PaperlayerView exact revision on arXiv

Source-linked AI summary

Feature-Aware Token Attack for Compression-Triggered Stealthy Failures in Large Vision-Language Models

Shilinlu Yan, Bowen Chen, Yuechen Zhang, Zhenhong Zhou, Li Sun, Sen Su

arXiv:2609.39134v1cs.CV

TL;DR

Full-token evaluation can miss adversarial errors that appear after visual-token compression. FATA combines attention suppression with feature preservation on fixed clean-image tokens; across four task subsets and four compressors, it outperforms CAA on reported full-token retention and conditional blinding.

  • Problem

    Compression can change which visual evidence reaches the language model, so full-token evaluation alone can miss adversarial errors that appear only after compression.

    Source: §1 · p. 1

  • Method

    FATA suppresses attention to fixed clean-image tokens while preserving their feature directions, optimizing only the perturbation through a frozen vision encoder.

    Source: §1 · p. 2

  • Results

    Across four visually dependent task subsets and four compressors, FATA reaches SR = 96.3% and CBR = 22.1%, versus 89.8% and 15.7% for CAA.

    Source: §1 · p. 2

  • Takeaways & Limitations

    The findings support evaluating compression robustness alongside clean efficiency and accuracy, across full-token and compressed inference.

    Source: §6 · p. 9

    FATA assumes visual-encoder gradients; its strongest Qwen3.5 and InternVL3.5 results use task- or architecture-aware extensions with adaptation-dependent full-token cost.

    Source: §6 · p. 9

Abstract

from arXiv · show

Visual-token compression improves the efficiency of large vision-language models, but can expose failures that full-token evaluation misses. We study adversarial images that preserve full-token correctness yet induce errors after compression, even when both inference paths succeed on the clean image. Creating such failures is challenging because perturbing token importance can also damage the visual content needed for full-token inference. We propose Feature-Aware Token Attack (FATA), which couples attention suppression with cosine-based feature preservation on a fixed set of salient clean-image tokens. In the primary LLaVA-1.5-7B setting, FATA uses only vision-encoder gradients, without access to the deployed compressor, token budget, or downstream task. Across four visually dependent task subsets and four compressors under a controlled reconstruction protocol, FATA achieves SR = 96.3% full-token accuracy retention and CBR = 22.1% conditional blinding, compared with 89.8% and 15.7% for CAA. Ablations support the role of both objectives in balancing compressed-path failure against full-token preservation. FATA also has the lowest measured detection rate among four attacks across three evaluated detectors at a 5% false-positive rate. These findings motivate assessing adversarial robustness jointly across full-token and compressed inference.

1 INTRODUCTION

Compression can make perturbed images fail despite correct full-token inference, so an attack must induce compressed-path errors while preserving full-token behavior. FATA couples attention suppression with feature preservation and evaluates the resulting robustness and detectability.

1 INTRODUCTION

  • The attack must preserve full-token correctness while causing errors after compression, because full-token evaluation alone misses this divergence.Attention perturbation can damage features needed for full-token inference, while feature preservation alone provides little pressure for compressed-path failure.Source: §1 · pp. 1–2
  • FATA couples attention suppression with feature preservation on fixed clean-image targets, using only vision-encoder access to induce compression-triggered failures.In the primary LLaVA-1.5-7B setting, optimization does not access the downstream language model, questions, answers, compressor, or token budget.Source: §1 · p. 2
  • Across four visually dependent task subsets and four compressors, FATA achieves SR = 96.3% and CBR = 22.1%, versus 89.8% and 15.7% for CAA.The evaluation uses a controlled reconstruction protocol.Source: §1 · p. 2
  • Evaluation spans four task settings and four compressors, with loss ablations and model-specific extensions under stated access assumptions.Source: §1 · p. 2
  • The paper introduces ML-ATD to monitor the vision encoder, projector, and language model, comparing three detection approaches at a fixed low false-positive rate.Source: §1 · p. 2

2 RELATED WORK

Prior work reduces visual-token costs by selecting or merging tokens, while adversarial work studies feature disruption and compression-aware failures. Detection methods examine input consistency or internal model signals.

2 RELATED WORK

  • Visual-token compression reduces the costs of long visual prefixes by retaining salient or diverse tokens, merging nearby features, or using decoder signals to remove redundancy.The cited methods operate at the encoder output, visual projector, or decoder.Source: §2 · pp. 2–3
  • Earlier adversarial attacks disrupt features, modality alignment, or transferable representations, while CAGE targets tokens likely to survive unknown budgets and CAA seeks failures after compression.These approaches do not generally model which tokens a compressor retains; this work adds explicit semantic preservation to CAA's objective.Source: §2 · p. 3
  • Adversarial detectors assess prediction consistency under transformations, modality-similarity changes, feature-distribution deviations, or internal activations.ML-ATD uses a Base-example attack reference direction and monitors activations in the visual encoder, projector, and language model.Source: §2 · p. 3

3 METHOD

FATA optimizes an input perturbation using fixed clean-image targets and paired attention-suppression and feature-preservation losses, then compares full-token and compressed inference on the same image. The evaluation metrics measure full-token retention and compression-induced errors at a practical token budget.

3.1 OVERVIEW

  • Figure 2 separates input-only PGD optimization from evaluation of the same image through full-token and compressed paths.The compressed path selects or merges representatives and reconstructs the visual-token sequence before inference.Source: Figure 2 · p. 3, §3.1 · pp. 3–4

3.2 FATA

  • FATA optimizes an ℓ∞-bounded image perturbation through the visual encoder, suppressing attention to fixed top-M clean-attention target tokens while preserving their feature directions via cosine similarity to clean features.Source: §3.2 · p. 4, §3.1 · p. 4

3.3 EVALUATION METRICS

  • SR measures full-token performance retention, while CER and CBR measure compressed-path errors, with LLaVA’s practical budget fixed per dataset–compressor pair across attacks.CBR conditions on both the clean input and attack being correct at full tokens, and the clean input remaining correct under compression at the practical budget.Source: §3.3 · pp. 4–5

4 EXPERIMENTS

Experiments evaluate FATA on LLaVA-1.5-7B across four benchmarks and compressors, then examine its dual-loss ablation and model adaptations. FATA improves the reported SR/CBR trade-off over CAA, with related compression effects reported for Qwen3.5 and InternVL3.5.

4.1 EXPERIMENTAL SETUP

  • The LLaVA-1.5-7B evaluation uses four 1,000-image task subsets, four compressors, six retained-token budgets, and a shared perturbation bound of ϵ = 2/255.For each dataset-compressor pair, Kprac is selected from clean results and fixed across attacks.Source: §4.1 · p. 5

4.2.1 MAIN RESULTS

  • At K = 576, FATA averages 89.7% accuracy versus Clean’s 93.2%; the gap widens from 3.5 points at K = 576 to 15.6 at K = 16.At K = 16, TextVQA-Open has the largest dataset-level difference, 23.8 points.Source: §4.2.1 · p. 5, Table 1 · p. 6
  • Compared with CAA, FATA raises SR from 89.8% to 96.3% and CBR from 15.7% to 22.1%.Base and CAGE have higher CBR but lower SR; FATA’s overall trade-off is reported in Table 2.Source: Table 2 · p. 6, §4.2.1 · p. 6

4.2.2 ABLATION STUDY

  • Attention loss alone reaches 32.9% CBR but 66.7% SR, while semantic loss alone reaches 14.5% CBR and 98.5% SR; full FATA reaches 22.1% CBR and 96.3% SR.The ablation attributes compression sensitivity to attention disruption and full-token preservation to semantic preservation.Source: Table 3 · p. 7, §4.2.2 · p. 7

4.3.1 QWEN3.5-9B

  • On Qwen3.5-9B, SR averages 99.3% and CBR averages 46.43% across four datasets and 16 dataset-compressor combinations.At the practical budget, FATA accuracy drops 40.44 points, from 88.92% to 48.48%, versus Clean’s 24.45-point drop, from 89.55% to 65.10%.Source: Table 5 · p. 7, §4.3.1 · p. 7, Table 4 · p. 7

4.3.2 INTERNVL3.5-8B-HF

  • On InternVL3.5-8B-HF, macro SR is 93.94% and macro CBR is 40.38% across 16 dataset-compressor combinations.InternVL exact-match SR uses binary correctness, so Table 6’s canonical task-credit accuracy cannot directly reproduce it.Source: Table 7 · p. 8, §4.3.2 · p. 8, Table 6 · p. 8

5 DETECTION ANALYSIS

The detection analysis compares four attacks using three input and internal-state detectors. FATA has the lowest TPR@5FPR for each detector, though the separation from CAA varies by detector.

DETECTOR METHODS

  • Feature Squeezing compares prediction scores before and after input transformations, Mahalanobis-Max measures feature-space deviation, and ML-ATD tracks activations across model stages.ML-ATD tracks the visual encoder, projector, and LLM.Source: §5 · p. 9

DETECTION RESULTS

  • The reported measures are AUROC, AUPR, and true positive rate at a 5% false-positive rate.Table 8 compares FATA, CAA, CAGE, and Base using the three detectors.Source: Table 8 · p. 9, §5 · p. 9
  • FATA has the lowest TPR@5FPR among the four attacks for each detector; under ML-ATD, it reaches 49.7%, versus 53.3% for CAA.Feature Squeezing gives FATA and CAA similarly low recall (2.4% and 2.7%), while Mahalanobis-Max separates them more clearly (13.4% and 46.8%).Source: §5 · p. 9, Table 8 · p. 9

6 CONCLUSION

FATA combines attention disruption and semantic preservation to shift damage toward compressed inference, while model adaptations extend the reported trigger beyond LLaVA. The authors identify access, scope, and detector limitations that leave transfer and broader evaluation open.

CONCLUSION

  • FATA retains 96.3% of LLaVA full-token performance with 22.1% practical-budget conditional blinding, and adapted Qwen3.5 and InternVL3.5 tests show the trigger beyond LLaVA.The authors call for evaluating token compression by adversarial behavior as well as clean efficiency and accuracy.Source: §6 · p. 9

LIMITATIONS

  • FATA assumes visual-encoder gradients; black-box transfer, broader tasks, and stronger online detectors remain open.The strongest Qwen3.5 and InternVL3.5 results use task- or architecture-aware extensions with adaptation-dependent full-token cost; stealth is task-based and ML-ATD is not an optimal defense.Source: §6 · p. 9

AI USE STATEMENT

The authors report using generative AI tools across implementation, research, and manuscript-preparation activities, while retaining responsibility for the final work.

AI USE STATEMENT

  • Generative AI tools assisted with implementation, debugging, dataset processing, experimental feedback, and interpretation of results.The authors also report assistance with literature search, translation, drafting, editing, and preparing figures, tables, and references.Source: AI USE STATEMENT · p. 9
  • AI-assisted revisions were checked against the manuscript’s equations and tables, dataset-selection records, and source publications.Source: AI USE STATEMENT · p. 9
  • The authors retain responsibility for the experimental evidence, methodological choices, and final text, including AI-assisted content.Source: AI USE STATEMENT · p. 9

ETHICS STATEMENT

The ethics statement frames compression-triggered attacks as a deployment risk and calls for further robustness evaluation across populations and applications. The appendix also documents the detailed FATA optimization procedure.

ETHICS STATEMENT

  • The authors identify possible evasion of screening and disruption after compression as risks, and say robustness across populations and applications requires further evaluation.The evaluation uses existing image-question benchmarks and model checkpoints and includes detection experiments; reuse remains subject to original licenses and privacy obligations, and the methods are intended for controlled, authorized evaluation.Source: ETHICS STATEMENT · pp. 9–10

APPENDIX CONTENTS

  • The appendix contents list optimization details, model-specific token budgets, evaluation definitions, experimental details, qualitative cases, ablations, cross-model results, and detection analyses.Source: APPENDIX CONTENTS · p. 13

A.1 DETAILED OPTIMIZATION PROCEDURE

  • FATA fixes the clean-image target tokens and feature references, recomputes attention and features on the perturbed image, then updates only the input perturbation through the frozen encoder.Source: §A.1 · p. 13

A.2 SENSITIVITY TO PGD HYPERPARAMETERS

The appendix reports hyperparameter trade-offs, evaluation and budget procedures, metric definitions, performance trends, and qualitative examples across models. The selected settings balance full-token preservation with compression-triggered effects, while the Clean–FATA gap widens as token budgets shrink.

A.2 SENSITIVITY TO PGD HYPERPARAMETERS

  • At α = 0.5/255, full-token accuracy is 95.0% and mean compressed accuracy is 84.1%; λ = 1 balances preservation and attack effect as larger λ raises K = 16 accuracy.The sweeps support α = 0.5/255 and λ = 1 as a balance across budgets.Source: Table 9 · p. 14, §A.2 · p. 14, Table 10 · p. 14

B.1 LLAVA-1.5-7B

  • LLaVA’s practical budget is the smallest candidate K retaining at least 80% of clean full-token accuracy; selected budgets are fixed across attacks.For Qwen3.5 and InternVL3.5, practical fractions are 1/9 for open-ended tasks and 1/18 for multiple-choice tasks, and apply to all four compressors.Source: §B.1 · p. 15, §B.2 · p. 15

C DETAILED EVALUATION DEFINITIONS

  • SR uses task accuracy for LLaVA and Qwen3.5 but exact-match accuracy for InternVL3.5, while CBR uses binary correctness and conditions on clean and attack correctness.Macro CBR is the unweighted mean across 16 dataset–compressor pairs; CER is reported only for LLaVA and measures overall error without conditioning on clean correctness.Source: C DETAILED EVALUATION DEFINITIONS · p. 16

D EXPERIMENTAL AND IMPLEMENTATION DETAILS

D.1 EVALUATION SUBSET CONSTRUCTION

  • Evaluation subsets retain the first 1,000 eligible unique-image pairs correct on the original image but incorrect on a black image at full tokens; archived VQAv2-MC options cannot be reproduced from the released builder’s seed alone.The evaluation uses archived mappings; exact reproduction requires saved questions, option order, and target letters.Source: §D.1 · p. 17

D.2 PERFORMANCE ACROSS TOKEN BUDGETS

  • As token budgets decrease, the Clean–FATA accuracy gap widens across all four datasets; TextVQA-Open has the largest gap at every compressed budget.Under severe compression, both open-ended tasks reach lower Clean and FATA accuracies than the multiple-choice tasks.Source: Figure 5 · p. 18, §D.2 · p. 18

E.1 LLAVA-1.5-7B

E QUALITATIVE COMPRESSION-TRIGGERED CASES

  • In the Qwen3.5 examples, compressed responses vary with compressor and retention fraction, including a correct VisionZIP answer at 1/9 after errors at two larger fractions.For InternVL3.5 VQAv2-MC, all four compressors lose target-overlapping clean anchors at practical retention and return incorrect FATA answers.Source: Figure 7 · p. 20, §E.2 · p. 20, Figure 8 · p. 21

F ADDITIONAL ABLATION RESULTS

The additional ablation results show that joint FATA keeps full-token retention consistently high while its compression-triggered effect varies across settings. The cross-model appendix describes a Qwen3.5 task-aware adaptation and reports positive practical-budget amplification across all four datasets.

F ADDITIONAL ABLATION RESULTS

  • Full FATA keeps SR above 90% across plotted settings, while its CBR ranges roughly from 9% to 55% and does not increase uniformly over semantic-only.Attention-only SR spans roughly 40–90%, whereas semantic-only SR clusters near 100%; full FATA reduces SR variation across settings.Source: Figure 9 · p. 22, F ADDITIONAL ABLATION RESULTS · p. 22

G.1 QWEN3.5 TASK-AWARE FATA ADAPTATION

  • The Qwen3.5 adaptation uses ground-truth answers and downstream gradients, combining compressed-task attack objectives with full-token cross-entropy and clean-logit distillation for preservation.The four compressors are cycled round-robin, and the budget schedule emphasizes the practical operating point while revisiting 1/3 retention.Source: §G.1 · pp. 22–23
  • Practical-budget amplification is positive across all four Qwen3.5 datasets, where amplification is the Clean–FATA accuracy gap at budget r minus the full-token gap.Source: §G.1 · p. 23

G.2 INTERNVL3.5 ARCHITECTURE-AWARE FATA ADAPTATION

The appendix details an InternVL3.5 adaptation that combines compression-aware disruption with preservation, then describes stage-wise detection and reports lower FATA detectability than Base at a 5% false-positive rate.

G.2 INTERNVL3.5 ARCHITECTURE-AWARE FATA ADAPTATION

  • The InternVL3.5 adaptation combines compression-side disruption with preservation of the uncompressed representation, using compressor-family-aware terms and practical-budget weighting.Its archived objective includes VisionZIP, VisPruner, DivPrune, PruMerge, and FlowCut, while reported comparisons exclude DivPrune.Source: §G.2 · pp. 23, 26
  • Clean-image rankings fix the target and cutoff lists, while compressor-selected retained sets are separately fixed and need not match those boundary lists.The adaptation uses attention, diversity, and relation-sensitive family scores; its diagnostics show retained-set changes but do not identify any one surrogate as solely responsible for task-level drops.Source: §G.2 · pp. 24, 25, 27
  • The Clean–FATA accuracy gap peaks at retention 1/9 and narrows as retention falls to 1/36.Table 15 applies each retention fraction uniformly across four datasets and averages over four compressors.Source: §G.2 · p. 26, Table 15 · p. 26

H.1 ML-ATD CONSTRUCTION

  • ML-ATD fits attack directions from Base and negative references, reads features from the visual encoder, projector, and language model, and evaluates each stage in its own feature space.The reported metrics average across the three stages; Figure 10 depicts reference fitting, readout, and stage-wise detection.Source: §H.1 · pp. 27–28, Figure 10 · p. 27
  • 62.5%, 51.8%, and 37.9%: FATA reduces TPR versus Base under Feature Squeezing, Mahalanobis-Max, and ML-ATD, respectively, at 5% false-positive rate.The reductions correspond to 6.4% to 2.4%, 27.8% to 13.4%, and 80.1% to 49.7%; Table 17 isolates the FATA and Base comparison.Source: §H.1 · p. 28, Table 17 · p. 28
  • ML-ATD reports lower detection of FATA than Base across all three evaluated detectors at the 5% false-positive operating point.Its TPR is obtained from each stage's test-set ROC curve at 5% false-positive rate.Source: §H.1 · p. 28

H.2 DETECTION EVALUATION

The detection evaluation compares three detectors using defined baselines and aggregation procedures. Detection depends on the deviation measured: Mahalanobis-Max finds FATA less detectable than CAA, while Feature Squeezing gives similar performance for the two.

H.2 DETECTION EVALUATION

  • ML-ATD averages equally over four compressors, four datasets, and three stages; its detection runs use K = 64 for open-ended tasks and K = 32 for multiple-choice tasks.Feature Squeezing and Mahalanobis-Max results are each aggregated across four datasets.Source: §H.2 · p. 29
  • Mahalanobis-Max orders CAGE > CAA > Base > FATA on all three metrics, whereas Feature Squeezing gives similar detection performance for FATA and CAA.The lower Mahalanobis-Max detection of FATA is consistent with its semantic preservation objective.Source: §H.2 · p. 29
  • CAA ScienceQA evaluation uses 990 attack examples for Feature Squeezing and 496 for Mahalanobis-Max, with aligned negatives numbering 1,980 and 992, respectively.Other conditions use nominal counts.Source: §H.2 · p. 29

Related papers

Loading 2609.39134v1…