PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Prompt Tuning for Vision-Language Models

Jiaming Zhang, Xingjun Ma, Xin Wang, Lingyu Qiu, Jiaqi Wang, Yu-Gang Jiang, Jitao Sang

arXiv:2311.11261v3cs.CVcs.AI

TL;DR

Small adversarial image perturbations threaten VLM robustness, while adversarial training is costly for large models. AdvPT tunes learnable text prompts against adversarial image embeddings, improving on vanilla CLIP across white-box and black-box attacks. The paper also reports that it can be combined with image-processing defenses to further boost robustness.

  • Problem

    VLM image encoders are vulnerable to small adversarial image noise, while adversarial training is computationally expensive for large VLMs.

    Source: §1 · p. 2

  • Method

    AdvPT optimizes learnable text prompts to align clean text embeddings with adversarial image embeddings while preserving pretrained parameters.

    Source: §1 · p. 2, §7 · p. 14

  • Results

    AdvPT outperforms vanilla CLIP with hand-crafted prompts across eight image datasets under white-box and black-box attacks.

    Source: §1 · pp. 2–3

  • Takeaways & Limitations

    AdvPT’s textual prompt tuning can be combined with image-based defense strategies to further boost adversarial robustness.

    Source: §1 · pp. 2–3

    The study is restricted to image recognition tasks, leaving applicability to broader tasks such as visual question answering for future research.

    Source: §6 · p. 14

Abstract

from arXiv · show

With the rapid advancement of multimodal learning, pre-trained Vision-Language Models (VLMs) such as CLIP have demonstrated remarkable capacities in bridging the gap between visual and language modalities. However, these models remain vulnerable to adversarial attacks, particularly in the image modality, presenting considerable security risks. This paper introduces Adversarial Prompt Tuning (AdvPT), a novel technique to enhance the adversarial robustness of image encoders in VLMs. AdvPT innovatively leverages learnable text prompts and aligns them with adversarial image embeddings, to address the vulnerabilities inherent in VLMs without the need for extensive parameter training or modification of the model architecture. We demonstrate that AdvPT improves resistance against white-box and black-box adversarial attacks and exhibits a synergistic effect when combined with existing image-processing-based defense techniques, further boosting defensive capabilities. Comprehensive experimental analyses provide insights into adversarial prompt tuning, a novel paradigm devoted to improving resistance to adversarial images through textual input modifications, paving the way for future robust multimodal learning research. These findings open up new possibilities for enhancing the security of VLMs. Our code is available at https://github.com/jiamingzhang94/Adversarial-Prompt-Tuning.

1 Introduction

Image-modality adversarial noise threatens VLM security, while conventional adversarial training is computationally expensive for large VLMs. AdvPT aligns learnable text prompts with adversarial image embeddings; the paper reports improved performance over vanilla CLIP across eight datasets and describes its combination with image-based defenses.

1 Introduction

  • Small adversarial image noise is a security threat, and adversarial training is computationally expensive for large VLMs.Image-modality noise is described as less visible than text-token replacement.Source: §1 · p. 2
  • AdvPT aligns learnable text prompts with adversarial image embeddings to improve VLM image-encoder robustness without extensive parameter training or architectural modification.It optimizes learnable vectors through the text encoder while preserving pretrained parameters.Source: §1 · pp. 2–3
  • AdvPT improves on vanilla CLIP with hand-crafted prompts under white-box and black-box attacks across eight image datasets.The paper also reports that AdvPT can be integrated with image-based defense strategies to further boost robustness.Source: §1 · pp. 2–3
  • The analysis examines a generalization–robustness trade-off, learned-vector transfer across datasets, and the vectors’ closest associated words.The paper presents these analyses as insights into AdvPT’s working mechanism.Source: §1 · p. 3

2 Related Work

The related work situates the study among VLMs, prompt learning, and adversarial defenses. It distinguishes AdvPT’s robustness objective and its use of textual input modification from prior approaches.

2.1 Vision Language Models

  • The study focuses on CLIP- and ALIGN-style VLMs that learn joint image-language representations, targeting image-encoder robustness for image recognition.The paper distinguishes these models from VLMs grounded in large NLP models, such as GPT-4V.Source: §2.1 · p. 3

2.2 Prompt Learning

  • Unlike prompt-learning work aimed at improving recognition accuracy, this study modifies textual inputs to improve the image encoder’s adversarial robustness.It is grounded in the CoOp framework but shifts its objective.Source: §2.2 · p. 3

2.3 Adversarial Defenses

  • Model robustification can be computationally demanding for VLMs, while image-processing defenses operate at inference; AdvPT instead modifies neither model nor input image.Image-processing approaches include transformations, smoothing, rescaling, and diffusion-based purification.Source: §2.3 · p. 4

3 Revisiting Clip and the Adversarial Robustness of Its Image Encoder

The section reviews CLIP’s image-text embedding and zero-shot classification setup, then specifies the image-attack threat model and adversarial objectives. It also contrasts input denoising with model robustification.

3.1 CLIP

  • CLIP uses separate image and text encoders to map visuals and text into a shared embedding space for zero-shot image recognition.The image encoder may use a CNN or ViT backbone, while the text encoder is a Transformer.Source: §3.1 · p. 4
  • CLIP classifies by comparing an image embedding with K class-text embeddings using temperature-scaled cosine similarities.The resulting similarities determine prediction probabilities.Source: §3.1 · p. 5

3.2 Adversarial Robustness of CLIP’s Image Encoder

  • The threat model gives the attacker full knowledge of both encoders and access to perturb images, but no control over text or knowledge of prompt tuning.Text adversarial attacks are therefore outside the study’s setting.Source: §3.2 · p. 5
  • PGD and AutoAttack represent objectives that respectively increase image-embedding discrepancy and reduce alignment with the ground-truth text embedding, under an ℓ∞ perturbation bound.The perturbation magnitude is bounded by ε.Source: §3.2 · p. 5
  • Input denoising processes adversarial images to reduce the gap between their encoded representations and those of clean images.The section contrasts this with model robustification methods such as adversarial training, which face efficiency issues for VLMs.Source: §3.2 · p. 5

4 Adversarial Prompt Tuning

AdvPT generates and stores adversarial image embeddings, then optimizes learnable text-prompt vectors against them while keeping the encoders frozen. This two-stage design avoids repeated image-encoder computation during prompt tuning.

4 Adversarial Prompt Tuning

  • AdvPT first builds an adversarial embedding bank from images encoded by the image encoder, then optimizes learnable text vectors using batches from that bank.The image encoder is discarded after bank generation; the text encoder is frozen while gradients update the prompt vectors.Source: §4 · p. 6, §4.1 · p. 7

4.1 Adversarial Embedding Bank Generation

  • In bank generation, PGD perturbs images against the image encoder, and the loss measures the embedding discrepancy using Kullback-Leibler divergence.The image encoder is fixed during this one-pass generation process, unlike adversarial training's repeated generation and model updates.Source: §4.1 · p. 7
  • The adversarial perturbation update projects each step into a feasible region so the perturbed example remains within the allowed perturbation limit.The step size controls each iteration, and the gradient is based on an embedding-distance loss.Source: §4.1 · p. 7
  • The bank stores adversarial embeddings, reducing redundant image-encoder forward and backward passes and memory use relative to storing inputs in the higher-dimensional image space.The embedding space has lower dimensionality than the original image space.Source: §4.1 · p. 7

4.2 Learnable Vector Optimization

  • For each class, AdvPT feeds learnable prompt vectors plus the class name to the text encoder to produce text embeddings.Mini-batches of adversarial embeddings are compared with these text embeddings to obtain similarity scores.Source: §4.2 · p. 7
  • Prompt optimization maximizes the ground-truth class score with cross-entropy, updating only the learnable vectors through the frozen text encoder.At this stage the image encoder has been discarded.Source: §4 · p. 6, §4.2 · p. 8

5 Experiments

The experiments evaluate AdvPT on CLIP across adversarial attacks, datasets, and input-denoising defenses. They also examine generalization and efficiency, with implementation settings varying by dataset and model.

5 Experiments

  • The experiments compare AdvPT with vanilla CLIP, input-denoising defenses, and adversarial training, and examine generalization, efficiency, and learned prompts.The evaluation also tests transfer across datasets and analyzes hyperparameters.Source: §5 · p. 8

5.1 Experimental Settings

  • Evaluation uses eight high-resolution vision datasets and four ImageNet variants for domain-generalization assessment.The eight include Pets, Flowers, ImageNet, Food101, SUN397, DTD, EuroSAT, and UCF101; the variants are ImageNetV2, ImageNet-Sketch, ImageNet-A, and ImageNet-R.Source: §5.1 · pp. 8–9
  • The study centers on CLIP ViT-B/16 and ViT-L/14, testing white-box PGD-40 and AutoAttack as well as black-box RAP.PGD-40 maximizes embedding-space KL divergence, while AutoAttack maximizes contrastive loss between image-text pairs.Source: §5.1 · p. 9
  • Defense comparisons use diffusion-based DiffPure and the faster Super-resolution and Rescale approaches.DiffPure is described as relatively time-consuming; Super-resolution and Rescale are described as more immediate but slightly less effective.Source: §5.1 · p. 9
  • Training uses 5 epochs (batch size 512) on ImageNet and 100 epochs (batch size 32) elsewhere; PGD-10 (8/255, 10 iterations) builds the bank, while test attacks use white-box PGD-40 (16/255, 40 iterations) or black-box RAP (400 iterations).Source: §5.1 · p. 9

5.2 Comparison with Vanilla CLIP

AdvPT improves over hand-crafted-prompt CLIP under both PGD-40 and RAP attacks, and it is compatible with input-denoising defenses. The reported Flowers example shows a substantial additional gain when AdvPT is combined with Super-resolution.

5.2 Comparison with Vanilla CLIP

  • AdvPT improves accuracy over vanilla CLIP with hand-crafted prompts under both PGD-40 and RAP attacks; Table 1 reports accuracy (%) and marks the margin of improvement.Source: §5.2 · p. 10, Table 1 · p. 10

5.3 Comparison with Adversarial Defenses

  • AdvPT is consistently compatible with benchmark input-denoising defenses, with a reported 0.3% drop for ViT-L/14 on Pets while accuracy remains above 90%.The authors report that combining AdvPT with input denoising improves results overall and requires no specialized tuning for purified images.Source: §5.3 · pp. 10–11, Table 2 · p. 10
  • 46.60%: on ViT-B/16 Flowers, adding AdvPT raises Super-resolution accuracy from 13.80% to 60.4%.AdvPT alone raises accuracy from 6.40% to 37.40% on that setting.Source: §5.3 · p. 11
  • The comparison also reports enhanced performance when AdvPT is combined with DiffPure under AutoAttack.Table 3 reports accuracy under AutoAttack.Source: §5.3 · p. 11, Table 3 · p. 11

5.4 Generalization-Robustness Trade-off

The section compares AdvPT with CoOp to assess how adversarial and clean-image prompt objectives relate to robustness and generalization. AdvPT improves adversarial robustness at some cost to generalization, with the gap narrowing at larger model scale.

5.4 Generalization-Robustness Trade-off

  • The comparison examines whether CoOp, fine-tuned on clean images for accuracy, affects adversarial robustness differently from AdvPT.The analysis compares generalizability and adversarial robustness.Source: §5.4 · pp. 11–12
  • AdvPT significantly outperforms CoOp in adversarial robustness, while sacrificing some generalizability.The paper identifies this as a robustness–generalization trade-off similar to that in traditional adversarial training.Source: §5.4 · p. 12
  • On ViT-L/14, the generalizability gap narrows as model scale increases while AdvPT enhances adversarial robustness.The authors describe AdvPT as highly compatible with the trend toward scaling up models.Source: §5.4 · p. 12

5.5 Comparison with Adversarial Training

AdvPT is reported to be more time-efficient and more effective than adversarial training, while linear-probe CLIP improves clean accuracy without matching AdvPT's robustness. The section also presents an efficiency comparison with Fast AT on Pets.

5.5 Comparison with Adversarial Training

  • Fig. 5 compares the efficiency of AdvPT and Fast AT on Pets.Source: Figure 5 · p. 12
  • AdvPT requires at least an order of magnitude less time than AT and exceeds AT's effectiveness by at least an order of magnitude.The paper characterizes its efficiency advantage as exceeding 100×.Source: §5.5 · p. 12

5.6 Comparison with Linear Prob CLIP

  • Linear-probe CLIP has higher clean accuracy than vanilla CLIP but lower robustness than AdvPT, so added downstream data alone does not directly enhance robustness.The comparison also indicates that robustness enhancements are not entirely related to accuracy improvements.Source: §5.6 · p. 13, Table 4 · p. 13

5.7 Evaluation on Domain Shift

AdvPT outperforms vanilla CLIP in adversarial robustness across the evaluated domain-shift datasets. The section also reports that learnable-vector count is not a constraint in its Pets evaluation and examines the words nearest to learned vectors.

5.7 Evaluation on Domain Shift

  • With ImageNet as the source, AdvPT outperforms vanilla CLIP in adversarial robustness on ImageNetV2, ImageNet-Sketch, ImageNet-A, and ImageNet-R.The authors describe this as stability across varied domains.Source: §5.7 · p. 13

Number of Learnable Vector

  • On Pets, varying the number of learnable vectors from 1 to 50 suggests that vector count does not constrain AdvPT's efficacy.The authors state that unlocking its potential efficacy warrants further investigation.Source: Number of Learnable Vector · p. 14
  • The nearest vocabulary words for learned vectors are not intuitively understandable and align with non-robust features in adversarial images.The paper searches for nearest words by Euclidean distance because the vectors are optimized in continuous space while words are discrete.Source: Interpreting the Learnable Vector · p. 14, Table 5 · p. 14

6 Limitations

The paper identifies its task scope and prospective directions for AdvPT.

6 Limitations

  • The study is restricted to image recognition; applying AdvPT to broader tasks such as VQA remains a direction for future research.The paper also identifies visual prompts as a promising avenue, while noting that they add model branches and fall under model robustification.Source: §6 · p. 14

7 Conclusion and Discussion

AdvPT aligns learnable text prompts with adversarial image embeddings to enhance VLM robustness without extensive retraining or architectural changes. The study presents this as an initial direction and calls for further work on scalability across settings.

7 Conclusion and Discussion

  • AdvPT aligns learnable text prompts with adversarial image embeddings to enhance VLM robustness without extensive retraining or architectural changes.The approach is presented as a technique for VLMs such as CLIP.Source: §7 · p. 14
  • The authors characterize this study as an initial foray into a complex domain.Source: §7 · p. 14
  • Future research should explore the scalability of adversarial prompt tuning across various settings.Source: §7 · p. 14

Related papers

Loading 2311.11261v3…