Source-linked AI summary
Towards Adversarial Attack on Vision-Language Pre-training Models
Jiaming Zhang, Qi Yi, Jitao Sang
TL;DR
Adversarial robustness in VLP models remains largely unexplored, especially across multimodal tasks and attack settings. The paper analyzes attack targets and perturbed objects, then proposes Co-Attack to jointly perturb image and text modalities, reporting improved attack performance across V+L tasks and VLP models.
Problem
Adversarial robustness in VLP models has not been systematically analyzed, despite their use across diverse multimodal and non-classification V+L tasks.
Method
The paper analyzes attacks under different targets and perturbed objects and develops Co-Attack, which collaboratively attacks image and text modalities.
Results
Co-Attack achieves improved attack performance on different V+L downstream tasks and VLP models.
Takeaways & Limitations
The analyses provide observations for designing multimodal attacks and improving robustness in VLP models.
Takeaways & Limitations
The distinction between [CLS] and full embeddings does not apply to CLIP generally, so [CLS] analysis is limited to CLIPViT while CNN embeddings are treated as [CLS].
Abstract
from arXiv · showhide
While vision-language pre-training model (VLP) has shown revolutionary improvements on various vision-language (V+L) tasks, the studies regarding its adversarial robustness remain largely unexplored. This paper studied the adversarial attack on popular VLP models and V+L tasks. First, we analyzed the performance of adversarial attacks under different settings. By examining the influence of different perturbed objects and attack targets, we concluded some key observations as guidance on both designing strong multimodal adversarial attack and constructing robust VLP models. Second, we proposed a novel multimodal attack method on the VLP models called Collaborative Multimodal Adversarial Attack (Co-Attack), which collectively carries out the attacks on the image modality and the text modality. Experimental results demonstrated that the proposed method achieves improved attack performances on different V+L downstream tasks and VLP models. The analysis observations and novel attack method hopefully provide new understanding into the adversarial robustness of VLP models, so as to contribute their safe and reliable deployment in more real-world scenarios. Code is available at https://github.com/adversarial-for-goodness/Co-Attack.
1 INTRODUCTION
The paper addresses the limited study of adversarial robustness in VLP models by analyzing attack settings and introducing Co-Attack, a collaborative image-text attack method.
- Adversarial robustness in VLP models has received little systematic study, while prior multimodal attacks typically perturb only one modality.
- Standard attacks are poorly suited to multimodal, non-classification tasks, motivating analysis of embedding-based attack targets and settings.
- Independent image and text perturbations can conflict, producing a countervailing 1 + 1 < 1 effect.
- The analysis varies attack targets and perturbed objects across fused and aligned VLP architectures and three V+L tasks.
- Co-Attack jointly attacks image and text modalities and is applicable to both fused and aligned VLP models.
- The paper reports improved attack performance across different V+L downstream tasks and describes multimodal consistency as supporting stronger attacks.
2 PRELIMINARIES AND RELATED WORK
This section introduces end-to-end VLP architectures, their downstream V+L tasks, and prior adversarial-attack approaches relevant to evaluating robustness.
- VLP models: The evaluated models—CLIP, ALBEF, and TCL—use end-to-end image encoders rather than computation-costly pre-trained object detectors.
- VLP models: ALBEF and TCL are fused VLP models with unimodal and multimodal encoders, whereas CLIP is an aligned VLP model with separate unimodal embeddings.
- Downstream V+L tasks: Image-text retrieval ranks ALBEF and TCL candidates using unimodal similarity followed by multimodal matching, while CLIP relies directly on image-text similarity.
- Downstream V+L tasks: Visual entailment predicts entailment, neutral, or contradiction, and ALBEF and TCL use a three-way classifier over the multimodal [CLS] representation.
- Downstream V+L tasks: Visual grounding localizes an image region from text, with ALBEF ranking detected proposals using an attention map derived through Grad-CAM.
- Adversarial attacks: Prior attacks include gradient-based image perturbations and token modifications, but VLP robustness lacks systematic attack analysis and dedicated attack design.
3 ANALYZING ADVERSARIAL ATTACK IN VLP MODEL
The paper evaluates adversarial attacks across VLP architectures, downstream tasks, perturbation objects, and attack targets. Across tasks, bimodal perturbation and multimodal-embedding attacks generally provide the strongest or comparable attack performance, while robustness also varies with image-encoder architecture.
- Examined VLP Models, Downstream Tasks and Datasets: The evaluation covers fused and aligned VLP models across image-text retrieval, visual entailment, and visual grounding.ALBEF and TCL represent fused models, while CLIP represents an aligned model; datasets include Flickr30K, MSCOCO, RefCOCO+, and SNLI-VE.
- Attack Settings: The attack study varies image-modal, text-modal, and bimodal perturbations, targeting full or [CLS] unimodal or multimodal embeddings.The [CLS] target is examined because it is directly used for inference in various downstream tasks.
- Observations on Different Attack Settings: Bimodal perturbation consistently outperforms single-modal perturbation across image-text retrieval, visual entailment, and visual grounding.The results support allowing both image and text inputs to be perturbed when designing stronger attacks.
- Observations on Different Attack Settings: For single-modal image attacks, full embeddings generally outperform [CLS] embeddings, whereas text attacks show the opposite pattern in image-text retrieval.The paper attributes this difference to sentence-level significance represented by text [CLS] embeddings and the stronger impact of full image embeddings.
- Observations on Different VLP Models: CLIP with a ViT image encoder is more robust to image-modal attacks than CLIP with a ResNet-101 CNN encoder, while pre-training objectives show no distinct robustness difference between ALBEF and CLIPViT.The comparison concerns CLIPViT and CLIPCNN under image and bimodal perturbations, and ALBEF versus CLIPViT unimodal embeddings.
- Observations on Different Downstream V+L Tasks: Multimodal-embedding attacks are superior or comparable to unimodal-embedding attacks across tasks, especially for visual entailment and visual grounding.For visual entailment, multimodal attacks outperform unimodal attacks under bimodal perturbation; Bi@Multifull is best in all visual-grounding settings.
ADVERSARIAL ATTACK IN VLP MODEL
Co-Attack collaboratively perturbs image and text inputs to avoid conflicting single-modal attacks, using a stepwise text-then-image procedure for fused and aligned VLP models. It achieves stronger resultant perturbations and outperforms baseline attacks across evaluated V+L tasks.
- Method: Co-Attack jointly perturbs image and text modalities, targeting multimodal or cross-modal embedding separation depending on the VLP architecture.For fused models it moves perturbed multimodal embeddings away from the original; for aligned models it separates perturbed image- and text-modal embeddings.
- Method: Co-Attack produces stronger resultant multimodal perturbations and more coordinated perturbation directions than vanilla attack.For multimodal embeddings, it yields a smaller angle between text- and image-modal perturbations; for unimodal embeddings, it achieves greater resultant perturbation and angle.
- Method: The attack first perturbs discrete text inputs, then optimizes continuous image inputs conditioned on the text perturbation.This stepwise scheme addresses the representation gap between discrete text and continuous image modalities.
- Results: Co-Attack outperforms all compared baseline attacks on the reported image-text retrieval and visual entailment comparisons.The experiments compare Co-Attack with Fooling VQA, SSAP, SSAP-MIM, SSAP-SI, and Vanilla; attack success rate is reported for the retrieval and entailment tables.
- Results: Figure 5 visualizations indicate that Co-Attack shifts model attention toward regions deviating from the ground truth, unlike single-modal perturbations that hardly change the heat map.Vanilla only slightly shifts attention while retaining noticeable regions on the object of interest.
- Results: Attack performance becomes stronger when both collaborative-objective coefficients are positive, demonstrating the importance of the second terms in the image-attack objectives.The ablation varies α1 and α2 from 0 to 5 on ALBEF and CLIPViT experiments.
5 CONCLUSION
The paper analyzes adversarial attacks on VLP models under different settings and develops a novel multimodal attack. It aims to clarify multimodal robustness and inform future attack and defense design.
- The study analyzes adversarial attack performance under different attack settings.
- Figure 6 examines how α1 and α2 affect visual entailment on ALBEF and image-text retrieval on CLIPViT.
- The paper develops a novel multimodal adversarial attack for VLP models.
- The authors intend the study to draw attention to the distinct adversarial-robustness properties of multimodal models.