PaperlayerView exact revision on arXiv

Source-linked AI summary

Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Models

Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, Feng Zheng

arXiv:2307.14061v1cs.CV

TL;DR

VLP adversarial transferability is insufficiently understood beyond white-box attacks. This paper proposes SGA, which uses set-level cross-modal guidance and alignment-preserving augmentation, and reports stronger transfer across VLP models and downstream tasks. The method improves black-box retrieval attacks, including transfer from ALBEF to TCL.

  • Problem

    Adversarial transferability across VLP models has been underinvestigated, despite weaker black-box transfer than white-box attack performance and practical security concerns.

  • Method

    SGA combines alignment-preserving set-level augmentation with cross-modal guidance to exploit many-to-many interactions among image-text pairs.

  • Results

    SGA strongly transfers across VLP models and downstream tasks, outperforming existing methods in black-box retrieval, captioning, and visual grounding.

  • Takeaways & Limitations

    The findings support designing multimodal attacks that explicitly model many-to-many cross-modal alignments and interactions.

  • Takeaways & Limitations

    Sep-Attack lacks cross-modal interactions, while Co-Attack uses only single image-text pairs, limiting guidance diversity and transferability.

Abstract

from arXiv · show

Vision-language pre-training (VLP) models have shown vulnerability to adversarial examples in multimodal tasks. Furthermore, malicious adversaries can be deliberately transferred to attack other black-box models. However, existing work has mainly focused on investigating white-box attacks. In this paper, we present the first study to investigate the adversarial transferability of recent VLP models. We observe that existing methods exhibit much lower transferability, compared to the strong attack performance in white-box settings. The transferability degradation is partly caused by the under-utilization of cross-modal interactions. Particularly, unlike unimodal learning, VLP models rely heavily on cross-modal interactions and the multimodal alignments are many-to-many, e.g., an image can be described in various natural languages. To this end, we propose a highly transferable Set-level Guidance Attack (SGA) that thoroughly leverages modality interactions and incorporates alignment-preserving augmentation with cross-modal guidance. Experimental results demonstrate that SGA could generate adversarial examples that can strongly transfer across different VLP models on multiple downstream vision-language tasks. On image-text retrieval, SGA significantly enhances the attack success rate for transfer attacks from ALBEF to TCL by a large margin (at least 9.78% and up to 30.21%), compared to the state-of-the-art.

1. Introduction

The paper studies adversarial transferability across VLP models, identifies weak cross-modal guidance as a limitation, and proposes SGA to improve transfer across multimodal tasks.

  • Existing work largely studies white-box attacks, leaving adversarial transferability across VLP models underexplored despite its practical security relevance.
  • Existing attacks lose substantial success when transferring from white-box to black-box settings, although perturbing both image and text consistently outperforms unimodal attacks.
  • Many-to-many image-text alignments motivate diverse guidance because single-pair cross-modal interactions provide limited diversity and restrict adversarial generality.
  • SGA uses alignment-preserving set-level augmentation and cross-modal guidance to exploit interactions among multiple image-text pairs.
  • SGA consistently improves transferability across VLP models and downstream tasks, including retrieval, captioning, and visual grounding.

2. Related Work

The related work introduces VLP architectures and multimodal retrieval, then distinguishes white-box from black-box attacks and motivates transferable adversaries across VLP models.

  • VLP models learn vision-language representations from large-scale image-text pairs using region-feature or Vision Transformer-based image encoders.
  • Fused VLP models combine unimodal encoders with a multimodal encoder, whereas aligned models use independent image and text encoders.
  • Image-text retrieval ranks relevant instances from a gallery using a query in the other modality, comprising text-to-image and image-to-text retrieval.
  • ALBEF and TCL rank candidates using unimodal similarity followed by multimodal matching, while CLIP ranks directly from image-text embedding similarity.
  • White-box attacks access the target model, whereas black-box attacks do not; practical applications therefore motivate highly transferable adversaries across VLP models.

3. Analysis of Adversarial Transferability

Experiments show that perturbing both image and text improves adversarial transferability, but existing attacks still lose substantial effectiveness across VLP models. The analysis attributes this weakness to insufficient cross-modal modeling and insufficiently diverse guidance for many-to-many alignments.

  • Existing attack methods: Sep-Attack combines separate unimodal attacks, while Co-Attack perturbs image and text collectively using cross-modal interactions.Sep-Attack uses PGD for images and BERT-Attack for text; Co-Attack jointly considers both modalities.
  • Transferability observations: Attacking both image and text transfers more effectively than attacking either modality alone across multiple VLP model and architecture settings.This pattern appears for ALBEF-to-TCL, different model types with the same architecture, and the same model types with different architectures.
  • Transferability observations: Even when both modalities are perturbed, attack success drops substantially when adversarial examples transfer from a source model to a target model.The drop occurs between ALBEF and TCL despite their having the same model architecture, and under both Sep-Attack and Co-Attack.
  • Implication: The findings motivate attacks specifically designed for cross-model transfer rather than direct reuse of white-box attack methods.The analysis calls for transferable multimodal attacks that work across different VLP models.
  • Limitations of existing methods: Sep-Attack limits transferability because it ignores inter-modal correspondence, which is central when retrieval targets another modality rather than discrete labels.Its lack of cross-modal interactions restricts adversarial-example generalization among VLP models.
  • Limitations of existing methods: Co-Attack uses only single image-text pairs, reducing guidance diversity and tying adversarial samples to the white-box model's alignment pattern.This restricts adversarial-example generality and lowers effectiveness when transferring to other models.

4. Methodology

SGA improves adversarial transferability by addressing insufficient cross-modal diversity with set-level alignment-preserving augmentation and cross-modal guidance. It expands paired images and captions while using interactions across modalities to generate more transferable adversarial examples.

  • Motivation: SGA targets weak black-box transferability caused by adversarial examples approaching alternative captions paired with the same image.The method therefore considers multiple paired captions rather than only the source model’s supervised caption.
  • Alignment-preserving Augmentation: SGA expands each image-text input into a set of aligned captions and differently scaled images, unlike methods using one paired example.The augmented caption set contains the most matching captions, while images are resized using multiple scales.
  • Alignment-preserving Augmentation: Alignment-preserving augmentation enriches multimodal inputs while retaining cross-modal alignments intact.Image scaling increases diversity, and selected caption pairs provide additional aligned text inputs.
  • Cross-modal Guidance: Cross-modal guidance uses paired information from the other modality to guide adversarial optimization and iteratively push multimodal information apart.The guidance disrupts cross-modal interaction while using the enlarged alignment-preserving input set.
  • Optimization: SGA generates adversarial captions for all captions in the text set, constrains them away from the original image, and then generates an adversarial image.The adversarial image is optimized against the resulting adversarial caption set, with resized images included in the objective.

5. Experiments

The experiments systematically evaluate adversarial transferability across VLP models, modalities, architectures, and downstream tasks. SGA consistently improves black-box transferability, with gains supported by cross-modal set augmentation and guidance.

  • Experimental scope: Experiments evaluate transferability across Flickr30K, MSCOCO, multiple VLP models, image-text retrieval, image captioning, and visual grounding.The evaluation includes fused and aligned VLP models and both white-box and black-box settings.
  • Baseline transfer attacks: 12.3% white-box performance drops when Co-Attack integrates MI, while ALBEF-to-TCL transfer retains only 25.40% ASR.The result illustrates the limited benefit of directly integrating transfer-based image attacks into multimodal attacks.
  • Image-text retrieval: Approximately 30% higher ASR is achieved by SGA than Co-Attack when transferring adversarial data from ALBEF to TCL.SGA also surpasses Co-Attack when source and target models are different types.
  • Model architectures: 38.76% versus 31.24% shows that adversarial examples from CLIPViT transfer more effectively to CLIPCNN than in the reverse direction.The same experiments report stronger white-box effects on CLIPCNN than CLIPViT.
  • Model architectures: 5.83% and 6.24% are SGA's improvements over Co-Attack for CLIPViT under white-box and black-box settings, respectively.SGA improves transferability on both CNN-based and ViT-based CLIP models.
  • Ablation study: Transferability peaks with image scales from 0.50 to 1.50 at 0.25-step intervals, while adding more than one matching caption eventually plateaus.These findings support alignment-preserving image and caption set augmentation.

6. Conclusion

The paper establishes adversarial transferability in VLP models as an underexplored problem and proposes SGA to address it. SGA uses alignment-preserving set augmentation and cross-modal guidance, achieving strong transfer across VLP models.

  • Contribution: This work provides the first systematic investigation of adversarial transferability in typical VLP models.It evaluates existing attacks and finds lower transferability despite strong white-box performance.
  • Method: SGA models many-to-many cross-modal alignments through set-level alignment-preserving augmentations and cross-modal guidance.The method is designed to exploit multimodal interactions more thoroughly.
  • Implications: The findings motivate specially designed transferable attacks and further evaluation of adversarial robustness in multimodal learning.This conclusion is framed as a direction for future research.

A. Motivation

Existing transfer attacks often fail because adversarial images are optimized against limited modality information and may still match other paired captions. The analysis motivates using multiple captions and cross-modal guidance to preserve attack ability across models.

  • Half of existing attack failures are associated with multiple paired captions.
  • About 46%-57% of adversarial images that achieve about 71% - 80% error rates in white-box attacks fail when matching other paired captions during transfer.
  • Existing attacks typically use only one image-caption pair and push the adversarial image away from the original image or caption in embedding space.
  • Sep-Attack and Co-Attack can strongly attack some captions while retaining weak attack ability against another paired caption.Their lowest rankings are both around 600, versus highest rankings around 2,200 and 2,400.
  • For ALBEF-to-TCL transfer, success conditioned on white-box attack success is 40.51%, compared with 15.21% overall transferability.
  • The analysis therefore recommends pushing adversarial images away from all paired captions and using additional paired images when crafting adversarial captions.

B.1. Experimental Settings

The experiments examine adversarial transferability across embedding configurations and multimodal datasets, using ALBEF-based analyses of paired-caption attack events. The setup distinguishes multimodal and unimodal embeddings in fused and aligned VLP models.

  • Fused VLP models expose multimodal and unimodal embeddings, each represented either by full embeddings or [CLS] embeddings.
  • Figure 6 evaluates ALBEF on Flickr30K by showing that an adversarial image may have weak attack ability against some paired captions.
  • The ALBEF Flickr30K analyses define white-box and black-box attack events based on whether adversarial images match paired captions.Tables 6 and 7 summarize these event definitions for the experimental setting.
  • For aligned VLP models such as CLIP, the analysis considers [CLS] embeddings for CLIPViT and treats CLIPCNN embeddings as [CLS] embeddings.

B.2. Transferability Analysis

Transferability is stronger when both modalities are attacked, but it varies substantially with pretraining objectives, model families, and image-encoder architectures. These patterns show that architectural similarity alone does not guarantee comparable transfer success.

  • Attacking image and text simultaneously transfers better across all VLP models than attacking only one modality.
  • VLP models with identical architectures but different pretraining objectives do not receive adversarial examples with similarly high success rates.ALBEF and TCL are given as an example.
  • Transferability from fused VLP models to aligned VLP models is higher than transfer in the reverse direction.
  • Despite shared ViT image encoders, transfer from ALBEF or TCL to CLIP-CNN exceeds transfer to CLIP-ViT.
  • Transferability from CLIP-ViT to CLIP-CNN exceeds transfer from CLIP-CNN to CLIP-ViT.

B.3. Main Results

SGA is evaluated against existing multimodal attack methods on Flickr30K and MSCOCO across white-box, black-box, and unimodal settings. It outperforms the state of the art across the reported scenarios and is presented as a robustness-evaluation method.

  • SGA outperforms state-of-the-art multimodal attack methods across all reported white-box and black-box settings.
  • On Flickr30K unimodal attacks with perturbed image or text inputs, SGA consistently surpasses existing methods even when only query data are accessible.
  • The authors suggest SGA as a method for evaluating multimodal-model robustness and improving security in real-world applications.

B.4. Ablation Study

The ablations examine SGA’s cross-modal iterative strategy and its augmented image and caption sets for improving adversarial transferability. Results indicate that cross-modal guidance and multi-scale image augmentation are especially important, while exact pipeline order is less critical.

  • Iterative Strategy: SGA generates adversarial examples through cross-modal guidance in a text-image-text (t-i-t) pipeline.The strategy aims to disrupt multimodal interactions through collaboratively generated perturbations.
  • Iterative Strategy: Reversing the t-i-t pipeline does not significantly change results, while adding one iteration slightly improves performance but doubles computational cost.These findings suggest that SGA benefits more from cross-modal guidance than from a specific pipeline order.
  • Multi-scale Image Set: Transferability increases with the image scale range, reaching its highest observed level at [0.50, 1.50] with a step size of 0.25.The experiments identify the augmented image set as crucial for increasing transferability.
  • Multi-pair Caption Set: The caption-set ablation evaluates how different numbers of captions affect the transferability of generated adversarial data.SGA augments the original caption into a caption set for crafting adversarial data.
  • Experimental Scope: The ablation study reports attack success rates for transferability across VLP models and compares SGA under different input modalities and experimental settings.The evaluated settings include Flickr30K and MSCOCO, multiple source and target models, and iterative, image-set, and caption-set variants.
Loading 2307.14061v1…