Attacking Visual Language Grounding with Adversarial Examples: A Case Study on Neural Image Captioning

• Image captioning generates descriptions from visual contents using CNN image-feature extraction and RNN caption generation.Source: §1 · p. 1
• Caption attacks are harder than classifier attacks because captions lack discrete class labels and semantically similar captions can take different forms; attacks on RNNs are less studied.Source: §1 · pp. 1–2
• Show-and-Fool formulates captioning attacks as optimization problems and offers targeted-caption and targeted-keyword methods.The keyword method requires specified words in the caption but lets the model choose their order.Source: §1 · p. 2
• Figure 1 illustrates visually imperceptible perturbations that mislead Show-and-Tell into generating targeted captions.Source: §1 · p. 2, Figure 1 · p. 2
• Targeted-caption attacks reach a 95.8% success rate on randomly assigned captions, while targeted-keyword attacks achieve an even higher success rate.Source: §1 · p. 2
• Show-and-Fool produces highly transferable adversarial examples that can fool captioning models beyond the model originally attacked.Source: §1 · p. 3

• The related-work review also covers CNN-classifier attacks, with that discussion deferred to supplementary material.Source: §2 · p. 3
• Visual language grounding includes captioning, visual dialog, question answering, storytelling, question generation, and image generation from captions.Source: §2 · p. 3
• Many neural captioners use a CNN encoder followed by an RNN decoder, while other approaches use semantic information or compositional methods.Source: §2 · p. 3
• Shekhar et al. (2017) studied insensitivity to one-word foil changes, whereas this paper targets specified captions or keywords.Source: §2 · p. 3

3.1 Overview of the Objective Functions

• The objective balances image distortion against attack loss, while a tanh reparameterization automatically keeps the adversarial image within the valid image range.A larger regularization constant c makes attack success more likely but increases distortion; the method selects c by binary search.Source: §3.1 · p. 3

3.2 Targeted Caption Method

• The targeted-caption method seeks a perturbed image for which the requested caption has the highest conditional log probability, with caption length capped at a predefined maximum.The paper offers probability- and logit-based losses; its logit loss pushes each target word above competing logits by a confidence margin.Source: §3.2 · pp. 4–5

3.3 Targeted Keyword Method

• The keyword method targets specified words at any position and iteratively feeds the current top predictions back to the RNN during optimization.It permits more freedom than exact-caption targeting and can probe generalization from a few keywords, though producing a valid, meaningful caption remains difficult to optimize.Source: §3.3 · p. 5
• To address keyword collisions, a gate masks other keywords at a position once one keyword becomes the top prediction there.Without this adjustment, multiple keywords can compete for one position even when the loss is small, making a caption containing both difficult to generate.Source: §3.3 · p. 5

4.1 Experimental Setup and Algorithms

• The experiments used Show-and-Tell with Inception-v3 on MSCOCO, and adversarial examples were also transferable to Show-Attend-and-Tell and NeuralTalk2.The authors note that no other image-captioning attack method was available for comparison.Source: §4.1 · pp. 5–6

4.2 Targeted Caption Results

• At least 95.8% of images yielded the exact targeted caption, with low ℓ2 distortion and visually indistinguishable adversarial examples.Targets were sampled from captions generated for other MSCOCO validation images so they fell within the captioning model's output space.Source: §4.2 · pp. 6–7

4.3 Targeted Keyword Results

• Targeted keyword attacks achieved at least 96% success for three keywords and at least 97% for one or two; failed three-keyword cases averaged about 1.5 target keywords.A success required all specified keywords, while keyword order in the generated caption was unrestricted.Source: §4.3 · p. 7

4.4 Transferability of Adversarial Examples

• At C = 1,000 and ϵ = 10, tgt was close to mis, indicating high transferability from Show-and-Tell to Show-Attend-and-Tell.Increasing c or ϵ enhanced transferability at the cost of larger, but still acceptable, distortion; the method also fooled NeuralTalk2.Source: Table 4 · p. 8, §4.4 · pp. 8–9

4.5 Attacking Image Captioning v.s. Attacking Image Classification

• 34.5% for I-FGSM and 22.4% for C&W were the attack success rates on Show-and-Tell, despite both reaching 100% targeted success on Inception-v3.The Show-and-Tell criterion counted a targeted label or one of its hypernyms in the caption, a weaker criterion than exact targeted-caption matching.Source: §4.5 · p. 9

• Show-and-Fool is proposed to craft adversarial examples and evaluate robustness in neural image captioning.The paper describes it as the first such method to the authors' knowledge.Source: §5 · p. 9
• Targeted caption and keyword attacks achieved high success while their perturbations remained imperceptible to human eyes, and the examples were highly transferable.Source: §5 · p. 9
• The results highlight inconsistency in visual language grounding between humans and machines and suggest a possible weakness in current machine vision and perception systems.Source: §5 · p. 9
• The paper concludes that attacking neural image captioning differs inherently from attacking CNN-based image classifiers.It also suggests Show-and-Fool could be extended to other RNN or CNN+RNN applications and may support robustness evaluation or improvement.Source: §5 · p. 9

6 Related Work on Adversarial Attacks to CNN-based Image Classifiers

• Classifier attacks seek a nearby adversarial image with a different predicted class, while targeted attacks specify the desired class.Adversarial examples may also transfer across models, and universal perturbations can cause misclassification across natural images.Source: §6 · p. 12
• Distortion metrics such as L∞, L2, and L1 regularize visual similarity, while an attack loss measures attack success.The cited choices include Kurakin et al. (2017), Carlini and Wagner (2017), and Chen et al. (2018).Source: §6 · p. 12
• Image-classification attack losses do not fit captioning because captions vastly outnumber classes and similar-meaning captions are not separate classes.The paper identifies designing attack losses for CNN+RNN captioning as a major contribution.Source: §6 · p. 12

7 More Adversarial Examples with Logits Loss

• Logits loss helps bypass defensive distillation by overcoming the gradient-vanishing problem.Defensive distillation can push inference probabilities toward 0 or 1, where the softmax derivative vanishes; before a target word reaches top-1 probability, the logits-loss gradient is constant.Source: §7 · p. 12
• The illustrated targeted-caption and three-keyword adversarial examples have small L2 distortions and are visually indistinguishable from their original images.The examples include the elephant caption target and keyword targets for the clock, giraffe, and bus images.Source: §7 · p. 12

8 Targeted Caption Results with Log Probability Loss

• 95.4% success rate was achieved by log-probability loss, about the same as logits loss, with small L2 distortions.The experiment combines log-probability loss with an L2 distortion term; failed outputs were often highly relevant to the target caption despite not matching it exactly.Source: §8 · pp. 12–13
• Figures 4–7 show Show-and-Fool adversarial examples: a targeted caption attack on an elephant image at ∥δ∥2 = 2.977, and targeted keyword attacks on clock, giraffe, and bus images at ∥δ∥2 = 2.979, 1.188, and 1.178, respectively.Source: Figure 4 · p. 13, Figure 5 · p. 13, Figure 6 · p. 13
• Log-probability and logits losses perform similarly on the undefended target, but logits loss is recommended for general captioning models because it avoids potentially vanished gradients.The recommendation concerns evaluating model robustness.Source: §8 · p. 13

9 Targeted Keyword Results with Log Probability Loss

• The keyword loss permits targets to appear at any position and uses a gate to avoid keyword collisions at positions whose most probable word is already a keyword.The log-probability loss encourages each target keyword to become the top-1 prediction at its most probable position.Source: §9 · pp. 13–14
• Optimization starts from the benign image’s inferred caption, then repeatedly re-infers and feeds the current top-1 prediction to the RNN until all keywords are found or the iteration limit is reached.The procedure minimizes the loss for T iterations at each cycle.Source: §9 · p. 14
• The log-probability results table summarizes both targeted methods and reports average L2 distortion over successful adversarial examples.The section also illustrates transferable caption attacks from Show-and-Tell to Show-Attend-and-Tell, with similar adversarial captions.Source: Table 5 · p. 14, Figure 8 · p. 14, Figure 9 · p. 14
• Among failures when targeting three keywords, more than 90% contain at least one target and more than 60% contain two; failures account for 4.3% of tested images.The passage states that this result holds when c is properly chosen and characterizes the failed examples as reasonably good attacks.Source: §9 · p. 14

10 Transferability of Adversarial Examples with Log Probability Loss

• The experiment finds adversarial examples for 1,000 images on Show-and-Tell, then tests successful exact-target examples on Show-Attend-and-Tell.The Show-and-Tell model is tested with different c values.Source: §10 · pp. 14–15
• Table 6 summarizes the 4.6% of targeted-caption examples that fail; its top-5 caption correlation scores are higher when targeted attack performance is better.The scores compare inferred captions of an adversarial image with its targeted caption.Source: Table 6 · p. 15
• Table 7 reports partial success across c values for the 4.3% of failed images missing at least one of the three targeted keywords.Source: Table 7 · p. 15
• Log-probability loss yields inferior ori and tgt values to logits loss, indicating that the additional parameter ϵ helps improve transferability.The comparison is for C = 1000 and ϵ = 10 in Table 4 versus log-probability loss without ϵ in Table 8.Source: §10 · p. 15

11 Attention on Original and Transferred Adversarial Images

• Original-image attention aligns well with human perception, but transferred adversarial images from Show-and-Tell yield significantly misaligned attention in Show-Attend-and-Tell.Source: §11 · p. 15
• Table 8 compares transferability using log-probability loss without ϵ; smaller ori or larger tgt indicates better transferability.Source: Table 8 · p. 15
• Figures 11–13 show attention over time, with highlighted areas marking changes as the model generates each word.Source: Figure 11 · p. 15, Figure 12 · p. 16, Figure 13 · p. 16