paper

Similar papers

Peer review

Reviewer zqVz5/10 · confidence 4/52023-06-15

Summary

The authors present a new adversarial attack framework, VLATTACK, to evaluate the robustness of large vision-language models (VLMs). The paper introduces a two-step adversarial attack approach. The first step involves attacking each modality (image and text) independently, and the second step employs a cross-search attack strategy to iteratively query the fine-tuned model for perturbation update. The paper conducts experiments on multiple pre-trained models that are fine-tuned for downstream vision tasks.

Strengths

1. The paper is well-written with a clear presentation that demonstrates the proposed framework. 2. The VLATTACK, which is a two-step adversarial attack framework, involves both white-box gradient attack and black-box query attack. This idea is interesting with practical implementation. 3. The evaluation takes account of multiple types of pre-trained models, and the BSA part of the attack overperforms SOTA image-space adversarial baselines.

Weaknesses

1. The black-box setting is questionable. Although the adversary only has black-box access to the downstream fine-tuned model, the first stage of attack has white-box access to widely-used foundations like ViLT. There is a high chance that the victim model shares mutual information (e.g., has knowledge of the same vision-language dataset / has the same model architecture) with the white-box pre-trained model. It will be beneficial if the authors elaborate more on the source of transferability. 2. Section 4.2 (ICSA) claims to be under the black-box setting. However, Lines 228-229 describe the process to update the perturbation by optimizing the attack loss of Eq. (2). Authors should write clearly how the gradient is obtained, and what model is white-box during this step. 3. Section 4.1 Text-Attack part uses clean image $\mathbf{I}$ instead of generated adversary $\mathbf{I'}$ for text optimization. Authors claim that this is to avoid unnecessary modification. However, using $\mathbf{I'}$ can possibly ease the difficulty of textual search and increase the success rate of adversarial textual optimization. Moreover, the authors should argue clearly what the unnecessary modification stands for. 4. The success of the attack will require a sufficient number of queries to generate effective adversaries. It will be helpful if authors evaluate the query cost (e.g., time of inference/API call), and discuss attack effectiveness by the number of queries.

Questions

1. Fig. 7 second column demonstrates that the model comprehension shifts from *A man in a purple shirt and **jeans*** to *A man in a purple shirt and **denim***. However, denim is the material pattern for the jeans shown in the image. The model prediction is still consistent with the image. It will be beneficial if the authors state clearly what this example stands for. 2. Given the setting of this paper that we have (1) publicly available pre-trained models and (2) the clean dataset for future perturbation, I wonder if it is possible to first fine-tune the model on the clean dataset for the downstream task and then conduct the transfer-based attack? It will be beneficial for this paper to argue the infeasibility of such approaches. 3. To summarize, with a fair paper presentation but several concerns stated in the weakness/question sections, I will rate it as a borderline accept at this stage. However, I look forward to the authors' response and I will consider revising the rating based on the soundness of the responses.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

3 good

Limitations

Yes, the authors have stated the potential limitations of the work in the supplementary materials.

Reviewer AgmN5/10 · confidence 4/52023-06-27

Summary

In this paper, the authors explore the adversarial vulnerability in visual language models. Specifically, a block-wise similarity attack is proposed to generate adversarial image examples, and the BERT-attack method is used for generating the adversarial text examples. The image and text pairs are perturbed by an iterative method with cross-search.

Strengths

1. This paper explores the black-box attack for vision language models, which is novel. 2. The proposed method can generate perturbed inputs to decrease the performance of the fine-tuned models on multi-modal and uni-modal datasets effectively.

Weaknesses

1. One important criterion for a successful adversarial attack is that the perturbed image cannot be distinguished by humans, and the semantic meaning of the text adversarial examples should be the same as the original one. However, there needs to be more analysis of the semantic similarity between the generated adversarial examples and the original text. The perturbation of the images should be measured as well. Most importantly, the perturbation of the generated image-text pairs should be analyzed. 2. By applying the iterative way for generating adversarial image and text pairs, the attackers need to query the large vision language model more times. The time costs and the average query numbers for a successful attack should be provided.

Questions

It is better to provide the analysis of the semantic similarity and the perturbation degree, as mentioned in Weaknesses 1. Compared to other methods, could you provide a thorough analysis of the costs and average query times of the proposed framework?

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

2 fair

Presentation

3 good

Contribution

3 good

Limitations

I did not find a potential negative societal impact.

Reviewer NrLG6/10 · confidence 4/52023-07-07

Summary

The paper presents VLAttack, which is a method for perturbing multimodal examples such that a multimodal model would get them wrong. VLAttack does not assume access to fine-tuned models but does assume access to foundation models that are used to create these downstream models. The authors argue that this level of access is reasonable because there are several real-world examples where the foundation model is available but downstream models are not. VLAttack makes models fail significantly more than similar adversarial attack algorithms across several datasets and tasks.

Strengths

As far as I am aware, the algorithm is novel (especially the visual perturbation part). And the authors showcase that it outperforms similar algorithms in the sense that it does not assume access to the fine-tuned model (which could be unreasonable) and it makes models get more errors.

Weaknesses

Major issues: It is great that VLAttack makes the models get higher error rates than other approaches, but crucially it is only a good result if VLAttack does not actually change the ground truth labels. It seems that you do not validate this with, e.g. crowd workers. Unless I missed it, the only validation that you do is presenting case studies of a few individual examples. Did you do a systematic validation? Less important (but still issues): More motivation would be nice. What scenarios are you envisioning for why VLAttack raises a safety concern? Self-driving car failures, etc.? Can you make these adversarial perturbations useful? For example, can you train a model on them to get better performance?

Questions

I tried to frame everything in the weaknesses section as questions.

Rating

6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

Limitations seem adequately addressed.

Reviewer 3TAC7/10 · confidence 4/52023-07-07

Summary

This paper focuses on adversarially attacking the multimodal finetuned models without getting access to the finetuned weights. By utilizing the activations and the parameters of the open-accessed pretrained model, this work proposes a method called VLATTACK for creating the adversarial attack samples for downstream tasks. The creating method first attempts to learn image perturbations via block-wise similarity attack (BSA) strategy. If not succeed, the text attack using BertAttack will be facilitated. If the two single-modal attack both fail, VLATTACK will use cross-search attack (ICSA) method to construct multimodal disrupted adversarial samples. Experimental results show the effectiveness of VLATTACK on various cross-modal (image-text) tasks and model structures. Some detailed analysis on the adversarial samples are also conducted.

Strengths

1. The experimental results are obtained based on various downstream tasks and pretrained models (in different architectures), which demonstrate the generalization ability of VLATTACK. 2. The choice of pretrained models are open-sourced, making the results more reproducible. 3. The performance of adversarial attack is good, compared with other typical and previous attacking methods. 4. The case study and ablation study are both well-conducted, providing insights on how the VLATTACK can achieve better attacking performance.

Weaknesses

Generally speaking, I think this paper is a good work on the topic of adversarial attacking. If the following issues are addressed, I think it will be much better: 1. Experiments or analysis on adversarial multimodal datasets: Some adversarially constructed datasets are proposed in previous works, based on the datasets used in this work, like Adversarial VQA. Does the created adversarial samples share some similarity with these datasets? I think some discussion or analysis on this research question can be performed and will be very welcomed. 2. Evaluation soundness: For VQA and captioning, an extra human evaluation on whether the predictions under attack are actually wrong will be much recommended, considering the automatic metrics may make false-positives. 3. Experiments on out-of-domain datasets: For OFA, we know the pretraining corpus include the downstream datasets (VQA, RefCOCO and MSCOCO), which may result in the adversarial samples easier to be obtained using the pretrained model. It would be very good if downstream datasets which not appear in pretraining OFA can be considered in experiments.

Questions

How would the performance of VLATTACK be affected under different model size (like OFA-base vs OFA-large) and image resolution ($224$ vs $480$)? I will be very happy if some insights can be provided.

Rating

7: Accept: Technically solid paper, with high impact on at least one sub-area, or moderate-to-high impact on more than one areas, with good-to-excellent evaluation, resources, reproducibility, and no unaddressed ethical considerations.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

3 good

Contribution

3 good

Limitations

The authors have proposed some limitations in the appendix, including the text attacking methods, downstream task scope and explored model architectures, which I think is reasonable and leave space for future research.

Reviewer pd9a5/10 · confidence 4/52023-07-07

Summary

The authors propose a substitute black-box attack strategy called VLAttack to generate adversarial examples by perturbing both images and texts on pre-trained models and then transferring them to finetuned models. At the image-modal level, they introduce a block-wise similarity attack (BSA) strategy to disrupt universal representations in the pre-trained model. At the multimodal level, they design an iterative cross-search attack (ICSA) to update adversarial image-text paris.

Strengths

1. This paper focuses on an important question concerning the prevalent pretraining and finetuning paradigm with respect to adversarial robustness. 2. The core idea of the proposed attack is clearly presented. 3. The proposed VLAttack could potentially serve as a valuable baseline for examining the robustness of multimodal models.

Weaknesses

Issues that affect my rating. 1. Lack of technique contributions. The question asked by the authors is quite valuable. However, the proposed attack strategy, VLAttack, seems trivial. Regarding the text modality, VLAttack directly employs the existing BertAttack[20]. For the image attack, the classical PGD attack with iteration $N_{s}=20$ is adapted. The idea of the proposed BSA loss Eq.2 is straightforward and similar to that of BadEncoder [a] (see BadEncoder's Eq.2~5), except BadEncoder focuses on the backdoor attack. The cross-modality attack should be the most important part, where the two modality attacks boost each other is excepted. However, the proposed "ICSA" seems directly concatenate the image and text attacks. Did the author have attempted to jointly optimize these two attacks? [a] Jia, J., Liu, Y., & Gong, N. Z. (2022, May). Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP) (pp. 2043-2059). IEEE. 2. Insufficient evaluation on popular multimodal models (CLIP, BLIP): I recommend that the authors extend their evaluation to include more prevalent multimodal models, such as CLIP or BLIP, as done in Co-attack[15] and BadEncoder[a]. This would enable readers and subsequent works to make more meaningful comparisons. 3. Ambiguity in the fine-tuned model settings: Considering the significant performance difference between VLAttack and baselines in Table 1, it is unclear how the target models are fine-tuned. Are the pre-trained model parameters fixed while training a task-specific head, or are all parameters fine-tuned throughout the pre-trained model? Providing clarity on this aspect is crucial for evaluating the impact of the proposed attack. Additional details should be included to enhance understanding. 4. Absence of essential ablation studies on BSA and ICSA: The effectiveness of BSA remains unclear, and a comparison with an attack on the pre-trained model's original loss could provide valuable insights. To showcase the efficacy of ICSA, a straightforward baseline could involve setting BSA's attack iteration $N_{s}=40$, without incorporating BERT-attack. The authors should consider conducting these ablation studies to better demonstrate their contributions.

Questions

Please refer to the weakness section.

Rating

5: Borderline accept: Technically solid paper where reasons to accept outweigh reasons to reject, e.g., limited evaluation. Please use sparingly.

Confidence

4: You are confident in your assessment, but not absolutely certain. It is unlikely, but not impossible, that you did not understand some parts of the submission or that you are unfamiliar with some pieces of related work.

Soundness

3 good

Presentation

4 excellent

Contribution

2 fair

Limitations

Yes

Reviewer zqVz2023-08-11

Thank the authors for providing a detailed rebuttal with experiments. Since the source of transferability remains the main challenge of this line of research, I will keep the rating as borderline accept.

Reviewer NrLG2023-08-16

Thanks for running that experiment. It is informative, and convinced me to change my rating above the "accept" threshold.

Reviewer pd9a2023-08-16

Thanks for the authors' response. **Question 1: Insufficient technical contributions** - The authors' responses do not fully address my concerns. It would be beneficial if the authors could directly answer my question: Have attempts been made to jointly optimize the text and image attacks? If so, why? If not, why not? Additionally, the authors might consider discussing and positioning their proposed Block-wise Similarity Attack (BSA) approach in comparison to the recently proposed BadEncoder [a] (see BadEncoder's Eq.2~5). Clarifying the distinction between these two methods could help to strengthen the contribution of this work. [a] Jia, J., Liu, Y., & Gong, N. Z. (2022, May). Badencoder: Backdoor attacks to pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium on Security and Privacy (SP) (pp. 2043-2059). IEEE. **Question 2: Insufficient evaluation on popular multimodal models (CLIP, BLIP)** I would still insist that it is important to augment the results in Table 1 with those from the CLIP and BLIP architectures, as done in Co-attack[15]. Omitting this step would make it challenging for readers to draw fair comparisons and accurately interpret the results.

Authorsrebuttal2023-08-18

`>>> Q1-1`: Joint Optimization We have attempted to optimize both image and text perturbations jointly, but the performance of the joint optimization is worse than that of the proposed VLAttack.Toward the joint optimization, we modify the proposed BSA loss by adding a new loss term for the text encoder, and its format is similar to the image encoder and multimodal encoder, where we compare the block-wise similarity between the clean text input and the perturbed text input. At each attack step, we directly follow the current BSA design to generate image perturbations for the image modality. We then move to the text modality. Due to the discrete nature of text data, we follow existing work [21] using the word embedding space to generate the text perturbations. First, we use the modified loss to calculate the gradients on the text and then add them to the original word embeddings. The summation can be treated as the ideal word embeddings of the perturbed text. The next step is to map these continuous embeddings to discrete words. For each informative word in the original text, we use BERT to calculate its synonym set following [20]. We then use the word synonym substitution approach to replace the original words with their synonyms under the constraint listed in Eq. (1) in the original paper to guarantee the semantics of the new perturbation. The new image and text perturbations will be iteratively updated until $N$ steps with the above processes. The experimental results are shown in the following table: |Dataset| BSA| BSA-joint| VLAttack| |-|-|-|-| |VQAv2|65.20|66.48|__78.05__| BSA-joint denotes the joint optimization, which performs slightly better than the proposed BSA on the VQAv2 dataset but is still far inferior compared to VLAttack. This is because the input text $\mathbf{T}$ is relatively short, and frequently perturbing texts and strictly coupling the updates may lead to fluctuations in the gradient information. Therefore, joint optimization degrades the overall attack performance. `>>> Q1-2`: BSA v.s. BadEncoder We admit the overall idea of the proposed BSA and BadEncoder is similar, and they all use similarity as the optimization target. However, the proposed BSA is different from or better than BadEncoder. (1) BadEncoder (Eq.2--5) only utilizes the final output feature vectors from the whole encoder, ignoring the outputs from the intermediate layers/blocks. However, BSA calculates fine-grained similarity scores. As shown in Eq. (2) of our original paper, we distinguish the outputs from image and Transformer encoders. Such a design can modify the low-level vision features and the high-level cross-modal representations. In our setting, we attack fine-tuned models of a wide diversity of downstream tasks, including but not limited to image classification tasks like Badencoder. The parameters of these task-specific models are fully finetuned on distinct datasets, and the output representations of the encoder significantly change accordingly. Thus, instead of only attacking the output feature from the last layer like BadEncoder, perturbing each intermediate feature representation from each encoder and each block can enhance the attack performance. This statement is also verified in Section 5.4, where the ASR score of BSA is higher than only attacking a single encoder. (2) The motivation for adopting the cosine distance is different. In BadEncoder, CLIP uses cosine similarity as a loss function to calculate distances for positive/negative image text pairs, which is motivated by the pre-training strategy of CLIP. However, we adopt cosine similarity because the fine-grained token representations attend to each other in the inner product space, which is inspired by the mechanism design of the Transformer structure. This motivation is also illustrated in Lines 180-181 of our original paper. We will add these discussions in the final version. `>>> Q2`: CLIP and BLIP Thanks for the constructive suggestions. We agree that adding more experiments on CLIP and BLIP is beneficial for validating the contributions of our work more comprehensively. For the CLIP model, we will add the experiments through the image classification task, which has been discussed in the previous response on the SVHN dataset. We will add results using more datasets. For the BLIP model, we experiment with the VQA task of the BLIP model using the VQAv2 dataset. The proposed models still achieve better performance, as shown below: |Dataset|DR|SSP|FDA|BSA|B&A|R&R|Co-Attack|VLAttack| |-|-|-|-|-|-|-|-|-| |VQAv2|7.04|11.84|7.12|26.36|15.30|2.94|20.62|__45.64__| We will add all experimental results in our revised version to enhance the validation of model effectiveness. We sincerely appreciate your valuable feedback, which elevates the significance of our model's design, highlights its distinctions from existing approaches, and fortifies our work's overall quality. We hope our responses can adequately address your concerns.

Authorsrebuttal2023-08-19

Dear Reviewer __pd9a__, Thanks again for your insightful and constructive comments, which are significantly helpful in improving the quality of our paper. We kindly seed confirmation on whether our last response has adequately addressed your concerns. We would like to discuss further any valuable questions and concerns you have. Thanks, Authors

Reviewer pd9a2023-08-20

After reviewing the authors' responses and additional experiments, my previous concerns have been largely addressed. The paper makes a good preliminary attempt at examining the robustness of multimodal models. Given this, I am inclined to upgrade my evaluation to 'borderline accept'.

Reviewer 3TAC2023-08-20

Thank the authors for providing the detailed response. I will keep the rating as accept.

Authorsrebuttal2023-08-20

Dear Reviewer 3TAC, Thanks for your positive feedback! We sincerely appreciate your effort and the acknowledgment of our paper! Sincerely, Authors

Reviewer AgmN2023-08-20

Thanks for your reply! The clarification regarding semantic similarity and costs addressed my concerns.

Program Chairsdecision2023-09-21

Decision

Accept (poster)

© 2026 NYSGPT2525 LLC