PaperlayerView exact revision on arXiv

Source-linked AI summary

InstructTA: Instruction-Tuned Targeted Attack for Large Vision-Language Models

Xunguang Wang, Zhenlan Ji, Pingchuan Ma, Zongjie Li, Shuai Wang

arXiv:2312.01886v3cs.CV

TL;DR

LVLMs are vulnerable to targeted adversarial examples, but practical attacks must operate without access to the victim’s prompts and LLM. InstructTA infers and paraphrases instructions, creates a target image, and matches instruction-aware surrogate features; experiments report superior targeted attack performance and transferability. The paper frames this as a gray-box vulnerability while discussing mitigation directions.

  • Problem

    Targeted LVLM attacks must transfer across unknown prompts and LLM backends when the attacker knows only the victim’s vision encoder.

    Source: §1 · p. 2

  • Method

    InstructTA uses GPT-4 to infer and paraphrase instructions, reverses the target response into an image, and minimizes surrogate instruction-aware feature distance.

    Source: §1 · p. 2, §3.2 · p. 7

  • Results

    Experiments demonstrate better targeted attack performance and transferability than intuitive baselines.

    Source: §1 · p. 3

  • Takeaways & Limitations

    InstructTA demonstrates targeted LVLM attacks under a practical gray-box setting and highlights instruction-based visual-language feature fusion as important for transferability.

    Source: §5 · p. 14

    The attack assumes access to the victim’s visual encoder and a locally constructed surrogate model with that same encoder.

    Source: §3.2 · p. 5

Abstract

from arXiv · show

Large vision-language models (LVLMs) have demonstrated their incredible capability in image understanding and response generation. However, this rich visual interaction also makes LVLMs vulnerable to adversarial examples. In this paper, we formulate a novel and practical targeted attack scenario that the adversary can only know the vision encoder of the victim LVLM, without the knowledge of its prompts (which are often proprietary for service providers and not publicly available) and its underlying large language model (LLM). This practical setting poses challenges to the cross-prompt and cross-model transferability of targeted adversarial attack, which aims to confuse the LVLM to output a response that is semantically similar to the attacker's chosen target text. To this end, we propose an instruction-tuned targeted attack (dubbed \textsc{InstructTA}) to deliver the targeted adversarial attack on LVLMs with high transferability. Initially, we utilize a public text-to-image generative model to "reverse" the target response into a target image, and employ GPT-4 to infer a reasonable instruction $\boldsymbol{p}^\prime$ from the target response. We then form a local surrogate model (sharing the same vision encoder with the victim LVLM) to extract instruction-aware features of an adversarial image example and the target image, and minimize the distance between these two features to optimize the adversarial example. To further improve the transferability with instruction tuning, we augment the instruction $\boldsymbol{p}^\prime$ with instructions paraphrased from GPT-4. Extensive experiments demonstrate the superiority of our proposed method in targeted attack performance and transferability. The code is available at https://github.com/xunguangwang/InstructTA.

1 Introduction

The paper studies targeted attacks on LVLMs when attackers know only the vision encoder, while prompts and LLM backends remain unknown. InstructTA combines inferred and paraphrased instructions with target-image feature matching to improve attack transferability.

Motivation

  • LVLMs are vulnerable to targeted adversarial examples that can induce harmful responses, motivating attacks that address these security threats.Examples include eliciting bomb-making explanations or specific medical diagnoses.Source: §1 · p. 2

Problem Setting

  • In the practical gray-box setting, attackers know the victim’s vision encoder but not its prompts or LLM, creating cross-model and cross-instruction transfer challenges.The unknown instructions also prevent direct extraction of instruction-aware features from the vision encoder.Source: §1 · p. 2

Method

  • InstructTA converts the target response into a target image, infers a matching instruction with GPT-4, and minimizes instruction-aware feature distance in a local surrogate model.The surrogate shares the victim’s vision encoder and uses target and adversarial images for feature matching.Source: §1 · p. 2, Figure 1 · p. 3
  • GPT-4 paraphrases the inferred instruction into semantically related variants, enabling instruction tuning intended to improve adversarial-sample transferability.The paper treats instructions and prompts interchangeably in this setting.Source: §1 · p. 2

Results

  • Extensive experiments report better targeted attack performance and transferability than intuitive baselines.The paper also discusses mitigations and ethical considerations.Source: §1 · p. 3

2 Related Work

Related work spans LVLM architectures, conventional adversarial attacks, and emerging attacks on vision-language systems. InstructTA differs by targeting semantic responses under unknown built-in prompts and by using inferred and rephrased instructions for transferability.

LVLMs

  • LVLMs combine a vision encoder, connector or projector, and LLM to support multimodal tasks such as captioning, visual question answering, reasoning, and dialog.Representative systems include BLIP-2, MiniGPT-4, InstructBLIP, LLaVA, and CogVLM.Source: §2 · p. 3

Adversarial Attacks

  • Adversarial attacks include targeted and non-targeted objectives, with white-box, black-box, and transfer-based settings differing in accessible model information.Transfer attacks construct adversarial samples using substitute models, while black-box attacks may query the target repeatedly.Source: §2 · p. 4

Vision-Language Attacks

  • Prior vision-language attacks address image-text perturbations, cross-model transferability, or feature matching across visual and textual representations.These methods extend adversarial-attack research beyond image classification to vision-language pretraining and related tasks.Source: §2 · p. 4

LVLM Targeted Attacks

  • Existing LVLM targeted attacks either force specific strings or align adversarial and target representations, whereas InstructTA targets semantic responses without knowing built-in prompts.Its distinguishing mechanism is guidance from inferred and rephrased instructions.Source: §2 · p. 5

3 Method

InstructTA formulates targeted LVLM attacks when only the victim’s vision encoder is known, then combines instruction-aware feature alignment with instruction augmentation and a dual optimization objective. The method reverses target text into a target image, infers and paraphrases instructions, and optimizes adversarial images under a perturbation constraint.

3.1 Problem Formulation

  • Targeted attacks optimize an adversarial image x′ to make an LVLM response semantically match predefined target text y_t under an L∞ perturbation budget, while the victim instruction p remains unknown.The LVLM maps an image and instruction to an answer, and the attack maximizes semantic similarity between the generated response and y_t.Source: §3.1 · p. 5

3.2 Targeted Attack with Instruction Tuning

  • InstructTA assumes a gray-box attacker knows only the victim’s visual encoder, while prompts and the underlying LLM remain inaccessible.Attackers may know the target usage domain and can build a local surrogate sharing the victim’s vision encoder.Source: §3.2 · pp. 5–6
  • GPT-4 infers an instruction from target text, a public text-to-image model converts the target text into target image x_t, and a surrogate aligns instruction-aware features of x′ and x_t.The surrogate combines the victim visual encoder with a projector, using Q-Former to produce features conditioned on instructions.Source: §3.2 · pp. 6–8
  • GPT-4 paraphrases the inferred instruction into a set Q, and randomly selected paraphrases are used during optimization to improve transferability across possible victim instructions.The original inferred instruction and n−1 rephrasings form Q; n is set to 10 by default.Source: Figure 3 · p. 6, §3.2 · p. 7

3.3 Dual Targeted Attack & Optimization

  • The dual targeted attack minimizes L = J_ins − J_mf, combining instruction-aware feature alignment with MF-it’s global embedding-matching objective.J_mf matches adversarial-image and target-response embeddings using paired visual and text encoders from an align-based VLP model.Source: §3.3 · p. 8
  • PGD iteratively updates x′ from the benign image and clips each step into the ε-ball, producing the final adversarial sample after T iterations.The update uses step size η and the sign of the loss gradient, with S_ε enforcing the perturbation constraint.Source: §3.3 · p. 8

4 Experiments

The experiments evaluate InstructTA across multiple LVLMs, compare it with targeted-attack baselines, and analyze its components, perturbation budget, instruction count, and instruction quality. InstructTA consistently improves targeted-attack effectiveness and transferability, while experiments identify trade-offs between attack strength and image perceptibility.

4.1 Evaluation Setup

  • The evaluation uses five victim LVLMs, CLIP score, NoS, and GPT-4-based ASR to measure targeted response similarity and attack success.Victims include BLIP-2, InstructBLIP, MiniGPT-4, LLaVA, and CogVLM, with target texts and instructions generated from ImageNet-1K and COCO-based pairs.Source: §4.1 · pp. 9–10, §4.2 · p. 11

4.2 Results

  • InstructTA consistently outperforms MF-tt, MF-it, and MF-ii in CLIP score and NoS across BLIP-2, InstructBLIP, and MiniGPT-4.The evaluation uses 1,000 ImageNet-1K images with randomly assigned target texts and instructions; success is assessed using CLIP similarity and GPT-4-based NoS.Source: §4.2 · pp. 11–12, Table 1 · p. 11
  • InstructTA also improves targeted-attack effectiveness when its instruction-aware surrogate vision encoder differs from the victim encoder, indicating transferability beyond MF-it.The method uses ViT-G/14 from EVA-CLIP as its surrogate, while LLaVA and CogVLM use different visual encoders.Source: §4.1 · p. 10, §4.2 · p. 12

4.3 Ablation Study

  • On BLIP-2, the combined InstructTA-woMFG ablation, removing MF-it and GPT-4 paraphrase optimization, reduces success rate by over 19% compared with complete InstructTA.The ablation study evaluates these components sequentially, with InstructTA-woMFG omitting both MF-it and GPT-4 paraphrases.Source: §4.3 · pp. 12–13

4.4 Discussion

  • Increasing ϵ raises CLIP scores and attack success rates until performance saturates beyond ϵ = 16, while large budgets make perturbations perceptible; ϵ = 8 balances effectiveness and imperceptibility.Fig. 5 measures visual degradation with LPIPS and shows that targeted-response effectiveness eventually saturates.Source: §4.4 · p. 13, Figure 5 · p. 13, Table 3 · p. 13
  • More paraphrased instructions increase ASR with roughly unchanged CLIP scores, while generated paraphrases remain highly similar to inferred and real instructions.The instruction-count and instruction-quality analyses use Tables 4 and 5, respectively.Source: §4.4 · p. 14, Table 4 · p. 14, Table 5 · p. 14

5 Conclusion, Ethics, and Mitigation

The paper frames InstructTA as exposing LVLM vulnerability in a practical gray-box setting while emphasizing responsible disclosure and future robustness research.

Conclusion

  • InstructTA demonstrates targeted attacks against LVLMs with high transferability in a practical gray-box scenario.Source: §5 · p. 14

Ethics

  • The authors report minimizing harm by avoiding damage to real users and disclosing the attack process and methods.Source: §5 · p. 14

Mitigation

  • Future mitigation directions include adversarial training for LVLMs or vision encoders and detecting adversarial examples through instruction-aware feature discrepancies.Source: §5 · p. 15

A Real Instructions

This appendix section lists real instructions adapted from LLaVA-Instruct-150K and identifies the accompanying shuffled-instruction results table.

Real Instructions

  • The section provides 11 real instructions adapted from LLaVA-Instruct-150K.Source: A Real Instructions · p. 19
  • The listed instructions ask for interpretations, descriptions, explanations, and observations of image content.Source: A Real Instructions · p. 19
  • Table A6 is designated for targeted attack performance with shuffled instructions.Source: Table A6 · p. 19

B Cross-Instruction Transferability

The cross-instruction experiment evaluates targeted attacks after shuffling semantically similar instruction-answer pairs.

Cross-Instruction Transferability

  • InstructTA achieves the best targeted attack performance on BLIP-2 by CLIP-score and NoS under shuffled instructions.The results indicate superior cross-instruction transferability for adversarial examples generated by InstructTA.Source: B Cross-Instruction Transferability · p. 19

Related papers

Loading 2312.01886v3…