REVIEW 6 cited by
On Evaluating Adversarial Robustness of Large Vision-Language Models
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Large vision-language models (VLMs) such as GPT-4 have achieved unprecedented performance in response generation, especially with visual inputs, enabling more creative and adaptable interaction than large language models such as ChatGPT. Nonetheless, multimodal generation exacerbates safety concerns, since adversaries may successfully evade the entire system by subtly manipulating the most vulnerable modality (e.g., vision). To this end, we propose evaluating the robustness of open-source large VLMs in the most realistic and high-risk setting, where adversaries have only black-box system access and seek to deceive the model into returning the targeted responses. In particular, we first craft targeted adversarial examples against pretrained models such as CLIP and BLIP, and then transfer these adversarial examples to other VLMs such as MiniGPT-4, LLaVA, UniDiffuser, BLIP-2, and Img2Prompt. In addition, we observe that black-box queries on these VLMs can further improve the effectiveness of targeted evasion, resulting in a surprisingly high success rate for generating targeted responses. Our findings provide a quantitative understanding regarding the adversarial vulnerability of large VLMs and call for a more thorough examination of their potential security flaws before deployment in practice. Code is at https://github.com/yunqing-me/AttackVLM.
Forward citations
Cited by 6 Pith papers
-
Evaluating Robustness of Monocular Depth Estimation with Procedural Scene Perturbations
A procedural-generation benchmark (PDE) shows that depth models are surprisingly vulnerable to camera changes and occlusion, while resisting lighting changes.
-
Attacking Graph Foundation Models Through Their Shared Representation
A shared representation layer in graph foundation models is a distinct attack surface: input edits break three of six models and one spectral tokenizer is uniquely fragile.
-
VISOR++: Universal Visual Inputs based Steering for Large Vision Language Models
A single adversarially optimized image can reproduce activation-steering behavior in multiple VLMs and partially transfer to unseen models.
-
XSPA: Crafting Imperceptible X-Shaped Sparse Adversarial Perturbations for Transferable Attacks on VLMs
Perturbing only about 1–2% of pixels along a fixed X-shaped pattern degrades CLIP zero-shot accuracy and transfers to hurt captioning and VQA in six vision-language models.
-
Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment
FOA-Attack aligns global and clustered local features via optimal transport with dynamic ensemble weighting to create targeted adversarial images that transfer to closed-source multimodal LLMs.
-
From Hallucinations to Jailbreaks: Rethinking the Vulnerability of Large Foundation Models
The paper argues hallucinations and jailbreaks share the same optimization dynamics and shows that defenses for one also reduce the other, but the theoretical support is largely circular.
Discussion (0). Continue with ORCID to comment.