Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image

Multimodal LLMs (MLLMs) with a great ability of text and image understanding have received great attention. To achieve better reasoning with MLLMs, Chain-of-Thought (CoT) reasoning has been widely explored, which further promotes MLLMs' explainability by giving intermediate reasoning steps. Despite the strong power demonstrated by MLLMs in multimodal reasoning, recent studies show that MLLMs still suffer from adversarial images. This raises the following open questions: Does CoT also enhance the adversarial robustness of MLLMs? What do the intermediate reasoning steps of CoT entail under adversarial attacks? To answer these questions, we first generalize existing attacks to CoT-based inferences by attacking the two main components, i.e., rationale and answer. We find that CoT indeed improves MLLMs' adversarial robustness against the existing attack methods by leveraging the multi-step reasoning process, but not substantially. Based on our findings, we further propose a novel attack method, termed as stop-reasoning attack, that attacks the model while bypassing the CoT reasoning process. Experiments on three MLLMs and two visual reasoning datasets verify the effectiveness of our proposed method. We show that stop-reasoning attack can result in misled predictions and outperform baseline attacks by a significant margin.

Paper

Similar papers

Reviewer 3eKb8/10 · confidence 3/52024-05-10

Summary

This paper considers the intersection of adversarial images + chain-of-thought prompting. The setup involves a model answering multiple choice questions given an image. The model tries to give reasoning first before spitting out a letter from A to E. There are several attacks: * answer attack, in making the model spit out the wrong answer * rationale attack, in making the model point out incorrect observations * stop reasoning attack, in making the model not do chain-of-thought at all the authors consider various image+LLMs like MiniGPT4, OpenFlamingo, and LLaVa; then A-OKVQA and ScienceQA. the results show that these various attacks can be successful. --- edit post rebuttal: still agree to accept this paper, I am less concerned about novelty and don't think one negative review saying that should be reason to reject. so overall should be reasonable to accept this paper given all the reviews.

Rating

8

Confidence

3

Ethics flag

1

Reasons to accept

This seems like an interesting paper to this reviewer. It extends the domain of adversarial inputs to the multiple-choice and CoT regime, both of which are very popular in today's LLM era. It also suggests * CoT provides a marginal robustness boost * Stop-reasoning is the most effective attack (so it is possible to perturb the images such that models stop reasoning) these seem pretty useful for the community to know!

Reasons to reject

Possibly, this is a bit of a narrow attack that assumes a lot of knowledge about the model - the model's parameters, the domain, etc. To this reviewer though this is interesting even outside of the security domain, so I still recommend acceptance.

Reviewer VqF66/10 · confidence 4/52024-05-10

Summary

This research focuses on multimodal language models (MLLMs) and introduces a novel adversarial attack method called "stop-reasoning attack" to investigate and assess the impact of CoT reasoning on the adversarial robustness of MLLMs. Experimental results demonstrate that CoT reasoning indeed enhances the robustness of MLLMs against existing adversarial attack methods.

Rating

6

Confidence

4

Ethics flag

1

Reasons to accept

1. The purpose and approach of the attack are interesting. 2. The writing of the paper is also quite clear.

Reasons to reject

1. I am concerned about the novelty of the method. The overall pipeline of the attack is similar to other methods, where noise is used to perturb images so that they are mapped to incorrect target locations in the feature space after passing through the MLLM image encoder.

Questions to authors

1. I have a question about the difference between "stop reasoning attack" and simply not using CoT and then attacking the answer. I believe they both ultimately attack the answer. What might be the performance difference between the "Answer Attack" column in Table 1 for "w/o CoT" and the "Stop Reasoning Attack" column for "with CoT"? Could this difference in performance be due to the need for additional optimization of a reasoning component in the stop reasoning attack

Reviewer hxRq7/10 · confidence 4/52024-05-12

Summary

This paper first found that the CoT technique can improve the adversarial robustness of MLLMs. Then they proposed a novel attack method that train visual noise using designed losses that are accosiated with CoT components. Experiments are conducted on two VQA datasets using three different MLLMs, and the resutls presented confim the effectiveness of the method.

Rating

7

Confidence

4

Ethics flag

1

Reasons to accept

1. The writing is straightforward and easy to follow. 2. The method seems to be effective given the results presented. 3. Discussion sections in the paper are insightful and the picked examples are vivid.

Reasons to reject

1. Generalization: the paper only perform their method on two VQA task. On the one hand, can the method perform well on multimodal generation tasks like captioning? On the other hand, while your current attack goal is to only "avoid the right answer", can your method be applied to more strict tasks like "generate the pre-defined wrong answer " (e.g., the jailbreaking task)? 2. Model Size: only MLLMs with 7B size LLM are applied , I'm wondering how's effectiveness of your stop-reasoning on larger MLLMs, such as models with 13B LLMs. 3. Ablation of $\epsilon$ and the training iteration: the pertubation budget $\epsilon$ and training iteration are main parameters in adversarial learning domain. Maybe you can draw a picture about the attack success rate of your method under different $\epsilon$ and/or training steps in the main part. 4. Missing reference: several references that are highly related to your paper are missing [1-3]. [1] Zhang H, Shao W, Liu H, et al. AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Adversarial Visual-Instructions[J]. arXiv preprint arXiv:2403.09346, 2024. [2] Tu H, Cui C, Wang Z, et al. How many unicorns are in this image? a safety evaluation benchmark for vision llms[J]. arXiv preprint arXiv:2311.16101, 2023. [3] Liu X, Zhu Y, Lan Y, et al. Query-relevant images jailbreak large multi-modal models[J]. arXiv preprint arXiv:2311.17600, 2023.

Reviewer VqF62024-06-04

Official Comment by Reviewer VqF6

Thank you very much for your response. It has addressed my concerns and clarified a previous misunderstanding I had about this paper. I have adjusted my rating:)

Program Chairsdecision2024-07-10

Decision

Accept

© 2026 NYSGPT2525 LLC