Pith. sign in

REVIEW 3 major objections 5 minor 1 cited by

VLMInferSlow: Evaluating the Efficiency Robustness of Large Vision-Language Models as a Service

T0 review · 3 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper claims that an API-only attacker can add imperceptible image perturbations that force vision-language models to generate much longer outputs, raising computational cost by up to 128.47%.

desk verdict First black-box efficiency attack on VLMs with clean ablations; the threat model overclaims API logprob access, so headline numbers apply to a score-based API, not today's commercial APIs. read the letter →

arxiv 2506.15755 v1 pith:QQENCIZ5 submitted 2025-06-18 cs.CV cs.CL

Xiasi Wang , Tianliang Yao , Simin Chen , Runqi Wang , Lei YE , Kuofeng Gao , Yi Huang , Yuan Yao This is my paper · ORCID
classification cs.CVcs.CL
keywords adversarialattacksefficiencyrobustnessvision-languagemodelsblack-boxattackzero-orderoptimizationinferencecostdenialofservicesequencelength
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

The paper sets out to show that the computational cost of deployed vision-language models can be attacked without white-box access, using only the inference API a normal customer would have. It introduces VLMInferSlow, a zero-order optimization attack that adds tiny image perturbations designed to make the model generate much longer captions, thereby increasing decoder calls, latency, and energy. Across four open VLMs and two datasets, the attack raises sequence length by up to 128.47% (Flamingo on MS-COCO), response latency by up to 105.56%, and energy by up to 115.19%, while the perturbations stay visually imperceptible. If the results hold, efficiency robustness is a practical black-box vulnerability of VLMs-as-a-service, not a white-box-only concern. The paper positions the work as the first black-box evaluation of this vulnerability and as a starting point for defenses.

What carries the argument

The key machinery is the composite adversarial objective $L(\delta)=L_{\mathrm{len}}(\delta)+\alpha L_{\mathrm{eos}}(\delta)+\beta L_{\mathrm{var}}(\delta)$, evaluated through API calls. $L_{\mathrm{len}}$ is the output sequence length; $L_{\mathrm{eos}}$ sums the sequence-position-weighted end-of-sequence probabilities with decay $\omega^{N-i}$ ($\omega=0.1$) so that later positions matter more; $L_{\mathrm{var}}$ is the negative KL divergence between the normalized top-$k$ token distribution ($k=100$) and the uniform distribution. Around this objective, a zero-order gradient estimator samples $2q$ antithetic Gaussian perturbations per iteration and estimates $\nabla_\delta J(\delta)=\mathbb{E}_\pi[L(z)\nabla_\delta\log\pi(z|\delta)]$, followed by projected gradient ascent under the $\ell_2$ constraint $\epsilon=64$. The load-bearing identity is that longer sequences cause more decoder calls, so maximizing $L$ through API queries directly increases latency and energy.

What would settle it

Run VLMInferSlow against an API endpoint that returns only sampled text with no token probabilities: if the sequence-length increase falls toward the 63.74% length-only ablation rather than the 128.47% full-objective result, the headline claim depends on logit access. A second check is to measure actual server-side latency and energy under the generated images; if those metrics do not rise with sequence length, the paper's core proxy fails.

Watch

Extended reading notes

Core claim

The paper's central claim is that inference cost is externally controllable through a derivative-free objective assembled from API-visible signals. VLMInferSlow optimizes a perturbation $\delta$ against the composite objective $L(\delta)=L_{\mathrm{len}}(\delta)+\alpha L_{\mathrm{eos}}(\delta)+\beta L_{\mathrm{var}}(\delta)$, where $L_{\mathrm{len}}$ is the generated sequence length, $L_{\mathrm{eos}}$ suppresses the end-of-sequence probability with a dynamic weight $\omega^{N-i}$, and $L_{\mathrm{var}}$ flattens the top-$k$ next-token distribution toward uniform. Because autoregressive decoder calls grow with sequence length, this objective approximates real resource consumption. Gradients are estimated with Natural Evolution Strategies using antithetic Gaussian samples, so the attack needs only API queries and returned logits, not parameters. On Flamingo with MS-COCO the reported relative increase is 128.47% in sequence length, 105.56% in latency, and 115.19% in energy; across four models the average I-length increase is 82.08% on MS-COCO and 76.98% on ImageNet, and the method stays competitive with white-box baselines while operating black-box. The paper also reports that the adversarial images degrade caption quality, with BLEU falling by up to 38.46%.

Load-bearing premise

The attack assumes the deployed API reveals the model's chance of each possible next word, including the chance of the stop signal; an API that only returns sampled text would leave only the sequence-length objective, which alone yields 63.74% rather than 128.47% on Flamingo/MS-COCO.

Editorial extensions

If this is right

  • API providers that expose token-level probabilities inherit a denial-of-wallet attack surface: one imperceptible image can more than double the output length, and the effect transfers across greedy, beam, top-$k$, and nucleus sampling.
  • Efficiency robustness needs to be evaluated under black-box assumptions; in the paper's comparisons, natural corruptions and transferred white-box attacks are inconsistent, while VLMInferSlow raises average sequence length by 82.08% on MS-COCO and 76.98% on ImageNet.
  • The attack is not mere verbosity: caption quality also drops (BLEU by up to 38.46%, text-feature dissimilarity up by 14.81%), so defenders cannot solve the problem by accepting longer, lower-quality output.
  • Input quantization does not stop the attack (I-length stays at 124.36% after the defense), so defenses need to target the sequence-prolongation mechanism, the logit surface, or output length limits.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial inference: the practical reach of the strongest result depends on whether mainstream APIs actually return full per-token logits; the paper asserts this is valid and realistic for major commercial API providers but does not demonstrate the attack against a live API, so the headline numbers are conditional on that access assumption.
  • Editorial inference: the attack's economics are not settled; at 500 iterations with 10 API queries each, the attacker spends thousands of queries per image, so a useful extension would compare attack cost against the induced latency and energy increase to see when the attack is economically rational.
  • Editorial inference: the dispersed GradCAM attention maps suggest a mechanistic hypothesis—perturbations that spread visual attention may reduce the decoder's confidence in stopping—and tracking attention entropy across optimization steps would test whether attention dispersion causes EOS suppression or merely correlates with it.
  • Editorial inference: the paper's own limitation about needing many optimization iterations implies that strict per-account query-rate limits already provide a partial defense; a rate-limited API would blunt the attack before any model change is needed.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper proposes VLMInferSlow, a black-box attack that increases the computational cost of vision-language models by adding imperceptible perturbations to input images. The attack uses three objectives: maximizing output sequence length (L_len), delaying EOS occurrence via per-token EOS probabilities (L_eos), and increasing output variability via top-k KL divergence to uniform (L_var). Gradients are estimated with a zero-order natural evolution strategy. Experiments on four VLMs and two datasets report up to 128.47% relative increase in sequence length and large increases in latency and energy, outperforming natural corruption and transfer-based white-box baselines. The paper claims to be the first to study efficiency robustness of VLMs in a black-box setting.

Significance. If the results hold, the paper demonstrates a practically relevant vulnerability: an adversary with only API access could substantially degrade the efficiency of deployed VLMs. The methodological combination of efficiency-oriented objectives with zero-order optimization is sensible and the derivation in Appendix D is standard. The paper ships code and the core optimization is internally consistent. However, the claimed practical threat model depends critically on an unverified assumption about the information returned by commercial VLM APIs, and the experimental comparison with white-box baselines uses asymmetric optimization budgets. The work is potentially significant, but these load-bearing issues need to be addressed before the claims are fully supported.

major comments (3)
  1. [§3.1, §4.2, Table 4] The attack's strongest results rely on objectives that require per-token probability access, not just sampled text. Eq. (3) requires Pr_EOS(y_i) at every generated position and Eq. (4) requires the normalized top-100 next-token distribution. Section 3.1 asserts that 'the deployed VLM API returns the corresponding textual outputs and logits' and calls this realistic for OpenAI, Google Gemini, and others, but provides no citation, API schema, or empirical demonstration. This is load-bearing: Table 4 shows that L_len alone achieves 63.74% I-length on Flamingo/MS-COCO, whereas the full objective achieves 128.47%, so the headline number is not established for a text-only API. The authors should either provide concrete evidence that commercial APIs expose the required probabilities, implement the attack against an actual API, or explicitly weaken the threat model to a score-based oracle with the corresponding reduction in claimed effectiveness.
  2. [§5.1, Appendix C.3, Table 2] The comparison with white-box baselines is unfair as implemented. VLMInferSlow uses T=500 optimization iterations, whereas the white-box baselines NICGSlowdown and Verbose Images are run for only 50 iterations (described in Appendix C.3). Since Table 2 is used to support the claim that VLMInferSlow achieves effectiveness comparable to white-box methods, the 10x difference in optimization budget must be controlled. The authors should rerun the white-box baselines with the same number of iterations (or otherwise match the budget) and report the corresponding results, or explicitly state that the comparison is against a limited-budget baseline.
  3. [Tables 1-4, §5.2] No variance or error bars are reported for any headline metric. The NES optimization is stochastic (Gaussian noise sampling), latency and energy measurements on a single RTX 3090 are inherently noisy, and the evaluation uses only 1000 images per dataset. Without standard deviations, confidence intervals, or significance tests over independent runs or image subsets, it is impossible to assess whether the reported improvements are stable or within noise. At minimum, the authors should provide mean ± std over several runs (or a bootstrap over the image set) for the main results in Tables 1, 2, and 4.
minor comments (5)
  1. [Appendix D / Theorem 1] The statement of Theorem 1 is a compressed and possibly imprecise restatement of the result in Ilyas et al. (2018). The conditions under which the bound holds (e.g., the relationship between η, the objective's smoothness, and the number of samples q) are not fully specified. Please state the theorem precisely or refer to the exact result with the required assumptions.
  2. [Figure 2] The figure includes many method names that are too small to read in the current resolution. Consider enlarging or simplifying the diagram, or listing the methods in a caption.
  3. [§5.1 metrics definitions] The three equations defining I-length, I-latency, and I-energy are unnumbered. Number them for consistency with the rest of the paper.
  4. [Table 3 caption] The caption states 'Results are for FLAMINGO,' but it would clarify whether the L2 and feature dissimilarity values are averaged over the same 1000 images used in Table 1 and whether the adversarial images are produced under the same perturbation bound (ϵ=64) and iteration count used in the main experiments.
  5. [Algorithm 1, line 7] In the gradient estimation step, δ+ and δ− are not explicitly defined in the algorithm listing. The reader must infer that δ+ = δ + η μ_i and δ− = δ − η μ_i. Please define these symbols for clarity.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack objectives are transparent definitions of the attack goal, and the reported improvements are empirical results of a zero-order optimizer compared against external baselines.

full rationale

VLMInferSlow's objectives (Eqs. 2-5) are direct definitions of the attack goal, not derived quantities fitted to the reported numbers. The hyperparameters alpha, beta, omega, and k are set by hand and held fixed across all models and datasets, and the method is compared against external baselines (Gaussian, JPEG, NICGSlowdown, Verbose Images) plus a white-box transfer setting. The reported I-length improvement is correlated with L_len by construction, since maximizing sequence length necessarily raises the length metric, but this is the intended attack mechanism rather than a concealed fit: the substantive empirical content is that zero-order optimization can actually drive this objective through a black-box API, and that I-latency and I-energy, which are not directly optimized, also rise substantially. The paper does not rely on self-citation for its central claim: Verbose Images and NICGSlowdown are baselines, and although some current authors overlap with those prior works, the baselines are outperformed rather than used to justify the method. The only notable weakness is external validity: Section 3.1 asserts, without citation or API documentation, that commercial VLM APIs return per-token logits including EOS probabilities and normalized top-100 next-token distributions. If that premise fails, L_eos and L_var cannot be computed and the attack degrades to L_len-only, which the paper's own ablation (Table 4) reports as 63.74% I-length. This is a factual realism risk, not a circularity: the equations do not assume their own conclusion, and the ablation explicitly discloses the degraded setting.

Assumptions & free parameters 9 free parameters · 5 assumptions · 0 invented entities

No new physical or architectural entities are introduced. The attack reuses existing models, APIs, and standard optimization machinery. However, the attack's effectiveness depends on nine hand-chosen hyperparameters and on the logits-access assumption listed above, which are the real unpaid inputs of the paper.

free parameters (9)
  • alpha (L_eos weight) = 0.5
    Weight on the EOS-delay objective in Eq. 5; chosen by hand, no sensitivity study is reported.
  • beta (L_var weight) = 0.1
    Weight on the output-variability objective in Eq. 5; chosen by hand, no sensitivity study is reported.
  • omega (EOS weight decay) = 0.1
    Decay rate in Eq. 3; sensitivity is shown in Fig. 9, but the reported optimum comes from this hand-set value.
  • k (top-k for L_var) = 100
    Number of top probabilities used in Eq. 4; sensitivity is shown in Fig. 9, but no principled selection is given.
  • epsilon (L2 bound) = 64
    Maximum perturbation norm in Eq. 9; sets the imperceptibility budget and is chosen following prior practice.
  • T (optimization iterations) = 500
    Number of gradient-ascent steps; directly determines the attack's query cost, about 5000 API calls per image.
  • gamma (step size) = 5
    Gradient-ascent step size; chosen by hand, no sensitivity study is reported.
  • q (noise pairs) = 5
    Number of antithetic Gaussian pairs in Eq. 8; balances estimator variance against query cost.
  • eta (search variance) = 0.1
    Variance of the search distribution in Eq. 8; small values sharpen the gradient estimate.
assumptions (5)
  • standard math NES gradient estimator is unbiased in the small-variance limit (Theorem 1, Ilyas et al. 2018)
    Relied on in Section 4.3 without proof; the estimator in Eq. 8 inherits its validity from the cited theorem.
  • domain assumption Latency and energy scale linearly with generated sequence length
    The whole efficiency model (Section 2 and Eq. 2) equates longer sequences with higher compute; this holds for autoregressive decoding but ignores fixed costs and batching effects.
  • domain assumption The API returns token-level logits for every query
    Section 3.1 assumes returned logits to compute Pr_EOS in Eq. 3 and the full distribution in Eq. 4; commercial APIs often restrict this.
  • domain assumption Greedy search is the generation policy during optimization
    Main results use greedy decoding (Appendix C.3); Appendix E.3 shows robustness to other sampling strategies, so the claim is somewhat insulated.
  • ad hoc to paper Top-k KL divergence to uniform is a valid proxy for output variability
    L_var in Eq. 4 defines variability as closeness to uniform over the top-100 tokens; this design choice is specific to this paper and not independently motivated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VLMInferSlow: Evaluating the Efficiency Robustness of Large Vision-Language Models as a Service." pith.science (2026). https://pith.science/paper/QQENCIZ5

@misc{pith2026250615755,
  author       = {Pith},
  title        = {Pith review of: VLMInferSlow: Evaluating the Efficiency Robustness of Large Vision-Language Models as a Service},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QQENCIZ5}},
  note         = {Machine review of arXiv:2506.15755}
}
read the original abstract

Vision-Language Models (VLMs) have demonstrated great potential in real-world applications. While existing research primarily focuses on improving their accuracy, the efficiency remains underexplored. Given the real-time demands of many applications and the high inference overhead of VLMs, efficiency robustness is a critical issue. However, previous studies evaluate efficiency robustness under unrealistic assumptions, requiring access to the model architecture and parameters -- an impractical scenario in ML-as-a-service settings, where VLMs are deployed via inference APIs. To address this gap, we propose VLMInferSlow, a novel approach for evaluating VLM efficiency robustness in a realistic black-box setting. VLMInferSlow incorporates fine-grained efficiency modeling tailored to VLM inference and leverages zero-order optimization to search for adversarial examples. Experimental results show that VLMInferSlow generates adversarial images with imperceptible perturbations, increasing the computational cost by up to 128.47%. We hope this research raises the community's awareness about the efficiency robustness of VLMs.

Figures

Figures reproduced from arXiv: 2506.15755 by the authors.

Figure 1
Figure 1. Our VLMInferSlow attack adds perturbations to input images, causing VLMs to generate longer se￾quences, resulting in reduced inference efficiency. stantial computational resources for effective de￾ployment (de Vries, 2023). When deploying VLMs in real-world applica￾tions, inference efficiency is a critical concern. For example, applications like Microsoft’s See￾ing AI (Microsoft) and Be My Eyes (BeMyEyes) depend on … view at source ↗
Figure 2
Figure 2. Comparison of VLMInferSlow and existing works in terms of attack goals (accuracy vs. efficiency) and attack types (white-box vs. black-box). computational costs and low efficiency. Endeavors have been made towards fastening the inference process. Existing works include offline pruning re￾dundant neurons (Kurtz et al., 2020; Hoefler et al., 2021), and adaptively skipping some parts during inference (Zhou et al., 2020… view at source ↗
Figure 3
Figure 3. Design overview of VLMInferSlow. image cannot be differentiated by humans from the benign image; and (3) Realistic. The adversarial image should be realistic in the real world. ∆ = argmaxδ RCF (I + δ) s.t. ∥δ∥ ≤ ϵ ∧ (I + δ) ∈ [0, 1]n (1) We formulate our problem as a constrained opti￾mization problem in Eq. 1, where I is the benign input, F denotes the victim VLM under attack, ϵ is the maximum allowable adversarial … view at source ↗
Figures from the paper (7 more)
Figure 4
Figure 4. Figure 4: The generated sequence length distribution of four VLMs. [PITH_FULL_IMAGE:figures/full_fig_p008_4.png]
Figure 6
Figure 6. Figure 6: Effects of iteration (left) and L2 restriction ϵ (right). Results are from FLAMINGO on MS-COCO. as a defense method. As shown in Tab. 6, neither the efficiency nor the accuracy is significantly im￾pacted by the defense method, demonstrating that Quantization is ineffec…
Figure 7
Figure 7. Figure 7: Examples of original images (left) and adver [PITH_FULL_IMAGE:figures/full_fig_p008_7.png]
Figure 8
Figure 8. Figure 8: Images in MS-COCO with different lengths [PITH_FULL_IMAGE:figures/full_fig_p012_8.png]
Figure 9
Figure 9. Figure 9: Effects of ω in Leos (left) and k in Lvar (right). Results are from FLAMINGO on MS-COCO. E.3 Effect of Different Sampling Strategies In our main results, we use the greedy search sam￾pling strategy for sequence generation. We fur￾ther investigate the impact of differen…
Figure 10
Figure 10. Figure 10: Visualization of original images (left) and adversarial images (right) generated by [PITH_FULL_IMAGE:figures/full_fig_p015_10.png]
Figure 11
Figure 11. Figure 11: Visualization of an original image (left) and an adversarial image (right) generated by our proposed [PITH_FULL_IMAGE:figures/full_fig_p016_11.png]

Review history (2 revisions) →

Discussion (0). Continue with ORCID to comment.

Forward citations

Cited by 1 Pith paper

Reviewed papers in the Pith corpus that reference this work. Sorted by Pith novelty score. Full citation record

  1. Hidden Tail: Adversarial Image Causing Stealthy Resource Consumption in Vision-Language Models

    cs.CR 2025-08 conditional novelty 7.0 of 10

    Hidden Tail crafts adversarial images that force VLMs to emit long invisible runs of special tokens, inflating output length up to 19.2x while keeping the visible answer normal.

Reference graph

Works this paper leans on

46 extracted references · 23 canonical work pages · cited by 1 Pith paper

  1. [1]

    Abdullah Al-Dujaili and Una-May O'Reilly. 2020. Sign bits are all you need for black-box attacks. In International conference on learning representations

    work page 2020

  2. [2]

    Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. 2022. Flamingo: a visual language model for few-shot learning. Advances in neural information processing systems, 35:23716--23736

    2022

  3. [3]

    Shuai Bai, Keqin Chen, Xuejing Liu, Jialin Wang, Wenbin Ge, Sibo Song, Kai Dang, Peng Wang, Shijie Wang, Jun Tang, et al. 2025. Qwen2. 5-vl technical report. arXiv preprint arXiv:2502.13923

    arXiv 2025

  4. [4]

    Bemyeyes

    BeMyEyes. Bemyeyes. https://www.bemyeyes.com/

    work page

  5. [5]

    Zhiyuan Chang, Mingyang Li, Yi Liu, Junjie Wang, Qing Wang, and Yang Liu. 2024. Play guessing game with llm: Indirect jailbreak attack with implicit clues. arXiv preprint arXiv:2402.09091

    arXiv 2024

  6. [6]

    Simin Chen, Hanlin Chen, Mirazul Haque, Cong Liu, and Wei Yang. 2023 a . The dark side of dynamic routing neural networks: Towards efficiency backdoor injection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24585--24594

    work page 2023

  7. [7]

    Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. 2022 a . Nmtsloth: understanding and testing efficiency degradation of neural machine translation systems. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pages 1148--1160

    work page 2022

  8. [8]

    Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. 2022 b . Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 15365--15374

    work page 2022

Show all 46 references
  1. [9]

    Yiming Chen, Simin Chen, Zexin Li, Wei Yang, Cong Liu, Robby Tan, and Haizhou Li. 2023 b . Dynamic transformers provide a false sense of efficiency. In The 61st Annual Meeting Of The Association For Computational Linguistics

    2023

  2. [10]

    Shuyu Cheng, Yibo Miao, Yinpeng Dong, Xiao Yang, Xiao-Shan Gao, and Jun Zhu. 2024. Efficient black-box adversarial attacks via bayesian optimization guided by a function prior. arXiv preprint arXiv:2405.19098

    2024 arXiv

  3. [11]

    Alex de Vries. 2023. The growing energy footprint of artificial intelligence. Joule, 7(10):2191--2194

    2023

  4. [12]

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. 2009. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248--255. Ieee

    2009

  5. [13]

    Jacob Devlin. 2018. Bert: Pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805

    2018 arXiv

  6. [14]

    Xiaoning Feng, Xiaohong Han, Simin Chen, and Wei Yang. 2024. Llmeffichecker: Understanding and testing efficiency degradation of large language models. ACM Transactions on Software Engineering and Methodology, 33(7):1--38

    2024

  7. [15]

    Kuofeng Gao, Yang Bai, Jindong Gu, Shu-Tao Xia, Philip Torr, Zhifeng Li, and Wei Liu. 2024. Inducing high energy-latency of large vision-language models with verbose images. In The Twelfth International Conference on Learning Representations

    2024

  8. [16]

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. 2019. Simple black-box adversarial attacks. In International conference on machine learning, pages 2484--2493. PMLR

    2019

  9. [17]

    Mirazul Haque, Simin Chen, Wasif Haque, Cong Liu, and Wei Yang. 2023. Antinode: Evaluating efficiency robustness of neural odes. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 1507--1517

    2023

  10. [18]

    Mirazul Haque, Yaswanth Yadlapalli, Wei Yang, and Cong Liu. 2022. Ereba: Black-box energy testing of adaptive neural networks. In Proceedings of the 44th International Conference on Software Engineering, pages 835--846

    2022

  11. [19]

    Dan Hendrycks and Thomas Dietterich. 2019. Benchmarking neural network robustness to common corruptions and perturbations. arXiv preprint arXiv:1903.12261

    2019 arXiv

  12. [20]

    Torsten Hoefler, Dan Alistarh, Tal Ben-Nun, Nikoli Dryden, and Alexandra Peste. 2021. Sparsity in deep learning: Pruning and growth for efficient inference and training in neural networks. Journal of Machine Learning Research, 22(241):1--124

    2021

  13. [21]

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black-box adversarial attacks with limited queries and information. In International conference on machine learning, pages 2137--2146. PMLR

    2018

  14. [22]

    Mark Kurtz, Justin Kopinsky, Rati Gelashvili, Alexander Matveev, John Carr, Michael Goin, William Leiserson, Sage Moore, Nir Shavit, and Dan Alistarh. 2020. Inducing and exploiting activation sparsity for fast inference on deep neural networks. In International Conference on M...

    2020

  15. [23]

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. 2022. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In International conference on machine learning, pages 12888--12900. PMLR

    2022

  16. [24]

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \'a r, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, ...

    2014

  17. [25]

    Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. 2023. Visual instruction tuning. Advances in neural information processing systems, 36:34892--34916

    2023

  18. [26]

    Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. 2019. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pages 860--868. IEEE

    2019

  19. [27]

    Aleksander Madry. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083

    2017 arXiv

  20. [28]

    Lingchen Meng, Hengduo Li, Bor-Chun Chen, Shiyi Lan, Zuxuan Wu, Yu-Gang Jiang, and Ser-Nam Lim. 2022. Adavit: Adaptive vision transformers for efficient image recognition. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12309--12318

    2022

  21. [29]

    Microsoft seeing ai

    Microsoft. Microsoft seeing ai. https://www.microsoft.com/en-us/garage/wall-of-fame/seeing-ai/

  22. [30]

    David Patterson, Joseph Gonzalez, Quoc Le, Chen Liang, Lluis-Miquel Munguia, Daniel Rothchild, David So, Maud Texier, and Jeff Dean. 2021. Carbon emissions and large neural network training. arXiv preprint arXiv:2104.10350

    2021 arXiv

  23. [31]

    Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. 2024. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI Conference on Artificial Intelligence

    2024

  24. [32]

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. 2021. Learning transferable visual models from natural language supervision. In International conference on machine learni...

    2021

  25. [33]

    Tim Salimans, Jonathan Ho, Xi Chen, Szymon Sidor, and Ilya Sutskever. 2017. Evolution strategies as a scalable alternative to reinforcement learning. arXiv preprint arXiv:1703.03864

    2017 arXiv

  26. [34]

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. 2017. Grad-cam: Visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE international conference on computer vision, pages 618--626

    2017

  27. [35]

    Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. 2023. Jailbreak in pieces: Compositional adversarial attacks on multi-modal language models. In The Twelfth International Conference on Learning Representations

    2023

  28. [36]

    Jianfeng Wang, Zhengyuan Yang, Xiaowei Hu, Linjie Li, Kevin Lin, Zhe Gan, Zicheng Liu, Ce Liu, and Lijuan Wang. 2022. Git: A generative image-to-text transformer for vision and language. arXiv preprint arXiv:2205.14100

    2022 arXiv

  29. [37]

    Daan Wierstra, Tom Schaul, Tobias Glasmachers, Yi Sun, Jan Peters, and J \"u rgen Schmidhuber. 2014. Natural evolution strategies. The Journal of Machine Learning Research, 15(1):949--980

    2014

  30. [38]

    Bin Xiao, Haiping Wu, Weijian Xu, Xiyang Dai, Houdong Hu, Yumao Lu, Michael Zeng, Ce Liu, and Lu Yuan. 2024. Florence-2: Advancing a unified representation for a variety of vision tasks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, page...

    2024

  31. [39]

    Weilin Xu, David Evans, and Yanjun Qi. 2017. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv preprint arXiv:1704.01155

    2017 arXiv

  32. [40]

    Jiaming Zhang, Xingjun Ma, Xin Wang, Lingyu Qiu, Jiaqi Wang, Yu-Gang Jiang, and Jitao Sang. 2024. Adversarial prompt tuning for vision-language models. In European Conference on Computer Vision, pages 56--72. Springer

    2024

  33. [41]

    Shengyao Zhang, Xudong Pan, Mi Zhang, and Min Yang. 2023. Slowbert: Slow-down attacks on input-adaptive multi-exit bert. In Findings of the Association for Computational Linguistics: ACL 2023, pages 9992--10007

    2023

  34. [42]

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. 2023. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36:54111--54138

    2023

  35. [43]

    Wangchunshu Zhou, Canwen Xu, Tao Ge, Julian McAuley, Ke Xu, and Furu Wei. 2020. Bert loses patience: Fast and robust inference with early exit. Advances in Neural Information Processing Systems, 33:18330--18341

    2020

  36. [44]

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. 2023. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592

    2023 arXiv

  37. [45]

    online" 'onlinestring :=

    ENTRY address archivePrefix author booktitle chapter edition editor eid eprint eprinttype howpublished institution journal key month note number organization pages publisher school series title type volume year doi pubmed url lastchecked label extra.label sort.label short.list...

  38. [46]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 gl...

Pith tools

Reviewed August 15, 2026 · model on record in the stance chip above.