Source-linked AI summary
Unveiling the Fragility of Vision-Language Models: Multi-Modal Adversarial Synergy via Texture-Constrained Perturbations and Cross-Modal Optimization
Xiang Fang, Wanlong Fang, Changshuo Wang
TL;DR
LVLM robustness to coordinated adversarial attacks across visual and textual modalities is underexplored, despite risks in applications such as autonomous driving and content moderation. MMAS jointly optimizes universal image and text perturbations using only model queries and cross-modal regularization. Across multiple models, tasks, and datasets, the paper reports stronger attack performance and transferability than comparison methods.
Problem
LVLM robustness to coordinated adversarial attacks across visual and textual modalities is underexplored, despite risks in applications such as autonomous driving and content moderation.
Method
MMAS jointly optimizes a texture scale-constrained universal image perturbation and a learnable text prompt perturbation using only model queries.
Results
MMAS consistently achieves the best semantic similarity performance across evaluated models and datasets, with strong transferability across datasets and LVLMs.
Takeaways & Limitations
The findings expose coordinated multi-modal vulnerabilities in LVLMs and support the need for robust defenses.
Abstract
from arXiv · showhide
Large Vision-Language Models (LVLMs) have transformed multi-modal understanding, excelling in tasks like image captioning and visual question answering by integrating visual and textual inputs. However, their robustness against adversarial attacks, particularly those exploiting both modalities, remains underexplored, posing risks to critical applications like autonomous driving and content moderation. Existing attacks focus on single modalities or require impractical white-box access, limiting their real-world relevance. In this paper, we introduce Multi-Modal Adversarial Synergy, a groundbreaking framework that crafts universal, black-box multi-modal attacks against LVLMs. MMAS simultaneously generates a texture scale-constrained universal adversarial perturbation for images and a learnable prompt perturbation for text, optimized jointly using only model queries. The image perturbation leverages wavelet-based texture constraints to ensure imperceptibility and robustness across diverse visual inputs. The text perturbation, constrained by an L-norm in the embedding space, maintains semantic coherence while steering outputs toward a target. A novel cross-modal regularization term aligns the perturbations' gradient directions, enhancing their synergistic impact and transferability across tasks and models. Extensive experiments show the strong universal adversarial capabilities of our proposed attack with prevalent LVLMs.
Introduction
LVLMs are increasingly capable but remain vulnerable to coordinated adversarial manipulation across visual and textual inputs. MMAS addresses this gap with a universal, black-box attack that jointly optimizes constrained image and text perturbations.
- Motivation: Existing LVLM attacks often target one modality or require white-box model access, limiting their practical applicability.The paper identifies a need for attacks that work through queries alone and generalize across tasks and inputs.
- MMAS Framework: MMAS jointly generates a texture scale-constrained image UAP and a learnable text prompt perturbation using only model queries.The framework is designed for universal attacks against LVLMs without internal model knowledge.
- MMAS Framework: Cross-modal regularization aligns image and text perturbations to enhance their combined efficacy and transferability across tasks and inputs.The regularizer is the framework’s central mechanism for coordinating the two modalities.
- Evaluation: MMAS is evaluated on CLIP and Flamingo across image captioning, VQA, and text-guided image classification.The evaluation includes targeted manipulation of a stop-sign image paired with a proceed prompt toward the output “go.”
- Results: The reported results show higher attack success rates and better transferability than single-modality baselines and naive multi-modal combinations.The perturbations are described as imperceptible to human observers in the targeted example.
- Implications: The paper frames coordinated multi-modal attacks as evidence of LVLM vulnerability and emphasizes the need for robust defenses.The concern is linked to safety-critical applications and content moderation.
Related Work
Prior work established universal image attacks and early multi-modal attacks, but important gaps remain in black-box practicality and joint optimization of both modalities.
- Vision Attacks: Universal adversarial perturbations established single noise patterns that can attack multiple images, improving attack scalability.Later work added texture scale constraints using wavelet-transform features.
- Multi-Modal Attacks: Early multi-modal attacks combined image noise with text alterations but depended on white-box access to model internals.That dependence restricts their real-world applicability.
- Multi-Modal Attacks: Black-box task-agnostic work uses query-based optimization but focuses on image perturbations with static text.This leaves joint optimization of visual and textual perturbations underexplored.
Methodology
MMAS constructs universal image and text perturbations in a black-box setting, constraining their perceptual and semantic effects while jointly optimizing their cross-modal interaction.
- Framework Overview: MMAS initializes a texture scale-constrained image UAP and a learnable text prompt perturbation, then jointly optimizes them using model queries.The pipeline includes initialization, joint optimization, and evaluation on unseen inputs.
- Texture Scale-Constrained UAP for Image Attack: The image perturbation uses wavelet-based multi-scale texture features to maintain visual coherence while improving robustness and transferability.The perturbation is optimized across diverse images rather than fitted to one image.
- Texture Scale-Constrained UAP for Image Attack: Wavelet projection constrains image perturbations to selected texture scales, with learnable weights combining inverse-transformed masked coefficients.The UAP is initialized within an ℓ∞ bound and optimized across a diverse image set.
- Learnable Prompt Perturbation for Text Attack: The text attack learns a universal embedding-space perturbation that is applied across prompts while preserving semantic coherence through an ℓ2 constraint.The perturbation is optimized during training and reused across the prompt set.
- Joint Optimization by Cross-Modal Regularization: Joint optimization addresses cases where changing only images or texts fails to sever the link between visual content and captions.The objective combines attack success with modality synergy.
- Joint Optimization by Cross-Modal Regularization: The cross-modal regularizer aligns image and text loss-gradient directions so their perturbations reinforce one another across prompts and tasks.Gradients are approximated with query-based noise sampling because the setting provides no model internals.
- Optimization Procedure: Projected Gradient Descent updates both perturbations while projection and repeated texture constraints enforce their respective bounds.The optimized perturbations are then evaluated as a universal attack on unseen inputs.
Experiments
MMAS is evaluated across multiple LVLMs, datasets, tasks, attack settings, transfer scenarios, defenses, and ablations. The experiments report strong attack performance, universal transfer behavior, and positive contributions from the image, text, and joint-optimization components.
- Attack Procedure: MMAS jointly optimizes universal image and text perturbations through a query-based procedure with texture constraints, norm bounds, and cross-modal regularization.The algorithm initializes image and text perturbations, estimates gradients from queries, computes a regularization term, and updates the perturbations iteratively.
- Experimental Setup: Experiments evaluate MMAS on LLaVA, MiniGPT-4, Flamingo, and BLIP-2 across classification, captioning, and VQA settings.The evaluation uses datasets including MS-COCO, VQAv2, and DALLE-3, with overall scores aggregating task results.
- Baselines: The attack is compared with clean inputs, task-agnostic UAP, MF-Attack, and CroPA under matched evaluation settings.The comparisons include VQA on ImageNet-1k, ASR on OpenFlamingo and MS-COCO, and attack transfer to commercial VLMs.
- Main Results: MMAS consistently achieves the best semantic-similarity performance across the evaluated models, datasets, and tasks.The overall score is the average semantic similarity across tasks, and the target output is “I am sorry.”
- Transferability: MMAS transfers across datasets and LVLMs, although dataset transfer is less effective than model transfer because image distributions differ.The transfer experiments train a patch on one dataset or model and evaluate it on others.
- Ablation Study: Removing the text attack, image attack, or joint optimization reduces performance, indicating that all three modules contribute positively.Additional ablations vary target texts and the scaling factor sk, with similarity peaking at sk = 4.
Conclusion
The paper introduces MMAS to expose and exploit LVLM vulnerabilities through coordinated multi-modal adversarial attacks. Experiments across multiple datasets show effectiveness across multi-modal tasks.
- Conclusion: MMAS exposes and exploits LVLM vulnerabilities through coordinated multi-modal adversarial attacks.The framework is presented as a universal attack method for LVLMs.
- Conclusion: Experiments on multiple datasets show that MMAS is effective across various multi-modal tasks.The conclusion summarizes the reported effectiveness without specifying a single metric.