$\texttt{MirrorCheck}$ : Efficient Adversarial Defense for Vision-Language Models

## Abstract

Abstract Vision-Language Models (VLMs) are becoming increasingly vulnerable to adversarial attacks as various novel attack strategies are being proposed against these models. While existing defenses excel in unimodal contexts, they currently fall short in safeguarding VLMs against adversarial threats. To mitigate this vulnerability, we propose a novel, yet elegantly simple approach for detecting adversarial samples in VLMs. Our method leverages Text-to-Image (T2I) models to generate images based on captions produced by target VLMs. Subsequently, we calculate the similarities of the embeddings of both input and generated images in the feature space to identify adversarial samples. Empirical evaluations conducted on different datasets validate the efficacy of our approach, outperforming baseline methods adapted from image classification domains. Furthermore, we extend our methodology to classification tasks, showcasing its adaptability and model-agnostic nature. Theoretical analyses and empirical findings also show the resilience of our approach against adaptive attacks, positioning it as an excellent defense mechanism for real-world deployment against adversarial threats.

## 1 Introduction

Vision-Language Models (VLMs) have emerged as transformative tools at the intersection of computer vision (CV) and natural language processing (NLP), revolutionizing the landscape of multimodal understanding. These models hold immense importance due to their unparalleled capacity to bridge the semantic gap between visual and textual modalities (Bao et al., , ; Li et al., , ; Guo et al., ; Zhu et al., ; Liu et al., ; Li et al., ), enabling machines to comprehend and generate content across modalities with human-like fluency.

Figure: Figure 1: \ours approach. At inference time, to check if an input image has been adversarially attacked, our framework follows this procedure: (1) generates the text description for the image. (2) use this caption to regenerate the image with a text-to-image model. (3) extract and compare embeddings from both the original and regenerated images using a feature extractor. If the embeddings significantly differ, the original image likely suffered an attack. The intuition behind our method is that if the input was attacked, the image and the caption would not be semantically consistent. Therefore, using the predicted caption as a prompt for image generation would result in an image that is significantly semantically different.
Refer to caption: x1.png

However, while VLMs have demonstrated remarkable capabilities across various tasks, their robustness against adversarial attacks remains a critical concern. Recent studies (Xu et al., ; Li et al., ; Zhang et al., ; Zhou et al., ; Zhao et al., ; Yin et al., ; Wang et al., ) have highlighted the susceptibility of VLMs to subtle variations in their input data, particularly in scenarios involving multimodal interactions. Adversaries can exploit weaknesses in VLMs by crafting imperceptible modifications to the input data that yield erroneous outputs. The interactive nature of VLMs, especially in image-grounded text generation tasks, further amplifies their vulnerability, raising concerns about their deployment in safety-critical environments (Vemprala et al., ; Park et al., ). Therefore, the need for effective defense mechanisms to safeguard against such threats is paramount.

To counter these threats in neural networks, advances have emerged in several major forms: (i) Detectors (Metzen et al., ; Grosse et al., ; Feinman et al., ; Roth et al., ; Xu et al., ; Meng and Chen, ; Metzen et al., ; Deng et al., ), designed to discern adversarial examples from natural images, (ii) Purifiers (Nie et al., ; Samangouei et al., ; Ho and Vasconcelos, ; Das et al., ; Hwang et al., ), which aim to remove adversarial features from samples, and (iii) Ensembles combining both detection and purification methods (Meng and Chen, ; Tramèr et al., ). Other defense mechanisms include (iv) Adversarial Training Methods (Goodfellow et al., ; Kurakin et al., ; Tramèr et al., ; Madry et al., ), and (v) Certified Robustness (Cohen et al., ; Salman et al., ; Carlini et al., ). However, while sophisticated detectors, purifiers, and ensemble approaches can be circumvented by knowledgeable attackers who exploit weaknesses in these defense mechanisms (adaptive attacks) (Athalye et al., ), adversarial training and certified robustness approaches are computationally expensive though they provide better and stronger guarantees. Moreover, these popular defense strategies have predominantly been optimized for image classification tasks, leaving a gap in robust defenses tailored specifically for VLMs.

To address this challenge, we introduce a novel method, \ours, for detecting adversarial samples in VLMs, and demonstrate the effectiveness of this method on different VL tasks. \ours leverages a Text-to-Image (T2I) model to generate an image based on the caption produced by the victim model, as illustrated in Figure 1. Subsequently, it extracts and compares the embeddings of the input image and the generated image using cosine similarity, for which a low score indicates a potential attack. This approach not only addresses the limitations of existing methods but also provides a robust solution for detecting adversarial samples in VLMs. Through empirical evaluation, we show that our approach outperforms recent methods in detecting adversarial samples, and resisting adaptive attacks. Further ablations prove the robustness of \ours to the choice of T2I models and image encoders. We also adapt our approach to detecting adversarial samples in image classification tasks and demonstrate its superior performance.

In summary, our work contributes to a novel model-agnostic approach for detecting adversarial attacks on VLMs. The proposed \ours does not require training and achieves excellent results in zero-shot settings. We evaluate our method for attacks on image captioning (IC) and visual-question answering (VQA) tasks, and also extend it to classification tasks, and observe significant improvements compared to the state-of-the-art.

## 2 Background

### 2.1 Adversarial Attacks on VLMs

The vulnerability of VLMs arises from the potential for perturbations to impact both visual and textual modalities. Initial efforts focused on specific tasks such as visual question answering (Xu et al., ; Bartolo et al., ; Cao et al., ; Kaushik et al., ; Kovatchev et al., ; Li et al., ; Sheng et al., ; Zhang et al., ) and image captioning (Aafaq et al., ; Li et al., , ; Chen et al., ; Xu et al., ), typically in white-box settings where attackers have access to model parameters. More recently, AttackVLM (Zhao et al., ) has addressed black-box scenarios, where adversaries manipulate models to generate targeted responses using surrogate models like CLIP (Radford et al., ) and BLIP (Li et al., ). Similarly, VLATTACK (Yin et al., ) generates adversarial samples by combining image and text perturbations, targeting black-box fine-tuned models. These findings highlight significant vulnerabilities in VLM deployment. Our study evaluates the efficacy of our defense method against various VLM and classification attacks, with details on classification attacks provided in Appendix A.2.

AttackVLM Transfer Strategy (ADV-Transfer). Given that the victim models are VLMs, AttackVLM (Zhao et al., ) employs an image encoder $\tilde{\mathcal{I}}_{\phi}(x)\rightarrow z$, along with a publicly available T2I generative model $G_{\psi}(t;\eta)\rightarrow x$ (e.g., Stable Diffusion (Rombach et al., )), to generate a target image corresponding to target caption $t^{*}$ (target caption the adversary expects the victim models to return). The objective is as follows:

$$ $\operatorname*{arg\,min}_{\delta:\|\delta\|_{\infty}\leq\varepsilon}d(\tilde{ \mathcal{I}}_{\phi}(x_{adv}),\tilde{\mathcal{I}}_{\phi}(G_{\psi}(t^{*};\eta))),$ (1) $$

where $x_{adv}=x+\delta$. Note that the gradient information of $G_{\psi}$ is not necessary when optimizing the equation above using the Project Gradient Descent (PGD) attack (Madry et al., ).

AttackVLM Query Strategy (ADV-Query). The success of transfer-based attacks heavily relies on how closely the victim and surrogate models align. When a victim model can be repeatedly queried with input images to receive text outputs, adversaries can use a query-based attacking strategy to estimate gradients by maximizing the text similarity as

$$ $\operatorname*{arg\,min}_{\delta:\|\delta\|_{\infty}\leq\varepsilon}d(\mathcal {T}_{\pi}(\mathcal{F}_{\theta}(x_{adv;p})),\mathcal{T}_{\pi}(t^{*})),$ (2) $$

where $\mathcal{T}_{\pi}(t)\rightarrow z$ is the text encoder, $\mathcal{F}_{\theta}(\cdot)$ is the victim model. Since AttackVLM (Zhao et al., ) assumes black-box access to the victim models and cannot perform backpropagation, the random gradient-free (RGF) method (Nesterov and Spokoiny, ) is employed to estimate the gradients. Transfer attack-generated adversarial examples were employed as an initialization step to enhance the efficacy of query-based attacks.

### 2.2 Adversarial Defenses

Defense Strategies for Image Classification Tasks. Adversarial defenses in machine learning aim to protect models from malicious inputs designed to deceive them. These defenses are crucial for maintaining model integrity and reliability, especially in security-sensitive applications. Several methods have been employed to defend against adversaries in classification tasks. For example, Defensive Distillation (Papernot et al., ) trains a secondary model to mimic the probability output of the original model, often with softened labels. While this approach reduces sensitivity to adversarial noise, it does not entirely eliminate attack risks. Detectors (Roth et al., ; Xu et al., ; Meng and Chen, ; Metzen et al., ; Deng et al., ) identify and filter out adversarial samples, though attackers can develop strategies to circumvent these defenses. Purification methods (Nie et al., ; Samangouei et al., ; Ho and Vasconcelos, ; Das et al., ; Hwang et al., ) remove adversarial perturbations from input data using techniques like autoencoders or denoising filters, but may also alter legitimate inputs, affecting performance. Adversarial Training Methods (Kurakin et al., ; Madry et al., ; Tramèr et al., ; Shafahi et al., ; Wong et al., ; de Jorge et al., ; Andriushchenko and Flammarion, ; Zhang et al., ; Dong et al., ) augment training datasets with adversarial examples, allowing models to learn from these perturbations, while Certified Defense Methods (Cohen et al., ; Salman et al., ; Carlini et al., ) provide mathematical guarantees of robustness. Both approaches, however, can be computationally intensive and may struggle to generalize to novel attack strategies.

Safeguarding VLMs. Recent studies (Zhao et al., ; Yin et al., ) reveal a surge in novel adversarial attack strategies targeting VLMs. Despite extensive exploration of adversarial defense strategies in the literature, these strategies have primarily been developed for unimodal tasks, such as image or text classification, and are not optimized to effectively safeguard VLMs. The unique challenges presented by VLMs arise from their ability to process and integrate multimodal data—visual and textual inputs—making traditional defense methods less effective. Existing defense methods often focus on a single modality and fail to account for the complex interactions between visual and linguistic data, which can be exploited by adversaries. To the best of our knowledge, a tailored defense strategy explicitly designed for VLMs remains absent. Hence, we propose \ours, an approach which aims to detect such samples without necessitating alterations to the model architecture or jeopardizing its performance.

## 3 Method

Let $\mathcal{F}_{\theta}(x_{\text{in}};p)\rightarrow t$ be the victim VLM model, where $x_{\text{in}}$ is the input image which may be clean ($x_{\text{clean}})$ or adversarial ($x_{\text{adv}}$), $p$ is the input prompt, and $t$ is the resulting output caption. In certain tasks, such as image captioning or text retrieval, the input prompt $p$ may remain empty. Let $\mathcal{I}_{\phi}(x)\rightarrow z$ be a pretrained image encoder and let $G_{\psi}(t;\eta)\rightarrow x_{\text{gen}}$ denote a pretrained text-conditioned image generation model producing image $x_{\text{gen}}$.

### 3.1 Threat Model

We operate under the assumption that the attacker holds
only black-box access of the victim VLM model $\mathcal{F}_{\theta}(x_{\text{in}};p)$. This includes no understanding of its architecture, parameters, and training methodologies. Similarly, the detection mechanism remains oblivious or indifferent to the specific methods employed by the attacker in generating adversarial examples. The attacker’s objectives are: to execute targeted attacks that cause the generated caption $t$ to match a predefined target response and to adhere to an adversarial constraint defined by the $l$-norm which limits the distance between $x_{\text{clean}}$ and $x_{\text{adv}}$. The defender’s objective is to accurately identify and flag images as either adversarial or clean.

Figure: Figure 2: An example using our \ours framework. For both Clean and adversarial (Adv) cases, we use the BLIP model to generate captions for the given images. Stable Diffusion then generates images based on these captions. For the clean image, different image encoders show high similarity between the input image and the generated one. Conversely, when the input image is adversarial, different image encoders show low similarity.
Refer to caption: x2.png

### 3.2 \ours Pipeline

Illustrated in Figures 1 and 2, our algorithm is designed to identify adversarial images within VLMs. These images are specifically crafted to deceive the underlying victim VLM model $\mathcal{F}_{\theta}(x_{\text{in}};p)\rightarrow t$, by adding adversarial perturbation $\delta$ to obtain $x_{\text{adv}}$ from $x_{\text{clean}}$, while keeping the perturbation within a perturbation bound $\varepsilon$. The key observation lies in the deviation of captions generated by adversarial images from the content of the input image, which is the primary objective of the attack. To tackle this, we propose a pipeline where the generated caption undergoes scrutiny by a separate generative model $G_{\psi}(t;\eta)\rightarrow x_{\text{gen}}$, where $t$ denotes the caption generated by the victim model, and $x_{\text{gen}}$ represents the newly generated image. Leveraging a pretrained image encoder $\mathcal{I}_{\theta}(x)\rightarrow z$, we evaluate the similarity between $x_{\text{in}}$ and $x_{\text{gen}}$. In scenarios involving clean images, we anticipate a high similarity, as the generated caption accurately reflects the image content. Conversely, in cases of adversarial images, the similarity tends to be low.

Subsequently, we employ an adversarial detector $\mathcal{D}(x)\rightarrow[0,1]$, which categorizes the image into either the "adversarial" class ($1$) or the "clean" class (0 0), with $\tau$ serving as the decision threshold parameter, i.e.

$$ $\mathcal{D}(x)=\begin{cases}1,\quad&\text{if }\text{sim}(\mathcal{I}_{\phi}(x) ,\mathcal{I}_{\phi}(G_{\psi}(\mathcal{F}_{\theta}(x;p);\eta)))<\tau,\\ 0,&\text{otherwise}\end{cases}.$ $$

Intuition behind image-image similarity. Instead of directly comparing $x_{\text{in}}$ (the input image) with the generated caption $t$, we opted to calculate the similarity between $x_{\text{in}}$ and $x_{\text{gen}}$ (the newly generated image). This decision is based on evidence in the literature indicating that these models struggle with positional relationships and variations in verb usage within sentences. This suggests that VLMs may function more like bags-of-words and, consequently, which could limit their reliability for optimizing cross-modality similarity (Yuksekgonul et al., ).

Recognizing the potential issue introduced by a single image encoder used for similarity assessment (i.e., if it was used to generate the adversarial samples), we propose two complementary strategies to combat this issue. One is to employ an ensemble of pretrained image encoders, the similarity will be calculated as follows: $\frac{1}{N}\sum_{i=1}^{N}\text{sim}(\mathcal{I}_{\phi}i(x),\mathcal{I}_{\phi}i
(G_{\psi}(\mathcal{F}_{\theta}(x;p);\eta)))$
i.e., calculates the average output across multiple image encoders ($\mathcal{I}_{\phi 1},\mathcal{I}_{\phi 2},...,\mathcal{I}_{\phi N}$).

Alternatively, we suggest perturbing the weights $\phi$ of the employed image encoder $\mathcal{I}_{\phi}$ with noise $\gamma$ to create a One-Time-Use Image Encoder (OTU) so in this case $\hat{\phi}=\phi+\gamma$. This process must ensure that despite the introduced noise, the encoder’s weights remain conducive to similarity evaluation.
Otherwise, the weights may become corrupted, impairing the encoder’s ability to assess image similarity. This strategy allows for the creation of a modified image encoder with perturbed weights, enabling one-time use for similarity evaluation while maintaining the encoder’s functionality.

## 4 Experiments

In this section, we demonstrate the effectiveness of \ours at detecting adversarial samples across VLM-reliant tasks. Additionally, we ablate our method in image classification tasks and explore its performances when using different T2I models and image encoders, as detailed in Appendix C. Note that all models used for our experiments are open-source to enable reproducibility. All our code and models will become publicly available.

### 4.1 Implementation Details

We use validation images sourced from ImageNet-1K (Deng et al., ) as the basis for clean images, which are then used to generate adversarial examples and quantitatively assess the robustness of large VLMs, following the methodology outlined in AttackVLM (Zhao et al., ) and also described in Section 2. For each experiment conducted, we randomly selected 100 or 1000 images. The targeted text descriptions that were used for this purpose are also randomly chosen from MS-COCO captions (Lin et al., ), ensuring that each clean image is paired with a corresponding descriptive prompt.

Adversarial Setting Description. As mentioned earlier, we followed the settings from (Zhao et al., ). Specifically, we set the perturbation bound to $8$ and used the $l_{\infty}$ constraint, where the pixel values are in the range $[0,255]$. For transfer-based attacks, we used 100-step PGD for optimization. Each step involved 100 query times for query-based attacks, and the adversarial images were updated using 8-step PGD with the estimated gradient.

Victim models $(\mathcal{F}_{\theta}(x_{\text{in}};p))$. UniDiffuser (Bao et al., ), BLIP (Li et al., ), Img2Prompt (Guo et al., ), BLIP-2 (Li et al., ), and MiniGPT-4 (Zhu et al., ) serve as our victim models.

T2I models $(G_{\psi}(t))$. Our primary T2I model is Stable Diffusion (SD) (Rombach et al., ), predominantly employing the CompVis SD-v1.4 weights. In our ablation studies, we also test the UniDiffuser T2I model (Bao et al., ) and the ControlNet model (Zhang et al., ) with the RunwayML SD-v1.5 weights. We run image generation for 50 time steps and generate images of $512\times 512$ pixels in all our experiments.

Pretrained image encoders $(\mathcal{I}_{\phi}(x_{\text{in}},x_{\text{gen}}))$. We use CLIP (Radford et al., ), pretrained on OpenAI’s dataset, as our primary image encoder. For the ablations, we employed OpenCLIP (Ilharco et al., ), pretrained on the LAION-2B (Schuhmann et al., ) dataset, and ImageNet-Pretrained Classifiers (VGG16 (Simonyan and Zisserman, ) and ResNet-50 (He et al., ), loaded from PyTorch). Both the input images $x_{\text{in}}$ and generated images $x_{\text{gen}}$ were preprocessed using the transforms specific to these models.

### 4.2 Baseline methods

To our knowledge, no publicly available defense methods exist for adversarial attacks on VLMs. For comparison, we adapt existing detection approaches (Meng and Chen, ; Pu et al., ; Xu et al., ) developed for image classification. MagNet (Meng and Chen, ) uses a detector to identify adversarial inputs by evaluating their proximity to the manifold of clean images via reconstruction errors from autoencoders. Similarly, PuVAE (Pu et al., ) employs a variational autoencoder (VAE) to project adversarial examples onto the data manifold, selecting the closest projection as the purified sample. At inference, PuVAE projects inputs to latent spaces of different class labels and uses root mean square error to identify the closest projection, thus removing adversarial perturbations. We adapt MagNet and PuVAE for VLM attack detection by training autoencoders and VAEs on the ImageNet dataset to learn the manifold of clean images. Feature Squeeze (Xu et al., ) creates "squeezed" versions of the input and compares model predictions on the original and squeezed inputs; significant discrepancies indicate adversarial examples. For VLMs, we adapt this by creating "squeezed" inputs and comparing the captions generated from the original and squeezed versions.

### 4.3 Results

**Table 1: Average Similarity Scores using CLIP’s image encoders to calculate the similarities between input images (Clean, ADV-Transfer, and ADV-Query) and generated images (using Stable Diffusion). The tasks used are image captioning (IC) and visual question answering (VQA). Key Takeaway: Our method consistently observes higher similarities for clean settings than adversarial settings.**
| Victim Model | Task | Setting | CLIP Image Encoders |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |  |
| UniDiffuser | IC | Clean | 0.718 | 0.811 | 0.755 | 0.751 | 0.713 | 0.750 |
| \cdashline3-9 | ADV-Transfer | 0.414 | 0.624 | 0.518 | 0.804 | 0.509 | 0.574 |  |
| \cdashline3-9 | ADV-Query | 0.408 | 0.667 | 0.537 | 0.517 | 0.533 | 0.532 |  |
| BLIP | IC | Clean | 0.701 | 0.805 | 0.742 | 0.728 | 0.698 | 0.735 |
| \cdashline3-9 | ADV-Transfer | 0.385 | 0.619 | 0.517 | 0.479 | 0.497 | 0.499 |  |
| \cdashline3-9 | ADV-Query | 0.440 | 0.675 | 0.561 | 0.531 | 0.550 | 0.551 |  |
| BLIP-2 | IC | Clean | 0.720 | 0.817 | 0.762 | 0.750 | 0.720 | 0.754 |
| \cdashline3-9 | ADV-Transfer | 0.430 | 0.637 | 0.543 | 0.499 | 0.526 | 0.527 |  |
| \cdashline3-9 | ADV-Query | 0.408 | 0.667 | 0.546 | 0.528 | 0.533 | 0.536 |  |
| Img2Prompt | VQA | Clean | 0.661 | 0.780 | 0.712 | 0.695 | 0.670 | 0.703 |
| \cdashline3-9 | ADV-Transfer | 0.380 | 0.621 | 0.508 | 0.478 | 0.501 | 0.498 |  |
| \cdashline3-9 | ADV-Query | 0.446 | 0.681 | 0.565 | 0.538 | 0.563 | 0.559 |  |
| MiniGPT-4 | VQA | Clean | 0.624 | 0.754 | 0.681 | 0.672 | 0.647 | 0.678 |
| \cdashline3-9 | ADV-Transfer | 0.530 | 0.693 | 0.599 | 0.578 | 0.558 | 0.591 |  |

Figure: Figure 3: Effect of our ensemble approach on a victim model (Case study: UniDiffuser).
Refer to caption: x3.png

Similarity Scores using Stable Diffusion and CLIP image encoders. Tables 1 and 3 presents the average similarity scores obtained by using CLIP image encoders to extract the embeddings of input images in different settings and generate images using Stable Diffusion. The results presented in Tables 1 and 3 are based on evaluations conducted on two tasks: image captioning (IC) and visual question answering (VQA). Across different victim models, higher average similarity scores are consistently observed for clean images compared to adversarial ones, showing the effectiveness of our approach in adversarial sample detection. However, variations in performance among victim models reveal the differences in susceptibility to multimodal adversarial attacks. Notably, in the case of UniDiffuser, there is an instance (using ViT-B/32) where the average similarity score for transfer-based adversarial samples exceeds that of clean ones. This phenomenon occurs when the image encoder used for similarity calculation matches the one employed for generating adversarial samples for that victim model. However, our ensemble approach effectively mitigates such events by leveraging various image encoders, as shown in Figure 3, ensuring robustness against the adversarial attack strategy used.

**Table 2: We compare our method’s detection accuracies with baseline methods; FeatureSqueeze (FS), MagNet (MN), PuVAE (PV); which were originally proposed for classification tasks. Key Takeaway: In the VLM domain, our method outperforms the baselines in detecting adversarial samples.**
| Victim Model | Setting | CLIP Image Encoders | Baseline Detection Methods |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| \cdashline3-11 | RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ens. | FS | MN | PV |  |
| UniDiffuser | ADV-Transfer | 0.94 | 0.96 | 0.95 | 0.39 | 0.91 | 0.92 | 0.56 | 0.74 | 0.51 |
| \cdashline2-11 | ADV-Query | 0.98 | 0.95 | 0.94 | 0.93 | 0.88 | 0.97 | 0.65 | 0.85 | 0.70 |
| BLIP | ADV-Transfer | 0.90 | 0.88 | 0.84 | 0.86 | 0.80 | 0.89 | 0.52 | 0.60 | 0.50 |
| \cdashline2-11 | ADV-Query | 0.89 | 0.85 | 0.75 | 0.81 | 0.73 | 0.81 | 0.57 | 0.65 | 0.80 |
| BLIP-2 | ADV-Transfer | 0.89 | 0.93 | 0.84 | 0.90 | 0.80 | 0.90 | 0.61 | 0.73 | 0.52 |
| \cdashline2-11 | ADV-Query | 0.92 | 0.85 | 0.83 | 0.86 | 0.78 | 0.89 | 0.61 | 0.85 | 0.72 |
| Img2Prompt | ADV-Transfer | 0.79 | 0.75 | 0.69 | 0.74 | 0.69 | 0.74 | 0.51 | 0.56 | 0.50 |
| \cdashline2-11 | ADV-Query | 0.73 | 0.70 | 0.67 | 0.67 | 0.60 | 0.68 | - | 0.65 | 0.78 |
| MiniGPT-4 | ADV-Transfer | 0.63 | 0.65 | 0.65 | 0.66 | 0.66 | 0.64 | 0.54 | 0.51 | 0.53 |

**Table 3: Similarity scores using 1000 samples for each setting. We observed similar results when using 100 images. The Min and Max similarity scores show the ranges observed on all samples used for the experiment. The average shows that \ours is able to maximize the difference between clean and adversarial images for all victim models.**
| Victim Model | Setting | RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| Avg | Min | Max | Avg | Min | Max | Avg | Min | Max | Avg | Min | Max | Avg | Min | Max |  |  |
| UniDiffuser | Clean | 0.720 | 0.241 | 0.931 | 0.818 | 0.512 | 0.963 | 0.758 | 0.320 | 0.975 | 0.750 | 0.344 | 0.973 | 0.723 | 0.244 | 0.952 |
| \cdashline3-17 | ADV-Transfer | 0.414 | 0.118 | 0.872 | 0.628 | 0.434 | 0.938 | 0.515 | 0.222 | 0.852 | 0.807 | 0.426 | 0.958 | 0.516 | 0.130 | 0.820 |
| \cdashline3-17 | ADV-Query | 0.421 | 0.165 | 0.742 | 0.676 | 0.539 | 0.780 | 0.551 | 0.330 | 0.759 | 0.528 | 0.274 | 0.725 | 0.547 | 0.280 | 0.735 |
| BLIP | Clean | 0.699 | 0.162 | 0.911 | 0.804 | 0.434 | 0.953 | 0.741 | 0.247 | 0.948 | 0.723 | 0.222 | 0.945 | 0.705 | 0.126 | 0.944 |
| \cdashline3-17 | ADV-Transfer | 0.395 | 0.077 | 0.823 | 0.627 | 0.455 | 0.858 | 0.522 | 0.239 | 0.847 | 0.487 | 0.173 | 0.798 | 0.512 | 0.070 | 0.828 |
| \cdashline3-17 | ADV-Query | 0.443 | 0.165 | 0.694 | 0.679 | 0.522 | 0.81 | 0.563 | 0.276 | 0.740 | 0.534 | 0.212 | 0.750 | 0.561 | 0.277 | 0.757 |
| BLIP-2 | Clean | 0.712 | 0.151 | 0.936 | 0.813 | 0.422 | 0.965 | 0.757 | 0.248 | 0.961 | 0.737 | 0.213 | 0.946 | 0.725 | 0.189 | 0.948 |
| ADV-Transfer | 0.439 | 0.045 | 0.827 | 0.644 | 0.417 | 0.884 | 0.543 | 0.218 | 0.864 | 0.498 | 0.175 | 0.844 | 0.544 | 0.140 | 0.822 |  |
| \cdashline3-17 | ADV-Query | 0.409 | 0.124 | 0.684 | 0.668 | 0.488 | 0.791 | 0.538 | 0.316 | 0.746 | 0.519 | 0.301 | 0.721 | 0.530 | 0.249 | 0.734 |
| Img2Prompt | Clean | 0.652 | 0.212 | 0.912 | 0.775 | 0.454 | 0.946 | 0.699 | 0.297 | 0.949 | 0.684 | 0.236 | 0.93 | 0.667 | 0.151 | 0.939 |
| \cdashline3-17 | ADV-Transfer | 0.389 | 0.097 | 0.798 | 0.626 | 0.426 | 0.866 | 0.517 | 0.214 | 0.822 | 0.481 | 0.161 | 0.797 | 0.508 | 0.129 | 0.794 |
| \cdashline3-17 | ADV-Query | 0.448 | 0.116 | 0.698 | 0.683 | 0.501 | 0.820 | 0.564 | 0.316 | 0.731 | 0.536 | 0.240 | 0.761 | 0.563 | 0.270 | 0.801 |

**Table 4: Detection accuracies using 1000 samples for each setting. TPR is the proportion of actual adversarial images that are correctly identified. FPR is the proportion of clean images incorrectly identified as adversarial. Accuracy is the proportion of correctly identified images (both clean and adversarial).**
| Victim Model | Setting | RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |  |  |  |  |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| TPR | FPR | ACC | TPR | FPR | ACC | TPR | FPR | ACC | TPR | FPR | ACC | TPR | FPR | ACC | TPR | FPR | ACC |  |  |
| UniDiffuser | ADV-Transfer | 0.917 | 0.085 | 0.916 | 0.912 | 0.088 | 0.912 | 0.902 | 0.098 | 0.902 | 0.368 | 0.636 | 0.366 | 0.874 | 0.127 | 0.874 | 0.87 | 0.13 | 0.87 |
| \cdashline3-20 | ADV-Query | 0.925 | 0.075 | 0.925 | 0.871 | 0.129 | 0.871 | 0.874 | 0.125 | 0.875 | 0.889 | 0.113 | 0.888 | 0.825 | 0.174 | 0.826 | 0.895 | 0.105 | 0.895 |
| BLIP | ADV-Transfer | 0.905 | 0.096 | 0.905 | 0.894 | 0.108 | 0.893 | 0.876 | 0.126 | 0.875 | 0.887 | 0.114 | 0.887 | 0.84 | 0.159 | 0.841 | 0.898 | 0.103 | 0.898 |
| \cdashline3-20 | ADV-Query | 0.896 | 0.104 | 0.896 | 0.855 | 0.144 | 0.856 | 0.838 | 0.162 | 0.838 | 0.854 | 0.144 | 0.855 | 0.792 | 0.213 | 0.790 | 0.865 | 0.136 | 0.865 |
| BLIP-2 | ADV-Transfer | 0.882 | 0.119 | 0.882 | 0.883 | 0.117 | 0.883 | 0.873 | 0.128 | 0.873 | 0.898 | 0.102 | 0.898 | 0.835 | 0.166 | 0.835 | 0.891 | 0.111 | 0.890 |
| \cdashline3-20 | ADV-Query | 0.921 | 0.082 | 0.920 | 0.885 | 0.117 | 0.884 | 0.886 | 0.114 | 0.886 | 0.896 | 0.104 | 0.896 | 0.856 | 0.144 | 0.856 | 0.912 | 0.090 | 0.911 |
| Img2Prompt | ADV-Transfer | 0.841 | 0.160 | 0.841 | 0.833 | 0.170 | 0.832 | 0.815 | 0.185 | 0.815 | 0.838 | 0.164 | 0.837 | 0.783 | 0.216 | 0.784 | 0.834 | 0.167 | 0.8335 |
| \cdashline3-20 | ADV-Query | 0.809 | 0.195 | 0.807 | 0.759 | 0.242 | 0.7585 | 0.767 | 0.235 | 0.766 | 0.789 | 0.213 | 0.788 | 0.708 | 0.295 | 0.707 | 0.782 | 0.220 | 0.781 |

Comparing \ours detection accuracies with baseline methods. Using the similarity scores observed in Table  1 and 3, we compute the detection accuracies of our method under different settings. We selected the value of $\tau$ based on the validation set to maximize the difference between the true positive rate TPR (the proportion of actual adversarial images correctly identified) and the false positive rate FPR (the proportion of clean images incorrectly identified as adversarial), using various image encoders. Subsequently, we compared the performance of our method with baseline methods (FeatureSqueeze (Xu et al., ), MagNet (Meng and Chen, ), PuVAE (Hwang et al., )). As illustrated in Tables 2 and 4 on both 100 and 1000 samples, our method consistently outperforms baselines in detecting both transfer-based and query-based adversarial samples. Particularly noteworthy is the performance of our CLIP-based RN50 image encoder, which outshines others across all victim models used, achieving detection accuracies ranging from $73\%$ to $98\%$. We provide some visualizations in Figure 4. More visuals can be seen in Appendix D.

Figure: Figure 4: Visual results using BLIP (Victim Model) and Stable Diffusion (T2I Model). On the left are the images generated using the adversarial images+texts and on the right are the images generated using the clean images+texts.
Refer to caption: x4.png

### 4.4 Ablations

Generalization to alternative image encoders and image generation methods.
We demonstrate the versatility of \ours by testing it with different Text-to-Image (T2I) models, namely UniDiffuser (Bao et al., ) and ControlNet (Zhang et al., ). For this, we replace the Stable Diffusion T2I model in our framework with UniDiffuser’s T2I model and ControlNet, respectively. After computing similarity scores for all configurations and victim models, we employ these scores to determine detection accuracies. Our analysis reveals an overall performance enhancement, with ControlNet delivering the most promising outcomes, as seen in Figure 5. These findings prove that \ours is agnostic to the T2I model and can seamlessly be combined with various generative models for image generation. We also substitute our primary image encoder, CLIP (Radford et al., ), with alternatives from OpenCLIP (Ilharco et al., ) and ImageNet-Pretrained Classifiers (VGG16 and ResNet-50) (Simonyan and Zisserman, ; He et al., ). Subsequently, we calculate similarity scores using these image models and determine detection accuracies. Refer to Appendices C.1, C.2, and C.3 for detailed results, from Tables 8 - 18.

Figure: Figure 5: We carry out ablations to observe the performance of our approach, \ours, when we replace our baseline T2I Model (Stable Diffusion) with UniDiffuser (UD) and ControlNet (CN). We then compare our detection accuracies with baselines (Feature Squeezing (FS (Xu et al., )), MagNet (MN) (Meng and Chen, ), PuVAE (PV) (Hwang et al., )). Detailed results can be found in Appendices C.1, C.2, and C.3. Key Takeaway: Across different T2I models, \ours consistently surpasses all baseline methods.
Refer to caption: x10.png

One-Time-Use Image Encoder Results. By carefully applying noise to the weights, we ensure that the resulting encoder remains suitable for its intended purpose, facilitating accurate image similarity assessments even in the presence of perturbations. This method is particularly effective in restraining adaptive attacks, especially when the attacker has knowledge of the original weights. We demonstrate the effectiveness of our One-Time Use (OTU) approach using the CLIP ViT-B/32 image encoder. Detailed results, key observations, and conclusions from our experiments are presented in Appendix C.5 (from Tables 23-27).

**Table 5: Robustness of \ours on adversarial samples generated through adaptive attacks carried out based on the attacker’s knowledge of image encoders used in \ours pipeline. The defender employs between one and five pretrained CLIP image encoders with backbones RN50, RN101, ViT-B/16, ViT-B/32, and ViT-L/14. The attacker has knowledge of all, all but one, or all but two of these encoders, and randomly uses the remaining unknown encoders from OpenCLIP encoders.**
| Attacked Image Encoder | \ours | \ours (OTU approach) |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| ALL | ALL but ONE | ALL but TWO | ALL | ALL but ONE | ALL but TWO |  |
| ViT-B/32 | 0.55 | 0.90 | - | 0.50 | 0.90 | - |
| \cdashline1-7<br>RN50 and ViT-B/32 | 0.60 | 0.70 | 0.90 | 0.70 | 0.80 | 0.90 |
| \cdashline1-7<br>RN50, ViT-B/32, and ViT-L/14 | 0.65 | 0.65 | 0.80 | 0.75 | 0.75 | 0.80 |
| \cdashline1-7<br>RN50, ViT-B/16, ViT-B/32, and ViT-L/14 | 0.65 | 0.65 | 0.85 | 0.75 | 0.80 | 0.85 |
| \cdashline1-7<br>RN50, RN101, ViT-B/16, ViT-B/32, and ViT-L/14 | 0.75 | 0.75 | 0.85 | 0.85 | 0.90 | 0.80 |

Robustness to Adaptive Attacks. Adaptive attacks serve as a critical tool for evaluating defenses against adversarial examples, providing a dynamic and realistic assessment of a model’s robustness by analyzing how attackers adapt their strategies to bypass the proposed defense. \ours effectively shatters the continuous gradients. Then, an attacker’s objective is to generate an adversarial image ($x_{adv}=x_{in}+\delta$) by minimizing the discrepancy between its features and the target caption $t^{*}$, as outlined in the original attack pipeline (Adv-Transfer) (Zhao et al., ). Moreover, the attacker aims to reduce the disparity between the features of $x_{adv}$ and the image generated from this target caption $x_{gen}$, striving for high similarity when our detection method is applied. Furthermore, the attacker will try to maintain a continuous pipeline for the entire attack, ensuring it remains differentiable. To achieve this, they can initiate the following process: starting with the victim VLM, responsible for generating the target caption $t^{*}$, the text embeddings of this caption obtained from the victim model text encoder $\hat{\mathcal{F}}_{\theta}(x;p)\rightarrow z$ are directly fed into the image generator of the attacker generative model $\hat{G}_{\phi}(z,\eta)\rightarrow x_{gen}$. This conditioned input generates an image closely resembling the second step of our defense mechanism. To align the text embeddings between the VLM and the generative model, the attacker must train an adapter network (MLP) capable of learning this mapping. With the entire pipeline now continuous, the attacker can perturb the input image by backpropagating through the entire process. This allows them to maximize the similarity between the adversarial image $x_{adv}$ and both the target caption $t^{*}$ and the generated image $x_{gen}$. This adaptive attack is illustrated in Figure 6 and Algorithm 1, where the attacker objective function is as follows:

$$ $\displaystyle\operatorname*{arg\,min}_{\delta:\|\delta\|_{\infty}\leq\varepsilon}$ $\displaystyle\textstyle d(\tilde{\mathcal{I}}_{\phi}(x_{adv}),\tilde{\mathcal{ I}}_{\phi}(G_{\psi}(t^{*};\eta)))+\tfrac{1}{N}\textstyle{\sum}_{j=1}^{N}d( \mathcal{I}_{\phi j,\xi}(x_{adv}),\mathcal{I}_{\phi j,\xi}(\hat{G}_{\psi}( \mathcal{A}(\hat{\mathcal{F}}_{\theta}(x_{adv};p));\eta))).$ (3) $$

Given that the attacker lacks knowledge about the specific image encoder $\mathcal{I}_{\phi}$ utilized, randomized functions and Expectation over Transformation (EOT) (Athalye et al., ) techniques can be employed to obtain gradients effectively. Therefore, in the adaptive part, the attacker employs multiple random image encoders, $\mathcal{I}_{\phi j,\xi}$, in an attempt to avoid detection, where $\xi$ denotes the internal randomness of the image encoder. To execute the adaptive attack technique, we vary the assumptions about the attacker’s knowledge of the image encoders used in the defense pipeline. The defender employs between one and five pretrained CLIP image encoders from the following backbones: RN50, RN101, ViT-B/16, ViT-B/32, and ViT-L/14. The attacker may have knowledge of all, all but one, or all but two of these image encoders. When the defender uses more encoders than the attacker knows, the remaining unknown encoders are substituted with OpenCLIP encoders (see Appendix C.6). Additionally, we conduct experiments to show the performance of \ours when the defender employs the OTU approach by introducing noise into these encoders. Table 5 presents the detection accuracy for these experiments, indicating an improvement in detection accuracy when incorporating noise. The results show that using more encoders complicates the attacker’s efforts to evade detection. In summary, employing multiple encoders and integrating noise both enhance robustness against adaptive attacks by increasing the difficulty of generating undetectable adversarial samples.

In our adaptive attack scenario, we consider the most challenging condition, where the attacker has full access to both the victim model and the generative model. Additionally, we explored a simpler approach for the adaptive attack by directly using the target caption $t^{*}$ to construct $x_{gen}$ and search for an adversarial image $x_{adv}$. This image is optimized to simultaneously
minimize the discrepancy between its features and the target caption $t^{*}$, as outlined in the original attack pipeline and the disparity between the features of $x_{adv}$ and $x_{gen}$. By adding the similarity measure between the adv and gen images to the original attack using the same encoder as the attack, we observed that the attack was effective, and the similarity was indeed high between the $x_{adv}$ and $x_{gen}$. However, the adversarial image was still detected by other encoders. When we employed a different encoder for optimizing the similarity between the $x_{adv}$ and $x_{gen}$, the similarity score decreased in the original attack. This led to a compromise in the main objective of the attack. We tried averaging the similarity scores across multiple encoders. However, we found that while clean images maintained high similarity scores across all encoders, the adversarial images showed variability.

**Table 6: Adapting \ours (MC) to detect adversarial samples in image classification settings.**
| Dataset | Classifier | MC | FS | MN |
| --- | --- | --- | --- | --- |
| CIFAR10 | DenseNet | 0.93 | 0.21 | - |
| \cdashline2-5 |  |  |  |  |
|  | CNN-9 | 0.89 | - | 0.53 |
| ImageNet | MobileNet | 0.77 | 0.43 | - |

Performance of \ours for Attacks on Image Classification. Although our primary focus is on Vision-Language Models (VLMs), we adapted \ours (MC) to match the configurations used in the baseline methods (Feature Squeezing (FS) (Xu et al., ) and MagNet (MN) (Meng and Chen, )), ensuring consistency in the evaluation process. Specifically, when evaluating \ours against Feature Squeezing, we utilized the same models (DenseNet - CIFAR10 and MobileNet - ImageNet) and adversarial attack methods (FGSM and BIM) as reported in Tables 1 and 4 of (Xu et al., ) to maintain a fair comparison.
We chose to compare \ours’s performance using these two attack strategies because FS reported much lower performance on them compared to other utilized attacks. We hypothesize that this is due to the fact that FGSM and BIM are weaker attack strategies, making it more difficult for FS to detect adversarial features.

However, \ours achieved significantly better detection accuracy in both adversarial settings. We followed the same process to compare \ours with MN. The results for the FGSM setting ($\epsilon=0.002$ for FS and $\epsilon=0.01$ for MN) of both baselines, summarized in Table 6, show a significant improvement over these baselines, demonstrating the versatility of \ours in the detection of adversarial samples in various domains. Note that the empty cells in Table 6 correspond to methods for which results were not reported in the referenced papers. For instance, CNN-9 was only evaluated on CIFAR10 by MN, while MN did not provide results for DenseNet and MobileNet. Comprehensive reports and additional details are available in Appendix C.4, with detailed evaluations for Feature Squeezing and MagNet in Sections C.4.1 and C.4.2, respectively.

## 5 Discussion

The development of Vision-Language Models (VLMs) has introduced a novel paradigm that mimics human learning from everyday sensory data. Despite their perceived robustness compared to unimodal architectures, recent literature reveals that VLMs are significantly vulnerable to new attack strategies. Recognizing this vulnerability, we introduce \ours, the first approach specifically tailored to detect adversarial samples in VLMs. Our extensive experiments demonstrate its efficacy across various VLM architectures and attack scenarios. Through quantitative evaluations on datasets such as ImageNet and CIFAR10, we show that \ours outperforms in detecting both transfer-based and query-based adversarial samples. Additionally, our method showcases robustness and adaptability, effectively functioning across different Text-to-Image (T2I) models and image encoders, underscoring its real-time practical applicability in real-world scenarios.

Broader Impacts. The adaptability of \ours extends beyond VLMs to image classification tasks, where it achieves superior detection accuracies compared to well-established methods like FeatureSqueezing. These results highlight the versatility and effectiveness of our approach in safeguarding against adversarial attacks across various machine learning tasks. By enhancing the security and robustness of VLMs and other machine learning models, \ours contributes to the broader field of AI safety and reliability. Its ability to detect adversarial samples in real time opens new avenues for deploying secure and resilient AI systems in diverse applications, from autonomous driving to healthcare.

Limitations. While \ours demonstrates strong performance, its effectiveness is influenced by the quality of the pretrained generative model used to generate images from the extracted captions. Any shortcomings in the generative model can directly impact the effectiveness of \ours in detecting adversarial samples. Future research should focus on this limitation.

## Appendix A Related Work

### A.1 Visual-Language Models (VLMs)

Humans possess the remarkable ability to seamlessly integrate information from various sources concurrently. For instance, in conversations, we adeptly interpret verbal cues, body language, facial expressions, and intonation. Similarly, VLMs demonstrate proficiency in processing such multimodal signals, allowing machines to comprehend and generate image-related content that seamlessly merges visual and textual components. Contemporary VLM architectures such as CLIP [Radford et al., ] predominantly leverage transformer-based models [Vaswani et al., , Dosovitskiy et al., ] for processing both images and text due to their effectiveness in capturing long-range dependencies. At the heart of the transformers lies the multi-head attention mechanism, which plays a pivotal role in these models’ functionality.

To enable multimodal comprehension, VLMs typically comprise three key components: (i) an Image Model responsible for extracting meaningful visual features from visual data, (ii) a Text Model designed to process natural language, and (iii) a Fusion Mechanism to integrate representations from both modalities. Encoders in VLMs can be categorized based on their fusion mechanisms into Fusion encoders [Li et al., , , , Su et al., ], which directly combine image and text embeddings, Dual encoders [Radford et al., , Li et al., , , Jia et al., ], which process modalities separately before interaction, and Hybrid methods [Singh et al., , Bao et al., ] that leverage both approaches. Furthermore, fusion schemes for cross-modal interaction can be classified into single-stream [Li et al., , , Su et al., , Bao et al., , Singh et al., ] and dual-stream [Li et al., ] architectures. The recent surge in multimodal development, driven by advances in vision-language pretraining (VLP) methods, has led to diverse vision-language applications falling into three main categories: (i) Image-text tasks (such as image captioning, retrieval, and visual question answering), (ii) Core computer vision tasks (including image classification, object detection, and image segmentation), and (iii) Video-text tasks (such as video captioning, video-text retrieval, and video question-answering).

### A.2 Adversarial Attacks used for Classification

An adversarial example, within the scope of machine learning, is a sample intentionally manipulated by an adversary to provoke an incorrect output from a target classifier. Typically, in image classification tasks, where the ground truth is based on human perception, defining adversarial examples involves perturbing a correctly classified sample (referred to as the seed example) by a limited amount to generate a misclassified sample (denoted as $x_{\text{adv}}$). Existing research on adversarial example generation predominantly centers on image classification models, reflecting the prominence and vulnerability of such models to adversarial attacks. Numerous methodologies have been introduced to craft adversarial examples, encompassing fast gradient-based techniques [Goodfellow et al., , Liu et al., ], optimization-based strategies [Szegedy et al., , Carlini and Wagner, ], and other innovative approaches [Nguyen et al., , Papernot et al., ]. Notably, [Carlini and Wagner, ] introduced state-of-the-art attacks that impose constraints on L0, L2, and L∞ norms, highlighting the versatility and effectiveness of adversarial attacks across various norm spaces.

Adversarial examples can be categorized as targeted or untargeted depending on the adversary’s objective. In targeted attacks, the adversary aims for the perturbed sample $x_{\text{adv}}$ to be classified as a specific class, while in untargeted attacks, the objective is for $x_{\text{adv}}$ to be classified as any class other than its correct class.

Formally, a targeted adversary seeks to find an $x_{\text{adv}}$ such that the target classifier assigns it to the target class $y$ while remaining within a certain distance $\epsilon$ from the original sample $x_{\text{clean}}$. Conversely, an untargeted adversary aims to find an $x_{\text{adv}}$ which is misclassified compared to the original $x_{\text{clean}}$ within the same distance threshold $\epsilon$. The adversary’s strength, denoted as $\epsilon$, restricts the allowable transformations applied to the seed example. In contrast, the distance metric $\Delta(x_{\text{clean}},x_{\text{adv}})$ and the threshold $\epsilon$ model how close an adversarial example needs to be to the original to deceive a human observer. As specified in Section 2, we will introduce some attack strategies used in classification tasks. We also leverage these attacks to test the efficacy of \ours in this setting;

- •
Fast Gradient Sign Method (FGSM, $L_{\infty}$, Untargeted): The Fast Gradient Sign Method (FGSM) is an adversarial attack technique proposed by Goodfellow et al. [Goodfellow et al., ] that efficiently generates adversarial examples for deep neural networks (DNNs). The objective of the FGSM attack is to perturb input data in such a way that it induces misclassification by the target model while ensuring the perturbations are imperceptible to human observers. The main idea behind FGSM is to compute the gradient of the loss function with respect to the input data, and then perturb the input data in the direction that maximizes the loss. Specifically, FGSM calculates the gradient of the loss function with respect to the input data, and then scales the gradient by a small constant $\epsilon$ to determine the perturbation direction. This perturbation is added to the original input data to create the adversarial example. Mathematically, the FGSM perturbation is defined as:
$x_{\text{adv}}=x_{\text{clean}}+\epsilon\cdot\text{sign}(\nabla_{x}J(w^{T}x_{
\text{clean}}),y))$
where $\epsilon$ is a small constant controlling the magnitude of the perturbation, and sign denotes the sign function. The objective function of the FGSM attack is typically the cross-entropy loss between the predicted and true labels, as it aims to maximize the model’s prediction error for the given input.
- •
Basic Iterative Method (BIM, $L_{\infty}$, Untargeted): The Basic Iterative Method (BIM) attack [Feinman et al., ], also known as the Iterative Fast Gradient Sign Method (IFGSM), is an iterative variant of the FGSM attack designed to generate stronger adversarial examples. Like FGSM, the objective of the BIM attack is to craft adversarial perturbations that lead to misclassification by the target model while remaining imperceptible to human observers. In the BIM attack, instead of generating a single perturbation in one step, multiple small perturbations are iteratively applied to the input data. This iterative approach allows for finer control over the perturbation process, resulting in adversarial examples that are more effective and harder for the target model to defend against. The BIM attack starts with the original input data and applies small perturbations in the direction of the gradient of the loss function with respect to the input data. After each iteration, the perturbed input data is clipped to ensure it remains within a small $\epsilon$-ball around the original input. This process is repeated for a fixed number of iterations or until a stopping criterion is met. Mathematically, the perturbed input at each iteration $s$ of the BIM attack is given by:
$x_{\text{adv}}^{s}=\text{clip}_{\epsilon}(x_{\text{adv}}^{s-1}+\alpha\cdot
\text{sign}(\nabla_{x}J(w^{T}x_{\text{clean}}),y))$
where $\text{Clip}_{\epsilon}$ denotes element-wise clipping to ensure the perturbation magnitude does not exceed $\epsilon$, and $\alpha$ is a small step size controlling the magnitude of each perturbation. The BIM attack aims to maximize the loss function while ensuring the perturbations remain bounded within the $\epsilon$-ball around the original input.
- •
DeepFool ($L_{2}$, Untargeted): The DeepFool attack [Moosavi-Dezfooli et al., ] is an iterative and computationally efficient method for crafting adversarial examples. It operates by iteratively perturbing an input image in a direction that minimally changes the model’s prediction. The objective of the DeepFool attack is to find the smallest perturbation that causes a misclassification while ensuring that the adversarial example remains close to the original input in terms of the $L_{2}$-norm. The DeepFool attack starts with the original input image and iteratively computes the perturbation required to push the image across the decision boundary of the model. It computes the gradient of the decision function with respect to the input and then finds the direction in which the decision boundary moves the most. By iteratively applying small perturbations in this direction, the DeepFool attack gradually moves the input image towards the decision boundary until it crosses it. Mathematically, the perturbed input at each iteration of the DeepFool attack is computed as follows:
$x_{\text{adv}}^{s}=x_{\text{adv}}^{s-1}+\alpha\cdot\frac{\nabla_{\text{f}}(x_{
\text{clean}})}{\|\nabla_{\text{f}}(x_{\text{clean}})\|}_{2}$
where $x_{\text{adv}}^{s-1}$ is the input image at the current iteration $s$, $\alpha$ is a small step size, and $\nabla_{\text{f}}(x)$ is the gradient of the decision function with respect to the input image $x_{\text{clean}}$. The process continues until the model misclassifies the perturbed input or until a maximum number of iterations is reached.
- •
Projected Gradient Descent (PGD, $L_{2}$, Untargeted): The Projected Gradient Descent (PGD) attack [Madry et al., ] is an advanced iterative method used for crafting adversarial examples. It builds upon the Basic Iterative Method (BIM), extending it by continuing the perturbation process until reaching a specified maximum perturbation magnitude. The objective of the PGD attack is to find the smallest perturbation that leads to misclassification while constraining the perturbed example to remain within a specified $L_{p}$-norm distance from the original input. The PGD attack starts with the original input image and iteratively computes the perturbation required to induce misclassification. At each iteration, it calculates the gradient of the loss function with respect to the input and applies a small step in the direction that maximizes the loss while ensuring the perturbed example remains within the specified $L_{p}$-norm ball around the original input. This process continues for a predetermined number of iterations or until a misclassification is achieved. Mathematically, the perturbed input at each iteration of the PGD attack is computed as follows:
$x_{\text{adv}}^{s}=\text{clip}(x_{\text{adv}}^{s-1}+\alpha\cdot\text{sign}(
\nabla_{\text{x}}J(w^{T}x_{\text{clean}}),y),x_{\text{adv}}-\epsilon,x_{\text{
adv}}+\epsilon)$
where $x_{\text{adv}}^{t-1}$ is the input image at the current iteration $t$, $\alpha$ is the step size, $\nabla_{\text{x}}J(w^{T}x_{\text{clean}},y)$ is the gradient of the loss function with respect to the input image $x_{\text{clean}}$, and clip function ensures that the perturbed image remains within a specified range defined by the lower and upper bounds.
- •
Carlini-Wagner (C&W, $L_{2}$, Untargeted): The Carlini-Wagner (C&W) attack [Carlini and Wagner, ], introduced by Carlini and Wagner in 2017, is a powerful optimization-based method for crafting adversarial examples. Unlike many other attack methods that focus on adding imperceptible perturbations to input data, the C&W attack formulates the attack as an optimization problem aimed at finding the smallest perturbation that leads to misclassification while satisfying certain constraints. The objective of the C&W attack is to find a perturbation $\delta$ that minimizes a combination of the perturbation magnitude and a loss function, subject to various constraints. The loss function is typically designed to encourage misclassification while penalizing large perturbations. The constraints ensure that the perturbed example remains within a specified $L_{p}$-norm distance from the original input and maintains perceptual similarity. The objective function of the C&W attack can be formulated as follows:
$\min\|\delta\|_{l}+c\cdot f(x_{\text{clean}}+\delta)$
where $\|\delta\|_{l}$ represents the $L_{l}$-norm of the perturbation, $f(x_{\text{clean}}+\delta)$ is the loss function representing misclassification, and $c$ is a regularization parameter that balances the trade-off between the perturbation magnitude and the loss function.

## Appendix B \ours as an Autoencoder

In the auto-encoder literature, reconstruction error has been shown to be a reliable indicator of whether a sample is in or out of the training distribution [Zhou, , Durasov et al., , ]. We now cast \ours as a particular kind of auto-encoder to leverage these results and justify our approach. \ours can be conceptualized within the structure of regular [Hinton and Salakhutdinov, , Vincent et al., , Makhzani et al., ] and Variational Autoencoders (VAEs) [Kingma and Welling, , Burda et al., , Higgins et al., ], which typically encode input data into a continuous latent space through an encoder and reconstruct the input using a decoder. Unlike typical variational-autoencoders, \ours relies on a discrete, categorical latent space comprising textual descriptions generated from images. In this respect, it is in line with recent VAEs that incorporate categorical latent variables through mechanisms such as the Gumbel-Softmax distribution [Maddison et al., , Jang et al., , Baevski et al., , Sadhu et al., , Gangloff et al., ].

The Image-to-Text phase of \ours acts as the encoder, mapping high-dimensional visual data into a discrete latent space represented by text. This process can be mathematically expressed as

$$ $q_{\phi}(\mathbf{z}|\mathbf{x})=\text{Cat}(\mathbf{z};\bm{\pi}(\mathbf{x}))\;,$ (4) $$

where $\mathbf{x}$ is the input image, $\mathbf{z}$ represents the latent textual description, Cat denotes the categorical distribution, and $\bm{\pi}(\mathbf{x})$ is the distribution over the discrete latent variables conditioned on the input image, parameterized by $\phi$.

The Text-to-Image phase serves as the decoder. It reconstructs the visual data from these textual descriptions. It can be written as

$$ $p_{\theta}(\mathbf{x}|\mathbf{z})=\text{Bernoulli}(\mathbf{x};\bm{\sigma}( \mathbf{z})),$ (5) $$

where $\bm{\sigma}(\mathbf{z})$ models the probability of generating an image $\mathbf{x}$ from the latent description $\mathbf{z}$, parameterized by $\theta$. When sampling caption text with a non-zero softmax temperature, these steps resemble the Gumbel-Softmax reparameterization trick, typically used in Variational Autoencoders (VAEs) to sample from the latent [Maddison et al., , Jang et al., ].

Thus, using the reconstruction error as an indication of whether an input has been compromised via an adversarial attack is as justified as using it to determine if a sample is out-of-distribution when employing a VAE. This aligns with earlier work [Meng and Chen, , Pu et al., ] that showed that this metric is good at detecting adversarial attacks. It is also in the same spirit as approaches to detecting anomalies through segmentation and reconstruction  [Lis et al., , ].

Computational Efficiency. Our experiments were carried out on a machine equipped with 80 CPUs and one NVIDIA Quadro RTX A6000 48GB GPU. The entire defense pipeline takes approximately 15 seconds per image. Within this process, obtaining a caption from the victim VLM model takes around 0.2 seconds, generating an image takes about 5 seconds, and calculating similarity requires approximately 10 seconds. However, this is the worst case scenario and there are multiple methods to improve this time.

## Appendix C Additional Empirical Results

### C.1 Similarity Scores and Detection Accuracies using CLIP Image Encoders

Rather than using Stable Diffusion in \ours, we leverage UniDiffuser T2I model [Bao et al., ] and ControlNet [Zhang et al., ]. Key Takeaway: We observe better accuracies using UniDiffuser, compared to using Stable Diffusion. We also observe better accuracies using ControlNet, compared to using Stable Diffusion, and slightly better overall accuracies compared to UniDiffuser. Tables 7 and 9 show the similarities when using UniDiffuser-T2I [Bao et al., ] and ControlNet [Zhang et al., ] for image generation and the CLIP models for evaluation, while Tables 8 and 10 show the detection accuracies.

**Table 7: Similarity: UniDiffuser + CLIP.**
| Victim Model | Setting | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | Clean | 0.737 | 0.826 | 0.769 | 0.764 | 0.721 | 0.763 |
| \cdashline2-8 | ADV-Transfer | 0.408 | 0.617 | 0.501 | 0.765 | 0.486 | 0.555 |
| \cdashline2-8 | ADV-Query | 0.396 | 0.659 | 0.526 | 0.508 | 0.520 | 0.522 |
| BLIP [Li et al., ] | Clean | 0.713 | 0.806 | 0.742 | 0.730 | 0.685 | 0.735 |
| \cdashline2-8 | ADV-Transfer | 0.375 | 0.609 | 0.500 | 0.466 | 0.480 | 0.486 |
| \cdashline2-8 | ADV-Query | 0.417 | 0.656 | 0.529 | 0.503 | 0.526 | 0.526 |
| BLIP-2 [Li et al., ] | Clean | 0.732 | 0.823 | 0.764 | 0.759 | 0.720 | 0.760 |
| \cdashline2-8 | ADV-Transfer | 0.425 | 0.627 | 0.533 | 0.491 | 0.517 | 0.519 |
| \cdashline2-8 | ADV-Query | 0.390 | 0.652 | 0.511 | 0.506 | 0.510 | 0.514 |
| Img2Prompt [Guo et al., ] | Clean | 0.663 | 0.780 | 0.703 | 0.689 | 0.660 | 0.699 |
| \cdashline2-8 | ADV-Transfer | 0.369 | 0.607 | 0.494 | 0.457 | 0.474 | 0.480 |
| \cdashline2-8 | ADV-Query | 0.417 | 0.656 | 0.522 | 0.502 | 0.525 | 0.525 |
| MiniGPT-4 [Zhu et al., ] | Clean | 0.599 | 0.737 | 0.646 | 0.641 | 0.610 | 0.646 |
| \cdashline2-8 | ADV-Transfer | 0.507 | 0.678 | 0.570 | 0.540 | 0.524 | 0.564 |

**Table 8: Detection: UniDiffuser + CLIP.**
| Victim Model | Setting | CLIP Image Encoders |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | ADV-Transfer | 0.935 | 0.910 | 0.910 | 0.470 | 0.910 | 0.827 |
| \cdashline2-8 | ADV-Query | 0.960 | 0.905 | 0.900 | 0.920 | 0.865 | 0.909 |
| BLIP [Li et al., ] | ADV-Transfer | 0.915 | 0.910 | 0.915 | 0.920 | 0.845 | 0.901 |
| \cdashline2-8 | ADV-Query | 0.920 | 0.880 | 0.900 | 0.915 | 0.820 | 0.887 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.915 | 0.930 | 0.885 | 0.935 | 0.860 | 0.905 |
| \cdashline2-8 | ADV-Query | 0.950 | 0.910 | 0.920 | 0.930 | 0.860 | 0.914 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.885 | 0.870 | 0.830 | 0.885 | 0.810 | 0.856 |
| \cdashline2-8 | ADV-Query | 0.845 | 0.810 | 0.805 | 0.830 | 0.775 | 0.813 |

**Table 9: Similarity: ControlNet + CLIP.**
| Victim Model | Setting | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | Clean Image | 0.747 | 0.839 | 0.768 | 0.758 | 0.731 | 0.769 |
| \cdashline2-8 | ADV-Transfer | 0.410 | 0.621 | 0.514 | 0.554 | 0.514 | 0.523 |
| \cdashline2-8 | ADV-Query | 0.440 | 0.663 | 0.555 | 0.522 | 0.519 | 0.540 |
| BLIP [Li et al., ] | Clean Image | 0.747 | 0.840 | 0.770 | 0.769 | 0.728 | 0.770 |
| \cdashline2-8 | ADV-Transfer | 0.398 | 0.625 | 0.526 | 0.494 | 0.511 | 0.511 |
| \cdashline2-8 | ADV-Query | 0.466 | 0.689 | 0.575 | 0.527 | 0.565 | 0.564 |
| BLIP-2 [Li et al., ] | Clean Image | 0.751 | 0.844 | 0.774 | 0.766 | 0.735 | 0.774 |
| \cdashline2-8 | ADV-Transfer | 0.388 | 0.623 | 0.526 | 0.493 | 0.512 | 0.508 |
| \cdashline2-8 | ADV-Query | 0.463 | 0.684 | 0.571 | 0.522 | 0.565 | 0.561 |
| Img2Prompt [Guo et al., ] | Clean Image | 0.661 | 0.780 | 0.712 | 0.695 | 0.670 | 0.703 |
| \cdashline2-8 | ADV-Transfer | 0.400 | 0.626 | 0.532 | 0.497 | 0.514 | 0.514 |
|  | ADV-Query | 0.463 | 0.685 | 0.569 | 0.534 | 0.569 | 0.564 |

**Table 10: Detection: ControlNet + CLIP.**
| Victim Model | Setting | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuse [Bao et al., ] | ADV-Transfer | 0.935 | 0.980 | 0.925 | 0.895 | 0.920 | 0.931 |
| \cdashline2-8 | ADV-Query | 0.945 | 0.965 | 0.880 | 0.920 | 0.880 | 0.918 |
| BLIP [Li et al., ] | ADV-Transfer | 0.955 | 0.965 | 0.880 | 0.945 | 0.880 | 0.925 |
| \cdashline2-8 | ADV-Query | 0.940 | 0.905 | 0.870 | 0.925 | 0.830 | 0.894 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.935 | 0.950 | 0.905 | 0.930 | 0.900 | 0.924 |
| \cdashline2-8 | ADV-Query | 0.915 | 0.910 | 0.880 | 0.890 | 0.850 | 0.889 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.965 | 0.940 | 0.900 | 0.950 | 0.890 | 0.929 |
| \cdashline2-8 | ADV-Query | 0.950 | 0.895 | 0.860 | 0.915 | 0.800 | 0.884 |

### C.2 Similarity Scores and Detection Accuracies using ImageNet-Pretrained Classifiers

We calculated detection accuracies (Table 12 using similarity scores (Table 11) gotten from different T2I models (Stable Diffusion [Rombach et al., ], UniDiffuser-T2I [Bao et al., ], and ControlNet [Zhang et al., ]) and ImageNet-Pretrained Classifiers for evaluation. Key Takeaway: \ours maintains the best performances compared to baselines in Table 2.

**Table 11: Similarity: (Stable Diffusion, UniDiffuser, ControlNet) + ImageNet-Pretrained Classifiers.**
| Victim Model | Setting | Stable Diffusion [Rombach et al., ] | UniDiffuser [Bao et al., ] | ControlNet [Zhang et al., ] |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| \cdashline3-8 | ResNet-50 | VGG16 | ResNet-50 | VGG16 | ResNet-50 | VGG16 |  |
| UniDiffuser [Bao et al., ] | Clean | 0.595 | 0.666 | 0.618 | 0.689 | 0.561 | 0.604 |
| \cdashline2-8 | ADV-Transfer | 0.155 | 0.174 | 0.140 | 0.161 | 0.134 | 0.143 |
| \cdashline2-8 | ADV-Query | 0.207 | 0.190 | 0.192 | 0.185 | 0.222 | 0.178 |
| BLIP [Li et al., ] | Clean | 0.574 | 0.647 | 0.591 | 0.661 | 0.552 | 0.601 |
| \cdashline2-8 | ADV-Transfer | 0.138 | 0.146 | 0.116 | 0.135 | 0.137 | 0.124 |
| \cdashline2-8 | ADV-Query | 0.178 | 0.152 | 0.150 | 0.135 | 0.187 | 0.173 |
| BLIP-2 [Li et al., ] | Clean Image | 0.608 | 0.677 | 0.633 | 0.695 | 0.563 | 0.601 |
| \cdashline2-8 | ADV-Transfer | 0.155 | 0.179 | 0.156 | 0.184 | 0.112 | 0.128 |
| \cdashline2-8 | ADV-Query | 0.226 | 0.156 | 0.193 | 0.148 | 0.197 | 0.148 |
| Img2Prompt [Guo et al., ] | Clean | 0.538 | 0.597 | 0.535 | 0.605 | 0.528 | 0.575 |
| \cdashline2-8 | ADV-Transfer | 0.117 | 0.124 | 0.124 | 0.128 | 0.137 | 0.150 |
| \cdashline2-8 | ADV-Query | 0.188 | 0.157 | 0.162 | 0.146 | 0.179 | 0.138 |

**Table 12: Detection: (Stable Diffusion, UniDiffuser, ControlNet) + ImageNet-Pretrained Classifiers.**
| Victim Model | Setting | Stable Diffusion [Rombach et al., ] | UniDiffuser [Bao et al., ] | ControlNet [Zhang et al., ] |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| \cdashline3-8 | ResNet-50 | VGG16 | ResNet-50 | VGG16 | ResNet-50 | VGG16 |  |
| UniDiffuser [Bao et al., ] | ADV-Transfer | 0.830 | 0.835 | 0.885 | 0.855 | 0.855 | 0.850 |
| \cdashline2-8 | ADV-Query | 0.870 | 0.910 | 0.875 | 0.920 | 0.835 | 0.855 |
| BLIP [Li et al., ] | ADV-Transfer | 0.870 | 0.870 | 0.865 | 0.850 | 0.840 | 0.825 |
| \cdashline2-8 | ADV-Query | 0.860 | 0.895 | 0.865 | 0.915 | 0.845 | 0.860 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.865 | 0.865 | 0.895 | 0.880 | 0.870 | 0.845 |
| \cdashline2-8 | ADV-Query | 0.855 | 0.915 | 0.910 | 0.940 | 0.830 | 0.855 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.825 | 0.835 | 0.865 | 0.875 | 0.850 | 0.815 |
| \cdashline2-8 | ADV-Query | 0.820 | 0.870 | 0.840 | 0.850 | 0.825 | 0.865 |

### C.3 Similarity Scores using OpenCLIP Image Encoders

We calculate detection accuracies for Stable Diffusion (Table 14), UniDiffuser (Table 16), and ControlNet (Table 18) using their respective similarity scores (Tables 13, 15, 17) and the OpenCLIP [Ilharco et al., ] Image Encoders. Key Takeaway: We observe better overall detection accuracies on query-based adversarial samples, compared to when using ControlNet+CLIP (Table 10). Generally, \ours maintains its SOTA detection performance, proving that our approach is agnostic to the choice of T2I models and Image Encoders.

**Table 13: Similarity: Stable Diffusion + OpenCLIP.**
| Victim Model | Setting | OpenCLIP Image Encoders |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | Clean Image | 0.525 | 0.537 | 0.618 | 0.641 | 0.579 | 0.580 |
| \cdashline2-8 | ADV-Transfer | 0.218 | 0.232 | 0.296 | 0.377 | 0.253 | 0.275 |
| \cdashline2-8 | ADV-Query | 0.193 | 0.177 | 0.226 | 0.296 | 0.111 | 0.200 |
| BLIP [Li et al., ] | Clean Image | 0.505 | 0.518 | 0.598 | 0.620 | 0.551 | 0.558 |
| \cdashline2-8 | ADV-Transfer | 0.209 | 0.216 | 0.272 | 0.330 | 0.235 | 0.252 |
| \cdashline2-8 | ADV-Query | 0.215 | 0.196 | 0.237 | 0.311 | 0.142 | 0.220 |
| BLIP-2 [Li et al., ] | Clean Image | 0.512 | 0.534 | 0.628 | 0.649 | 0.591 | 0.583 |
| \cdashline2-8 | ADV-Transfer | 0.221 | 0.231 | 0.294 | 0.350 | 0.265 | 0.272 |
| \cdashline2-8 | ADV-Query | 0.199 | 0.175 | 0.227 | 0.309 | 0.122 | 0.207 |
| Img2Prompt [Guo et al., ] | Clean Image | 0.450 | 0.468 | 0.543 | 0.578 | 0.494 | 0.507 |
| \cdashline2-8 | ADV-Transfer | 0.201 | 0.209 | 0.266 | 0.328 | 0.226 | 0.246 |
| \cdashline2-8 | ADV-Query | 0.217 | 0.199 | 0.227 | 0.306 | 0.130 | 0.216 |

**Table 14: Detection: Stable Diffusion + OpenCLIP.**
| Victim Model | Setting | OpenCLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | ADV-Transfer | 0.925 | 0.920 | 0.925 | 0.910 | 0.900 | 0.916 |
| \cdashline2-8 | ADV-Query | 0.940 | 0.950 | 0.980 | 0.970 | 0.990 | 0.966 |
| BLIP [Li et al., ] | ADV-Transfer | 0.905 | 0.925 | 0.930 | 0.895 | 0.890 | 0.909 |
| \cdashline2-8 | ADV-Query | 0.905 | 0.940 | 0.955 | 0.920 | 0.975 | 0.939 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.915 | 0.915 | 0.920 | 0.915 | 0.920 | 0.917 |
| \cdashline2-8 | ADV-Query | 0.935 | 0.960 | 0.970 | 0.960 | 0.970 | 0.959 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.830 | 0.820 | 0.885 | 0.890 | 0.810 | 0.847 |
| \cdashline2-8 | ADV-Query | 0.815 | 0.835 | 0.900 | 0.880 | 0.930 | 0.872 |

**Table 15: Similarity: UniDiffuser + OpenCLIP.**
| Victim Model | Setting | OpenCLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | Clean | 0.531 | 0.547 | 0.636 | 0.659 | 0.578 | 0.590 |
| \cdashline2-8 | ADV-Transfer | 0.202 | 0.209 | 0.290 | 0.371 | 0.250 | 0.264 |
| \cdashline2-8 | ADV-Query | 0.190 | 0.183 | 0.228 | 0.297 | 0.104 | 0.200 |
| BLIP [Li et al., ] | Clean | 0.512 | 0.522 | 0.596 | 0.627 | 0.539 | 0.559 |
| \cdashline2-8 | ADV-Transfer | 0.189 | 0.203 | 0.271 | 0.326 | 0.232 | 0.244 |
| \cdashline2-8 | ADV-Query | 0.194 | 0.183 | 0.229 | 0.293 | 0.130 | 0.206 |
| BLIP 2 [Li et al., ] | Clean | 0.529 | 0.539 | 0.625 | 0.652 | 0.577 | 0.584 |
| \cdashline2-8 | ADV-Transfer | 0.196 | 0.208 | 0.299 | 0.353 | 0.264 | 0.264 |
| \cdashline2-8 | ADV-Query | 0.178 | 0.172 | 0.223 | 0.300 | 0.112 | 0.197 |
| Img2Prompt [Guo et al., ] | Clean | 0.447 | 0.464 | 0.532 | 0.563 | 0.469 | 0.495 |
| \cdashline2-8 | ADV-Transfer | 0.185 | 0.194 | 0.252 | 0.316 | 0.207 | 0.231 |
| \cdashline2-8 | ADV-Query | 0.198 | 0.189 | 0.226 | 0.293 | 0.124 | 0.206 |

**Table 16: Detection: UniDiffuser + OpenCLIP.**
| Victim Model | Setting | OpenCLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | ADV-Transfer | 0.925 | 0.940 | 0.920 | 0.900 | 0.910 | 0.919 |
| \cdashline2-8 | ADV-Query | 0.940 | 0.940 | 0.975 | 0.990 | 0.980 | 0.965 |
| BLIP [Li et al., ] | ADV-Transfer | 0.935 | 0.960 | 0.930 | 0.945 | 0.900 | 0.934 |
| \cdashline2-8 | ADV-Query | 0.960 | 0.965 | 0.965 | 0.950 | 0.970 | 0.962 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.930 | 0.930 | 0.945 | 0.930 | 0.910 | 0.929 |
| \cdashline2-8 | ADV-Query | 0.950 | 0.960 | 0.965 | 0.965 | 0.995 | 0.967 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.870 | 0.855 | 0.885 | 0.840 | 0.875 | 0.865 |
| \cdashline2-8 | ADV-Query | 0.865 | 0.875 | 0.890 | 0.875 | 0.935 | 0.888 |

**Table 17: Similarity: ControlNet + OpenCLIP.**
| Victim Model | Setting | OpenCLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | Clean | 0.531 | 0.542 | 0.623 | 0.647 | 0.583 | 0.585 |
| ADV-Transfer | 0.221 | 0.237 | 0.303 | 0.382 | 0.251 | 0.279 |  |
| \cdashline2-8 | ADV-Query | 0.203 | 0.183 | 0.235 | 0.304 | 0.225 | 0.230 |
| BLIP [Li et al., ] | Clean | 0.512 | 0.519 | 0.601 | 0.615 | 0.555 | 0.560 |
| \cdashline2-8 | ADV-Transfer | 0.215 | 0.221 | 0.274 | 0.327 | 0.235 | 0.254 |
| \cdashline2-8 | ADV-Query | 0.213 | 0.121 | 0.231 | 0.318 | 0.203 | 0.233 |
| BLIP-2 [Li et al., ] | Clean | 0.531 | 0.544 | 0.646 | 0.660 | 0.606 | 0.597 |
| \cdashline2-8 | ADV-Transfer | 0.231 | 0.237 | 0.303 | 0.358 | 0.285 | 0.283 |
| \cdashline2-8 | ADV-Query | 0.208 | 0.184 | 0.233 | 0.313 | 0.194 | 0.226 |
| Img2Prompt [Guo et al., ] | Clean | 0.467 | 0.475 | 0.573 | 0.604 | 0.519 | 0.528 |
| \cdashline2-8 | ADV-Transfer | 0.203 | 0.210 | 0.278 | 0.321 | 0.243 | 0.251 |
| \cdashline2-8 | ADV-Query | 0.212 | 0.196 | 0.228 | 0.301 | 0.193 | 0.226 |

**Table 18: Detection: ControlNet + OpenCLIP.**
| Victim Model | Setting | OpenClip Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser [Bao et al., ] | ADV-Transfer | 0.900 | 0.825 | 0.930 | 0.845 | 0.935 | 0.893 |
| \cdashline2-8 | ADV-Query | 0.930 | 0.940 | 0.955 | 0.900 | 0.960 | 0.937 |
| BLIP [Li et al., ] | ADV-Transfer | 0.920 | 0.960 | 0.955 | 0.945 | 0.985 | 0.953 |
| \cdashline2-8 | ADV-Query | 0.925 | 0.965 | 0.970 | 0.970 | 0.980 | 0.962 |
| BLIP-2 [Li et al., ] | ADV-Transfer | 0.975 | 0.990 | 0.990 | 0.985 | 0.965 | 0.981 |
| \cdashline2-8 | ADV-Query | 0.995 | 0.995 | 0.990 | 0.990 | 0.980 | 0.990 |
| Img2Prompt [Guo et al., ] | ADV-Transfer | 0.950 | 0.910 | 0.935 | 0.995 | 0.945 | 0.947 |
| \cdashline2-8 | ADV-Query | 0.955 | 0.925 | 0.935 | 0.995 | 0.995 | 0.961 |

### C.4 Adapting \ours for Classification Tasks

#### C.4.1 \ours vs FeatureSqueezing

We implement MirrorCheck on DenseNet [Iandola et al., ] trained on CIFAR10 and MobileNet [Sandler et al., ] trained on ImageNet datasets, following the configurations and hyperparameters outlined in FeatureSqueeze [Xu et al., ]. The classifiers are subjected to adversarial attacks using FGSM [Huang et al., ] and BIM [Kurakin et al., ] strategies. To adapt MirrorCheck for comparison with FeatureSqueeze, we input $x_{in}$ into the classifier $f_{\theta}(\cdot)$, extract the predicted class name using argmax, and generate an image using either Stable Diffusion or ControlNet. Subsequently, we compute similarity scores and detection results. Table 19 shows classification similarities using Stable Diffusion and ControlNet for image generation and the CLIP Image Encoders for evaluation. Comparing our results in Table 20 with the best reported outcomes from various FeatureSqueezing configurations—Bit Depth, Median Smoothing, Non-Local Mean, and Best Joint Detection—we observe significant improvements. On CIFAR10 with DenseNet, our best setting achieves a detection accuracy of 91.5% against FGSM adversarial samples, compared to FeatureSqueeze’s 20.8%. Similarly, for BIM samples, our approach achieves an accuracy of 87% compared to FeatureSqueeze’s 55%. For ImageNet with MobileNet, our approach also outperforms FeatureSqueeze. Against FGSM samples, our best setting achieves a detection accuracy of 76.5% compared to FeatureSqueeze’s 43.4%, and for BIM samples, it achieves 79.5% compared to FeatureSqueeze’s 64.4%.

**Table 19: Classification Similarity: (Stable Diffusion and ControlNet) + CLIP Image Encoders.**
| Classifier | Setting | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| DenseNet-CIFAR10 | Clean-CN | 0.607 | 0.761 | 0.729 | 0.697 | 0.690 | 0.697 |
| \cdashline2-8 | ADV-FGSM-CN | 0.571 | 0.729 | 0.650 | 0.625 | 0.594 | 0.634 |
| \cdashline2-8 | ADV-BIM-CN | 0.614 | 0.750 | 0.652 | 0.649 | 0.606 | 0.654 |
|  | Clean Image-SD | 0.543 | 0.740 | 0.705 | 0.671 | 0.674 | 0.667 |
| \cdashline2-8 | ADV-FGSM-SD | 0.444 | 0.666 | 0.572 | 0.537 | 0.548 | 0.553 |
| \cdashline2-8 | ADV-BIM-SD | 0.507 | 0.713 | 0.593 | 0.554 | 0.532 | 0.579 |
| MobileNet-ImageNet | Clean-CN | 0.659 | 0.786 | 0.731 | 0.715 | 0.711 | 0.720 |
| \cdashline2-8 | ADV-FGSM-CN | 0.578 | 0.744 | 0.632 | 0.634 | 0.599 | 0.617 |
| \cdashline2-8 | ADV-BIM-CN | 0.540 | 0.718 | 0.595 | 0.601 | 0.558 | 0.602 |
|  | Clean Image-SD | 0.668 | 0.790 | 0.729 | 0.704 | 0.705 | 0.719 |
| \cdashline2-8 | ADV-FGSM-SD | 0.520 | 0.712 | 0.606 | 0.612 | 0.585 | 0.607 |
| \cdashline2-8 | ADV-BIM-SD | 0.503 | 0.693 | 0.581 | 0.565 | 0.538 | 0.576 |

**Table 20: Detection Accuracy: \ours vs FeatureSqueezing.**
| Classifier | Dataset | Defense Method | Configuration | Attack Setting |  |
| --- | --- | --- | --- | --- | --- |
| \cdashline5-6 | FGSM | BIM |  |  |  |
| DenseNet | CIFAR10 | FeatureSqueezing | Bit Depth | 0.125 | 0.250 |
| \cdashline4-6 | Median Smoothing | 0.188 | 0.550 |  |  |
| \cdashline4-6 | Non-Local Mean | 0.167 | 0.525 |  |  |
| \cdashline4-6 | Joint Detection | 0.208 | 0.550 |  |  |
|  | \ours (Using SD) | RN50 | 0.795 | 0.620 |  |
| \cdashline4-6 | RN101 | 0.825 | 0.595 |  |  |
| \cdashline4-6 | ViT-B/16 | 0.860 | 0.845 |  |  |
| \cdashline4-6 | ViT-B/32 | 0.915 | 0.850 |  |  |
| \cdashline4-6 | ViT-L/14 | 0.850 | 0.870 |  |  |
| \cdashline4-6 |  | Ensemble | 0.925 | 0.810 |  |
|  | \ours (Using CN) | RN50 | 0.630 | 0.450 |  |
| \cdashline4-6 | RN101 | 0.650 | 0.550 |  |  |
| \cdashline4-6 | ViT-B/16 | 0.750 | 0.725 |  |  |
| \cdashline4-6 | ViT-B/32 | 0.740 | 0.660 |  |  |
| \cdashline4-6 | ViT-L/14 | 0.800 | 0.760 |  |  |
| \cdashline4-6 |  |  | Ensemble | 0.760 | 0.685 |
| MobileNet | ImageNet | FeatureSqueezing | Bit Depth | 0.151 | 0.556 |
| \cdashline4-6 | Median Smoothing | 0.358 | 0.444 |  |  |
| \cdashline4-6 | Non-Local Mean | 0.226 | 0.467 |  |  |
| \cdashline4-6 | Joint Detection | 0.434 | 0.644 |  |  |
|  | \ours (Using SD) | RN50 | 0.745 | 0.755 |  |
| \cdashline4-6 | RN101 | 0.680 | 0.720 |  |  |
| \cdashline4-6 | ViT-B/16 | 0.715 | 0.775 |  |  |
| \cdashline4-6 | ViT-B/32 | 0.710 | 0.755 |  |  |
| \cdashline4-6 | ViT-L/14 | 0.765 | 0.785 |  |  |
| \cdashline4-6 |  | Ensemble | 0.725 | 0.800 |  |
|  | \ours (Using CN) | RN50 | 0.685 | 0.700 |  |
| \cdashline4-6 | RN101 | 0.600 | 0.690 |  |  |
| \cdashline4-6 | ViT-B/16 | 0.725 | 0.780 |  |  |
| \cdashline4-6 | ViT-B/32 | 0.650 | 0.725 |  |  |
| \cdashline4-6 | ViT-L/14 | 0.750 | 0.795 |  |  |
| \cdashline4-6 |  |  | Ensemble | 0.700 | 0.735 |

#### C.4.2 \ours vs MagNet

We also implement and compare \ours with MagNet [Meng and Chen, ]. Table 21 show the classification similarities using Stable Diffusion [Rombach et al., ] for image generation and the CLIP Image Encoders for evaluation. Subsequently, we compare \ours with MagNet [Meng and Chen, ] using the same settings as reported in [Meng and Chen, ]. Our approach demonstrate a superior performance over MagNet. Key Takeaway: From experiments performed on CIFAR-10, using the classifier specified in [Meng and Chen, ], \ours outperforms MagNet in detecting adversarial samples in classification settings, proving the efficacy of our approach in multiple scenarios. Table 22 shows the comparison with MagNet.

**Table 21: Classification Similarity: Stable Diffusion + CLIP Image Encoders.**
| Setting | Eps ($\epsilon$) | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| Clean |  | 0.554 | 0.734 | 0.695 | 0.664 | 0.641 | 0.658 |
| \cdashline2-8<br>FGSM | $\epsilon=0.01$ | 0.456 | 0.685 | 0.574 | 0.542 | 0.532 | 0.558 |
| \cdashline2-8<br>FGSM | $\epsilon=0.1$ | 0.408 | 0.633 | 0.484 | 0.475 | 0.519 | 0.504 |
| \cdashline2-8<br>L2-PGD | $\epsilon=0.01$ | 0.488 | 0.691 | 0.613 | 0.580 | 0.563 | 0.587 |
| \cdashline2-8<br>L2-PGD | $\epsilon=0.5$ | 0.494 | 0.687 | 0.601 | 0.573 | 0.551 | 0.581 |
| \cdashline2-8<br>DeepFool | $\epsilon=0.1$ | 0.482 | 0.689 | 0.606 | 0.574 | 0.560 | 0.582 |
| \cdashline2-8<br>C&W | $\epsilon=0.1$ | 0.506 | 0.699 | 0.620 | 0.587 | 0.569 | 0.596 |

**Table 22: Detection Accuracy: \ours vs MagNet (MN) [Meng and Chen, ].**
| Setting | Eps ($\epsilon$) | CLIP Image Encoder |  |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| \cdashline3-8 | RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble | MN [Meng and Chen, ] |  |
| FGSM | $\epsilon=0.01$ | 0.660 | 0.655 | 0.770 | 0.790 | 0.750 | 0.750 | 0.525 |
| \cdashline2-9<br>FGSM | $\epsilon=0.1$ | 0.750 | 0.785 | 0.890 | 0.880 | 0.755 | 0.845 | 0.885 |
| \cdashline2-9<br>L2-PGD | $\epsilon=0.01$ | 0.635 | 0.645 | 0.730 | 0.750 | 0.715 | 0.735 | 0.490 |
| \cdashline2-9<br>L2-PGD | $\epsilon=0.5$ | 0.600 | 0.655 | 0.720 | 0.730 | 0.710 | 0.710 | 0.485 |
| \cdashline2-9<br>DeepFool | $\epsilon=0.1$ | 0.625 | 0.665 | 0.710 | 0.735 | 0.685 | 0.730 | 0.525 |
| \cdashline2-9<br>C&W | $\epsilon=0.1$ | 0.590 | 0.615 | 0.725 | 0.705 | 0.685 | 0.705 | 0.530 |

### C.5 \ours : One-Time-Use (OTU) Image Encoder Approach

In this section, we show results from different applications of our OTU approach on the CLIP ViT-B/32 Image Encoder. Tables 23, 24, 25, 26, and 27 show the detailed descriptions of each of our experiments, along with our key observations and conclusions.

**Table 23: We started by adding different pertubation values $\eta$ to the CLIP ViT-B/32 Image Encoder weights. Key Takeaway: Very small $\eta$ (i.e., $\eta\leq 10^{-4}$) doesn’t change the model, and large $\eta$ (i.e., $\eta\geq 10^{-2}$) destroys the model’s usage. This sets our optimal $\eta$ at $10^{-4}\leq\eta<10^{-2}$.**
| Victim Model | Setting | One-Time-Use (OTU) ViT-B/32 Image Encoder |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| $\eta=5\cdot 10^{-6}$ | $\eta=3\cdot 10^{-4}$ | $\eta=10^{-3}$ | $\eta=10^{-2}$ | $\eta=10^{-1}$ |  |  |
| UniDiffuser | Clean | 0.751 | 0.752 | 0.755 | 0.867 | 0.721 |
| \cdashline2-7 | ADV-Transfer | 0.804 | 0.803 | 0.778 | 0.872 | 0.717 |
| BLIP | Clean | 0.728 | 0.731 | 0.741 | 0.871 | 0.715 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.486 | 0.506 | 0.866 | 0.706 |
| BLIP-2 | Clean | 0.750 | 0.751 | 0.758 | 0.870 | 0.722 |
| \cdashline2-7 | ADV-Transfer | 0.499 | 0.505 | 0.524 | 0.865 | 0.706 |
| Img2Prompt | Clean | 0.695 | 0.696 | 0.708 | 0.862 | 0.716 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.484 | 0.506 | 0.859 | 0.706 |

**Table 24: To prove our conclusion in Table 23, we investigated with more perturbation values. Key Takeaway: Larger $\eta$ values destroy the usefulness of the encoder. Therefore, $\eta$ should be low enough.**
| Victim Model | Setting | One-Time-Use (OTU) ViT-B/32 Image Encoder |  |  |  |
| --- | --- | --- | --- | --- | --- |
| $\eta=10^{-3}$ | $\eta=5\cdot 10^{-3}$ | $\eta=10^{-1}$ | $\eta=5\cdot 10^{-1}$ |  |  |
| UniDiffuser | Clean | 0.755 | 0.799 | 0.721 | 0.859 |
| \cdashline2-6 | ADV-Transfer | 0.778 | 0.789 | 0.717 | 0.855 |
| BLIP | Clean | 0.741 | 0.800 | 0.715 | 0.860 |
| \cdashline2-6 | ADV-Transfer | 0.506 | 0.506 | 0.706 | 0.857 |

**Table 25: We then investigate which layer carries the most importance for perturbing, to get to our goal of having an OTU encoder. We started by adding different pertubation values $\eta$ to the weights of the first layer (conv1) of CLIP ViT-B/32 Image Encoder. Key Takeaway: We observe similar trends in this case, as compared to Table 23. Our optimal $\eta$ sits at $10^{-4}\leq\eta<10^{-2}$.**
| Victim Model | Setting | One-Time-Use (OTU) ViT-B/32 Image Encoder |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| $\eta=5\cdot 10^{-6}$ | $\eta=3\cdot 10^{-4}$ | $\eta=10^{-3}$ | $\eta=10^{-2}$ | $\eta=10^{-1}$ |  |  |
| UniDiffuser [Bao et al., ] | Clean | 0.751 | 0.752 | 0.749 | 0.882 | 0.881 |
| \cdashline2-7 | ADV-Transfer | 0.804 | 0.802 | 0.785 | 0.865 | 0.894 |
| Blip [Li et al., ] | Clean | 0.728 | 0.728 | 0.725 | 0.881 | 0.887 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.482 | 0.490 | 0.843 | 0.877 |
| Blip-2 [Li et al., ] | Clean | 0.750 | 0.749 | 0.744 | 0.881 | 0.888 |
| \cdashline2-7 | ADV-Transfer | 0.499 | 0.502 | 0.511 | 0.852 | 0.883 |
| Img2Prompt [Guo et al., ] | Clean | 0.695 | 0.694 | 0.692 | 0.875 | 0.881 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.479 | 0.489 | 0.845 | 0.876 |

**Table 26: We also investigate the model’s performance when perturbing the pre-weight layer ($visual.ln_pre.weight$) of the used encoder. Key Takeaway: We observe a slightly different trend in this case. Very small $\eta$ (i.e., $\eta\leq 10^{-4}$) still doesn’t change the model; however, larger $\eta$ (i.e., $10^{-4}$) produced good results. This implies that for any attack, our OTU approach could create a totally new encoder to be used in \ours by perturbing one or more of the mid-layers.**
| Victim Model | Setting | One-Time-Use (OTU) ViT-B/32 Image Encoder |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- |
| $\eta=5\cdot 10^{-6}$ | $\eta=3\cdot 10^{-4}$ | $\eta=10^{-3}$ | $\eta=10^{-2}$ | $\eta=10^{-1}$ |  |  |
| UniDiffuser | Clean | 0.751 | 0.751 | 0.751 | 0.752 | 0.785 |
| \cdashline2-7 | ADV-Transfer | 0.804 | 0. 804 | 0.804 | 0.806 | 0.698 |
| BLIP | Clean | 0.728 | 0.728 | 0.728 | 0.730 | 0.775 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.478 | 0.478 | 0.481 | 0.587 |
| BLIP-2 | Clean | 0.750 | 0.750 | 0.750 | 0.752 | 0.791 |
| \cdashline2-7 | ADV-Transfer | 0.499 | 0.499 | 0.499 | 0.501 | 0.615 |
| Img2Prompt | Clean | 0.695 | 0.695 | 0.695 | 0.697 | 0.767 |
| \cdashline2-7 | ADV-Transfer | 0.478 | 0.478 | 0.478 | 0.480 | 0.589 |

**Table 27: Finally, we investigate the model’s performance when perturbing the last layers ($visual.ln_post.weight$). Key Takeaway: This trend was the total opposite of what was observed when perturbing the first layer and when perturbing all weights. We observed good performances even when using large $\eta$ (up to $5\cdot 10^{-1}$), which implies that there is a good range of encoders that can be created from a pretrained evaluator using our OTU approach. Furthermore, using this approach means that an attacker will find it difficult to create adversarial samples when carrying out an adaptive attack approach against our defense method.**
| Victim Model | Setting | One-Time-Use (OTU) ViT-B/32 Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| $\eta=5\cdot 10^{-6}$ | $\eta=3\cdot 10^{-4}$ | $\eta=10^{-3}$ | $\eta=10^{-2}$ | $\eta=10^{-1}$ | $\eta=5\cdot 10^{-1}$ |  |  |
| UniDiffuser [Bao et al., ] | Clean | 0.751 | 0.751 | 0.751 | 0.751 | 0.748 | 0.723 |
| \cdashline2-8 | ADV-Transfer | 0.804 | 0.804 | 0.804 | 0.804 | 0.801 | 0.781 |
| Blip [Li et al., ] | Clean | 0.728 | 0.728 | 0.728 | 0.728 | 0.724 | 0.696 |
| \cdashline2-8 | ADV-Transfer | 0.478 | 0.479 | 0.479 | 0.479 | 0.473 | 0.433 |
| Blip-2 [Li et al., ] | Clean | 0.750 | 0.750 | 0.750 | 0.750 | 0.746 | 0.720 |
| \cdashline2-8 | ADV-Transfer | 0.499 | 0.499 | 0.499 | 0.498 | 0.492 | 0.450 |
| Img2Prompt [Guo et al., ] | Clean | 0.695 | 0.695 | 0.695 | 0.695 | 0.689 | 0.656 |
| \cdashline2-8 | ADV-Transfer | 0.478 | 0.478 | 0.478 | 0.478 | 0.472 | 0.429 |

### C.6 Adaptive Attack

Figure: Algorithm 1 Adaptive Attack to Bypass Defense Mechanisms (Figure 6)

Figure: Figure 6: Illustration of the adaptive attack pipeline: (1.) Rather than use the discrete output of the Victim Model (I2T), the attacker seamlessly integrates the embedding layer for the text decoder (2.) with the decoding module of the generative model (T2I), using an Adapter for semantics alignment. The goal of the adapter is to (3.) craft adversarial images $x_{\text{adv}}$ such that its distance $d$ from target caption $t$ and generated images $x_{\text{gen}}$ is minimized.
Refer to caption: x11.png

We assessed the success of the adaptive attack relative to the standard attack, as the attacker’s primary objective is to maximize the attack’s effectiveness. To accomplish this, we computed the similarity between the target caption and the captions of the adversarial images generated by the adaptive attack. Subsequently, we compared these results with the similarity between the target caption and the captions of adversarial images generated by the standard attack (ADV-Transfer). As illustrated in Table 28, our findings indicate that the adaptive attack yields lower similarity, indicating a less successful attack.

**Table 28: Text embedding similarity between the target captions and the captions produced by the victim model attacked using transfer attack (ADV-Transfer) and different adaptive settings.**
| Victim Model | Setting | CLIP Image Encoder |  |  |  |  |  |
| --- | --- | --- | --- | --- | --- | --- | --- |
| RN50 | RN101 | ViT-B/16 | ViT-B/32 | ViT-L/14 | Ensemble |  |  |
| UniDiffuser | ADV-Transfer | 0.76 | 0.71 | 0.74 | 0.77 | 0.68 | 0.73 |
| \cdashline2-8 | Adaptive (ViT-B/32) | 0.59 | 0.61 | 0.60 | 0.64 | 0.53 | 0.60 |
| \cdashline2-8 | Adaptive (RN50 + ViT-B/32) | 0.63 | 0.60 | 0.63 | 0.66 | 0.55 | 0.61 |
| \cdashline2-8 | Adaptive (RN50 + ViT-B/32 + ViT-L/14) | 0.70 | 0.64 | 0.68 | 0.70 | 0.60 | 0.66 |
| \cdashline2-8 | Adaptive (RN50 +ViT-B/16 + ViT-B/32 + ViT-L/14 ) | 0.69 | 0.64 | 0.68 | 0.71 | 0.62 | 0.67 |
| \cdashline2-8 | Adaptive (RN50 + RN101 + ViT-B/16 + ViT-B/32 + ViT-L/14 ) | 0.63 | 0.64 | 0.66 | 0.67 | 0.58 | 0.64 |

## Appendix D Some Visualization

Figure: Figure 7: Visual results using BLIP (Victim Model) and Stable Diffusion (T2I Model).
Refer to caption: x12.png

## Peer Reviews

confidence: 4
contribution: 3
initial_rating: 6
presentation: 3
questions: Though the paper conducts ablation study to explore the influence of different Text-to-Image (T2I) models and pretrained image encoders, is it possible to provide some information of T2I models such as classification accuracy and training mechanism to explain the relation between detection results and text-to-image models?
soundness: 3
strengths: The proposed method is simple and elegant. It leverages Text-to-Image models to generate images based on captions produced by target VLMs. Then, the similarities of the embeddings of both input and generated images in the feature space are used to identify the adversarial samples.

The paper conducts sufficient experiments to demonstrate the advantages of proposed method. Specifically, the experiments are conducted on five victim models. More Text-to-Image models and pretrained image encoders are tested in the ablation studies.

The paper is well-written. For example, there is a section in Method to describe the threat model.
summary: The paper addresses the problem of adversarial defense for Vision-Language Models (VLMs). The paper proposes a simple and elegant method called MIRRORCHECK to detect adversarial samples. The method utilizes Text-to-Image (T2I) models to generate images based on captions produced by target VLMs. Then, the similarities of the embeddings of both input and generated images in the feature space are leveraged to identify adversarial samples. Extensive experiments are conducted to demonstrate the effectiveness of proposed method.
weaknesses: It is better to introduce how to choose hyperparameter \tau (decision threshold in line 217), especially the relation between \tau and text-to-images models (or pretrained image encoders).

The experiments are conducted against targeted attacks. How about untargeted attacks?

In Section 3.1, the paper writes "the attacker's objectives are to execute targeted attacks". If the attack performance of used attack method is low, will the proposed method still work?

There are some typos. For example, "Tables 1 and 3 presents" should be "Tables 1 and 3 present" in line 312.

---

confidence: 2
contribution: 3
initial_rating: 6
presentation: 3
questions: - How can the method be further improved to handle cases where the pretrained generative model is of poor quality?
- Can the authors provide more insights into the theoretical foundation of the image-image similarity approach?
- Are there any potential limitations or challenges in applying MirrorCheck to other types of multimodal models or tasks?
soundness: 3
strengths: - **Originality**: The idea of using a T2I model to generate images for adversarial sample detection in VLMs is novel. It provides a new perspective and approach compared to existing defenses.
- **Quality**: The experiments are well-designed and conducted. The use of multiple datasets, victim models, T2I models, and image encoders shows the robustness and generality of the method. The results are presented clearly and support the claims made in the paper.
- **Clarity**: The paper is well-written and organized. The introduction provides a clear motivation for the work, the method description is detailed and understandable, and the experimental results are presented in a logical manner.
- **Significance**: The proposed method has significant implications for the security and reliability of VLMs. It addresses an important problem of adversarial attacks and provides a practical solution that can be applied in real-world scenarios.
summary: The paper proposes MirrorCheck, a novel method for detecting adversarial samples in Vision-Language Models (VLMs). It leverages a Text-to-Image (T2I) model to generate an image based on the caption produced by the victim model and then compares the embeddings of the input and generated images. The method is evaluated on different datasets and tasks, showing its effectiveness and superiority over baseline methods. It also demonstrates robustness against adaptive attacks and adaptability to different T2I models and image encoders.
weaknesses: - The effectiveness of MirrorCheck depends on the quality of the pretrained generative model used. Any shortcomings in the generative model can directly impact the performance of the method. This limitation could be further explored and addressed.
- The paper could provide more in-depth analysis of the theoretical aspects of the method. For example, a more detailed explanation of why the image-image similarity approach works better than directly comparing the input image with the generated caption could be beneficial.

---

confidence: 5
contribution: 3
initial_rating: 3
presentation: 3
questions: see weakness.
soundness: 2
strengths: - The writing is clear.
- Detecting adversarial samples in multimodal models is an interesting research topic.
summary: This paper presents a simple adversarial sample detection method called MirrorChecker, which detects adversarial samples by comparing the embedding similarity between reconstructed adversarial samples and clean samples. Specifically, given an adversarial sample, the method first uses a pre-trained multimodal model to generate a caption for the image and then employs a diffusion model to reconstruct the image based on that caption. Finally, it assesses the similarity between the reconstructed image and the clean image to detect malicious adversarial samples. The paper validates the effectiveness of the proposed defense method across multiple models.
weaknesses: - **Unclear Threat Model:** In section 3.1, the authors focus on targeted attacks (lines 199-200), but this assumption is unclear. It is recommended that the authors address a broader range of attack scenarios, including patch attacks and untargeted attacks. Specifically, how might untargeted attacks affect the performance of the proposed detection method?

- **Lack of Defender Capability:** The paper does not provide sufficient detail about the defender's capabilities and the practical feasibility of the proposed defense. A key concern is how the defender obtains the clean samples needed for comparison. In other words, if clean images are not required, how does the defense work? The authors should clarify how this affects the real-world applicability of their approach.

- **No Support for Theoretical Analyses:** The authors claim to provide theoretical analyses in the abstract (line 22); however, a review of the paper reveals no such analyses. If these analyses are not present, the authors should explain why this claim is made.

- **Insufficient Robustness Against Adaptive Attacks:** The robustness of the proposed defense method against adaptive attacks needs further analysis. For example, if attackers are aware of this defense mechanism, they may modify the adversarial images to minimize the distance to the clean images. Would this enable them to evade the proposed detection? The authors should consider stronger adaptive attacks and provide corresponding defense results.

- **Defense Results on Out-of-Distribution Data:** It is unclear how the proposed method detects adversarial samples when applied to out-of-distribution (OOD) data, particularly across multiple domains. The authors should provide either experimental results or a theoretical discussion on the performance of their method when dealing with OOD samples from various domains.

- **Lack of Comparison with Advanced Defense Baselines:** A comparison with advanced baselines, such as DiffPure [1], would strengthen the paper. DiffPure uses a diffusion model to remove adversarial noise and detects adversarial samples by assessing the prediction differences between cleaned samples and the original adversarial samples. The detection process of DiffPure seems more straightforward and efficient than the proposed method. The authors should provide a quantitative comparison on a common dataset, focusing on both detection accuracy and computational efficiency. This would help highlight the strengths of their method over existing baselines.

[1] Diffusion models for adversarial purification, ICML, 2022

---

confidence: 4
contribution: 2
initial_rating: 3
presentation: 2
questions: - Line 158-160, the certified defense methods can guarantee robustness. What does it mean by the struggle to generalize to novel attack strategies? 
- Line 253, experiments are conducted with 100 or 1000 randomly selected images; why not use the full dataset for evaluation? And which experiments are using 100 and which are using 1000? 
- Line 258-260, I believe the PGD requires a gradient for optimization of the attack vector; how is this used for 100 queries and 8-step PGD with an estimated gradient?
soundness: 3
strengths: - Although the idea behind the method is simple, it is technically sound. The core concept is that adversarial examples tend to cause VLMs to generate text that deviates from the content of the original image. As a result, the T2I model's generated image will also deviate, leading to large differences in similarity scores between the generated and original images.
- While adversarial training is a popular defense method, it is costly, difficult to scale for large models, and faces trade-offs between robustness and accuracy. In contrast, detecting adversarial examples offers a cost-effective defense by rejecting malicious queries. MirrorCheck, the proposed detection method, is specifically designed for VLMs.
- The method is evaluated under a realistic black-box threat model, where the adversary can only query the victim model without access to gradient information, making it practical for real-world scenarios. Additionally, experiments were conducted using a white-box threat model to push the method to its limits. The evaluation setup and findings are well-appreciated.
summary: This paper focuses on detecting adversarial examples targeting Vision-Language Models (VLMs) by introducing a method called MirrorCheck. MirrorCheck uses an additional Text-to-Image (T2I) model and a CLIP image encoder to identify adversarial inputs. For any input to a VLM, the T2I model generates an image based on the VLM's output, and the CLIP image encoder extracts embeddings to compute a similarity score between the generated and original images. A significant difference in similarity indicates a potential adversarial example. The method is simple yet technically sound, and experiments with various VLMs, T2I models, and CLIP encoders confirm its effectiveness.
weaknesses: - The core motivation behind MirrorCheck is that adversarial examples typically cause VLMs to generate content that deviates from the main image. However, adversaries could potentially manipulate the VLM to produce content that is aligned, or at least partially aligned, with the image. In such cases, MirrorCheck might fail to detect the adversarial example. For instance, consider Figure 2, where the adversary's target text is "A leopard laying down on a rock next to a field ...", followed by harmful or misleading texts. If the adversary uses a targeted attack to craft an adversarial example that closely aligns with the original image (except for the harmful text), how would the similarity scores behave? To what extent could this reduce MirrorCheck's detection effectiveness? This scenario raises concerns about MirrorCheck's robustness when handling adversarial attacks that maintain a degree of semantic consistency with the image. This type of targeted attack is examined in this work [1]. 

- The Average Similarity Scores in Table 1 alone do not fully capture MirrorCheck’s detection performance. While they show a general pattern of deviation between clean and adversarial examples, they do not clearly demonstrate whether MirrorCheck can reliably differentiate between them. In Table 3, the minimum similarity score for clean versus adversarial examples is on the same level, and a similar pattern is observed for the maximum scores, further obscuring the distinction. I recommend that the authors plot the distribution of similarity scores to better illustrate the detection performance. 

- The detection accuracy, TPR, and FPR presented in Tables 2 and 4 are influenced by the ratio of adversarial and clean examples. However, this ratio is not explicitly mentioned in the paper. In real-world scenarios, adversarial queries are typically rare. I suggest conducting an ablation study that examines detection performance under varying ratios of adversarial examples. Starting with a balanced 50%-50% to 99.9%-0.1%

- Line 371 stated that the threshold $\tau$ is based on optimized performance. In practical settings, it is very unlikely that the optimal hyperparameters can be found. The similarity scores could vary depending on the validation set, attack used, and CLIP image encoder. I suggest also including the area under the ROC curve and Precision-Recall curve. 

- Following the setting in the adaptive attack study, line 485, the adversarial examples can still be detected by other encoders. This could be the result of the adversarial example not transferable to other encoders. What if the adversary improves the transferability by using an ensemble of other encoders?

- There are relevant detection baselines [2-4] and related adversarial attacks [1, 5, 6] that are not examined in the paper. 

- Line 098 claims that MirrorCheck does not require training. This could be misleading. T2I models and CLIP encoders are part of the defense that does require training. 

- Lines 177 - 182 suggest that existing defenses do not consider multi-modal settings. However, several works [7-9] have proposed adversarial training for the multi-modal setting. 

---

[1] Schlarmann, C., & Hein, M. (2023). On the adversarial robustness of multi-modal foundation models. In Proceedings of the IEEE/CVF International Conference on Computer Vision(pp. 3677-3685).\
[2] Lee, K., Lee, K., Lee, H., & Shin, J. (2018). A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems, 31.\
[3] Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S., Schoenebeck, G., ... & Bailey, J. (2018). Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. In International Conference on Learning Representations.\
[4] Cohen, G., Sapiro, G., & Giryes, R. (2020). Detecting adversarial samples using influence functions and nearest neighbors. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 14453-14462).\
[5] Bailey, L., Ong, E., Russell, S., & Emmons, S. (2023). Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236.\
[6] Dong, Y., Chen, H., Chen, J., Fang, Z., Yang, X., Zhang, Y., ... & Zhu, J. (2023). How Robust is Google's Bard to Adversarial Image Attacks?. arXiv preprint arXiv:2309.11751.\
[7] Mao, C., Geng, S., Yang, J., Wang, X., & Vondrick, C. (2023). Understanding Zero-shot Adversarial Robustness for Large-Scale Models. In The Eleventh International Conference on Learning Representations.\
[8] Schlarmann, C., Singh, N. D., Croce, F., & Hein, M. (2024). Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Models. In Forty-first International Conference on Machine Learning.\
[9] Wang, S., Zhang, J., Yuan, Z., & Shan, S. (2024). Pre-trained model guided fine-tuning for zero-shot adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 24502-24511).

Meta-review: This paper proposes a novel method to detect adversarial examples against vision-language models. The method adopts text-to-image models to generate images based on the captions produced by the target VLMs. Then the method calculates the feature similarities between the input image and generated image to identify adversarial examples. Experimental results show the effectiveness of the proposed method.

Overall, the idea is intuitive and novel. Utilizing a pre-trained text-to-image model to detect adversarial examples for vision-language models is interesting and is tailored for vision-language models rather than general defenses. The writing is good.

However, one major limitation of the method is its robustness under adaptive attacks. This issue has been raised by multiple reviewers and the authors have provided additional experiments to show the performance of adaptive attacks. After careful examination and discussion with reviewers, there are still some concerns.

- The authors has shown the results of attacking few CLIP encoders and using others to detect adversarial examples. This is **not** the white-box setting where the attackers can have access to all the defense details. So, using other CLIP models cannot prove the robustness of the method under strong adaptive attacks.

- Indeed, the authors also provided the results of attacking an ensemble of five CLIP encoders and using the same set of models for detection. However, the details on how to perform optimization on the adaptive attack problem are not clear. So, it is questionable whether the attack is strong enough to generate adversarial examples for the ensemble models.

As this paper has borderline rating with two borderline accept recommendations and two borderline reject recommendations, the AC thinks that this paper falls short of the ICLR acceptance threshold and can be further improved by carefully addressing more diverse attacks and adaptive attacks. Therefore, the AC would recommend rejection.

Decision: Reject