Source-linked AI summary
AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learning
Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, Hai Jin
TL;DR
Multimodal pre-trained encoders enable diverse downstream tasks, but their security remains underexplored, especially under realistic limited-knowledge attack settings. AdvCLIP generates a universal adversarial patch by modeling cross-modal topology and demonstrates strong attacks across two task types and eight datasets, while motivating stronger defenses.
Problem
The security of publicly available cross-modal pre-trained encoders remains underexplored despite their use across downstream tasks and known adversarial fragility.
Method
AdvCLIP builds a topological graph and topology-deviation based generative adversarial network to generate universal non-targeted adversarial patches under limited attacker knowledge.
Results
AdvCLIP shows excellent attack performance across two downstream task types, eight datasets, and five CLIP backbones, with three defenses tailored for mitigation.
Takeaways & Limitations
Cross-modal pre-trained encoders incur security risks that can transfer to inherited downstream tasks, highlighting the need for new defense mechanisms.
Takeaways & Limitations
The attacker lacks knowledge of the pre-training datasets and downstream tasks and therefore pursues non-targeted attacks that reduce downstream accuracy.
Abstract
from arXiv · showhide
Multimodal contrastive learning aims to train a general-purpose feature extractor, such as CLIP, on vast amounts of raw, unlabeled paired image-text data. This can greatly benefit various complex downstream tasks, including cross-modal image-text retrieval and image classification. Despite its promising prospect, the security issue of cross-modal pre-trained encoder has not been fully explored yet, especially when the pre-trained encoder is publicly available for commercial use. In this work, we propose AdvCLIP, the first attack framework for generating downstream-agnostic adversarial examples based on cross-modal pre-trained encoders. AdvCLIP aims to construct a universal adversarial patch for a set of natural images that can fool all the downstream tasks inheriting the victim cross-modal pre-trained encoder. To address the challenges of heterogeneity between different modalities and unknown downstream tasks, we first build a topological graph structure to capture the relevant positions between target samples and their neighbors. Then, we design a topology-deviation based generative adversarial network to generate a universal adversarial patch. By adding the patch to images, we minimize their embeddings similarity to different modality and perturb the sample distribution in the feature space, achieving unviersal non-targeted attacks. Our results demonstrate the excellent attack performance of AdvCLIP on two types of downstream tasks across eight datasets. We also tailor three popular defenses to mitigate AdvCLIP, highlighting the need for new defense mechanisms to defend cross-modal pre-trained encoders.
1 INTRODUCTION
Multimodal pre-trained encoders support diverse downstream tasks but introduce underexplored security risks. AdvCLIP addresses these risks by generating universal, downstream-agnostic adversarial patches that disrupt cross-modal and downstream relationships.
- 1 INTRODUCTION: Multimodal contrastive learning trains general-purpose encoders on large-scale unlabeled image-text pairs for zero-shot or lightly fine-tuned downstream tasks.The approach supports resource-constrained users through powerful representations and reduced labeled-data and computational requirements.
- 1 INTRODUCTION: Cross-modal pre-trained encoders remain an underexplored security threat despite known adversarial fragility and risks inherited by downstream tasks.Prior work mainly examined unimodal encoders, while existing VLP attacks relied on unrealistic white-box assumptions and sample-specific examples.
- 1 INTRODUCTION: AdvCLIP is the first framework for downstream-agnostic adversarial examples against cross-modal pre-trained encoders under limited attacker knowledge.It focuses on universal, non-targeted image patch attacks that can transfer across downstream tasks.
- 1 INTRODUCTION: AdvCLIP constructs a topological graph and uses a topology-deviation based generative adversarial network to disrupt cross-modal mappings and multi-sample relations.The resulting universal patch reduces similarity between different-modal embeddings and moves adversarial examples away from their original classes.
- 1 INTRODUCTION: Experiments across two downstream task types and eight datasets show strong attack performance, while tailored defenses underscore the need for new protection mechanisms.The evaluated defenses are intended to mitigate AdvCLIP and further assess the vulnerability of pre-trained encoders.
2 RELATED WORK
Related work covers multimodal contrastive and vision-language pre-training, universal adversarial perturbations and patches, and emerging studies of pre-trained encoder robustness. Existing universal attacks are largely unimodal, limiting their suitability for cross-modal downstream tasks with restricted attacker knowledge.
- 2 RELATED WORK: Multimodal pre-training learns general-purpose vision-language representations for downstream tasks, with CLIP representing embedding-based methods that separately encode modalities.Cross-encoder methods use cross-attention, whereas embedding-based methods measure distances between independently generated visual and textual representations.
- 2 RELATED WORK: Universal image attacks comprise global perturbations and localized patches, with patches offering greater physical-world applicability despite being visible.Universal perturbations apply shared noise across images, while patch methods control a localized image region.
- 2 RELATED WORK: Existing universal attack methods are mainly designed for unimodal classification and are insufficient for cross-modal tasks when downstream-task knowledge is limited.This motivates focusing on universal image-based attacks for cross-modal settings.
- 2 RELATED WORK: Recent research has begun examining pre-trained encoder robustness, including perturbations against image encoders and attacks on CLIP-based image-text retrieval systems.The related studies include PAP and other initial investigations of cross-modal encoder vulnerabilities.
3 METHODOLOGY
AdvCLIP formulates a quasi-black-box, downstream-agnostic attack that applies a universal image patch without knowing downstream tasks. It combines cross-modal feature deviation, topology disruption, and visual-quality constraints to improve transferability across downstream models.
- 3.2 Problem Formulation: AdvCLIP assumes access to a public cross-modal encoder but no knowledge of pre-training data or downstream tasks, using a distinct surrogate dataset to generate a small universal noise.The attack targets non-targeted degradation of downstream retrieval and classification models under an l_p perturbation budget.
- 3.3 Intuition Behind AdvCLIP: The method addresses modality and transferability gaps by separating cross-modal feature disruption from changes in downstream decision boundaries.Fine-tuning may change feature-space boundaries, so attacks must move examples in directions likely to cross original category boundaries.
- 3.3 Intuition Behind AdvCLIP: AdvCLIP constructs clean and adversarial neighborhood graphs, then uses cross-entropy between them to corrupt sample similarity relationships.Cosine-affinity probabilities define graph edges; removing nearest neighbors preserves local manifold connectivity and global structure while enabling topology deviation.
- 3.4 Topology-deviation based Generative Attack Framework: A fixed noise vector is fed to generator G to produce one universal patch, which is pasted onto surrogate images using a binary position mask.The generator, discriminator, and victim encoder form the main attack framework.
- 3.4 Topology-deviation based Generative Attack Framework: The generator objective combines adversarial, topology-deviation, quality, and GAN losses, weighted by predefined hyperparameters α and β.The adversarial loss moves target features away from original image features and corresponding cross-modal features, while topology loss disrupts neighborhood relations.
4 EXPERIMENTS
AdvCLIP is evaluated as a downstream-agnostic attack on image-text retrieval and image classification using CLIP encoders, multiple datasets, and varied settings. Results indicate substantial vulnerability, with attack effectiveness depending on backbone, surrogate dataset, perturbation budget, and batch size.
- 4.2 Attack Performance: AdvCLIP poses a significant security threat to cross-modal pre-trained encoders on image-text retrieval across four downstream datasets.The evaluated datasets are NUS-WIDE, Pascal-Sentence, Wikipedia, and XmediaNet.
- 4.2 Attack Performance: Transformer backbones are more susceptible to successful adversarial-patch attacks than ResNet backbones under the same settings.The comparison spans ResNet50, ResNet101, ViT-L/14, ViT-B/16, and ViT-B/32.
- 4.2 Attack Performance: Larger surrogate datasets, including NUS-WIDE and XmediaNet, tend to produce higher downstream attack success rates.The analysis attributes this pattern to the larger number of samples in these datasets.
- 4.3 Ablation Study: With ε=0.03, smaller patches can achieve higher attack success rates, while batch size 16 balances attack performance and computational efficiency.The ablation varies perturbation budgets and batch sizes from 4 to 128.
5 DEFENSE
The study evaluates corruption, pruning, and adversarial training as defenses against AdvCLIP. Corruption and pruning do not effectively mitigate the attack, while adversarial training does not prevent successful downstream attacks.
- 5 DEFENSE: The defense study considers preprocessing, downstream adversarial training, and parameter pruning as mitigation strategies.
- 5.1 Corruption: Gaussian-noise corruption significantly decreases retrieval accuracy while only slightly affecting AdvCLIP, indicating resistance to this preprocessing defense.
- 5.2 Pruning: Pruning parameters is difficult to use for resisting CLIP-based attacks while maintaining normal model accuracy.
- 5.3 Adversarial Training: AdvCLIP successfully attacks downstream tasks even when models undergo adversarial training.
6 CONCLUSION
AdvCLIP is a downstream-agnostic attack framework that generates universal adversarial patches against cross-modal pre-trained encoders. Experiments across downstream tasks, CLIP backbones, and datasets demonstrate strong attack performance, while defense results motivate new protection mechanisms.
- 6 CONCLUSION: AdvCLIP generates universal adversarial patches that fool downstream tasks under strict constraints on attacker knowledge.
- 6 CONCLUSION: Experiments verify strong AdvCLIP attack performance across two downstream task types, five CLIP backbones, and eight datasets.
- 6 CONCLUSION: The defense results highlight the need for new mechanisms to protect cross-modal pre-trained encoders.