Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images
Authors: Kuofeng Gao
Yang Bai
Jindong Gu
Shu-Tao Xia
Philip Torr
Zhifeng Li
Wei Liu
Venue: ICLR 2024 poster (2024)
Keywords: energy-latency manipulation; large vision-language model; verbose images
Primary area: societal considerations including fairness, safety, privacy

Abstract: Large vision-language models (VLMs) such as GPT-4 have achieved exceptional performance across various multi-modal tasks. However, the deployment of VLMs necessitates substantial energy consumption and computational resources. Once attackers maliciously induce high energy consumption and latency time (energy-latency cost) during inference of VLMs, it will exhaust computational resources. In this paper, we explore this attack surface about availability of VLMs and aim to induce high energy-latency cost during inference of VLMs. We find that high energy-latency cost during inference of VLMs can be manipulated by maximizing the length of generated sequences. To this end, we propose verbose images, with the goal of crafting an imperceptible perturbation to induce VLMs to generate long sentences during inference. Concretely, we design three loss objectives. First, a loss is proposed to delay the occurrence of end-of-sequence (EOS) token, where EOS token is a signal for VLMs to stop generating further tokens. Moreover, an uncertainty loss and a token diversity loss are proposed to increase the uncertainty over each generated token and the diversity among all tokens of the whole generated sequence, respectively, which can break output dependency at token-level and sequence-level. Furthermore, a temporal weight adjustment algorithm is proposed, which can effectively balance these losses. Extensive experiments demonstrate that our verbose images can increase the length of generated sequences by 7.87× and 8.56× compared to original images on MS-COCO and ImageNet datasets, which presents potential challenges for various applications.

Published as a conference paper at ICLR 2024
INDUCING HIGH ENERGY-LATENCY OF LARGE VISION-LANGUAGE MODELS WITH Verbose IMAGES
Kuofeng Gao', Yang Bai", Jindong Gu', Shu-Tao Xia Torr', Zhifeng Li Wei Liu Tsinghua University Tencent Technology (Beijing) Co.Lid UUnivessity of Oxford Tencent Data Platform Peng Cheng Laboratory
gkf21@mails testttinnnn tsinghua.... edu. en, {jindong. gu, philip. torr) tti.pp.ttoooreeenn.......... ox. ax. xiast@sz. tsinghua. edu. on edu
mi sichaelz (eenenetteet....mmmeemmmmmem.e.e com,
ABSTRACT
Large vision-language models (VLMs) such as GPT-4 have achieved exceptional performance across various multi-modal tasks. However, the deployment of VLMs necessitates substantial energy consumption and computational resources. Once attackers maliciously induce high energy consumption and latency time (energy-latency cost) during inference of VLMS,, it will exhaust computational resources. In this paper, we explore this attack surface about availability of VLMs and aim to induce high energy-latency cost during inference of VLMs. We find that high energy-latency cost during inference of VLMs can be ma- nipulated by maximizing the length of generated sequences. To this end, we propose verbose images, with the goal of crafting an imperceptible perturba- tion induce VLMs generate long sentences during inference. Concretely, we design three loss objectives. First, a loss is proposed to delay the occur- of end-of-sequence (EOS) token, where EOS token is signal for VLMs to stop generating further tokens. Moreover, an uncertainty loss and token di- versity loss are proposed increase the uncertainty over each generated token and the diversity among all tokens of the whole generated sequence, respec- tively, which can break output dependency token-level and sequence-level. Furthermore, a temporal weight adjustment algorithm is proposed, which can effectively balance these losses. Extensive experiments demonstrate that our verbose images can increase the length of generated sequences by 7.87x and 8.56x compared to original images on MS-COCO and ImageNet datasets, which presents potential challenges for various applications. Our code is available at /ettp::/giituue com http///ofeeeae///ebbbbeeeaa Imagee
INTRODUCTION
Large vision- vision-language language models (VLMs) (Alayrac et al. 2022, Chen et al. 2022a Liu et al. 2023b Li ct al. 2021 2023b), such GPT-4 (OpenAl (023), have recently achieved remarkable performance in mudti-modal tasks, including image captioning, visual question answering, and visual reasoning. However, these VLMs often consist of billions of parameters, necessitating substantial computa- tional resources for deployment. Besides, according to Patterson et al. (202I), both NVIDIA and Amazon Web Services claim that the inference process during deployment accounts for over 90% of machine learning demand.
Once attackers maliciously induce high energy consumption and latency time (energy-latenis cost) during inference stage, it can exhaust computational resources and reduce availability of VLMs. The energy consumption the amount of energy used on a hardware during one inference and latency time is the response time taken for one inference. As explored in previous studies, sponge samples (Shumailov al.) 2021) maximize the L2 norm of activation values across all layers to introduce more representation calculation cost while NICGSlowdown (Chnn et al. 2022c) minimizes the logits
1 Corresponding authors

---

Published as a conference paper at ICLR 2024
1500
Energy ()
30
6000
Latency (s)
1000
Latency
Energy
4500
150
20
3000
100
500
10
1500
0
0
256 512 768
1024
256 512 768 Length
2024
512 768 Length
1024
256 512 768 1024 Length
Length
(a) Energy of BLIP-2
(b) Latency of BLIP-2 (c) Energy of MiniGPT-4 (d) Latency of MiniGPT-4
Figure I: The approximately positive linear relationship between energy consumption, latency time, and the length of generated sequences in VLMs. Following Shumailov et al. (2021). energy con- sumption is estimated by NVIDIA Management Library (NVML), and latency time the response time of an inference.
of both end-of-sequence (EOS) token and output tokens to induce high energy-latency cost. How- ever, these methods are designed for LLMs or smaller-scale models and cannot be directly applied to VLMs, which will be further discussed in Section 2
In this paper, we first conduct comprehensive investigation on energy consumption, latency time, and the length of generated sequences by VLMs during the inference stage. As observed in Fig. I both energy consumption and latency time exhibit an approximately positive linear relationship with the length of generated sequences. Hence,
maximize the length of generated sequences to induce high energy-latency cost of VLMs. Moreover, VLMs incorporate the vision modality into impressive LLMs (Touvron et al. 2023] Chowdhery al.] 2022) to enable powerful visual interaction but meanwhile, this integration also introduces vulnerabilities from the manipulation of visual inputs (Goodfellow al.] 2015). Consequently, we propose verbose images to craft an imperceptible perturbation to induce VLMs to generate long sentences during inference.
By delaying the placement of the EOS token, VLMs are encouraged to generate more tokens and extend the length of generated sequences. Besides, to accelerate the process of delaying EOS tokens, we propose break output dependency, following Chen et al. (202cc). (2) Uncertainty Loss: By introducing more uncertainty over each generated token, can break the original output dependency at the token level and encourage VLMs to produce more varied outputs and longer sequences. (3) Token Diversity Loss: By promoting token diversity among all tokens the whole generated sequence, VLMs are likely to generate diverse range of tokens in the output sequence, which can break the original output dependency at the sequence level and contribute to longer and more complex sequences. Furthermore, temporal weight adjustment algorithm is introduced balance the optimization of these three loss objectives.
Our objectives for verbose images designed follows. (1) Delayed EOS loss:
In summary, contribution can be outlined follows:
We conduct comprehensive investigation and observe that energy consumption and la- tency time are approximately positively linearly correlated with the length of generated sequences for VLMs.
We propose verbose images craft an imperceptible perturbation induce high energy- latency cost for VLMs, which is achieved by delaying the EOS token, enhancing output uncertainty, improving token diversity, and employing temporal weight adjustment algo- rithm during the optimization process.
Extensive experiments show that verbose images increase the length of generated sequences by 7.87 and 8.56x relative to original images on MS-COCO and ImageNet across four VLM models. Additionally, our verbose images produce dispersed attention on visual input and generate complex sequences containing hallucinated contents.
RELATED WORK
Large laiiuanlanguage models (VLMs). Recently, the advanced VLMs, such as BLIP (Li et al. 2022). BLIP-2 (Li eLi al. 20235), InstructBLIIP (Dai al. 2023), and MiniGPT-4 (Zhu al. 2023
2

---

Published as a conference paper at ICLR 2024
have achieved an enhanced zero-shot performance in various multi-modal tasks. Concretely, BLIP proposes a unified vision and language pre-training framework, while BLIP-2 introduces a query transformer to bridge the modality gap between vision transformer and an LLM. Additionally, In- structBLIP and MiniGPT-4 both adopt instruction tuning for VLMs to improve the vision-language understanding performance. The integration of the vision modality into VLMs enables visual context-aware interaction, surpassing the capabilities of LLMs. However, this integration also in- troduces vulnerabilities arising from the manipulation of visual inputs. In our paper, we propose to craft verbose images to induce high energy -ategyyy cost of VLMs.
Energy-latency manipulation. The energy-lateng, manipulation (Chen et al., 2022b Hong al, 2021 Chen et al. [023] Liu et al.) (023a) aims to slow down the models by increasing their energy computation and response time during the inference stage, a threat analogous to the -f (DoS) attacks (Pelechrinis et al. 2010) from the Internet. Specifically, Shummilov et al. (2021) first observe that a larger representation dimension calculation can introduce more energy-latency cost in LLMs. Hence, they propose to craft sponge samples to maximize the L2 norm of activation values across all layers, thereby introducing more representation calculation and energy-latency cost. NICGSlowDown (Chen et al.) (022c) proposes to increase the number of decoder calls, i.e., the length of the generated sequence, to increase the energy-latency of smaller-scale captioning models. They minimize the logits of both EOS token and output tokens generate long sentences.
However, these previous methods cannot be directly applied to VLMs for two main reasons. On one hand, they primarily focus LLMs or smaller-scale models. Sponge samples are designed for LLMs for translations (Liu et al. (019) and NICGSlowdown targets for RNNs or LSTMs combined with CNNs for image captioning (Anderson et al., 2018). Differently, our verbose images are tai- lored for VLMs in multi-modal tasks. On the other hand, the objective of NICGSlowdown involves logits of specific output tokens. Nevertheless, current VLMs generate random output sequences for the same input sample, due to advanced sampling policies (Holtzman et al. 2020). which makes it challenging optimize objectives with specific output tokens. Therefore, highlights the need for methods specifically designed for VLMs to induce high energy-latency cost.
PRELIMINARIES
3.1 THREAT MODEL
Goals and capabilities. The goal of our verbose images is to craft imperceptible image and in- duce VLMs to generate a sequence as long as possible, thereby increasing the energy consumption and prolonging latency during the victim model's deployment. Specifically, the involved perturba- tion is restricted within a predefined magnitude in l, norm, ensuring it difficult to detect.
Knowledge and background. We consider the target VLMs which generate sequences using an auto-regressive process. As suggested in Bagdasaryan et al. ); Qi et al. (2023) we assume that the victim VLMs can be accessed in full knowledge, including architectures and parameters. Additionally, we consider a more challenging scenario where the victim VLMs are inaccessible, as detailed in Appendix A and Appendix
3.2 PROBLEM FORMULATION
Consider an image x, an input text Cn and a sequence of generated output tokens y {V1, .2.., UN J. where Yi represents the i-th generated token, N is the length of the output se- quence and Cja is placeholder 0 in image captioning or question in visual question answering and visual reasoning. Based on the probability distribution over generated tokens, VLMS generate one token at one time an auto-regressive manner. The probability distribution after the Softmax-() layer over the i-th generated token can be denoted as fa (y/,... :i--i x; cm.). Since mainly focus on images x of VLMs in this paper, we abbreviate it as fa (æ). where fi (x) E RV and V is the vocabulary size. Meanwhile, the hidden states across all the layers over the i-th generated token
are recorded as 9i (1/1.... 1/--1; x; Cm.. abbreviated as g, (x), where gi (x) E IRC and C is the dimension size of hidden states.
As discussed in Section D the energy consumption and latency time of an inference are approx- imately positively linearly related to the length of the generated sequence of VLMss. Hence,
3

---

Published as a conference paper at ICLR 2024
Original image x
Verbose
What the content of this image? g
content image?
imago
A tall building with the blue sky.
Multi-family buildings I've gathered some ideas
Normal Energy. Normal Lateney.
High Energy!!! High Latency!!!
Victim Large Vision Language Models
EOS token probability
uniform distribution
diversity caleulated by RANK(-)
(4) temporal
U
weight
adjustment
(I) delaying EOS occureence
(2) enhancing ourpur uncertainty
(3) improving token diversity
algorithm
An overview of verbose images against VLMs to increase the length of generated se- quences, thereby inducing higher energy-latency cost. Three losses designed to craft verbose images by delaying EOS occurrence, enhancing output uncertainty. and improving token diversity. Besides, a temporal weight adjustment algorithm proposed to better utilize the three objectives.
Figure 2:
propose maximize the length N of the output tokens of VLMs by crafting verbose images æ'. To ensure the imperceptibility, we impose an lp restriction on the imperceptible perturbations, where the perturbation magnitude is denoted such that |xx" x E.
4 METHODOL.GGY
Overview. To increase the length of generated sequences, three loss objectives are proposed to op- timize imperceptible perturbations for verbose images in Section 4.1 Firstly and straightforwardly, we propose delayed EOS loss to hinder the occurrence of EOS token and thus force the sen- tence continue. However, auto-regressive textual generation VLMs establishes an output dependency, which means that the current token is generated based all previously generated to- kens. Hence, when previously generated tokens remain unchanged, is also hard to generate a longer sequence
though the probability of the EOS token has been minimized. To this end, we propose to break this output dependency as suggested in CCen et al.] (2022c). Concretely, two loss objectives are proposed both token-level and sequence-level: token-level uncertainty loss, which enhances output uncertainty over each generated token, and sequence-leve token diversity loss, which improves the diversity among all tokens of the whole generated sequence. Moreover, to balance three loss objectives during the optimization, temporal weight adjustment algorithm is introduced in Section 4.2 Fig. shows an overview of our verbose images.
4.1 LOSS DESIGN
Delaying EOS occurrence. For VLMs, the auto-regressive generation process continues until an end-of-sequence (EOS) token generated or predefined maximum token length reached. To increase the length of generated sequences, one straightforward approach is to prevent the occur- rence the EOS token during the prediction process. However, considering that the auto-regressive prediction is non-deterministic random process, it is challenging directly determine the exact location of the EOS token occurrence. Therefore, we propose to minimize the probability of the EOS token all positions. This can be achieved through the delayed EOS loss, formulated as:
1 N Σ EOS (x').
(1
where (.00(() is EOS token probability of the probability distribution after the Softmax(-) layer over the i-th generated token. When reducing the likelihood of every EOS token occurring by minimizing (-), VLMs are encouraged to generate more tokens before reaching the EOS token.
Enhancing output uncertainty. VLMs generate tokens in the generated sequences based on the generated probability distribution. To encourage predictions that deviate from the order of original generated tokens and focus more other possible candidate tokens, propose to enhance output uncertainty over each generated token to facilitate longer and more complex sequences. This objec- tive be implemented by maximizing the entropy of the output probability distribution for each
4

---

Published as a conference paper at ICLR 2024
Algorithm 1 Verbose images: Inducing high energy-latency cost of VLMs
Input: Original images æ, the perturbation magnitude e, step size a and optimization iterations T'.
Output: Verbose images x'.
so x +U(--,,
initialize verbose images D loop over iterations calculate the losses calculate the loss weights update verbose images clip into e-ball of original images
for t + 1 do
L1 (1 11 13 Eq. Eq.
Eq.
xJ(1) -- m 1j(1 1) (1 mm) Ay(1), 1= 1,2,
a. t - x sign Vai_, Ej.1 (i(t) (,(c%-1))
a/ Clip(ar -, +c)
end for
generated token. Based on Shannon 1948). it can be converted minimize the Kullback-Leible (KL) divergence DKL (:.)) KKullbck & Leibler 1951) between the output probability distribution and uniform distribution 4. The uncertainty loss can be formulated follows:
C2(x') Σ DEL (fi (z))
(2)
where fi(-) is the probability distribution after the Softmax(-) layer over the i-th generated token. The uncertainty loss can introduce more uncertainty the prediction for each generated token, effectively breaking the original output dependency. Consequently, when the original output depen- dency is disrupted, VLMs can generate more complex sentences and longer sequences, guided by the delay of the EOS token.
Improving token diversity. To break original output dependency further, we propose to improve the diversity of hidden states among all generated tokens explore a wider range possible outputs. Specifically, the hidden state of token is the vector representation of word or subword in VI.Ms.
Definition
Let Rank(.) indicates the rank of a matrix and [g] 922":=)()))); :.gg ;g denotes the concatenated matrix of hidden states among all generated tokens. To induce high latenyy cost, the token diversity is defined as the rank of hidden states among all generated tokens, i.e., Rank([gı (æ'); (92(x");.-> :gN(x")) ))).
Given by Definition [ increasing the rank of the concatenated matrix of hidden states among all generated tokens yields more diverse set of hidden states of the tokens. However, based on Fazel (2002), the optimization of the matrix rank is an NP-hard non-convex problem. To address this issue, we calculate the nuclear norm of matrix approximately measure its rank, stated in Proposition [ Consequently, by denoting the nuclear norm of a matrix as the token diversity loss follows:
|| |l., we can formulate
Ca(x') = - Il[a (æ'): g2)):g((e 1: (z'); ... :9x(2')]11
(3)
This token diversity loss can lead to more diverse and complex sequences, making it hard for VLMs converge coherent output. Compared to C2(+), La(-) breaks the original output dependency from diversifying hidden states among all generated tokens. In summary, due to the reduced proba- bility of EOS occurrence by (-)., and the disruption of the original output dependency introduced by Ce(-) and Ls(-), our proposed verbose images can induce VLMs to generate a longer sequence and facilitate more effective evaluation on the worst-case energy-latency cost of VLMs.
Proposition 1 (Fazel 2002) The rank of the concatenated mairix of hidden states among all gen- erated tokens can be heuristically measured using the nuclear norm of the concatenated matrix of hidden states among all generated tokens.
4.2 OPTIMIZATION
To combine the three loss functions, L)(-), C2(-). and Ca(-) into an overall objective function, we propose to assign three weights Å1, Az and Ay to the (i(,), Lz(+), and Ls(-) and sum them up to obtain the final objective function as follows:
min X1 Li('') + d Lz(x') + As x Ls(x'), s.t. || x11p S.C. x²'
(4)
5

---

Published as a conference paper at ICLR 2024
where is the perturbation magnitude to ensure the imperceptibility. To optimize this objective, adopt the projected gradient descent (PGD) algorithm, as proposed by Madry et al. (2018). PGD algorithm is an iterative optimization technique that updates the solution by taking steps in the direction of the negative gradient while projecting the result back onto the feasible set. We denote verbose images the t-th step as 2/ and the gradient descent step is follows:
x = -'--1
sign( (V -i_ , (A1
L1 (x)_-) + X2 (2(2221) + A3 La(a(-1))), (5)
s.t. x x|pp e,
where a is the step size. Since different loss functions have different convergence rates during the iterative optimization process, we propose a temporal weight adjustment algorithm to achieve better balance among these three loss objectives. Specifically, we incorporate normalization scaling and temporal decay functions, (t), (t)), and (t),,, into the optimization weights (1),, (2()),
and (t) of Li(.). C2(+), and Ca(-). It can be formulated as follows:
A (t) = ||
/ I1 (Zb (t(),
(t = ||(=( | T2(t),
(6)
(a = ||(2( (a(a(= Ta(),
where the temporal decay functions are set as:
(t) = 01 x ln(() + b,, (2()) = d2 x In(t) + b2, Ta(t) = 0g x In(t) + hy-
(7)
Besides, a momentum value m introduced into the update process of weights. This involves taking into account not only current weights but also previous weights when updating losses, which helps smooth out the weight updates. The algorithm of our verbose images is summarized in Algorithm
EXPERIMENTS
5.1 EXPERIMENTAL SETUPS
Models and datasets. We consider four open-source and advanced large vision-language models as our evaluation benchmark, including BLIP (Li et 2022), BLIP-2 (Li et al. 2023b), InstructBLIP (Dai et al. 2023), and MiniGPT-4 (Zhu et al. 2023). Concretely, we adopt the BLIP with the basic multi-modal mixture of encoder-decoder model in 224M version, BLIP-2 with an OPT-2.7B LM (Zhang et al.) 2022). InstructBLIP and MiniGPT-4 with a Vicuna-7B LM (Chiang al. 2022 These models perform the captioning task for the image under their default prompt template. Results of more tasks are in Appendix We randomly choose the 1,000 images from MS- (Lin et al.
2014) and ImageNet (Deng et al. 2009) dataset, respectively, as our evaluation dataset. More details about target models shown in Appendix A.
Baselines and setups. For evaluation, we consider original images, images with random noise, sponge samples, and NICGSlow as baselines. For sponge samples, NICGSlowDown, and our verbose images, we perform the projected gradient descent (PGD) (Madry et al. 2018) algorithm in 000 T = 1,0000 iterations. Besides, order ensure the imperceptibility, the perturbation magnitude is set as e 8 within Lo0 restriction, following Carlini et al. (2019), and the step size is set as == 1. The default maximum length of generated sequences of VLMs set as 512 and the sampling policy is configured to use nucleus sampling (Holtzman et al. 2020). For our verbose images, the parameters of loss weights are 01 = 10, momentum of our optimization is m 0.9. More details about setups are listed in Appendix A.2
220, 02 O, b2 O. a3 0.5, and by = 1 and the
Evaluation metrics. We calculate the energy consumption (J) and the latency time (s) during in- ference on one single GPU. Following Shummilov et al. (202T). the energy consumption and latency time are measured by the NVIDIA Management Library (NVML) and the response time cost of an inference, respectively. Besides, the length of generated sequences is also regarded as metric. Considering the randomness sampling modes in VLMs, we report the average evaluation results over three times.
5.2
MAIN RESULTS
Table compares the length of generated sequences, energy consumption, and latency time of orig- inal images, images with random noise, sponge samples, NICGSlowdown, and our verbose images.

---

Published as a conference paper at ICLR 2024
The length of generated sequences, energy consumption (J), and latency time (s) of five categories of visual images against four VLM models, including BLIP. BLIP-2, InstructBLIP. and MiniGPT-4, on two datasets, namely MS-COCO and ImageNet. The best results are marked bold.
Table 1:
MS-COCO
ImageNet Lateney
VLM model
Method
Length
Latency
Energy
Length
Energy
Original
10.03
0.21
9.51
10.17
0.22
9.10
Noise
9.98
0.17
8.57
9.87
0.18
8.29
BLIP
Sponge samples
65.83
1.10
73.57
76.67
1.26
86.00
NICGSlow Down
179.42
2.84
220.73
193.68
2.98
243.84
Verbose images (Ours)
318.66
5.13
406.65
268.25
4.31
344.91
Original
8.82
0.39
16.08
8.11
0.37
15.39
Noise
9.55
0.43
17.53
8.37
0.44
19.39
BLIP-2
Sponge samples
22.53
0.73
30.20
43.59
1.51
63.27
NICGSlow
103.54
3.78
156.61
129.68
4.34
180.06
Verbose images (Ours)
226.72
7.97
321.59
250.72
10.26
398.58
Original
63.79
2.97
151.80
54.40
2.60
128.03
Noise
62.76
2.91
148.64
53.01
2.50
125.42
InstructBLIP
Sponge samples
92.69
4.10
209.81
80.26
3.55
175.17
NICGSlow Down
93.70
4.08
200.51
81.64
3.56
174.44
Verbose images (Ours)
140.35
6.15
316.06
131.79
6.05
300.43
Original
45.29
10.39
329.50
40.93
9.11
294.68
Noise
45.15
10.35
327.04
47.78
10.98
348.66
MiniGPT-4
Sponge samples
220.30
43.84
1390.73
228.70
47.74
1528.58
NICGSlow Down
232,80
46.39
1478.74
245.51
51.22
1624.06
Verbose images (Ours)
321.35
67.14
2113.29
321.24
64.31
2024.62
100
100
Original Durs
Original
Original
Original
Durs
Ours
Durs
Proportion
Proportion
Proportion
Proportion
40
10
128 256
384 512 Length
128 256
364 Length
512
128 256 384 512
128
256 Length
384
512
Length
(a) BLIP
(b) BLIP-2
(c) InstructBLIP
(d) MiniGPT-4
Figure 3: The length distribution of four VLM models: (a) BLIP. (b) BLIP-2. 2. (c) InstructBLIP. (d) MiniGPT-4. The peak of length distribution of our verbose images shifts towards longer sequences.
The original images serve as a baseline, providing reference values for comparison. When random noise is added to the images, the generated sequences exhibit similar length to those of the orig- inal images. illustrates that is necessary to optimize a handcrafted perturbation to induce high energy-latency cost of VLMs. The sponge samples and NICGSlowdown can generate longer quences compared to original images. However, the increase length is still smaller than that of our verbose images. This can be attributed the reason that the additional computation cost intro- duced by sponge samples and the objective for longer sequences in smaller-scale models introduced by NICGSlowdown cannot directly be transferred induce high energy-latency cost for VLMs.
Our verbose images can increase the length of generated sequences and introduce the highest energy- latency cost among all these methods. Specifically, our verbose images can increase the average length of generated sequences by 7.87x and 8.56x relative to original images on the MS-COCO and ImageNet datasets, respectively. These results demonstrate the superiority of our verbose images. In addition, we visualize the length distribution of output sequences generated by four VLMs on original images and our verbose images in Fig. 3 Compared to original images, the distribution peak for sequences generated using verbose images exhibits shift towards the direction of the longer length, confirming the effectiveness our verbose images generating longer sequences. We conjecture that the different shift magnitudes due to different architectures, different training policies, and different parameter quantities in these VLMs. More results length distribution are shown in Appendix D

---

Published as a conference paper at ICLR 2024
and its GradCAM
a'and its GradCAM
x and its GradCAM
and its GradCAM
stones on the ground with windows of grass
the cave mavis beacons National Park by kerrys
a school bus is driving after hiatus school bus now out in a futuristic open
snowy road
GradCAM for the original image a and our verbose counterpart a'. The attention of our verbose images is more dispersed and uniform. We intercept only part of the generated content.
Figure 4:
Table 2: The CHAIR; (%) and CHAIR, (%) of the original images and verbose images against four VLMs. Our verbose images can induce VLMs to generate more hallucinated objects.
CHAIR, (%)
CHAIR, (%)
VLMs
MS-COCO
ImageNet
MS-COCO
ImageNet
Original
Ours
Original
Ours
Original
Ours
Original
Ours
BLIP
11.41
79.93
22.29
89.80
12.77
84,22
13.77
90.33
BLIP-2
12.03
52.30
25.30
69.83
10.99
35.02
11.77
46.11
InstructBLIP
23,66
55.56
40.11
69.27
38 04
75,46
34.55
64.55
MiniGPT-4
19.42
46.65
29.20
65.50
19.61
52.01
16.57
54.37
5.3 DISCUSSIONS
To better reveal the mechanisms behind our verbose images, conduct two further studies, in- cluding the visual interpretation where we adopt Grad-CAM (Selvaraju et al. 2017) to generate the attention maps and the textual interpretation where we evaluate the object hallucination in generated sequences by CHAIR (Rohrbach et al. 2018).
Visual Interpretation. We adopt GradCAM (Selvaraju et al. 2017). gradient- based visualization technique that generates attention maps highlighting the relevant regions in the input images for the generated sequences. From Fig. 4 the attention of original images primarily concentrates region containing specific object mentioned in the generated caption. In contrast, our verbose images can effectively disperse attention and cause VLMs shift their focus from specific object to the entire image region. Since the attention mechanism serves as a bridge between the input image and the output sequence VLMs, we conjecture that the generation of a longer sequence can be reflected on an inaccurate focus and dispersed and uniform attention from the visual input.
local
Textual Interpretation. We investigate object hallucination in generated sequences using CHAIR (Rohrbach et al. 2018). CHAIR; is calculated as the fraction of hallucinated object instances, while CHAIR, represents the fraction of sentences containing hallucinated object, with the results pre- sented in Table Compared original images, which exhibit lower object hallucination rate, the longer sequences produced by our verbose images contain a broader set of objects. This observation implies that our verbose images prompt VLMs generate sequences that include objects not present in the input image, thereby leading to longer sequences and higher energy-latency cost. Ad- ditionally, results joint optimization of both images and texts, results of visual interpretation, and additional discussions are provided in Appendix Appendix and Appendix G
5.4 ABLATION STUDIES
We explore the effect of the proposed three loss objectives, the effect of the temporal weight adjust- ment algorithm with momentum, and the effect of different perturbation magnitudes.
Effect of loss objectives. Our verbose images consist of three loss objectives: (1(-), C2(-) and L.(+). To identify the individual contributions of each loss function and their combined effects on the overall performance, we evaluate various combinations of the proposed loss functions, as presented in Table It can be observed that optimizing each loss function individually longer sequences, and the combination of all three loss functions achieves the best results in terms of sequence length. This ablation study suggests that the three loss functions, which delay EOS occurrence, enhance output uncertainty, and improve token diversity, play a complementary role in extending the length of generated sequences.
generate
8

---

Published as a conference paper at ICLR 2024
Table 3: The length of generated sequences, energy consumption (J), and latency time (8) against
BLIP-2 in different combinations of three loss objectives.
MS-COCO Latency
ImageNet Latency
L
2
L3
Length
Energy
Length
Energy
119.46 46
3.96
162.40
147.87
4.52
185.64 885.64
139.54
4.65
194.17
161.6 .6
5.69
240.25
/
104.03
3.29
135.75
129.02
3,90
161.87
/
177.95
6.47
267.01
217.78
7.47
306.09
150.79
4.51
182.16
151.57
4.71
194.40
176.53
254.30
206.43
7.50
304.06
226.72
7.97
321.59
250.72
10.26
398.58
Table 4: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 in different combinations two optimization modules.
MS-COCK
ImageNet Latency
Temporal decay
Momentum
Length
Latency
Energy
Length
Energy
152.49
4,70
205.09
144.90
5.31
231.83
199,92
7.02
292.55
231.03
7.88
318.34
187.32
6.89
274.67
214.92
7.49
308.11
226.72
7.97
321.59
250.72
10.26
398.58
Table 5: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 with different perturbation magnitudes e.
MS-COCO
ImageNet
Magnitude
Length
Latency
Energy
LIPIS
Length
Latency
Energy
LIPIS
2
91.75
3.06
126.22
0.0037
103.51
3.50
144.30
0.0038
141.46
4.63
187.14
0.0121
147.30
4.90
199.24
0.0130
8
226.72
7.97
321.59
0.0362
250.72
10.26
398.58
0.0372
16
251.09
8,41
355.00
0,0879
272.95
9.51
380.86
0,0862
32
287.22
9.13
377.64
0.1608
321.65
10.61
429.77
0.1575
Effect of temporal weight adjustment. During the optimization, introduce two methods: temporal decay for loss weighting and an addition of the momentum. As shown in Table 4 both methods contribute to the length of generated sequences. Furthermore, the longest length obtained by combining temporal decay and momentum, providing a significant improvement over the baseline without both methods MS-COCO and ImageNet datasets. indicates that temporal decay and momentum can work synergistically to induce high energy-latency cost of VLMs.
Effect of different perturbation magnitudes. In our default setting, the perturbation magnitude is set as 8, To investigate the impact of different magnitudes. we vary under [2, 4, 8, 16, 32) in Table and calculate the corresponding LIPIS (Zhang al., 2018) between original images and their counterpart verbose images, which quantifies the perceptual difference. It can be observed that larger perturbation magnitude results in a longer generated sequence by VLMs but produces more perceptible verbose images. Consequently, this trade-off between image quality and energy- energy-latency cost highlights the importance of choosing an appropriate perturbation magnitude during evaluation. Additional ablation studies are shown in Appendix H and in Appendix
CONCLUSION
In this paper, we aim to craft an imperceptible perturbation to induce high energy-latency cost of VLMs during the inference stage. We propose verbose images to prompt VLMs to generate as many tokens as possible. To this end, a delayed EOS loss, an uncertainty loss, a token diversity loss, and a temporal weight adjustment algorithm are proposed to generate verbose images. Extensive experimental results demonstrate that, compared to original images, our verbose images can increase the length of generated sequences by 7.87x and 8.56x MS-COCO and ImageNet across four VLMs. We hope that our verbose images can serve as a baseline for inducing high cost of Vs. Additional examples of our verbose images shown in Appendix

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGEMEN
This work is supported in part by the National Natural Science Foundation of China under Grant 62171248, Shenzhen Science and Technology Program (800000081000012255,, and the PCNL KEY project (PCL2023AS6-) This work is also supported by the UKRI grant: Turing AI Fellow- ship EP/W002981/1, EPSRC/MURI grant: EP/N019474/1. We would also like thank the Royal Academy of Engineering and FiveAl.
ETHICS STATEMENT
Please note that we restrict all experiments in the laboratory environment and do not support our verbose images in the real scenario. The purpose of our work is to raise the awareness of the security concern availability of VLMS and call for practitioners to pay more attention to the energy-lateng cost of VLMs and model trustworthy deployment.
REFERENCES
Cran-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, lain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. In NeurIPS, 2022.
Peter Anderson, Xiaodong He, Chris Buchler, Damien Teney, Mark Johnson, Stephen Gould, and Lei Zhang. Bottom-up and top-down attention for image captioning and visual question answer- ing. In CVPR, 2018.
Eugene Bagdasaryan, Tsung- Yin Hsich, Ben Nassi, and Vitaly Shmatikov. (ab) using images and sounds for indirect instruction injection multi-modal llms. arXiv preprint arXiv:2307.10490 2023.
Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo. Shu-tao Xia, and En-hui Yang. Targeted attack for deep hashing based retrieval. In ECCV, 2020a.
Jiawang Bai, Kuofeng Gao, Dihong Gong, Shu-Tao Xia, Zhifeng Li, and Wei Liu. Hardly percepti- ble trojan attack against neural networks with bit flips. In ECCV, 2022.
Yang Bai, Yuyuan Zeng, Yong Jiang, Yisen Wang, Shu-Tao Xia, and Weiwei Guo. Improving query efficiency of black-box adversarial attack. In ECCV, 2020b.
Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma. and Yisen Wang. Improving adversarial robustness via channel-wise activation suppressing. In ICLR, 2021.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv: 190..06500. 2019.
Jun Chen, Han Guo, Kai Yi, Boyang Li, and Mohamed Elhoseiny. Visualgpt: Data-efficient adapta- tion of pretrained language models for image captioning. In CVPR, 2022a.
Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. Nmtsloth: understanding and testing efficiency degradation of neural machine translation systems. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 1148-1160, 2022b.
Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In CVPR, 2022c.
Simin Chen, Hanlin Chen, Mirazul Haque, Cong Liu, and Wei Yang. The dark side of dynamic routing neural networks: Towards efficiency backdoor injection. In CVPR, 2023.
Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. Vicuna: An open-source chatbot impressing gpt-4 with 90% chatgpt quality. 2022.
10

---

Published as a conference paper at ICLR 2024
Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204.02311 2022.
Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li. Pascale Fung, and Steven Hoi. Instructblip: Towards general-purpose vision-language models with instruction tuning. NeurIPS, 2023.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. hierarchical image database. In CVPR, 2009.
Imagenet: A large-scale
Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boost- ing adversarial attacks with momentum. In CVPR, 2018.
Maryam Fazel. Matrix rank minimization with applications. PhD thesis, Stanford University, 2002.
Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. In CVPR. 2023.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
Yash Goyal, Tejas Khot, Douglas Summers-Stay, Dhruv Batra, and Devi Parikh. Making the v in vqa matter: Elevating the role of image understanding in visual question answering. In CVPR, 2017.
Jindong Gu, Volker Tresp. and Yao Qin. Are vision transformers robust patch perturbations? In ECCV, 2022a.
Jindong Gu, Hengshuang Zhao, Volker Tresp, and Philip HS Torr. Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. In ECCV, 2022b.
Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers. ACL, 2021.
Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In ICLR, 2020.
Sanghyun Hong, Yigitcan Kaya, Ionut-V Vlad Modoranu, and Tudor Dumitras. A panda? no, it's sloth: Slowdown attacks on adaptive multi-exit neural network inference. In ICLR, 2021.
Drew A Hudson and Christopher D Manning. Gqa: A new dataset for real-world visual reasoning and compositional question answering. In CVPR, 2019.
Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018
Diederik Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
Solomon Kullback and Richard A Leibler. On information and sufficiency. The annals of mathematical statistics, 22(1):79-86, 1951.
Dongxu Li, Junnan Li, Hung Le, Guangsen Wang, Silvio Savarese, and Steven CH Hoi. Lavis: A one-stop library for language-vision intelligence. In ACL, 2023a.
Junnan Li, Ramprasaath Selvaraju, Akhilesh Gotmare, Shafiq Joty, Caiming Xiong, and Steven
Chu Hong Hoi. Align before fuse: Vision and language representation learning with momentum distillation. In NeurlPS, 2021.
Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping lunguage-image pre- training for unified lasion-language understanding and generation. ICMI., 2022.
Junnan Li, Dongxu Li. Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In ICML, 2023b.

---

Published as a conference paper at ICLR 2024
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In ECCV, 2014.
Han Liu, Yuhao Wu, Zhiyuan Yu, Yevgeniy Vorobeychik, and Ning Zhang. Slowlidar: Increasing
the lateney of lidar-based detection using adversarial examples. In CVPR, 2023a.
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. arXiv preprint arXiv:2304.08485, 2023b.
Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, and Xiaochun Cao. Watermark vaccine: Adversarial attacks to prevent watermark removal. In ECCV, 2022.
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907. 11699. 1692, 2019.
Yue Ma, Yali Wang, Yue Wu, Ziyu Lyu, Siran Chen, Xiu Li, and Yu Qiao. Visual knowledge graph for human action reasoning in videos. In MM, 2022.
Yue Ma, Yingging He, Xiaodong Cun, Xintao Wang, Ying Shan, Xiu Li, and Qifeng Chen. Follow your pose: Pose-guided text-to-video generation using pose-free videos. In AAAI, 2024.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant adversarial attacks. In ICLR, 2018.
OpenAI. Gpt-4 technical report. 2023.
Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high- performance deep learning library. In NeurlPS, 2019.
David Patterson, Joseph Gonzalez, Quoc Le, Chen Liang, Lluis-Miquel Munguia, Daniel Rothchild, David So, Maud Texier, and Jeff Dean. Carbon emissions and large neural network training. 2021.
Konstantinos Pelechrinis, Marios Iliofotou, and Srikanth Krishnamurthy. Denial of service attacks in wireless networks: The case of jammers. IEEE Communications surveys & tutorials, 13(2):
245-257, 2010.
Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Mengdi Wang, and Prateck Mittal. Visual adversar- ial examples jailbreak large language models. arXiv preprint arXiv:2306.13213 2023.
Anna Rohrbach, Lisa Anne Hendricks, Kaylee Burns, Trevor Darrell, and Kate Saenko. Object hallucination in image captioning. In EMNLP, 2018.
Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via baaslentt-bsed local- ization. ICCV, 2017.
Claude Elwood Shanmon. A mathematical theory of communication. The Bell system technical journal, 27(3):379 423, 1948.
Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. Sponge examples: Energy-latency attacks on neural networks. In IEEE EuroS&P, 2021.
Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint 2tt.:22322.17711111 2023.
Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey. arXiv preprint arXiv:2312.08880 2023.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features perceptual metric. In CVPR, 2018
12

---

Published as a conference paper at ICLR 2024
Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christo- pher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. 2022.
Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. 2023.
Xueyan Zou, Jianwei Yang, Hao Zhang, Feng Li, Linjie Li, Jianfeng Gao, and Yong Jae Lee. Seg- ment everything everywhere all once. arXiv preprint arXiv:2304.06718, 2023.
13

---

Published as a conference paper at ICLR 2024
Appendix
Overview, The implementation details are described in Appendix A including the introduction of target models in Appendix A.1 and the experimental setups in Appendix A.2 The transferabiliity of our verbose images the black-box setting is studied Appendix B assuming that the victim VLMs are inaccessible. In addition to the captioning task, we conduct further experiments
other
multi-modal tasks, including visual question answering (VQA) and visual reasoning, Appendix shown in Appendix D The results of the joint optimization
C More results of length distribution of both images and texts are demonstrated in Appendix El Additional discussions on visual inter- pretation are provided in Appendix F Discussions the feasibility analysis of intuitive solution to study whether limitation on generation length can address the energy-latene vulnerability, the model performance of three energy-latency attacks, image embedding distance between original im- ages and verbose counterpart, energy consumption for generating one verbose image, and standard deviation results of our main table are shown in Appendix Ablation studies on different sampling policies and maximum lengths of generated sequences are presented in Appendix H The results of grid search for various parameters of loss weights and momentum values are reported in Appendix I Lastly, visual examples of original images and our verbose images against four VLM models are showeased in Appendix ]
A IMPLEMENTATION DETAILS
In summary, the Py PyTorch framework (Paszke et al.) 2019) and the LAVIS library (Li et al, 2023a) to implement the experiments. Note that every experiment is run on one NVIDIA Tesla A100 GPU with 40GB memory.
A.1 TARGET MODELS
For case of reproduction, we adopt four soun-sourced VLMs as our target model and the implemen- tation details of them described follows.
Settings for BLIP. We employ the BLIP with the basic multimodal mixture of an encoder-decoder model in 224M version. Following Li et al. (2022), we set the image resolution to 384 x 384, and placeholder 0 serves as the input text Gjn of BLIP for the image captioning task.
Settings for BLIP-2. We utilize the BLIP-2 with OPT-2.7B LM (Zhang al. 2022). As sug- gested in Li et al. (023b)), the image resolution is 224 x 224, and placeholder () also serves as the input text Gin of BLIP-2 for the image captioning task.
Settings for InstructBLIP. We choose InstructBLIP with a Vicuna-7B LM (Chiang et al.) 2022). Following Dai et al. (2023), we set the image resolution 224 224, and based the instruction templates for the image captioning task provided in Dai et al. (2023), we configure the input text Cin of InstructBLIP accordingly as: <Image> What the content of this image?
Settings for MiniGPT-4. We adopt MiniGPT-4 with Ticuna-7B LM (Chiang et al. 2022). As suggested in Zhu et al. (2023). the image resolution is 224 224, and considering the predefined instruction templates for the image captioning task provided in Zhu et al. (203)). the input text of MiniGPT-4 set as:
You will be able to see the image once I provide it to you. Please answer my questions. ## Human: <Img><<magee <laaee<eeeteeeee>>>///// What is the content of this image? #Assistann
Give the following image:
A.2 EXPERIMENTAL SETUPS
Setups for main experiments. We perform the projected gradient descent (PGD) (Madry et al. 2018) algorithm to optimize sponge samples, NICGSlowDown, and our verbose images. Specif- ically, the optimization iteration set as T 1, 000, the perturbation magnitude is set as c =
within Loc restriction (Goodfellow et al. 2015 Carlini et al. 2019 Bai et al., 2020a 2021 2022
Gu et al. (202aa] b. Liu et al., 2022) Wu et al. 2023), and the step size is set as a = 1. Besides, for the VLMs, set the maximum length of generated sequences as 512 and use nucleus sampling
14

---

Published as a conference paper at ICLR 2024
Table 6: The length of generated sequences, energy consumption (J); and latency time (s) of black- box transferability across four VLMs of our verbose images. Our verbose images can transfer across different VLMs.
MS-COCO Latency
ImageNet Latency
Source model
Target model
Length
Energy
Length
Energy
None
10.03
0.21
9.51
10.17
0.22
9.10
318.66
5.13
406.65
268.25
4.31
344.91
BLIP-2
BLIP
14.51
0,24
10.05
14.03
0,24
10.23
InstructBLIP
63.43
2.84
142.46
54.14
2.52
131.22
MiniGPT-4
48.50
10.23
316.28
49.14
10.20
321.29
None
8.82
0.39
16.08
8.11
0.37
15.39
BLIP
36.09
1.19
47.07
73.22
2.39
99.24
BLIP-2
BLIP-2
226.72
321.59
250.72
10.26
398.58
InstructBLIP
140.05
3,91
166.40
145.39
4.07
175.01
MiniGPT-4
140.88
3.81
154,43
140.92
3.91
165.95
None
63.79
2.97
151,80
54.40
2.60
128.03
BLIP
91.94
4.13
203.94
82.66
3.77
186.51
BLIP-2
InstructBLIP
109.01
4.87
240.30
99,25
4.53
225.55
InstructBLIP
140.35
6.15
316.06
131.79
6.05
300.43
MiniGPT-4
100.08
210.58
99.42
4.47
219.08
None
45.29
10.39
329.50
40.93
294.68
BLIP
229.10
48.90
1562.25
254.57
54.57
1691.51
BLIP-2
MiniGPT-4
296.77
58.84
1821.66
289.19
58.79
1826.81
InstructBLIP
270.73
48.88
1551.04
258.32
50.26
1632,01
MiniGPT-4
321.35
67.14
2113.29
321.24
64.31
2024.62
Table 7: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 on VQA and visual reasoning. Our verbose images can still achieve better on VQA and visual reasoning.
Image Caption Latency
VQA Latency
Visual Reason Latency
Attacking method
Length
Energy
Length
Energy
Length
Energy
Original Noise
8.82
0.39
16.08
6.43
0.44
17.92
5.70
0.44
18.23
9.55
0.43
17.53
6.62
0.45
17.09
6.70
0.53
19.83
Sponge samples
22.53
30.20
133.24
5.04
191.16
142.28
5.24
205.35
NICGSlowDown
103.54
3.78
156.61
127.96
5.07
190.13
136.44
5.21
185.88
Verbose images (Ours)
226.72
7.97
321.59
271.95
11.49
365.49
280.10
12.52
413.06
Holtzman al. 2020) with p 0.9 and temperature / 1 to sample the output sequences. For
simplicity, we only consider one-round conversation between the user and the VLMs. For the optimization of our verbose images, the parameters of loss weights 02 = 0, by = 0, a3 = 0.5, and by = 1 and the momentum is set as 0.9.
aj 10, bj 20,
Setups for discussions. For the CHAIR (Rohrbach hallucination. A higher CHAIR value indicates the presence of more hallucinated objects in the sequence, As the calculation of CHAIR requires the object ground truth an image, we employ SEEM (Zou et al., 2023) method to segment each image and obtain the objects they contain.
2018), it measures the extent of the object
For the results of the black-box setting described in Appendix we leverage the transferability of the verbose images to induce high energy-latency cost. Specifically, we consider BLIP, BLIP-2, InstructBLIP, and MiniGPT-4 as the target victim VLMs, while the surrogate model is chosen as any VLM other than the target victim itself.
B BLACK-BOX SETTING
In the previous experiments, assume that the victim VLMs fully accessible. In this section, we consider a more realistic scenario, where the victim VLMs are unknown (llyas et al., 2018 Bai al. 2020b). To induce high energy-latency cost of black-box VLMs, we can leverage the
15

---

Published as a conference paper at ICLR 2024
Proportion (96)
Original
100
Original Ours
Proportion (%6
Originall Ours
Proportion (96
30
Original
00
Ours
80
60
Proportion
20-
40
40
10
20
0
256
384
0
384
512
128
512
128 256 384 Length
512
Length
Length
Length
(a) BLIP
(b) BL.P-2
(c) InstructBI.IP
(d) MiniGPT-4
Figure 5: The length distribution of four VLM models on MS-COCO dataset, including (a) BLIP. (b) BLIP-2. (c) InstructBLIP. (d) MiniGPT-4. The peak of length distribution our verbose images
shift towards longer sequences.
Proportion (%)
Original
Proportion (%)
100
Original
30
Original
30
Original
80
Proportion
Proportion
20
60
60
20
40
10
10-
20
Length
Length
Length
Length
(a) BLIP
(b) BLIP-2
(c) InstructBLIP
(d) MiniGPT-4
Figure 6: The length distribution of four VLM models ImageNet dataset, including (a) BLIP. (b)
BLIP-2. (c) InstructBLIP. (d) MiniGPT-4. The peak of length distribution of our verbose images shift towards longer sequences.
transferability property (Dong et al. 2018) of verbose images. We can first craft verbose images on known and accessible surrogate model and then utilize them to transfer to the target victim VLM. The black-box transferability results across four VLMs of verbose images are evaluated in T When the source model is set as 'None', it indicates that we evaluate the energy-latency cost for the target model using the original images. The results show that our transferable verbose images are less effective than the white-boo box verbose images but still result in longer generated sequence.
C MORE TASKS
To verify the effectiveness our verbose images, we induce high energy-latency cost on two ad- ditional modti-modal tasks: visual question answering (VQA) and visual reasoning. Following Li ct al. (2023b), we use VQAv2 dataset (Goyal et al. 2017 for VQA and GQA dataset (Hudson & Manning, 2019) for visual reasoning. We use BLIP- the target model, and following the rec- ommendations in [i et al. (2023b), we set the prompt template as "Question: O Answer:". Unless otherwise specified, other settings remain unchanged. Table deemonstratss that verbose images can induce the highest energy-latency cost among three multi multi-modal tasks.
D MORE RESULTS OF LENGTH DISTRIBUTION
We provide more results of the length distribution on MS-COCS dataset in Fig. 5 and ImageNet dataset Fig. 6 The length distribution of generated sequences in the four VLM models exhibits bimodal distribution. Specifically, our verbose images tend to prompt VLMs to generate either long or short sequences. We conjecture the reasons as follows. majority the long sequences are generated, confirming the effectiveness of our verbose images. As for the short sequences, we have carefully examined the generated content and observed two main cases. In the first case, our verbose images fail to induce long sentences, particularly for BLIP and BLIP-2, which lack instruction tuning and have smaller parameters. In the second case, our verbose images can confuse the VLMs, leading them generate statements such 'I am sorry, but cannot describe the image.' This scenario
16

---

Published as a conference paper at ICLR 2024
Table 8: The length of generated sequences, energy consumption (J), and latency time (8) against BLIP-2 of our verbose images by the joint optimization of both images and texts. Our verbose images can still achieve better.
MS-COCO Latency
ImageNet Latency
Auacking method
Length
Energy
Length
Energy
Original
5.81
0.37
14.81
5.85
0.35
13.48
Noise
5.91
0.38
15.02
6.65
0.39
18.18
Sponge samples
162.78
4.66
193.76
190.52
5.53
223.94
NICGSlow Down
185.21
5.66
227.03
200.51
6.71
286.09
Verbose images (Ours)
270.25
9.39
378.14
262.92
9.03
365.28
predominantly occurs with InstructBlip and MiniGPT-4, both of which have instruction tuning and
larger parameters.
E JOINT OPTIMIZATION OF BOTH IMAGES AND TEXTS
VLMs combine vision transformers and large language models to obtain an enhanced zero-shot performance in multi-modal tasks (Liu al. 2023b Li et al. 2021 2023b Ma et al. 2022 2024). Hence, VLMs are capable of processing both visual and textual inputs, enabling them to handle multi-modal tasks effectively. In this section, we will adopt our proposed losses and the temporal weight adjustment algorithm to optimize both the imperceptible perturbation of visual inputs and tokens of textual inputs to induce high energy-latency cost of VLMs. For the optimization textual inputs, update parameterized distribution matrix to optimize input textual tokens, suggested in Guo et al. (2021). The number of optimized tokens is set as Besides, Adam optimizer (Kingma & Ba 2015) with learning rate of 0.5 is used optimize input textual tokens every iteration. Moreover, both the imperceptible perturbation of visual inputs and tokens of textual inputs are jointly optimized. Unless otherwise specified, other settings remain unchanged. Table [ demonstrates that our methods can still induce VLMs to generate longer sequences than other methods under the joint optimization of both images and texts of VLMs.
F VISUAL INTERPRETATION
We show more visual interpretation results of the original images and our verbose images by using Grad-CAM (Selvaraju et al. 2017). The results are demonstrated in Fig.
G ADDITIONAL DISCUSSIONS
We conduct additional discussions, including the feasibility analysis of intuitive solution to study whether limitation on generation length can address energy-latency vulnerability, the model per- formance of three energy-latens attacks, image embedding distance between original images and verbose counterpart, energy consumption for generating one verbose image, and standard deviation results of main table.
G.1 FEASIBILITY ANALYSIS OF AN INTUITIVE SOLUTION
An intuitive solution to mitigate the energy-latency vulnerability is to impose limitation on gener- ation length. We argue that such an intuitive solution infeasible and the reason is as follows.
(1) Users have diverse requirements and input data, leading to wide range of sentence lengths and complexities. For example, the prompt text of 'Describe the given image in one sentence." and 'Describe the given image in details." can introduce different lengths of generated sentences. We visualize a case Fig. g Consequently, service providers often consider a large token limit to accommodate these diverse requirements and ensure that the generated sentences
complete and meet users' expectations. Previous work, NICGSlowDown (Chen et al. (022c). also states the same view us. Besides, shown in Table 7 the results demonstrate that verbose images
17

---

Published as a conference paper at ICLR 2024
and its GradCAM
a'and its GradCAM
x and its GradCAM
and its GradCAM
stones on the ground with windows of grass
the cave- mavis beacons National Park by kerrys
a school bus is driving a snowy road
after hiatus school bus now out in a futuristic open
and its GradCAM
x'and its GradCAM
and its GradCAM
x'and its GradCAM
train advancing on the railway track
close up of the outfit of next to a ycllow railway and its GradCAM
some birds on the ground near body of water
duck looking for food ... by the water in the green plain
x and its GradCAM
x and its GradCAM
x' and its GradCAM
a bird with blue and orange feather sitting on a tree
an artist's impression of a blue jay on the sunny day
an orange cat is sitting a bed with a light
grill table design ideas kitten is llyng and resting
Figure 7: GradCAM for the original image and our verbose counterpart a'. The attention of our verbose images is more dispersed and uniform. Note that we intercept only a part of the generated content.
Original image
Describe the given image sentence.
This image shows a ear parked on street. [Total: tokens]
Describe the given image in details.
The given image is of a beige truck with the bood open and the engine visible. The track appears to be parked on the side of a road and there a red car in the background, partially obscured by trees. There are no people visible in the image inn The truck appears to be standard pickup truck, with standard grille and headlights, and a relatively plain body. There bird's-eye view, looking down on truck from above. The tuck appeans of the road and left in this position for some time, as the hood is open and the engine is visible. It possible that the truck was left in this position part of rondside breakdown or as repuir job. The red car in the hackground appeurs to be newer model,
markings identify fying fentures the truck that would help identify The image is likely taken have
parked
side
sleeker design than the truck. [Totull: 223 tokens]
Describe given image as detailed possible. Please provide very detailed analysis.
The given image shows silver colored SUV parked ncxt brick building with green trees the background, The SUV is facing the camera and has two rear tires and truck the background in There is a small amount of dirt and debris on the passenger side of the vehicle. There are no people or other objocts visiblc in the image. in The image was taken with digital camerra, and the lighting appears be natural, There image. point interest in image uppears track and the trees. The shudows on the truck and the trees are well-definan defined, with good contrust between the shadows and the highlights The the image has good level of detail, with all the fentures of the vehicle and the surrounding environment visible. The image in focus and colors appear to natural and nccurate. The colors the vehicle subdued appearunce. uninTh image uppears to be well-compenn composed, with the truck the background serving as point of interest. The position of the SUV and the truck allows for good balance between the two objects. The image appears to have been laken with a digital camera, and the lighting appears be natural The image has good level of detail, with all the fatures the vehicle the surrounding accurate.... [Total: 552 tokens]
apparent vigneltc bokch the background serving sun casting strong shadows the
composition the image simple sraightforward, with truck taken on sunny day,
have
and envirunment are slightly muted, which gives the image pleasing
visible. The image
and colors appear natural and
Figure 8: An example of generated sequences from MiniGPT-4 by different input prompts. Users have diverse requirements and input data, leading to a wide range of lengths of generated sequences.
adaptable for different prompt texts and can induce the length of generated sentences closer to the token limit set by the service provider. As a result, the energy-latency cost can be increased while staying within the imposed constraints.
(2) We argue that this attack surface about availability of VLMs becomes more important and our verbose images can induce more serious attack consequences in the era of large (vision) language
18

---

Published as a conference paper at ICLR 2024
Table 9: The attacking performance, including the length of generated sequences, energy consump- tion (J), and latency time (s), and captioning performance, including BLEU-I, BLEU-2, BLEU-3, BLEU-4, and CIDEr of sponge samples, NoWGSlowDown, and our verbose images.
Attacking performance
Captioning performance
Attacking method
Length
Latency
Energy
BLEU-1
BLEU-2
BLEU-3
BLEU-4
CIDEr
Sponge samples
22.53
0.73
30.20
0.298
0.193
0.120
0,073
0.571
NICGSlowDown
103.54
3.78
156.61
0.012
0.005
0.002
0.001
0.027
Verbose images (Ours)
226.72
7.97
321.59
0.026
0.012
0.005
0.003
0.099
The image embedding distance between original images and attacked counterpart of sponge samples, NICGSlowDown, and our verbose images. All these methods are similar in image embedding distance.
Table 10:
MS-COCO
ImageNet
Attacking method
BLIP BLIP-2
InstructBLIP MiniGPT-4
BLIP BLIP-2
InstructBLIP MiniGPT-4
Sponge samples 0.965
0.977
0,978
0.978
0.968
0.979
0,981
0.981
NICGSlowDown
0.966
0.978
0.979
0.971
0.968
0.980
0.981
0.975
Verbose images (Ours)
0.965
0.970
0.971
0.969
0.966
0.969
0.970
0.971
models. The development of VLMs and LLMs has led to models capable of generating longer sentences with logic and coherence. Consequently, service providers have been increasing the max- imum allowed length of generated sequences to ensure high-quality user experiences. For instance, gpt-3.5-turbo and gpt-4-turbo allow up to 4,096 and 8,192 tokens, respectively. Hence, we would like uncover that while longer generated sequences introduce potential security risks about energy-latency cost, as our verbose images demonstrates. Therefore, when VLM service providers consider increasing the maximum length of generated quences for better user experience, they should not only focus on the ability of VLMs but also take the maximum energy consumption payload into account.
indeed improve service quality, they also
G.2 EVALUATION PERFORMANCE OF ENERGY-LATENCY MANIPULATION
We evaluate the BLEU and CIDEr scores for sponge samples, NICGSlowDown, and our verbose images on MS-COCO for BLIP-2, illustrated in Table Concretely, our verbose images generate the longest sequence, extending it to 226.72, while sponge samples, despite their superior caption- ing performance, only increase the length to 22.53. Furthermore, both the length of the generated sequence and the captioning performance of our verbose images outperform those of NICGSlow- Down.
G.3 IMAGE EMBEDDING DISTANCE BETWEEN ORIGINAL IMAGES AND ATTACKED COUNTERPART
We adopt the image encoder of CLIP to extract the image embedding. Then the image embedding distance is calculated as the cosine similarity of both original images and the corresponding sponge samples (Shumailov et al. 202I), NICGSlowDown (Chen et al. 2022c),, and our verbose images. The results are shown in Table 10 which demonstrates that these methods are similar in image embedding distance.
G.4 ENERGY CONSUMPTION FOR GENERATING ONE ATTACKED IMAGE
We calculate the energy-latency cost for the generation of one verbose image and show the results in Table It can be observed that the eneryy-latenc, cost during attack increases with the number of attack iterations, along with increase in energy consumption for generating This finding provides valuable insights into the positive relation between the attack performance and the energy consumption associated with the generation of verbose images.
verbose image.
19

---

Published as a conference paper at ICLR 2024
The length of generated sequences, energy consumption (J) and latency time (s) during attack, and energy consumption (J) and latency time (s) during generation against BLIP-2 for gener- ating one verbose image. The results indicate positive correlation between the energy-latene cost during attack, the energy-latency cost during generation, and the number of attacking iterations.
Table 11:
During attack
During generation
Attacking iterations
Length
Latency
Energy
Latency
Energy
8.40
0.45
17.91
100
70.26
3.77
136.73
50.28
6593.69
500
175.24
6.84
285.63
261.20
36537.34
1000
226.72
7.97
321.59
442.12
67230.84
Table 12: The standard deviation results for length of generated sequences, energy consumption (J), and latency time (s).
MS-COCO Lateney
ImageNet Lateney
VLM model
Method
Length
Energy
Length
Energy
Original
1.96
0.16
6.97
1.83
0.17
7.13
Noise
1.83
0.14
6.22
1.86
0.14
6.03
BLIP
Sponge samples
100.69
1.66
145.27
124.64
2.02
171.51
NICGSlowDown
205.71
3.21
278.81
214.22
3.30
294.34
Verbose images (Ours)
207.88
3.26
284.50
209.32
3.31
297.79
Original
3.25
0.20
8.67
3.32
0.22
8.97
Noise
3.26
0,22
8.68
3,08
0,21
8.93
BLIP-2
Sponge samples
64.11
1.09
44.22
100.63
1,80
77.80
NICGSlow Down
166.75
2.48
104.35
189.63
2.14
92.32
Verbose images (Ours)
170.70
3.74
161.27
164.81
4.76
191.38
Original
19.90
0.71
37.07
17.76
0.72
37.47
Noisc
18.79
0.68
33.93
18.31
0.71
35.02
InstructBLIP
Sponge samples
23.84
0.70
37.21
23.36
0.63
32.35
NICGSlowDove
22.86
0.70
36.01
24.29
0.67
33.43
Verbose images (Ours)
56.52
1.07
56.65
80.55
1.62
85.84
Original
47.54
7.21
227.09
52.46
7.29
231.74
Noise
47.93
6.79
212.87
53.30
6.83
219.14
MiniGPT-4
Sponge samples
239.17
10.02
330.83
196.57
11.04
353.66
NICOSlow Down
264.48
11.36
382.07
188.33
11.98
379.11
Verbose images (Ours)
223.39
11.53
352.66
160.35
11.10
352.03
Besides, the overall energy-latency cost of generating single verbose image is higher than that of using it to attack VLMs. Therefore, necessary for the attacker to make full use of every gener- ated verbose image and learn from DDoS attack strategies to perform this attack more effectively. Specifically, the attacker can instantly send as many copies of the same verbose image as possible to VLMMs which increases the probability of exhausting the computational resources and reducing the availability of VLMs service. Once the attack successful and causes the competitor's 's service to collapse, the attacker will acquire numerous users from the competitor and gain significant benefits.
G.5 STANDARD DEVIATION RESULTS
The standard deviation results for length of generated sequences, energy consumption, and latency time are shown in Table
H ADDITIONAL ABLATION STUDIES
We conduct additional ablation studies, including the effect of different sampling policies and dif- ferent maximum lengths of generated sequences.
20

---

Published as a conference paper at ICLR 2024
Table 13: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 in different sampling policies. Our verbose images can still achieve better in different sam- pling policies.
MS-COCO Latency
ImageNet Latency
Sampling method
Method
Length
Energy
Length
Energy
Original
8.19
0.27
10.06
7.58
0.24
10.23
Noisc
7.32
0.23
10.24
7.74
0.25
10.43
Greedy search
Sponge samples
8.47
0.27
11.30
8.11
0.27
10.90
NICGSlow Down
195.44 49
5.22
216.48
267.02
7.45
301.47
Verbose images (Ours)
323.97
8.86
367.72
352.16
9.56
399.19
Original
9.53
0.42
17.74
8.84
0.43
18.75
Noise
9.34
0.41
16.87
8.76
0,45
19.36
Beam search
Sponge samples
9.96
0.46
18.36
8.96
0.39
17.99
NICGSlowDown
305.73
8.88
451.59
425.87
12.20
610.64
Verbose images (Ours)
437.02
12.40
639.74
469.87
13.00
683.11
Original
8.20
0.33
13.22
7.54
0.31
12.85
Noise
8.15
0.32
13.17
7.59
0.32
13.01
Top-k sampling
Sponge samples
8.53
0.35
14.86
7.73
0.26
11.03
NICGSlowDowe Down
207.96
5.77
225.89
262.11
7.12
291.76
Verbose images (Ours)
293.48
8.08
330.39
372.53
10.24
417.89
Original
8.82
0.39
16.08
8.11
0.37
15.39
Noise
9.55
0.43
17.53
8.37
0.44
19.39
Nucleus sampling
Sponge samples
22.53
0.73
30.20
43.59
1.51
63.27
HICGSlowDown
103.54
3.78
156.61
129.68
4.34
180.06
Verbose images (Ours)
226.72
7.97
321.59
250.72
10.26
398.58
Table 14: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 different maximum lengths. Our verbose images can still achieve better in different maximum lengths.
MS-COCO Latency
ImageNet Latency
Maximum length
Method
Length
Energy
Length
Energy
Original
7.88
0.31
13.34
8.61
0.35
14.49
Noise
8.45
0.35
14.11
8.25
0.34
13.81
128
Sponge samples
16.60
0.51
21.79
22.73
0.72
28.90
NICGSlowDown
35.94
1.26
49.60
40.46
1.46
59.13
Verbose images (Ours)
61.55
2.25
90.53
66.89
2.38
91.97
Original
8.18
0.32
13.01
8,03
0.34
13.83
Noise
8.26
0.35
14.67
0.34
13.46
256
Sponge samples
18.75
0.55
23.42
31.68
0.93
37,26
NICGSlowDowe
60.73
2.00
80.83
70.57
2.21
87.41
Verbose images (Ours)
109.13
4.04
163.74
116.94
4.17
167.02
Original
8.82
0.39
16.08
8.11
0.37
15.39
Noise
9.55
0.43
17.53
8.37
0.44
19,39
Sponge samples
22.53
0.73
30.20
43.59
1.51
63.27
NICGSlow Down
103.54
3.78
156.61
129.68
4.34
180.06
Verbose images (Ours)
226.72
7.97
321.59
250.72
10.26
398.58
Original
8.18
0.35
13.97
8.49
0.35
14.69
Noise
7.78
0.40
14.94
8.10
0.33
14.39
1024
Sponge samples
30.60
0.92
34.34
64.10
1.97
85.01
NICGSlow Down
193.97
5.80
237.39
256.35
7.71
312.95
Ver Verbose images (Ours)
417.66
13.92
586.40
447.88
14.81
611.60
H.1 DIFFERENT SAMPLING POLICIES
In our default settings, VLMs generate the sequences using nucleus sampling method (Holtzman al. 2020) with p 0.9 and temperature & Besides, present the results of three other
21

---

Published as a conference paper at ICLR 2024
sampling policies, including greedy search, beam search with beam width of and top-k sampling with A = 10. As depicted in Table 13, our verbose images can induce VLMs to generate the longest sequences across various sampling policies, demonstrating that our verbose images not sensitive to the generation sampling policies.
H.2 DIFFERENT MAXIMUM LENGTHS OF GENERATED SEQUENCES
Table 14 presents the results of five categories of visual images under varying maximum lengths of generated sequences. It shows that the maximum length of generated sequences of VL.Ms increases, the length of generated sequences becomes longer, leading to higher energy consumption and longer latency time. Furthermore, verbose images consistently outperform the other four methods, which confirms the superiority of our verbose images.
I
GRID SEARCH
conduct the experiments grid search (Gao al. 2023) for different parameters of loss weights and different momentum values.
1.1 DIFFERENT PARAMETERS LOSS WEIGHTS
We set parameters of loss weights as = 10, bj 20, d2 = 0, 62 = 0, a3 = 0.5, and 63 during the optimization of our verbose images. These parameters are determined through the grid
search. The results of grid search are shown in Ta5 Table [6] Table 17 Table 18 Table 19 and
Table 20 which demonstrates that our verbose images with a₁ 10, bj 20, a2 0, b2 0, 43 0.5, and by = 1 can induce VLMs to generate the longest sequences.
1.2 DIFFERENT MOMENTUM VALUES
We show the results our verbose images in different momentum values m = 0.,0.3, 0.9} in Table 21, These results demonstrate that it is necessary adopt the addition of momentum during the optimization.
J VISUALIZATION
We visualize the examples of the original images and our verbose images against BLIP, BLIP-2, InstructBLIP, and MiniGPT-4 in Fig. 9 Fig. [0] Fig. II and Fig. [2 It can be observed that VLMs with more advanced LLMs (e.g., Vicuna-7B) generate more fluent, smooth, and logical content when encountering our verbose images.
22

---

Published as a conference paper at ICLR 2024
Table 15: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of a1
MS-COCO Latency
ImageNet Latency
b
b2
bg
Length
Energy
Length
Energy
-20
0.5
215.91
7.36
310.36
233.67
8.83
375.31
10
-20
0
0.5
226.72
7.97
321.59
250.72
10.26
398.58
100
-20
0
0
0.5
159.34
5.77
207.95
162.75
6.88
232.95
Table 16: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of b1.
MS-COCO Latency
ImageNet Latency
b1
b2
bg
Length
Energy
Length
Energy
10
-2
0.5
212.99
7.39
307.97
212.14 14
7.56
304.26
10
-20
0
0.5
226.72
7.97
321.59
250.72
10,26
398.58
10
-200
0
0.5
195.23
6.74
253.56
195.38
6.32
266.37
Table 17: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of a2-
MS-COCO Latency
ImageNet Latency
Q1
b1
bz
0g
by
Length
Energy
Length
Energy
-20
0
0.5
177.59
7.06
270.62
213.63
8.18
297.52
-20
0,5
226.72
7.97
321.59
250.72
10.26
398.58
-20
0
0.5
196.17
6.87
290.8
227.38
10.06
357.64
Table 18:
The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of bz.
MS-COCO Latency
ImageNet Latency
01
b
01
b2
03
by
Length
Energy
Length
Energy
10
-20
0
0.1
0.5
132.13
5.54
206.47
160.53
6.51
227.87
226.72
7.97
321.59
250.72
10.26
398.58
10
-20
0
0.5
203.61
7.08
286.32
224.06
9.36
345.61
Table 19: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of d33
MS-COCO
ImageNet Latency
011
6
02
b2
bg
Length
Latency
Energy
Length
Energy
10
-20
0
0
0.05
209.43
7.18
292.43
217.03
8.62
303.73
10
0
226.72
7.97
321.59
250.72
10.26
398.58
10
-20
0
0
199.62
7.17
283.76
226.52
8.06
335.48
Table 20: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of bg.
MS-COCO Latency
ImageNNtt Lateney
a1
b
02
b2
43
by
Length
Energy
Length
Energy
10
-20
0
0
0.5
0.1
208.48
7.16
290.92
236.06
9.97
380.23
-20
0
0.5
226.72
7.97
321.59
250.72
10.26
398.58
10
-20
0
0
0.5
10
186.68
7.05
282.61
222.03
9.03
340.55
Table 21: The length of generated sequences, energy consumption (J), and latency time (s) against
BLIP-2 for grid search of the momentum m.
MS-COC COCO Latency
ImageNet Latency
m
Length
Energy
Length
Energy
0
199.92
7.02
292.55
231.03
7.88
318.34
201.83
7.21
301.70
237.85
9,33
330.83
0.6
218.69
7.69
312.77
240.27
9.85
376.59
0.9
226.72
7.97
321.59
250.72
10.26
398.58
23

---

Published as a conference paper at ICLR 2024
A cat looking at television screen turned
banana and apple being suspended on wires.
group a cat with black bear on neck the form of mini guitar, fake black dog, and tiger dog, painted as truck with leopard, that is sitting in the The person funny animal print graduation ruges craft print pizzas and funny cat hola person with the bus. person with a calculator bear head and the laptops made to look like two dogs, slotted black bears and black bears with auto cars as wheels painted on them, as their animals, all animals, look like they treading the self. Their bears holding vehicle with wheels and the green
hand gesture of words with much fruit and knife body don't see group out cake. some bananas an apple by a sculpture on one oval table in front of in front by advertising for food plate art group to people lunch series with art dinner or a white plate of apples above, an entrament. The banana peel with two oranges and an apple on a pedestal next to statue set by person background with fruit bedding bed oval background, oval drawing, oval person's, space oval floor with strawberry. In the foreground, there are bananas
oval print
the walls in
Figure 9: A visualization example for the original images and our verbose counterpart against BLIP.
24

---

Published as a conference paper at ICLR 2024
boy looking at bird on cliff.
W Two motorcyclists riding race cars down a track.
dg A boy in white t-shirt and shorts standing on dirt path by lake with a large bird in the background. The sun shines brightly, casting a warm glow on scene and creating peaceful atmosphere. the background, a large, majestic bird can be seen, perhaps heron his father, his hands with bird, crocodile, old man and his son, his wife, his dog. The calm waters of the lake reflect boy and woman, mother and son, car, and son. This boy holding his toy, his boat, and his grandfather, looking down the river ......
33 Super stock race is meeting at beautiful rain acrobatics, air - show, fireball paraflame, fireball mavita group photos, On January 13, 2018, Round the Super Stock took place, drawing large crowd enthusiastic spectators, cager to witness the exeitement on the Super Stock 600 track. The super stock shows the photos, person, heroes automotive, and whoever. During the process, the classic motorcycle competitors have won the super stock 600 class at the beautiful sunny day and classic motorcycle race on Saturday every morning... ...
egret. He is with
Figure 10: A visualization example for the original images and our verbose counterpart against BLIP-2.
25

---

Published as a conference paper at ICLR 2024
What is the content of this image?
8 What is the content of this image?
The image features cozy living room with well-lit window, providing view of a city scene. There is small couch in the room, and it is situated close to staircase. Additionally, there is coffee table, several pillows, and two chairs in the room.
The image features large white ferry boat cruising across the water, surrounded by the blue ocean and bridge in the background. There are numerous flags adorning the ferry boat, showcasing the spirit of the vessel as travels through the water.
R
What is the content of this image?
What the content this image?
The image features two levels, the second level featuring the main scene. The first floor is small apartment or studio with living room and dining area. The living room includes a couch and a coffee table, while the dining area contains chairs and a dining table. A lamp situated on the edge the image on the left, and there is window on the left side of the room. Several chairs can be seen in the living room and dining area, creating cozy atmosphere. On the second floor, the main scene
(2)
The image depicts a ship floating calm sea, carrying several passengers with its high- speed propeller. The ship has a colorful flag, indicating its nationality or destination. The background features picturesque landscape, with row of trees and distant shore background. The boat passing by large lighthouse that stands proudly, serving navigation aid and beacon for ships sailing by. In the foreground, airplane is visible, perhaps adding to the overall picture of an exciting maritime
Figure 11: A visualization example for the original images and our verbose counterpart against InstructBLIP.
26

---

Published as a conference paper at ICLR 2024
8 Give the following image. You will able
Give the following image. You will be able 8
the image once I provide to Please answer my questions.
the image once provide to you. Please answer my questions.
8
What is the content of this image?
What is the content of this image?
This image depicts two people on skis with poles, walking through snowy terrain. The sky overcast, and there are some dark trees visible in the background. The color palette is muted and monochromatic, with the figures wearing white clothing.
This image is of motorcycle parked on the side of road surrounded appears to be taken sunny day with lots of light coming through the trees. The motorcycle is parked with the side of the bike facing the camera.
dense forest.
Give the following image. You will able to see the image provide you. Please answer my questions.
1
Give the following image. You will be able to see the image once provide to Please answer my questions.
&
What is the content of this image?
1
What is the content of this image?
content of this image two people in snowy environment. The person in the front is wearing suit that appears to be made out of snow and the person in the back is holding a gun. There are also several other objects the background such trees and other buildings. The mood of the image cold and wintery. The image is also in black and white. The subject matter of the image is people a snowy environment. The genre of the image is landscape. The style of the image is realistic
The image shows a man and a motorcycle on road surrounded by trees. The man sitting on the motoreycle with his legs stretched out front of him. He is wearing black leather jacket and black jeans. The motorcycle is black and has a silver fuel tank. The background is made up of tall, thin trees a row, creating lush green canopy above the road. There are also small green plants and grass growing along the sides of the road
Figure 12: A visualization example for the original images and our verbose counterpart against MiniGPT-4.
27


Reviews:
[{"review_id": "29IX9xAJd6", "reviewer": "Reviewer_xu4N", "summary": "The computation cost, including energy consumption and latency time, is an important issue for the development of large vision-language models. This paper investigates the computation cost and observes that it highly correlates with the generated sequence length. To maximize the generated sequence length, this paper seeks to craft an imperceptible perturbation during the inference stage and proposes three losses to guide the derivation of the verbose image, including a delayed EOS loss, an uncertainty loss and a token diversity loss. In addition, a temporal weight adjustment algorithm is proposed for better optimization. Experiments on MSCOCO and ImageNet show the effectiveness of the proposed verbose images. Beyond inducing longer generated sequences, the verbose images can introduce more dispersed attention and enhance the object hallucination.", "questions": "The verbose images reveal some susceptible aspects of current LVLMs. I am interested to see how such findings can further shed light on the learning of LVLMs. By the way, I suspect whether such a phenomenon always exists in the data-driven deep-learning approach? So, is there any insight on optimizing LVLMs?", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 4, "contribution": 3, "strengths": "1. The problem is well-formulated. The solutions and results are delivered clearly. I appreciate the writing and presentation.\n2. Simple yet effective methods to induce longer generated sequences. Adding imperceptible perturbation is a reasonable way to induce longer sequences. Optimizing the verbose images via the sequence losses is also quite straightforward.\n3. The experimental results are quite convincing. The models, when faced with verbose images, perform much worse than original results. The ablations and qualitative explorations show intriguing results.", "weaknesses": "Despite the simplicity and effectiveness, I think this paper lacks novelty.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "6N33YkdLXj", "reviewer": "Reviewer_Ysyk", "summary": "This paper propose an attack that makes a VLM model generate a very long sequence such that its power consumption become much higher. The paper adopts existed approaches and augments them with two new design into the training framework.", "questions": "1. Why the quality output won't be a metric? Does it mean that this attack are designed to be easily spotted? As one of current practice is using another LLM to inspect the output of current LLM.\n\n2. In Fig. 3, 5 and 6, why the attack distribution results in like two-mode distribution?\n\n3. What is the image embedding distance between the original image and the attacked image? \n\n4. What is the energy consumption for generating one attack image?\n\n5. When showing the results of length in the Table, the standard deviation should be added.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. The proposed method demonstrates the attack power on VLM and make the model generate very long output.\n\n2. The paper proposed new loss ($L_3$) and temporal weighting to train the model better.", "weaknesses": "1. A simple defense of the service provider could be set the limit of token based on the statistics of the clean data. As shown in Fig. 5 and 6, the original distribution focus certain length. In such case, it seems that this attack won't be too sever anymore?\n\n2. I am not sure is this a real problem or not, as pointed by 1, a simple approach can resolve it (but with some tradeoff); on the other hand, as the attacked results do not make sense anymore (e.g. Fig.8), it seems the attacks can be easy identified. I think the problem definition should be constrained on the results are still make sense and good. That is, the evaluation should consider the performance of those tasks.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CkM1k3RJBz", "reviewer": "Reviewer_NtLX", "summary": "The paper investigates the attack of VLMs, which will induce high energy-latency cost during inference via maximizing the length of the sequence. To achieve this aim, the paper proposes three losses, which first decrease the probability of the end-of-sequence token, and then increase the uncertainty of output tokens and diversity of token embeddings. Experiments are done on popular VLMs models including BLIP, BLIP-2, InstructBLIP, and MiniGPT-4, and on common datasets including MS-COCO and ImageNet datasets.", "questions": "Please check the weakness part.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "* The paper investigates an important and interesting problem, which attacks the inference efficiency of VLMs. The proposed solution is simple and does not cost much.\n* The paper is well-written and easy to follow. The figures are presented well.\n* Experiments have been done on a variety of models with two tasks. Improvements in sequence length and latency are obvious. Also, the paper gives a detailed ablation study.", "weaknesses": "* The motivation or the reason for the effectiveness of the second loss is weak. I think the second loss, which increases the uncertainty of tokens is more like destroying the accurate outputs. While the paper claims that the second loss can help with longer sequences, I do not see a strong correlation. Can the authors give some description to build the relationship between sequence length and token uncertainty, which usually indicates less favorable accuracy performance? \n\n* In the third loss part, the paper claims that “for a matrix, the calculation of the matrix rank is an NP-hard non-convex problem”, and thus proposes the third loss. Unfortunately, this is not true. For the 2-way matrix that corresponds to [token, hidden_states] in this example, the rank calculation is available by Gaussian elimination and is not NP-hard. Therefore, I keep doubting the motivation and design of the third loss, which also shows the least performance improvement in the ablation study.\n\n* The paper seems to target the problem in VLMs and claims that VLMs have special things like vulnerabilities from the manipulation of visual inputs. While it says that other methods for LLMs, can not be directly applied to VLMs, I do not see the special design or consideration in this method for challenges in VLMs.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)