PaperlayerView exact revision on arXiv

Source-linked AI summary

OT-Attack: Enhancing Adversarial Transferability of Vision-Language Models via Optimal Transport Optimization

Dongchen Han, Xiaojun Jia, Yang Bai, Jindong Gu, Yang Liu, Xiaochun Cao

arXiv:2312.04403v1cs.CV

TL;DR

Prior methods use image-text interaction and augmentation but do not optimally align the resulting pairs, limiting transferability. OT-Attack uses optimal transport to guide adversarial-example generation; the paper reports stronger transferability across image-text matching benchmarks and effectiveness on other tasks and commercial models.

  • Problem

    Prior methods do not account for optimal alignment between augmented image-text pairs, a gap the paper links to source-model overfitting and limited transferability.

    Source: §5 · p. 13

  • Method

    OT-Attack models augmented image and text features as distributions and uses their similarity-based optimal transport mapping to guide adversarial-example generation.

    Source: §1 · p. 2, §5 · p. 13

  • Results

    OT-Attack outperforms existing methods in transferability on image-text matching and is also effective in cross-task attacks and against GPT-4 and Bing Chat.

    Source: §5 · p. 14

  • Takeaways & Limitations

    The results underscore the need for robust defenses against adversarial threats to advanced AI applications.

    Source: §5 · p. 14

    The threat model assumes full knowledge of the white-box source model while the black-box target’s internals are unknown.

    Source: §3.1 · p. 4

Abstract

from arXiv · show

Vision-language pre-training (VLP) models demonstrate impressive abilities in processing both images and text. However, they are vulnerable to multi-modal adversarial examples (AEs). Investigating the generation of high-transferability adversarial examples is crucial for uncovering VLP models' vulnerabilities in practical scenarios. Recent works have indicated that leveraging data augmentation and image-text modal interactions can enhance the transferability of adversarial examples for VLP models significantly. However, they do not consider the optimal alignment problem between dataaugmented image-text pairs. This oversight leads to adversarial examples that are overly tailored to the source model, thus limiting improvements in transferability. In our research, we first explore the interplay between image sets produced through data augmentation and their corresponding text sets. We find that augmented image samples can align optimally with certain texts while exhibiting less relevance to others. Motivated by this, we propose an Optimal Transport-based Adversarial Attack, dubbed OT-Attack. The proposed method formulates the features of image and text sets as two distinct distributions and employs optimal transport theory to determine the most efficient mapping between them. This optimal mapping informs our generation of adversarial examples to effectively counteract the overfitting issues. Extensive experiments across various network architectures and datasets in image-text matching tasks reveal that our OT-Attack outperforms existing state-of-the-art methods in terms of adversarial transferability.

1. Introduction

Black-box transferability matters because adversarial examples generated on a proxy can mislead models whose internals are unknown. OT-Attack addresses SGA’s limited matching of augmented image-text pairs using optimal transport, and the paper reports stronger transferability across models, datasets, and tasks.

1. Introduction

  • The paper motivates transferability as a practical black-box concern: proxy-generated examples can mislead models without detailed knowledge of their internals.The introduction contrasts this setting with white-box attacks that require access to model structure, weights, and gradients.Source: §1 · p. 1
  • Prior work progressed from separate image and text attacks to multimodal Co-Attack and set-level SGA, with intermodal guidance and augmentation associated with improved transferability.The cited methods are Co-Attack and SGA.Source: §1 · p. 2
  • SGA averages similarities across image-text pairs, which can dilute the influence of an optimal match when augmentation makes images align unevenly with text.The paper gives zooming, which enlarges some image regions while omitting others, as an example.Source: §1 · p. 2
  • OT-Attack treats augmented image and text features as distributions and uses their similarity-based optimal transport mapping to guide adversarial-example generation.The authors state this balanced matching reduces overfitting and improves transferability.Source: §1 · p. 2
  • Experiments report results exceeding the state of the art on image-text and text-image matching, with cross-task effectiveness and attacks on GPT-4 and Bing Chat.The experiments include ALBEF, TCL, and CLIP, and Flickr30K and MSCOCO.Source: §1 · p. 2

2. Background And Related Work

The background introduces fused and aligned VLP models, the paper’s downstream tasks, prior adversarial-transfer methods, and optimal transport as a way to compare distributions.

2.1. Vision-Language Pre-training Models

  • Fused VLP models combine image and text embeddings in a multimodal encoder, whereas aligned models independently encode the two modalities.ALBEF and TCL exemplify fused models; CLIP exemplifies aligned models.Source: §2.1 · p. 3

2.2. Vision-Language Tasks

  • Image-text retrieval queries a database with one modality to retrieve the other; captioning generates text for images, while visual grounding locates image regions described by language.Retrieval includes image-to-text and text-to-image tasks.Source: §2.2 · p. 3

2.3. Transferability of Adversarial Examples

  • Adversarial-transfer work spans white-box gradient attacks, multimodal Co-Attack, and SGA, which uses augmented image sets aligned with multiple captions.The background describes SGA as enhancing transferability across black-box models.Source: §2.3 · p. 3

2.4. Optimal Transport

  • Optimal transport compares and aligns feature-set distributions, with applications including generative models, sequence and graph alignment, and image matching.The background also names clustering, distribution estimation, and causal discovery as distribution-centric applications.Source: §2.4 · pp. 3–4

3. Approach

The approach frames adversarial image generation around transfer from a known white-box model to an opaque black-box model. It analyzes how augmentation can disrupt image–text matching, then uses optimal transport to align augmented image and text feature sets.

3.1. Threat Model

  • The threat model assumes full access to the source model but no internal knowledge of the black-box target, with image perturbations bounded by a norm constraint.The attack seeks a perturbation that increases loss on the white-box model and produces sufficient feature-space deviation on the black-box model.Source: §3.1 · p. 4

3.2. Observation & Analysis

  • With ALBEF as source and TCL as target, attack success first rises and then falls as image augmentations increase, while excessive augmentation can disrupt image–text matching.The analysis links overfitting to modified examples missing or exaggerating image features, including subtle details.Source: §3.2 · p. 4

3.3.1 Symbol Conventions

  • The method horizontally flips and scales each input image, encodes the augmented images and original texts, and computes their pairwise similarity matrix.The image and text feature sets are denoted Fimg and Xtxt, respectively.Source: §3.3.1 · pp. 4–5

3.3.2 Optimal Transport

  • The OT formulation maps source and target distributions through a feasible transport plan, with Sinkhorn iterations minimizing an entropy-regularized objective under marginal constraints.The transport matrix records amounts moved between source and target elements; entropy regularization supports numerical stability and efficient computation.Source: §3.3.2 · pp. 5–6

3.3.3 Calculating Loss through Optimal Transport

  • OT-Attack treats augmented-image and text features as distributions, using a minimum-cost transport alignment to address overfitting from relying on similarity alone.The cost matrix is derived from similarity, and transport weights connect augmented-image features to original-text features.Source: §3.3.2 · pp. 5–6, §3.3.3 · p. 6
  • The attack defines transport cost as C = 1 − S and uses the resulting OT loss during adversarial-image generation, updating images by gradient sign within perturbation limits.The generation procedure applies augmentation, computes similarity and Wasserstein distance, and obtains the transport plan with Sinkhorn optimization.Source: §3.3.3 · pp. 6–7

4. Experiments

Experiments evaluate OT-Attack across VLP architectures and datasets, finding higher image-text retrieval transferability than SGA and effects on captioning and visual grounding. Cross-task tests include attacks generated on one model and evaluated on another.

4.1. Settings

  • Experiments evaluated transferability across fused ALBEF and TCL source models and two aligned CLIP target variants, using Flickr30K and MSCOCO for image-text retrieval and RefCOCO+ for visual grounding.Baselines were PGD, BERT-Attack, Sep-Attack, Co-Attack, and SGA; retrieval samples comprised 1,000 Flickr30K images and 5,000 captions, and 5,000 MSCOCO images and 25,000 captions.Source: §4.1 · p. 7, §4.2 · p. 9
  • For retrieval attacks, PGD used a 2/255 perturbation limit, 0.5/255 steps, and 10 iterations; the text attack used BERT-Attack with a limit of 1 and vocabulary length 10.OT-Attack augmented images at six scales and with horizontal flips, expanded text using five closely matched caption pairs per image, and used Sinkhorn to approximate the transport plan; ASR measures the percentage of successful attacks.Source: §4.1 · pp. 7–8

4.2. Comparative Experimental Results

  • 6.95% on Flickr30K and 4.88% on MSCOCO, and 8.41% on Flickr30K and 5.71% on MSCOCO: OT-Attack improved TR R@1 attack success over SGA in both ALBEF-to-TCL and TCL-to-ALBEF settings.The evaluation spans image-text retrieval across ALBEF, TCL, CLIPViT, and CLIPCNN; Table 2 reports Flickr30K results.Source: Table 2 · p. 8, §4.2 · p. 9

4.3.1 Image Captioning

  • With ALBEF-generated adversarial examples evaluated by BLIP on 10,000 MSCOCO images, OT-Attack reduced BLEU-4 by 0.7, METEOR by 0.5, ROUGE-L by 0.6, CIDEr by 3.4, and SPICE by 0.5 versus SGA.Lower scores indicate greater captioning attack effectiveness; the experiments also report susceptibility of GPT-4 and Bing Chat to perturbations at 16/255 over 500 iterations.Source: Table 4 · p. 10, §4.3.1 · p. 11

4.3.2 Visual Grounding

  • On RefCOCO+ visual grounding, with TCL as source and ALBEF as target, OT-Attack reduced ALBEF scores versus SGA by 0.2 on Val, 0.2 on TestA, and 0.3 on TestB.Separately, Figure 7 shows that subtle perturbations to ALBEF white-box attacks on Flickr30K samples disrupt object recognition and localization.Source: §4.3.2 · p. 12, Table 5 · p. 13

5. Conclusion

OT-Attack addresses overlooked alignment between augmented image and text pairs by using optimal transport to guide adversarial-example generation. Experiments report stronger transferability than existing methods, including cross-task attacks on commercial models.

5. Conclusion

  • OT-Attack represents image and text features as distributions and uses their similarity as a cost matrix to find an optimal mapping that guides adversarial-example generation.The authors state that this approach mitigates overfitting and improves adversarial transferability.Source: §5 · pp. 13–14
  • Experiments across network architectures and datasets in image-text matching show OT-Attack outperforms existing methods in adversarial transferability.The conclusion also reports effectiveness in cross-task attacks, including image captioning and visual grounding.Source: §5 · p. 14
  • OT-Attack poses a considerable challenge to commercial models, including GPT-4 and Bing Chat, in cross-task attacks.The authors state that this highlights the need for robust defenses against sophisticated attacks.Source: §5 · p. 14

Related papers

Loading 2312.04403v1…