PaperlayerView exact revision on arXiv

Source-linked AI summary

Detecting Adversarial Images through Response Profiles of Vision-Language Models

Arash Vashagh, Roozbeh Razavi-Far

arXiv:2610.10436v1cs.CV

TL;DR

Adversarial inputs can retain plausible confidence and image–text similarities, leaving the broader pattern of VLM responses across semantic prompts as a potential detection signal. The paper profiles those responses with a compact set of features and a lightweight classifier while keeping the VLM fixed. Across datasets, backbones, and attacks, the method shows strong standard and cross-attack performance, and the response profile outperforms evaluated embedding-geometry detectors under a controlled protocol.

  • Problem

    A frozen VLM’s confidence or embedding-space distance does not capture the full pattern of its responses across semantic prompts, which can change under adversarial perturbations.

    Source: §I · p. 1

  • Method

    The detector combines category, graph, clean-reference residual, diffusion, and transformation-stability features from prompt-conditioned responses and classifies the compact profile with a lightweight model while keeping the VLM fixed.

    Source: §I · pp. 1–2, A. Problem setup and notation · p. 3, E. Semantic residual modeling · p. 5

  • Results

    Across multiple datasets, backbones, and attacks, the response-profile detector shows strong standard and cross-attack performance and achieves higher mean ROC-AUC than evaluated embedding-geometry detectors under a common protocol.

    Source: §VI · p. 11, §VII · p. 11

  • Takeaways & Limitations

    Prompt-conditioned response profiling provides a detection signal with information beyond classification confidence and direct embedding-space geometry, with complementary contributions from its feature groups.

    Source: §VI · p. 11

Abstract

from arXiv · show

Adversarial perturbations can alter the predictions of frozen vision-language models (VLMs) while leaving their confidence and image--text similarity patterns seemingly plausible. We investigate whether we can identify adversarial inputs based on the broader way an image interacts with a collection of general semantic prompts. Our detector summarizes these responses using category-level statistics, relationships among prompts, deviations from clean reference distributions, and stability under weak image transformations, producing a compact response profile that is classified by a lightweight model while the VLM remains fixed. We evaluate the approach on multiple public image datasets, several CLIP-style visual backbones, and a range of gradient-based, optimization-based, automated, and spatial attacks. The detector achieves strong discrimination in attack-specific settings and retains substantial performance when evaluated on attacks not seen during training. Under a controlled detector-specific protocol, the response-profile representation outperforms the evaluated embedding-geometry baselines. Additional analyses show that the feature groups provide complementary information and that the method remains effective under variations in the prompt configuration. We also examine inference cost and performance against detector-aware adaptive attacks. Overall, the results indicate that response patterns across semantic prompts provide a useful complementary signal for adversarial image detection in frozen VLMs.

I. INTRODUCTION

Adversarial inputs can retain plausible confidence and image–text similarities, so the final classifier output may miss information in a VLM’s broader prompt responses. The paper profiles those responses with complementary features and a lightweight detector while keeping the VLM fixed.

I. INTRODUCTION

  • Adversarial perturbations can change predictions while leaving confidence and image–text similarities plausible, making the final classifier output an incomplete detection signal.The broader VLM representation contains information that a single output can discard.Source: §I · p. 1

II. BACKGROUND

  • Prior adversarial detectors use confidence, transformations, feature-space statistics, or VLM geometry, attention, and semantic priors.The background positions prompt-conditioned response profiling among these detector approaches.Source: §I · p. 1, §II · p. 2

I. INTRODUCTION

  • Prompt-conditioned response profiling measures how an image interacts with general semantic prompts separate from the dataset-class prompts used for zero-shot classification.The prompt responses can reflect changes in their distribution, local relationships, clean-reference deviations, and transformation behavior.Source: §I · p. 1
  • The compact response profile combines category statistics, prompt-graph measurements, clean-reference residuals, graph diffusion, and transformation stability.The components are concatenated and classified by a lightweight multilayer perceptron.Source: §I · pp. 1–2
  • Unlike embedding-geometry and irrelevant-question attention methods, this detector uses image–text similarities from a fixed prompt bank, training only the lightweight detector.The image encoder, text encoder, prompt embeddings, and prompt graph remain frozen.Source: §I · p. 2
  • The feature groups can be removed or combined separately, allowing their contributions to be studied without modifying the frozen backbone.This makes the detector’s measurable response properties analyzable apart from an opaque classifier on high-dimensional embeddings.Source: §I · p. 2
  • The evaluation spans three datasets, three CLIP-style backbones, multiple attack families, cross-attack tests, geometry comparisons, ablations, runtime, and detector-aware attacks.These experiments assess detector effectiveness, generalization, and feature-group contributions.Source: §I · p. 2

A. Adversarial example detection

Prior detectors use confidence, representation structure, transformations, or VLM-specific signals, while semantic OOD methods generally address a different task. The paper instead builds a detector from prompt-conditioned image–text responses while the VLM remains frozen.

A. Adversarial example detection

  • Conventional adversarial detectors use confidence scores, transformations, feature-space density or geometry, and nearest-neighbor structure, but are primarily designed for unimodal classifiers.Examples include MSP, energy scores, feature squeezing, LID, Mahalanobis distance, and statistical tests.Source: A. Adversarial example detection · p. 2

B. VLMs for out-of-distribution and semantic detection

  • CLIP-based semantic OOD methods use image–text alignment, negation-aware prompts, negative labels, or consistency across related labels, but mainly target OOD detection rather than adversarial detection.They usually rely on class-specific prompts or aggregated image–text similarities.Source: B. VLMs for out-of-distribution and… · p. 2

C. Adversarial detection with VLMs

  • VLM adversarial detectors have used embedding geometry, attention responses to irrelevant questions, or learned latent spaces guided by CLIP text embeddings.Prompt-conditioned response profiling instead uses semantic prompts not tied to dataset labels and extracts graph, category, residual, and stability features.Source: C. Adversarial detection with VLMs · p. 3

D. Relationship to prior VLM-based detectors

  • The proposed detector operates on prompt-conditioned image–text responses and combines category, graph, clean-reference residual, diffusion, and transformation-stability features, training only a lightweight detector.The VLM itself remains frozen.Source: D. Relationship to prior VLM-based… · p. 3

A. Problem setup and notation

  • A frozen VLM encodes the image and semantic prompts; their similarities form a response vector that is mapped to features and scored by a lightweight MLP.Higher detector scores indicate a higher likelihood of adversarial input.Source: A. Problem setup and notation · p. 3

B. Threat model

Attacks target the frozen VLM’s zero-shot classification logits using dataset-class prompts, with white-box access to the model and attack gradients. The detector separately summarizes responses to general prompts grouped into semantic categories.

B. Threat model

  • Adversarial examples are generated by optimizing a loss over image–text logits within an allowed perturbation set around a clean labeled image.The stated attacks include PGD, MI-FGSM, CW, AutoAttack, and flow-based attacks.Source: B. Threat model · p. 3
  • The attacker has white-box access to the target VLM, including its image encoder, class-level text embeddings, logits, labels, and gradients.The attacks seek to change zero-shot classification scores computed against dataset-class prompts.Source: B. Threat model · p. 3

C. Semantic anchor space

  • The detector uses general prompts organized into seven broad categories rather than reproducing dataset labels.The categories are animal, vehicle, person, food, object, scene, and plant.Source: C. Semantic anchor space · p. 3, Figure 1 · p. 4
  • Category-level statistics summarize positive semantic mass, average response, spread, and strongest prompt response; normalized masses, entropy, and margin describe category concentration.The margin contrasts the two largest normalized category masses, while entropy and margin characterize diffuse versus concentrated responses.Source: C. Semantic anchor space · p. 4

D. Graph-structured semantic representation

The graph representation treats prompt similarities as a signal over relationships among semantic prompts. It summarizes both global smoothness and local irregularities in that signal.

D. Graph-structured semantic representation

  • A prompt graph models relationships between semantic prompts, with each graph node corresponding to one prompt.The adjacency matrix uses top-r nearest neighbors in prompt embedding space and is symmetrized before the graph Laplacian is formed.Source: D. Graph-structured semantic… · p. 4
  • Graph smoothness measures whether related prompts have similar responses; a high global smoothness energy indicates irregular semantic variation across the graph.Node-wise deviations capture local inconsistencies.Source: D. Graph-structured semantic… · p. 4
  • Maximum, mean, variance, and top-k mean of node-wise deviations summarize whether semantic irregularity is localized to a few prompts or spread across the graph.The resulting prompt graph is visualized in Section IV-A1.Source: D. Graph-structured semantic… · p. 5

E. Semantic residual modeling

The section measures category-level response deviations from clean-image statistics and examines how semantic responses behave under small transformations and graph diffusion.

E. Semantic residual modeling

  • Residuals compare category responses with clean-training distributions, capturing distributional inconsistency beyond similarity magnitude alone.The method estimates a clean mean and covariance for each category and uses residuals for the two categories with the largest semantic masses, including the nearest competing category.Source: E. Semantic residual modeling · p. 5

F. Semantic stability under small transformations

  • Small image transformations provide stability measurements, while graph diffusion features characterize semantic responses after prompt-graph smoothing.The section describes transformation-based embedding and semantic drift measurements, diffusion deviation and cosine similarity, and entropy of the diffused category masses.Source: F. Semantic stability under small… · p. 5

G. Feature representation and detector

The detector concatenates semantic, graph, diffusion, residual, stability, and embedding-norm features, then normalizes them and trains an MLP while keeping the VLM fixed.

G. Feature representation and detector

  • The unified feature vector combines semantic alignment, graph structure, clean-distribution residuals, and transformation stability into a compact profile.Category-level, graph-level, diffusion, residual, stability, and normalized embedding-norm features are concatenated.Source: G. Feature representation and detector · p. 5
  • Feature-wise normalization uses clean-training statistics before the MLP receives the feature vector.The detector is trained on the whitened representation rather than the raw feature vector.Source: G. Feature representation and detector · p. 5
  • The MLP is trained with binary cross-entropy plus a margin loss, then classifies inputs as adversarial when its score reaches a validation-selected threshold.The margin term encourages adversarial scores to exceed clean scores by at least the desired margin.Source: G. Feature representation and detector · p. 6

H. Computational complexity

Inference cost is driven primarily by VLM forward passes for the original and transformed images; training keeps the backbone fixed and trains only on extracted features.

H. Computational complexity

  • Inference complexity is O((1 + |A|) Cmodel) in practice because the VLM forward-pass cost dominates.The expression also accounts for similarity and graph-feature computation across transformations and diffusion on the prompt graph.Source: H. Computational complexity · pp. 6–7
  • The backbone remains fixed during training, and the trainable component operates only on the extracted feature vector.The supplied section introduces training complexity but does not provide its expression.Source: H. Computational complexity · p. 7

IV. EXPERIMENTAL SETUP

The experimental setup evaluates the detector across datasets, frozen VLM backbones, and attack families, with implementation choices specifying prompt graphs, clean-reference statistics, transformations, and feature dimensions.

IV. EXPERIMENTAL SETUP

  • Experiments cover multiple image datasets, frozen VLM backbones, and adversarial attack families under several evaluation settings.The setup also includes controlled baselines, ablations, computational-cost measurements, and detector-aware settings.Source: §IV · p. 7

1) Prompt graph construction:

  • The prompt graph connects each prompt to its nearest neighbors in normalized text-embedding space, then symmetrizes the adjacency matrix before computing the Laplacian.Prompt embeddings are computed once and the resulting graph is fixed and shared across images for a prompt set.Source: 1) Prompt graph construction · p. 7

2) Clean residual statistics and feature whitening:

  • Clean residual statistics and feature-whitening parameters are estimated from clean training samples.Category-level covariance estimation uses shrinkage coefficient 0.20; whitening prevents large-range features from dominating and improves training stability.Source: 2) Clean residual statistics and… · p. 7

3) Transformations and hyperparameters:

  • Weak shifts, mild blur, and minor photometric changes measure stability while preserving the image’s main semantic content.The graph diffusion strength is α = 0.15 and the margin-loss weight is λ = 10−3.Source: 3) Transformations and hyperparameters · p. 7

4) Feature-vector dimensionality:

  • The final feature vector has dimension dϕ = 43, comprising 28 category-level features and 15 additional scalar features.The category-level features come from four statistics for each of seven semantic categories; the remaining features cover graph, diffusion, residual, stability, entropy, margin, and embedding norm measurements.Source: 4) Feature-vector dimensionality · p. 7
  • The two residual features correspond to the categories with the largest semantic masses, and the two stability features measure responses under small input transformations.Localized graph-anomaly features are the maximum, mean, variance, and top-k mean of node-wise graph deviations.Source: 4) Feature-vector dimensionality · p. 7

5) Detector architecture:

The detector combines fixed VLM-derived response-profile features in a lightweight MLP and is evaluated across attack-specific and cross-attack settings, retaining strong discrimination on unseen attacks.

5) Detector architecture:

  • The detector classifies whitened response-profile features with a three-layer MLP while keeping the VLM backbone, prompt graph, and clean residual statistics fixed.Hidden dimensions are 256, 128, and 64, with ReLU and dropout after each layer.Source: 5) Detector architecture · p. 7, Figure 4 · p. 9

6) Attack settings:

  • The evaluation covers PGD, MI-FGSM, CW, AutoAttack, and Flow attacks on CLIP-style classification logits from dataset class prompts.The described attacks optimize the zero-shot image-text classification objective.Source: 6) Attack settings · p. 7

B. Hardware and runtime

  • The standard evaluation spans 45 model-dataset-attack configurations and took approximately 70 hours; frozen VLM forward passes dominate computation.MLP training is comparatively inexpensive because it uses extracted feature vectors.Source: B. Hardware and runtime · pp. 8–9

A. Standard and cross-attack evaluation

  • The standard setting trains and evaluates a separate detector per attack, whereas cross-attack evaluation trains on PGD and tests on other attacks without retraining.The test samples are disjoint from training and validation samples.Source: A. Standard and cross-attack evaluation · p. 9
  • Strong standard-setting discrimination and substantial cross-attack performance persist when a PGD-trained detector is tested on unseen attack families.Transfer is strongest for AutoAttack across most configurations, while remaining consistently high for MI-FGSM and maintained for CW and Flow.Source: Table I · p. 9, A. Standard and cross-attack evaluation · p. 9

B. Controlled comparison with geometric baselines

Under a controlled detector-specific protocol, the response-profile detector achieves the strongest mean ROC-AUC against the evaluated geometric baselines on both datasets. Inference costs include multiple encoder views, while maximum-softmax-probability detection varies substantially across settings.

B. Controlled comparison with geometric baselines

  • The proposed detector achieves the strongest mean ROC-AUC on both datasets in the controlled comparison with embedding-geometry detectors.The mean is across PGD, CW, and Flow; comparisons use detector-aware attacks and a shared evaluation protocol.Source: B. Controlled comparison with… · p. 9, Table II · p. 10

C. Inference-time overhead

  • The full inference configuration uses four image-encoder passes, while a one-view configuration reduces encoder evaluations by omitting transformation-stability features.The MLP contributes only a small portion of total inference cost.Source: C. Inference-time overhead · p. 10

D. MSP-based baseline

  • MSP performance varies substantially across datasets and attacks, while the response-profile detector maintains consistently high ROC-AUC across standard configurations.The paper characterizes the response profile as a more stable detection signal than classification confidence alone.Source: D. MSP-based baseline · p. 10, Table IV · p. 10

E. Ablation study

The full response profile achieves the strongest overall result, with transformation stability providing the largest individual feature-group improvement. Across the broader evaluation, prompt-conditioned profiling retains cross-attack discrimination and captures information beyond confidence and embedding geometry.

E. Ablation study

  • The complete feature representation achieves the strongest overall result, and transformation-stability features provide the largest individual improvement over category-level features.Combining category, graph, and stability features further improves performance; ablations indicate complementary response properties.Source: E. Ablation study · p. 11

VI. DISCUSSION AND FUTURE WORK

  • The detector uses 70 general prompts across seven broad categories to create a reusable semantic reference space rather than reproduce dataset labels.Category statistics provide a substantial detection signal, while graph, residual, and transformation-stability features contribute complementary information.Source: §VI · p. 11
  • PGD-trained detectors retain strong discrimination against CW, MI-FGSM, Flow, and AutoAttack, while response profiles achieve higher mean ROC-AUC than evaluated embedding-geometry detectors under a common protocol.The transfer result holds across the evaluated VLM backbones.Source: §VI · p. 11
  • Transformed views contribute strongly to detection performance but account for most of the additional inference cost.The detector nevertheless retains substantial discriminative ability under adaptive optimization.Source: §VI · p. 11
  • Future work includes automatic prompt construction and weighting, more efficient stability features, broader multimodal architectures, real-world distribution shifts, and further adaptive evaluation.Source: §VI · p. 11

VII. CONCLUSION

  • Across multiple datasets, backbones, and attacks, the detector achieves strong standard and cross-attack performance, with complementary features and substantial discrimination under adaptive optimization.Controlled comparisons show information beyond confidence-based and geometric embedding scores.Source: §VII · p. 11
Loading 2610.10436v1…