REVIEW 22 cited by
How Robust is Google's Bard to Adversarial Image Attacks?
Not yet reviewed by Pith; the record is open.
This paper has not been read by Pith yet. Machine review is queued; the pith claim, tier, and objections will appear here once it completes.
SPECIMEN: schema-true, not a live event
T0 review · schema-true
One-sentence machine reading of the paper's core claim.
pith:XXXXXXXX · record.json · timestamp
read the original abstract
Multimodal Large Language Models (MLLMs) that integrate text and other modalities (especially vision) have achieved unprecedented performance in various multimodal tasks. However, due to the unsolved adversarial robustness problem of vision models, MLLMs can have more severe safety and security risks by introducing the vision inputs. In this work, we study the adversarial robustness of Google's Bard, a competitive chatbot to ChatGPT that released its multimodal capability recently, to better understand the vulnerabilities of commercial MLLMs. By attacking white-box surrogate vision encoders or MLLMs, the generated adversarial examples can mislead Bard to output wrong image descriptions with a 22% success rate based solely on the transferability. We show that the adversarial examples can also attack other MLLMs, e.g., a 26% attack success rate against Bing Chat and a 86% attack success rate against ERNIE bot. Moreover, we identify two defense mechanisms of Bard, including face detection and toxicity detection of images. We design corresponding attacks to evade these defenses, demonstrating that the current defenses of Bard are also vulnerable. We hope this work can deepen our understanding on the robustness of MLLMs and facilitate future research on defenses. Our code is available at https://github.com/thu-ml/Attack-Bard. Update: GPT-4V is available at October 2023. We further evaluate its robustness under the same set of adversarial examples, achieving a 45% attack success rate.
Forward citations
Cited by 22 Pith papers
-
On Surjectivity of Neural Networks: Can you elicit any behavior from your model?
Pre-LayerNorm transformers and linear attention are almost always surjective, so any target output has an input that produces it in the continuous embedding space.
-
Two Sides of the Same Coin: Co-Evolving Search for Cross-Task Attacks on Vision-Language Models
CoEvoAttack uses evolutionary search on both text and image sides to generate object-region adversarial examples that transfer across captioning, detection, region categorization, and localization in unified VLMs.
-
Visual Token Compression Enhances Robustness of MLLMs
Pruning visual tokens farthest from the text feature space at selected 'robust' layers improves MLLM jailbreak defense (average +13.29% RAR) and slightly reduces hallucination.
-
3D FaceShell: Attribute Transfer in 3D Face Avatars as a VLM Defense Mechanism
An optimized, view-consistent 3D Gaussian shell around a face avatar reliably changes which facial attributes vision-language models report, while preserving identity and appearance.
-
On Adversarial Vulnerability of Vision-Language Models through the Lens of Intermediate Spectral Subspaces
Aligning adversarial perturbations with the near-null singular directions of intermediate linear layers in transformer VLMs yields stronger attacks than existing feature- and output-space methods.
-
Grounding-Driven Attack: Improving Encoder-based Adversarial Transferability against Large Vision-Language Models
A grounding-guided attack that concentrates perturbation on text-matched image regions and disrupts global and local semantic alignment consistently improves adversarial transferability across multiple vision-language models.
-
VISOR++: Universal Visual Inputs based Steering for Large Vision Language Models
A single adversarially optimized image can reproduce activation-steering behavior in multiple VLMs and partially transfer to unseen models.
-
One Object, Multiple Lies: A Benchmark for Cross-task Adversarial Attack on Unified Vision-Language Models
A single adversarial image can make a unified vision-language model misclassify the same object across captioning, detection, region classification, and localization, and the new CrossVLAD benchmark and CRAFT attack m...
-
Fighting Fire with Fire (F3): A Training-free and Efficient Visual Adversarial Example Purification Method in LVLMs
F3 adds attention-guided noise to adversarial images so that large vision-language models produce answers that are much closer to their clean-image answers.
-
Con Instruction: Universal Jailbreaking of Multimodal Large Language Models via Non-Textual Modalities
Con Instruction embeds harmful textual instructions into adversarial images or audio by aligning their representations, achieving successful jailbreaks on several vision- and audio-language models.
-
Disrupting Vision-Language Model-Driven Navigation Services via Adversarial Object Fusion
AdvOF crafts 3D adversarial objects that mislead VLM perception across multiple views and degrade VLN agent navigation success in simulation.
-
Spa-VLM: Stealthy Poisoning Attacks on RAG-based VLM
Spa-VLM crafts paired adversarial images and misleading texts to poison RAG-based VLM knowledge bases, reaching attack success rates above 0.8 with just five injected entries.
-
Backdoor Cleaning without External Guidance in MLLM Fine-tuning
BYE filters backdoored training images from MLLM fine-tuning by clustering low attention entropy across selected layers.
-
On the robustness of multimodal language model towards distractions
Adding irrelevant visual and textual distractions to science questions degrades the accuracy of most vision-language models, and text distractions are more harmful than image distractions.
-
GeoThreat: Transferable Targeted Adversarial Attacks on Large Vision-Language Models for Remote Sensing Image Interpretation
A black-box adversarial attack method, GeoThreat, generates transferable targeted perturbations for LVLMs in remote sensing by jointly aligning global conceptual and local perceptual representations with a target image.
-
Dual Adversarial Fine-tuning for Enhancing Robustness of Large Vision Language Model
DAFT fine-tunes CLIP's vision encoder with a visual-consistency loss plus a caption-triplet loss, reporting modest adversarial-robustness gains over FARE on classification, captioning, and VQA benchmarks.
-
Adversarial-Guided Diffusion for Multimodal LLM Attacks
AGD steers the final denoising steps of Stable Diffusion with CLIP-based target gradients and momentum, producing targeted MLLM attacks with high image fidelity and better survival under defenses.
-
Adversarial Attacks against Closed-Source MLLMs via Feature Optimal Alignment
FOA-Attack aligns global and clustered local features via optimal transport with dynamic ensemble weighting to create targeted adversarial images that transfer to closed-source multimodal LLMs.
-
Contrastive Spectral Rectification: Test-Time Defense towards Zero-shot Adversarial Robustness of CLIP
CSR detects and repairs adversarial CLIP inputs by comparing features with a low-pass filtered copy and applying a small contrastive PGD correction, claiming SOTA robust accuracy on 16 benchmarks.
-
Blockchain Network Analysis using Quantum Inspired Graph Neural Networks & Ensemble Models
The submission's abstract claims a quantum-inspired GNN with a CP-decomposition layer reaches 74.8% F2 on blockchain fraud detection, but the uploaded full text is an unrelated paper on VLM agent security.
-
A Survey of Safety on Large Vision-Language Models: Attacks, Defenses and Evaluations
A survey of LVLM safety that adds a lifecycle taxonomy and new benchmark results showing Janus-Pro-7B has weaker safety than several open-source LVLMs.
-
Empowering Multimodal LLMs with External Tools: A Comprehensive Survey
A survey paper maps how external tools are used to augment multimodal large language models across data, tasks, evaluation, and future directions.
Discussion (0). Continue with ORCID to comment.