PaperlayerView exact revision on arXiv

Source-linked AI summary

One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models

Lin Li, Haoyan Guan, Jianing Qiu, Michael Spratling

arXiv:2403.01849v1cs.CVcs.AIcs.LG

TL;DR

Pretrained vision-language models are vulnerable to adversarial image perturbations, and text prompts have received less attention than model weights as a route to robustness. The paper studies prompt sensitivity and proposes Adversarial Prompt Tuning, reporting improved performance and generalization across its evaluations.

  • Problem

    Pretrained VLM outputs can be manipulated by human-imperceptible image perturbations, while text prompts have rarely been studied for adversarial robustness.

    Source: §1 · pp. 1–2

  • Method

    Adversarial Prompt Tuning learns soft text prompts for CLIP from adversarial examples while leaving model weights frozen.

    Source: §1 · p. 2

  • Results

    APT outperforms hand-engineered prompts and other adaptation methods in-distribution and generalizes under input distribution shifts and across datasets.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The experiments support text prompting as a parameter- and data-efficient approach to improving VLM adversarial robustness.

    Source: §7 · p. 9

    APT’s learned context vectors are difficult to interpret, and its effectiveness depends on pretrained weights; it cannot effectively boost robustness for the standardly pretrained overly vulnerable model.

    Source: §6 · p. 8

Abstract

from arXiv · show

Large pre-trained Vision-Language Models (VLMs) like CLIP, despite having remarkable generalization ability, are highly vulnerable to adversarial examples. This work studies the adversarial robustness of VLMs from the novel perspective of the text prompt instead of the extensively studied model weights (frozen in this work). We first show that the effectiveness of both adversarial attack and defense are sensitive to the used text prompt. Inspired by this, we propose a method to improve resilience to adversarial attacks by learning a robust text prompt for VLMs. The proposed method, named Adversarial Prompt Tuning (APT), is effective while being both computationally and data efficient. Extensive experiments are conducted across 15 datasets and 4 data sparsity schemes (from 1-shot to full training data settings) to show APT's superiority over hand-engineered prompts and other state-of-the-art adaption methods. APT demonstrated excellent abilities in terms of the in-distribution performance and the generalization under input distribution shift and across datasets. Surprisingly, by simply adding one learned word to the prompts, APT can significantly boost the accuracy and robustness (epsilon=4/255) over the hand-engineered prompts by +13% and +8.5% on average respectively. The improvement further increases, in our most effective setting, to +26.4% for accuracy and +16.7% for robustness. Code is available at https://github.com/TreeLLi/APT.

1. Introduction

The section frames adversarial vulnerability in pretrained VLMs as a security concern and notes the cost of adapting model weights. It proposes learning text prompts, motivated by prompt-sensitive attacks and defenses, and reports broad performance gains.

1. Introduction

  • Figure 1 reports accuracy and ϵ = 4/255 robustness gains over hand-engineered prompts across 11 datasets after adding one learned prompt vector.The figure caption describes the gains as substantial and identifies the learned “word” as a vector.Source: Figure 1 · p. 1
  • Human-imperceptible image perturbations can manipulate VLM outputs, while full-weight adaptation can be prohibitively costly and may hurt out-of-distribution generalization.Adversarial training can make full-weight adaptation still less affordable.Source: §1 · p. 1
  • Figure 2 contrasts APT with visual prompting and partial adversarial fine-tuning, which discards CLIP’s entire text branch.Learnable parameters are highlighted in yellow in the architectural comparison.Source: Figure 2 · p. 2
  • Adversarial attack strength and CLIP robustness depend on the text prompt, and the strongest examples almost always use matching attack and inference prompts.The matching-prompt finding concerns attacks generated against the victim model during inference.Source: §1 · p. 2
  • APT learns soft text prompts from adversarial examples to improve CLIP robustness, using learnable vectors shared across classes or specific to each class.The prompts are optimized to minimize predictive loss, and the adopted strategy generates training adversarial examples from the latest updated prompts.Source: §1 · p. 2
  • Across 15 datasets and four data-sparsity settings, APT outperforms hand-engineered prompts and other adaptation methods in-distribution and under distribution shift.The reported generalization includes both shifts in input distribution and evaluation across datasets.Source: §1 · p. 2

2. Related Works

Related work covers parameter-efficient adaptation, adversarial training, and existing approaches to adapting pretrained models for adversarial robustness. It positions text-driven prompting as a distinct alternative and depicts APT alongside visual prompting and partial fine-tuning.

2. Related Works

  • Parameter-efficient adaptation includes prompt tuning, adapters, and linear probing; text and visual prompting modify different modality inputs.The paper investigates text-driven prompt learning for defending against adversarial attacks in image recognition.Source: §2 · p. 2
  • Adversarial training replaces clean examples with on-the-fly adversarial examples, but is expensive and prone to overfitting.Prior work includes methods aimed at improving its efficiency or effectiveness.Source: §2 · p. 2
  • Prior pretrained-model defenses adapt weights through adversarial fine-tuning or images through visual prompting; this work instead tunes text prompts.Figure 3 depicts APT with frozen image and text encoders and learnable prompt contexts that may be shared or class-specific.Source: §2 · p. 3, Figure 3 · p. 3

3. Text Prompt for Adversarial Robustness

CLIP’s adversarial robustness depends on both the inference prompt and the prompt used to generate attacks. In CLIP, class prompts combine class names with context, and attack gradients depend on the text features those prompts produce.

3.1. Review of CLIP

  • CLIP’s image and text encoders extract features that are compared to score image–text alignment.The encoders are parameterized by θv and θt, respectively.Source: §3.1 · p. 3
  • Zero-shot classification uses class text descriptions as prompts and predicts the class with the highest image–text alignment score.CLIP’s default class prompt is “a photo of a [CLASS]”; its context is the prompt content other than the class name.Source: §3.1 · p. 3
  • Prompt context can be arbitrary, and tuning it can affect performance on a target dataset.The paper identifies prompt context as another dimension for adapting a frozen pre-trained VLM.Source: §3.1 · p. 3

3.2. The Sensitivity of Robustness to Prompts

  • Adversarial attacks search for a bounded image perturbation that increases dissimilarity between the image feature and its ground-truth class text feature.The attack objective depends on the text encoder and attack prompt because they shape the text features used in the gradients; the encoder weights are frozen in this work.Source: §3.2 · pp. 3–4
  • For pre-trained CLIP with ViT-B/32 evaluated against PGD100, changing inference prompt from P5 to P4 raises worst-case robustness from 8.53% to 10.55% when attack prompt t′ equals inference prompt t.Source: Figure 4 · p. 4, §3.2 · p. 4
  • Figure 4 compares robustness across inference prompts in rows and attack prompts in columns, with cells showing absolute or row-relative robustness.Its results average across 11 datasets and use ViT-B/32 and PGD100.Source: Figure 4 · p. 4
  • The lowest robustness occurs when attack and inference prompts match, except for P4, where P2 yields robustness just 0.06% lower.Attack strength varies with the attack prompt, and access to the inference prompt helps attackers construct strong attacks.Source: §3.2 · p. 4

4. Adversarial Prompt Tuning (APT)

Adversarial Prompt Tuning (APT) learns prompt contexts using adversarial examples while keeping the pre-trained model weights fixed. Its on-the-fly strategy matches the effectiveness of the perturbed strategy and is more effective than the constant strategy.

4.1. Prompt Parameterization

  • APT represents prompt context as learnable vectors in the word-embedding space, concatenated with a fixed class embedding.The class embedding can be placed at the front, middle, or end; because no results distinguished these positions, the end is used by default.Source: §4.1 · p. 4
  • Unified Context shares one vector sequence across classes, while Class-Specific Context learns a separate sequence per class.Class-Specific Context has C times more parameters; Unified Context is more effective with limited data, while Class-Specific Context is more effective with abundant data.Source: §4.1 · p. 4

4.2. Prompt Optimization

  • APT trains prompt contexts with adversarial training, generating image perturbations to maximize loss and updating the learnable context vectors to minimize predictive loss.The training strategies differ in how the adversarial perturbation is generated; the optimization can also be extended to TRADES.Source: §4.2 · pp. 4–5
  • APT’s training iteration forms a prompt from the context and class embedding, generates an adversarial example according to the chosen strategy, then updates the context.Only the context vectors are learnable; class embeddings remain constant.Source: §4.2 · pp. 4–5
  • The constant strategy uses a fixed “a photo of a [CLASS]” attack prompt, while the perturbed strategy also perturbs text prompts.Constant perturbations can be cached but may be less effective because they are no longer dynamically adversarial; perturbed adds text-encoder attack passes to on-the-fly generation.Source: §4.2 · p. 5
  • On-the-fly adversarial generation matches the perturbed strategy’s effectiveness and outperforms the constant strategy, offering the best effectiveness–efficiency trade-off.The on-the-fly strategy generates examples from the latest updated prompts.Source: §4.2 · p. 5

5. Experiments

Across 11 datasets, APT improves in-distribution accuracy and robustness over hand-engineered prompts, and its learned prompts generalize across input shifts and datasets. The experiments also compare prompt variants, accuracy–robustness trade-offs, evaluation reliability, and design choices.

5. Experiments

  • The evaluation uses PGD for training and testing, with 3 training steps and 100 evaluation steps at perturbation budgets ε = 1/255 and 4/255.The default image encoder is ViT-B/32 with weights pretrained using TeCoA.Source: §5 · p. 5

5.1. In-Distribution Performance on 11 Datasets

  • +26.4% accuracy and +16.7% robustness over HEP at ε = 4/255 when trained with the full dataset, using the CSC variant.Table 1 reports average performance; HEP results are repeated across shot settings despite not being controlled for shot count.Source: Table 1 · p. 6, §5.1 · p. 6
  • APT improves over HEP on all 11 datasets, though margins vary; at 16 shots, UC still improves ImageNet accuracy by +1.1% and robustness by +1.9%.The cited prose attributes ImageNet's smaller margin to the model weights having been pretrained with HEP on the full ImageNet training set.Source: §5.1 · p. 6, Figure 5 · p. 7
  • APT substantially outperforms AVP and PAFT at 1 and 4 shots; versus PAFT at 16 and all shots, it has comparable robustness and higher accuracy.Compared with AVP, APT's advantage in accuracy and robustness grows as more training data is used.Source: §5.1 · p. 6, Table 1 · p. 6

5.2. Generalization of Learned Prompt Contexts

  • APT achieves the best overall generalization among compared methods across distribution-shift and cross-dataset tests, with highest accuracy and robustness on most target datasets.Prompts are learned on ImageNet; the tests cover four ImageNet variants and the other ten benchmark datasets.Source: §5.2 · p. 7, Table 2 · p. 8

5.3. Trade-off Between Accuracy and Robustness

  • Adversarially trained unified prompts generally trade some accuracy for robustness, but robustness gains exceed accuracy losses on most datasets.On Flowers102, robustness improves by +11.2% with an accuracy change of -2.3%.Source: §5.3 · p. 8, Figure 6 · p. 8

5.4. Reliability of Adversarial Evaluation

  • Additional tests with TPGD, CW, AutoAttack, and transferred adversarial examples indicate the robustness advantage is not due to attack-specific overfitting or obfuscated gradients.The passage points to Appendix C.4 for the results.Source: §5.4 · p. 8

5.5. Ablation Study

  • Ablations examine prompt-context length, class-embedding position, and the strategy for generating training adversarial examples.The passage identifies these as design choices studied in Appendices C.3.1–C.3.3, without reporting their outcomes here.Source: §5.5 · p. 8

6. Limitation

APT has limitations in interpreting its learned context vectors and in improving robustness when the pretrained model is highly vulnerable.

6. Limitation

  • Learned context vectors are difficult to interpret, and APT's effectiveness depends on pretrained weights; APT and other parameter-efficient methods did not effectively boost robustness for the standardly pretrained, overly vulnerable model.The paper suggests limited tunable parameters relative to the image and text encoders as a possible reason, especially for the unified-context variant.Source: §6 · p. 8

7. Conclusion

The paper studies VLM adversarial robustness through text prompts, first showing prompt sensitivity and then introducing APT to learn robust prompts for CLIP. Its experiments support APT's effectiveness in-distribution and under distribution shift and across datasets.

7. Conclusion

  • The conclusion presents text prompting as a parameter- and data-efficient route to improving CLIP adversarial robustness, with effectiveness across in-distribution and generalization settings.The authors describe the work as opening a new way to enhance VLM robustness through text prompting.Source: §7 · pp. 8–9

A.1. Adversarial Defense for VLMs

  • Earlier VLM defense work trained from scratch, added auxiliary modules, or adversarially fine-tuned weights, leaving prompt effects on robustness unexplored.The paper addresses that gap by analyzing prompt sensitivity and optimizing text prompts.Source: §A.1 · p. 13

A.2. Adversarial Visual Prompting

  • AVP adds a learnable perturbation to the input image and optimizes it against both clean and adversarial losses.The perturbation is applied to the image, while the model encoders remain part of the loss computation.Source: §A.2 · p. 13

A.3. Partial Adversarial Fine-Tuning

  • PAFT discards CLIP's text encoder, adds a linear classifier above its frozen image encoder, and optimizes that classifier using adversarial loss.Its attack perturbation is generated with conventional PGD on the new classifier.Source: §A.3 · p. 13

B. Experiment Setting

The experiment setting uses 11 datasets spanning several vision-task categories and fixes sampled training examples across methods for fair comparison.

B. Experiment Setting

  • The 11-dataset benchmark spans object, scene, action, fine-grained, texture, and satellite-imagery tasks, with the same sampled training data used for every evaluated method.The text refers to a dataset-statistics-and-prompts table, but the supplied passage gives no table values.Source: B. Experiment Setting · p. 13, Table 3 · p. 13

B.1. General Training Set-ups

The reported training setups specify optimization schedules for APT, AVP, and PAFT, alongside average-performance evaluations under different encoder and context-length settings.

B.1. General Training Set-ups

  • APT uses SGD with cosine learning-rate scheduling, an initial learning rate of 0.002, batch size 32, and last-checkpoint reporting.ImageNet training runs for 20/20/50/20 epochs at 1/4/16/all shots; other datasets use 50/100/200/200 epochs.Source: §B.1 · p. 13
  • AVP uses unified padding prompts of size 52 to match APT’s unified-context parameter count, with cosine scheduling and an initial learning rate of 0.1.AVP runs 20/50/100/100 epochs on non-ImageNet datasets and 20/20/50/20 on ImageNet across 1/4/16/all shots.Source: §B.1 · p. 13
  • PAFT uses an initial learning rate of 0.1 with decay by 0.1 at shot-dependent epochs; non-ImageNet runs use 20/50/100/100 epochs.For ImageNet, PAFT uses 20/20/50/20 epochs at 1/4/16/100 shots.Source: §B.1 · p. 13
  • The reported averages cover ResNet50 at ε=1/255 with M=16 and 16 shots, and context-length variants at ε=4/255 with 16 shots.The captions identify evaluation scope but do not provide comparative values.Source: Table 4 · p. 14, Table 5 · p. 14

C. Additional Results

Additional in-distribution results assess performance at ε=1/255 across datasets. Their trends are generally consistent with those reported at ε=4/255.

C. Additional Results

  • For ϵ=1/255, Fig. 7 depicts results on each dataset, with trends generally consistent with those observed for ϵ=4/255 in Fig. 5.Source: §C.1 · p. 14
  • The ε=1/255 results generally follow the trends observed at ε=4/255 in Fig. 5.Source: §C.1 · p. 14
  • Figure 7 reports results for each dataset at ε=1/255, with trends generally consistent with those observed for ε=4/255 in Figure 5.Source: §C.1 · p. 14

C.2. Generalization to Other Architectures

The ResNet50 evaluation reports advantages over the zero-shot baseline, while ablations examine context length and class-embedding position under specified settings.

C.2. Generalization to Other Architectures

  • With a ResNet50 vision encoder, APT improves substantially over the zero-shot baseline and achieves LP-comparable robustness with significantly higher accuracy.Source: §C.2 · p. 14

C.3. Ablation Study

  • The ablation default uses M=16, places the class embedding at the prompt end, trains adversaries on-the-fly, and evaluates 16-shot models at ε=4/255.Source: §C.3 · p. 14

C.3.1 Prompt Context Length

  • Increasing context length significantly improves UC performance, whereas CSC gains only marginal accuracy and no robustness improvement.The authors attribute CSC’s limited robustness change partly to its greater parameter count than UC at M=16 when the class count exceeds 16, as in most tested datasets.Source: §C.3.1 · p. 14

C.3.2 Class Embedding Position

  • Class-embedding position produces no statistically significant differences for UC or CSC, so the end position is retained for slightly better performance and simplicity.Table 6 compares embedding positions at M=16, ε=4/255, and 16 shots.Source: §C.3.2 · p. 14, Table 6 · p. 14

C.3.3 Prompting for Training Adversarial Generation

The appendix compares adversarial-example generation strategies and checks robustness across attack types and prompts, while also discussing interpretability and backbone dependence.

C.3.3 Prompting for Training Adversarial Generation

  • On-the-fly and properly configured perturbed training achieve very close accuracy and robustness, with perturbed slightly advantaged in unified-context accuracy.Both outperform constant training.Source: §C.3.3 · pp. 14, 16
  • Figure 7 reports in-distribution performance on 11 datasets and averaged performance across shots at ε=1/255 with M=16.Source: Figure 7 · p. 15
  • In perturbed training, increasing α′ increases prompt deviation from the original and is associated with a performance drop.Source: §C.3.3 · p. 16

C.4. Verification

  • Under CW and AutoAttack, APT’s performance degrades but remains well above the baseline, supporting robustness beyond the particular attack used in evaluation.The verification also evaluates TPGD; AutoAttack uses a 5,000-image ImageNet test subset because the full test set is expensive.Source: §C.4 · p. 16, Table 8 · p. 16
  • APT is more robust against adversarial examples generated from six other prompts, suggesting its robustness generalizes across attack-prompt sources.Source: §C.4 · p. 16, Table 9 · p. 16

C.5. Interpretability of the Learned Context

  • Nearest-word decoding yields words that often lack dataset-semantic relevance, but the authors caution that this may not faithfully interpret learned vectors.Some decoded tokens are non-Latin; no established distance threshold indicates when a decoded word is faithful.Source: §C.5 · p. 16, Table 10 · p. 16

C.6. Dependency on the Robust Visual Backbone

  • APT failed to improve robustness over the hand-engineered-prompt baseline or collapsed when CLIP’s image encoder lacked robust pretraining.The authors state that a robust visual backbone is necessary for APT to be effective.Source: §C.6 · pp. 16–17
  • For standardly trained ResNet18 on CIFAR10, AVP achieved 27.7% accuracy and 16.7% robustness, versus 94.9% accuracy without AVP.The authors describe this accuracy–robustness trade-off as unacceptable.Source: §C.6 · p. 17
Loading 2403.01849v1…