Topological Signatures of Adversaries in Multimodal Alignments
Authors: Minh N. Vu
Geigh Zollicoffer
Huy Mai
Ben Nebgen
Boian Alexandrov
Manish Bhattarai
Venue: ICML 2025 poster (2025)
Keywords: Multimodal Adversarial Detection
Persistent homology
Text-image alignment
Maximum Mean Discrepancy Test
Primary area: social_aspects->security
TL;DR: Via persistent homology, we introduce two novel topological-contrastive losses detecting topological disruptions in image-text embeddings of adversaries in multimodal machine learning, and utilize these signatures for improved adversarial detection.

Abstract: Multimodal Machine Learning systems, particularly those aligning text and image data like CLIP/BLIP models, have become increasingly prevalent, yet remain susceptible to adversarial attacks. While substantial research has addressed adversarial robustness in unimodal contexts, defense strategies for multimodal systems are underexplored. This work investigates the topological signatures that arise between image and text embeddings and shows how adversarial attacks disrupt their alignment, introducing distinctive signatures. We specifically leverage persistent homology and introduce two novel Topological-Contrastive losses based on Total Persistence and Multi-scale kernel methods to analyze the topological signatures introduced by adversarial perturbations. We observe a pattern of monotonic changes in the proposed topological losses emerging in a wide range of attacks on image-text alignments, as more adversarial samples are introduced in the data. By designing an algorithm to back-propagate these signatures to input samples, we are able to integrate these signatures into Maximum Mean Discrepancy tests, creating a novel class of tests that leverage topological signatures for better adversarial detection.

Topological Signatures of Adversaries in Multimodal Alignments
Minh Vu Geigh Zollicoffer
Huy Mai 2
Ben Nebgen'
Boian Alexandrov Manish Bhattarai
Abstract
that can maliciously alter the system's outputs (Goodfel- low, 2014; Brendel et al., 2017). While substantial research has focused on safeguarding AI models against adversarial attacks in unimodal contexts, the challenges presented by the multimodal landscape remain understudied. Notably, although adversarial attacks in multimodal settings have advanced rapidly (Zhang et al., 2022; Zhou et al., 2023), defense strategies have yet fully consider the unique char- acteristics of multimodal systems, which are crucial for enhancing their robustness against such threats.
Multimodal Machine Learning systems, partic- ularly those aligning text and image data like CLIP/BLIP models, have become increasingly prevalent, yet remain susceptible to adversarial attacks. While substantial research has addressed adversarial robustness in unimodal contexts, de- fense strategies for multimodal systems are un- derexplored. This work investigates the topologi- cal signatures that arise between image and text embeddings and shows how adversarial attacks disrupt their alignment, introducing distinctive signatures. We specifically leverage persistent homology and introduce two novel Topological- Contrastive losses based on Total Persistence and Multi-scale kernel methods to analyze the topo- logical signatures introduced by adversarial per- turbations. We observe a pattern of monotonic changes in the proposed topological losses emerg- ing in a wide range of attacks on image-text align- ments, as more adversarial samples are introduced in the data. By designing an algorithm back- propagate these signatures to input samples, we are able to integrate these signatures into Maxi- mum Mean Discrepancy tests, creating novel class of tests that leverage topological signatures for better adversarial detection.
In this study, we focus on multimodal alignments, typically appearing in CLIP (Radford et al., 2021) and BLIP (Li et al., 2022), where the image and text data embeddings are aligned for downstream predictions. Based on the Man- ifold Hypothesis (Goodfellow al., 2016), in many in- stances- such as natural images the support of the data distribution stays on low-dimensional manifold embed- ded within Euclidean space. Many interesting features and patterns of those data can be captured through the topolog- ical properties of that manifold as well as the manifold of their neural network's embeddings. Particularly, through extensive experiments based on persistent homology, an emerging technique in topological data analysis (TDA) to study those manifolds, we show that adversarial attacks alter the image-text topological aligmment and introduce distine- tive topological signatures. We further demonstrate that the presence of adversarial examples in an image batch can be more effectively detected with those signatures.
1. Introduction
The key results of this work are highlighted in Fig. 1. Using the ImageNet (Deng et al., 2009) and CIFAR- 10 (Krizhevsky, 2009) datasets with CLIP-ViT-B/32 and (TTEL/ respectively, we demonstrate our proposed Total Persistence (TP) loss 47 and Multi-scale Kernel (MK) loss L5 under varying proportions of ad- versarial samples in the data batch. Intuitively, these losses capture the mismatch in the corresponding topological sig- natures between the image and text embeddings. The results clearly show a proportional change in these losses the per- centage of adversarial data increases, emphasizing the sen- sitivity of our topological measures to adversarial perturha- tions. In the third and fourth columns, we demonstrate how the Maximum Mean Discrepancy (MMD) (Grosse et al., 2017; Gao al., 2021) tests, based on topological features derived from the TP and MK losses (TPSAMMD and MK-
In recent years, the rapid advancement of artificial intel- ligence (AI) has led to the development of increasingly complex multimodal systems that integrate diverse streams of data, including text, images, audio, and graphs. As these technologies become more pervasive, they also face signif- icant vulnerabilities, particularly from adversarial attacks. Adversarial attacks exploit inherent weaknesses in machine learning (ML) models by introducing subtle perturbations
'Thoreetical Division, Los ALamos National Laboratory, Los Alamos, NM, USA 'Independent. Correspondence to: Minh Vu <mvu@ gov.
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Topological Signatures of Adversaries in Multinodal Alignments
ImaggeNe- VIT-B/32
Normalzes
2.0
2.3-
Total Persistance Ratios
---
PGD 1p481
PG3 [poo]
Epp4)
Rormalzzes MIC Lozs
0.0
1.0
PCD (E364)
AA (tpss)
M. Eas4)
PGD (E2680
Loss Ratios
Te.st Power
1.0
0.75
Test Epc
Type Error
0.02
0.08
0.04
0.00
0.10
Eps
SAMMD
MKSAHMD
ME
C2ST
TPSAHIND
941
0.00
0.09
1/255
2/255
4256
1/255
2255
Adversorial Ratio
Acvarsarial
Attack megnitude (Ups)
Altack iragritude (kps)
CIFARIO VTTL/14@336px
Total Porsistance vs Adv. Ratios
MK Losp vS Adv. Ratlos
Test power vs. Eps
Typo | crror Eps
Normelized TP
20-
10
(ipeli
Iopadt
Norma aalaaadddd MK Loss
20
2.5
[ipel1 POD 12y0811
(-150)
Test Power
C.75
2.00
Type Error
2.08
3.04
2.08
SCF
MISANMD
C2ST
SAMND
ME
DC2
TPSAHMD
0.2
0.6
0.6 Advensarial
C.00
1,255
2/555
4/55
500
1/255
2755
4055
Ratio
Attack magnitude (Eps)
Attack megnituce (Eps)
Figure 1. Highlights of our results in ImageNet (top) and CIFARIO (bottom) in CLIP's alignment: (Ist and 2nd columns) The TP and MK losses of the data hatch monotonically change as the proportion of adversaries (AA for AutoAttack and PGD for Projected Gradient Descent) in the batch increases. (3rd and 4th columns) Utilizing the topological signatures derived from TP and MK losses significantly improve the Test power of existing MMD solutions, e.g.. TPSAMMD and MKSAMMD vs SAMMD, while keeping the Type errors under control (e.g., 5% error). The results are shown for Autoattack with Loo.
SAMMD), enhance the test power and control Type-I error in existing MMD solutions, highlighting the effectiveness of our topological approach in detecting multimodal adver- sarial attacks. This work's main contributions are:
adversarial generation methods (FGSM, PGD, Au- toAttack, APGD, BIM, and Carlini-Wagner (CW)) to demonstrate the advantages of the two above findings.
Our paper is organized as follows. Sect. provides the back- ground and related work of this study. Sect. 3 formulates our proposed TC losses and demonstrates their capabilities in monitoring alignment of multimodal adversaries. Sect. 4 shows how we can leverage the TC losses for MMD-based adversarial detection. Sect. 5 reports our experimental re- sults, and Sect. 6 concludes this paper.
We introduce two novel Copollogicl-CConrrasee (TC) losses, P and 43 based on Total Persistence (Di- vol & Polonik, 2019) and Multi-scale Kernel (Rein- inghaus et al., 2014), measuring the topological differ- ences between image embeddings and text embeddings in multimodal alignment. We provide extensive experi- ments showing the presence of adversaries results in clear distinction in the TC losses, i.e., in most set- tings, the TC losses monotonically change when more adversarial data is in the data batch. We also provide a theoretical justification for the increase of TP via Poisson Cluster Process modeling.
2. Related Work and Preliminaries
The Two-sample test and the MMD: Given samples from two distributions P and Q, two-sample test assesses whether to reject the null hypothesis that P Q based on a test statistic that measures the distance between the samples. One such test statistic is the MMD, which quan- tifies the distance between the embeddings of the proba- bility distributions into a reproducing kernel Hilbert space (RKHS) (Gretton et al., 2012):
We integrate both TC losses into state-of-the-art (SOTA) MMD tests that differentiate between clean and adversarial data, creating novel class of MMD tests based on TC features. Specifically, we design an algorithm to back-propagate the TC losses to the input samples, resulting in the TC features capturing how much each sample contributes to the global topological distortion in the data batch. These features are then used to enhance the MMD test.
MMP Q: H4) = sup fEHLIfIIS
B[f(x)] E[f(Y)] (1)
Here, le is a bounded kernel associated with the RKHS H4 (i.e., [k(())) < o0), || := || llH,, and X and Y are random variables sampled from P and Q, respectively. Gretton et al. demonstrated that the MMD equals zero if and only if P == Q, indicating that the MMD can be used to determine whether two distributions are identical.
We conduct extensive experiments in 3 datasets (CI CIFAR- 100, and ImageNet), 5 CLIP em- beddings (ResNet50, ResNet101, ViT-B/16, ViT-L/14, and ViT-L/14@336px), BLIP embeddings ( VIT- B/14, VTT-B/129, and VIT-B/129 -9- and 6
Adversarial Detection in Unimodal/ MI. In
2

---

Topological Signatures of Adversaries in Multimodal Alignments
the unimodal context, many defense methods have been pro- posed to safeguard against adversaries (Costa al., 2024). For our scope, we focus on statistical methods detecting the presence of adversaries based on MMD. Specifically, the paper (Grosse et al., 2017) introducing a Gaussian kernel- based two-sample test is one of the first works employ- ing the MMD to detect adversaries. Later, Sutherland et al. (Sutherland al., 2016) and Liu al. (Liu et al., 2020) developed MMD tests with optimized Gaussian kernels and deep kernels, respectively, Gao et al. (Gao et al., 2021) further proposed applying the MMD test to the semantic features (SAMMD) of the attacked models, which signif- icantly improved test power. In addition to MMD- based methods, numerous other detection techniques leverage re- cent advancements in diffusion models (Zhang et al., 2023), Bayesian uncertainty estimates (Feinman al., 2017), man- ifold learning (Ma et al., 2018; Park al., 2022). Gaussian discriminant analysis (Lee et al., 2018), unsupervised clus- tering (Cohen et al., 2020; Mao et al., 2020), and neural network classifiers (Li & Li, 2017).
Topological data analysis (TDA): is an emerging field in mathematics that applies the concepts of topology into prac- tical, real-world applications. It has significant uses in areas such as data science, robotics, and neuroscience. TDA em- ploys advanced tools from algebraic topology to analyze the inherent topological structures in data, uncovering insights that traditional metric-based methods may overlook. The most widely used technique in modern TDA is persistent homology, developed in the early 2000s by Gunnar Carlsson and his collaborators. We recommend consulting (Ghrist, 2014; Edelsbrunner & Harer, 2022) for a comprehensive overview of persistent homology and TDA.
Given a point cloud X, this work considers the Vi- etoris-Rips Rips complex (VR) (Vietoris, 1927) of X at scale (where 0 S E < oo), denoted by R. (X). This complex includes all simplices (i.e., subsets) of X such that every pair of points within simplex satisfies dist(ar,, 2ry) S e for all Zi, Iy E X. Since the VR complexes satisfy the relation R. (X) S (X) for e S é', they constitute a filtration and can track the evolution of the homology groups (i.e., topolog- ical invariants) as increases (Edelsbrunner & Harer, 2022). Each topological feature is monitored by its birth time e b when it appears and its death time e = d when it disappears. They are the central concepts understand the persistence of topological signatures within the data. For given di- mension i, the birth-death pairs (b, d) E B - (b < d) can be encoded in a persistence diagram (X corresponding to the features in the i-th homology group. Intuitively, the difference between death and birth indicates the significance of feature. Readers can refer Fig. 2 for illustrations of the VR filtration and the persistence diagrams.
Adapting adversarial detection techniques towards mul- timodal systems has recently gained substantial inter- est (Zhang et al., 2024a). Zhang et al. suggests utilizing variety of mutations to disturb adversarial perturbations. Hsu et al. empirically identifies the model's weights that contribute to unwanted outputs and safeguards the model by utilizing LORA (Hu et al., 2022). Prompt optimization techniques have also been used to better inform the model of possible attacks (Wang et al., 2024b). There also exists recent evidence that hidden states of multimodal systems contain signatures of adversarial text data and can be utilized for detection (Zhao et al., 2024; Wang et al., 2024a).
Multimodal Alignment: CLIP (Radford et al., 2021) and BLIP (Li et al., 2022) are multimodal systems developed by OpenAl and Salesforce respectively that bridge the gap between natural language and visual understanding. Unlike traditional systems that are trained for specific tasks, they are trained to understand wide variety of visual concepts in zero-shot manner by leveraging large-scale image-text pairs. Both systems consist of an image encoder, typically a convolutional neural network (e.g., ResNet) or a Vision Transformer (ViT) that processes input images and maps them to high-dimensional embedding space, and text encoder, usually Transformer (e.g., GPT-like architecture) that processes input text descriptions and maps them to the same embedding space as the image encoder. Those image and text embeddings are then aligned to perform a vari- ety of tasks without additional computation. For instance, CLIP and BLIP can conduct zero-shot image classification by comparing the image embeddings to class labels' em- beddings. Thus, adversaries can be considered specially crafted inputs designed to disrupt the image-text alignment.
3. Topological Signatures of Adversaries against Multimodal Alignment
Our analysis of multimodal adversaries is based on the in- tuition that the adversarial perturbations in one data stream can potentially alter or destroy the alignment between that data and another data stream. The problem is in how to capture this behavior, analyze, and leverage it for better ad- versarial detection. Measuring multimodal alignment not trivial because the data streams not only come from different domains, have different representations, and semantic mean- ings, but also lack index alignment. We tackle that question through the lens of TDA: we first capture the topological structures from the point clouds of representations of each data stream. We then compare the extracted topological fea- tures to measure the alignment. In particular, we rely on the total persistence (Divol & Polonik, 2019; Edelsbrunner & Harer, 2022) and the Multi-scale Kernel (Reininghaus et al., 2014), two concepts of persistence homology, to quantify topological information.
This section first describes our proposed topological con-
3

---

Topological Signatures of Adversaries in Multimodal Alignments
Embedding
Vietorie Filtration
Persistence Diagram
Tapo. Contrastive Measure
Clean
Lye (Cleann Text)
Image
Backward Topo, Loea
Adv. Image
(Ado,,
Backward Topo.
Text
Figure 2. The computations of the TC loss Lrc E {Cip, c3cc and the backward computations of the topological features.
trastive losses, i.e., the TP and the MK losses (Subsect. 3.1). Then, results from extensive experiments on CLIP and BLIP models will show that the presence of adversaries in the in- put data batch introduces distinct topological signatures captured by TP and ML losses (Subsect. 3.2). We further attempt explain the observed monotonic increasing be- havior of TP by modeling the logits Poisson Cluster Process (PCP) (Subsect. 3.3). With the assumption that the adversaries' logits are less tightly clustered to the predicted classes, PCP modeling enables Monte Carlo simulation to compute TP and demonstrate why adversarial logits gener- ally result in higher 0-th order TP, providing insights into how adversarial attacks affect the logits' topology.
refer readers to (Divol & Polonik, 2019) for more details on how the loss can be used to capture topological information.
MK Loss:
The loss is formulated based on the Multi-scale kernel k. D D IR introduced by Reininghaus et al., acting on persistence diagrams of point clouds X and Y:
ki (D, 1
Σ
1x 0l3
(4)
STO
PED,(X),EE..0)
where p and q the birth-death pairs from the correspond- ing persistence diagrams, and q (d, b) denotes the mirror of = (b, d) through the diagonal. Notably, the MK is proved to be 1-Wasserstein stable (Theorem 2. Reininghaus et al.), and is a robust summary representation of data't 's topological features. For our purpose, we define the MK loss of scale between two point clouds by:
3.1. Topological Contrastive Losses
This study focuses two homology signatures commonly employed in TDA: while TP measures the cumulative impor- tance of topological features across all dimensions, serving as a holistic summary of dataset's 's topology, the MK fa- cilitates comparisons between datasets by analyzing their topological features at multiple scales. We choose these two homologies for this study for their distinctive behav- iors with adversaries (Subsect.3.2) and their capability to be back prck-propegated for adversarial detection (Sect.4).
CMr(XX Σ ti (D,,))), D(())
(5)
Topological Contrastive Losses for Multimodal Align- ment: Fig. 2 describes how we use our TC losses Lro {L+p, 4Mr to analyze multimodal alignment. The for- ward left-to-right arrows indicate the computation of TP and MK losses. In CLIP and BLIP, the images and text represen- tations are aligned in a shared embedding space. We first extract the those logit/embedddngs. before the alignment step. treating these embeddings as point clouds. Next, the cor- responding VR filtrations {R e are constructed, followed by the generation of persistence diagrams [D:), The TC losses are then computed using Eq. 3 for the TP and Eq. 5 for the MK losses, with X and Y representing the image and text embeddings, respectively.
For a given dimension i, the a-total persistence of dimension i is computed on the persistence diagram (X) (Divol & Polonik, 2019):
TP Loss:
(X) =
Σ (X))
bd
(2)
The TP loss of order a between two point clouds is the summation of the difference at all homology groups:
(tp(X,Y) = Σ Pers (X) (Xs)))
3.2. Monotonic Behaviors of Adversarial TC losses
The TP (Eq.2) can be considered as a fundamental quantity for persistence homology analysis as is closely related to the Wasserstein distance between point clouds. We would
We now present a key finding of this work. Through exten- sive experiments utilizing the proposed TC losses conducted across models, adversarial attacks, and datasets, we observe

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
of clean and adversarial samples. Fig. reports the impact of adversarial samples measured by the proposed TPP and MK losses as functions of the proportion of adversarial samples in data batch, with an adversarial perturbation magnitude of 6 4/255. For better intuition, we report the normalized TP and MK losses, which are the TP/MK losses of Sy normalized by their respective values at Sy = 5x Thus, all plots start at 1.
MK Loss rablo T.Perss. ratio
15
CLIP-CIFAR1O
2.0
15 15
18
1.0
MK Loss ratio T.Pers. ratio
CLIP-ImageNer
Table 1. Monotonic behaviors of TP and MK for different models under adversarial attacks (c 4/255). (1:4) 4) and (ft, 4) indicate monotonically increasing/deecrcaiing trends in TP and MK, respec- tively. The dash indicates non-monotonic behavior.
16
0.8
Dataset
Model
PGD
AA
BIM
APGD
FGSM
0.6
CLIP RNS0
t
1
1/1 1/
17
t/1
t
t
t/
1
0.6
0.0
0.6
1.0
CIFARIO
CLIP ViT-B/32
t/4 1
1/ 6 1 T
Adv. rabio
Adv. rablo
CLIP VIT:1/14
1/1
1/1
1
T
RN101
VTT-8/16
CLIP VIT-L/14-336
t/t
+
T
ft 4 4
T
VIT-L/14
VIT-L1443336px
CLIP RN50
1/4
4
T
4
T
1 7
MK Loss ratio T.Pers. ratio
CLIP RNI01
T 7/4
T
4
1
4
1
4
BLIP-ImageNet
2.0
2.5
2.0
ImageNet
CLIP VIT-L/14
T/4
T
4
3
1
4
1
4
4
4
1.5
CLIP VIT-L/14-336
T/
T /
T
4
7
4
17
4
1.0
3.0
BLIP VIT-B/14
1/1 2
T
4
/
9t
2.0
ImageNot
BLIP VIT-B/129
T/
7/4
T
1
2.0
BLII VIT-B/129-CT.
1/
13
1.5
Fig. 3 illustrates the relationship between TP and MK losses as the proportion of adversarial samples in the data batch (e = 4/255) increases for CLIP-CIFAR10, CLIP-ImageNet, and HLLI-ImmgeNNe
Adv.
VIT-8/14
VIT-B/129
VIT-8/129-CapfFi CapFill-L
The important finding is that both losses generally exhibit monotonically changing behavior when clean samples are replaced with adversarial ones. Specifically, the TP loss steadily increases across nearly all experiments, while the MK loss increases with higher pro- portion of adversarial samples in CLIP-CIFARI 10 and BLIP- ImageNet but decreases consistently in CLIP-Imagele Despite these variations, both losses indicate that adversar- samples significantly alter the topological structure of the logits. other words, although attacks make image sam- ples align different predicted texts, they do not preserve the topological structure of the adversarial images. Table I summarizes the monotonic behaviors of TP and MK losses across wider range of attacks, offering an overview of the prevalence of these monotonic dynamics in more scenarios.
Figure 3. Normalized TP (row 1,3 and 5) and MK losses (row 2, 4 and 6) vs. the proportion of adversaries in the data batch (e 4/255) CLIP-CIFARIO, ILaP-ImageNNe and BLIP-ImageNer
that the topological signatures of the logits exhibit a con- sistent, monotonic change the proportion of adversarial examples in the data batch increases.
Experimental Setting: Our analysis of multimodal adver- saries is conducted on 10000 test samples extracted from CI- FAR10, C0F,R100, and ImageNet datasets. The analysis is on 5 CLIP embedding models (ResNet50, ResNet101, VIT- B/16, ViT-L/14, and ViT-L/14@ (TTLL/143366xx,, BLIP embedding models (ViT-B/14, ViT-B/129, and ViT-B/129-CapFite and 5 adversarial generation methods (FGSM, PGD, Au- toAttack, APGD, and BIM). Due to space constraints, the complete description of the experiments, further results on CIFAR 100, other CLIP embeddings, more attack methods, and attacking magnitudes are reported in Appx A.
vs. Adversarial Razio
vs. Adv.
RN50
TP natlo
Ractoo
UT4
L/2.4
Behaviors of Adversarial Signatures: For all test image samples, we fix the text and the BLIP/CLIP's alignment modules and generate adversarial images that successfully alter the zero-shot predictions. We then select only set of clean samples 5x = { and the corresponding adversarial 5xx = { where the prediction on x; and i; are different. Starting from Sx, we iteratively replace x; by i; and obtain mixture set Syite (
0.2
0.2
0.1
0.5
0.5
1.0
11.
032
12.1
13.6
2.0
1.0
Adversorial Ratio
Advarsarial ratio
Figure 4. Normalized TP and MK losses vs. the proportion of text adversaries the data batch CIaPeImmgeNet..
Behaviors of Signatures of Text Adversarial: Regarding
5

---

Topological Signatures of Adversaries in Multimodal Alignments
text-based adversarial attacks, we conducted experiments on Cross-class prompt-injection attacks in the text modal- ity (Maus et al., 2023; Xu & Wang, 2024). Using three CLIP vision backbones (RN50, ViT-B/32, and ViT-L/144 on ImageNet, we gradually inject adversarial text prompts into each batch, track the resulting changes in TP and MK losses (Eqs. 3 and 5), and report the results in Fig. 4.
Although Persi (X) is the length of the MST, calculating it theoretically is still very challenging (Aldous & Steele, 1992), and the impact of the scattering of the data on the MST remain theoretically unclear. Consequently, we opt to use Monte Carlo simulations to investigate how the scatter- ing of the logit impact its 0-th order TP Pers (X).
Fig. 6 illlustrates the simulated MST length for 500 and 1,000 points in a 10-dimensional simplex as the parameters as and the ratio vary. In fact, when the PCP is more scattered (i.e., lower a, and r), the length of the MST increases. Thus, the adversarial scattering assumption implies the adversaries reduce the logits' concentration and results in a higher Pers(()), This is consistent with results in Sect. 3.2 and facilitates the use of to detect adversaries.
Similar to our image-based study, both the TP and MK losses change monotonically when the ratio of adversarial text increases, reinforcing the consistency of these topologi- cal measures across modalities.
3.3. Modeling Total Persistence of Adversaries
The final part of this section presents theoretical explana- tion for the observed overall increase in TP of adversaries (see Table 1). Our assumption is that, since the primary goal of adversarial attacks is to change the top logit, they do not maintain the structure of the new label cluster. This leads to a more scattered and less organized representations. We call this the adversarial scattering assumption. Under that assumption, our hypothesis is that the scattering behavior of adversarial logit leads to a higher TP.
Higher-dimensional topological features: During our re- search, experimental results show that higher-degree summaries are less effective for the adversarial detection examined in this work. Specifically, we observe that crit- ical distinctions between adversarial and non-adversarial logits primarily arise from lower-degree homology, par- ticularly degree-0, rather than higher-degree topological features such as loops (degree-1) or cavities (degree-2).
To test the above hypothesis, we start with modeling the logits as points generated by a latent Poisson Cluster Process (PCP) (Daley Vere-Jones, 2003), with clusters centered at the vertices of K-dimensional simplex. For the following discussion, it is sufficient understand that the PCP is governed by two parameters: a, and bias ratio r. Intuitively, a larger r encourages the centers of clusters to be closer to the vertices of the simplex, and a larger ag results in generated points being more concentrated around these centers. This relationship visualized in Fig. 5. We provide rigorous formulation of the PCP in Appx. B.
PCP modeling:
This limitation of degree- homology can be explained via our PCP modeling. For example, as shown by the 3 con- figurations on the right of Fig. 5, when the filtration radius approaches half the distance between vertices of simplex, a prominent one-dimensional hole emerges across all cases. As this degree-1 1 feature appears uniformly, it provides lim- ited discriminative power among those configurations.
However, there are cases higher-order topological informa- tion can be beneficial. For example, Table shows that FGSM exhibits different behaviors compared to more ad- vanced attacks. We hypothesize that, because FGSM is relatively simple, it produces adversarial logits that is fur- ther from the target-class logits. Thus, instead of perturbing logits toward existing clean-data clusters- more complex attacks do-FGSM creates entirely new clusters. Conse- quently, the mixture of clean and FGSM logits can have
0.=1, r=5
r=10
0,=4, r=
0,=4, r=10
Figure 5. Points generated from PCP(os,)) r) in 2D-simplex.
We utilize the PCP to investigate how the scattering of logits affects the TP. Due to the high com- plexity, we focus on connected components (O-dimensional homology), which are the most straightforward to analyze Pers (X) Σ (b.d)eD((X) d", which is actually the length of the minimum spanning tree (MST) for the graph on X, and the edges corresponding to the birth-death pairs in (x) constitutes a MST in X (Koyama et al., 2023). Thus, to determine Pers (X). we can alternatively focus on the MST and avoid the costly constructions of VR filtrations.
TP of PCP:
1=00
Longth
N-500
ds
Ratio
15
70
Figure 6. Monte Carlo simulations of the length of the MST
(Pers (X)) for different parameters of the PCP model.
6

---

Topological Signatures of Adversaries in Multimodal Alignments
twice as many clusters: one set from the clean data and one from the adversarial. As the adversarial ratio grows, the clean-data cloud first transforms into this double-cluster configuration-yieldde
y y= (Y,, where Y represents the image's logits and 7 denotes the text embedding. Intuitively, the gradients capture how each image's feature contributes to the changes in the topological image-text alignment. The gradients are computed by back-propagating Eq. 3 and 5 via Pytorch's 's implementations of the homologies (AidosLab, 2023).
a high aPd then, at higher ra- tios, collapses into the adversarial cloud. This explains the peak in TP observed at intermediate mixture levels (see Fig. 11, 12 and 13, Appx. A). Although FGSM's persis- tence curve is not strictly monotonic, its distinctive, cluster- doubling behavior can be revealed via higher-order homol- ogy.
To ensure the independence assumption in SAD, the topo- logical features need to be computed independently, This can be achieved by utilizing a hold-out dataset Z, i.e., Ui 9: (rr(((((()) U Z, T,, Vys E Sy. However, this requires a VR filtration for each yı E Sy, which is compu- tationally prohibitive. Instead, our implementation adopts a Batch-processin approach:
4. Maximum Mean Discrepancy with Topological Features
In this section, we demonstrate how to utilize the topological signatures identified in Sect. 3 for adversarial detection. Following (Gao et al., 2021; Grosse et al., 2017), we aim to address the Statistical adversarial detection (SAD) problem:
Lyc U T
(6)
While this approach does not ensure independence, it only need to construct a single VR filtration. The introduced error is acceptable when / is significantly larger than | The above process is illustrated by the backward arrows of Fig. and detailed in Appx. C (Alg. 1).
Let X C Thd and let IP be a Borel probability measure on X. Consider a dataset Sx = {2,] ~ 1a composed of i...d samples drawn from P. and let f R -> C denote the true labeling mapping for samples in IP, where C is the set of labels. Suppose that adversaries have access to a classifier f trained on Sx and i..dd samples S'y from F. The objective is to determine whether a dataset Sy = } originated from the distribution P. We assume that Sx and S'x are independent and no prior information about the attackers is available. Sy may consist of either i.i.d. samples from P or non-i.i.d samples generated by attackers.
As an illustration, Fig. 7 displays histograms of the exact gradients, computed for 500 different yi in the CIFARIO dataset, where Z = 1000. It shows that distinct signatures of adversaries are reflected in our extracted topological fea- tures, suggesting high potential for more accurate detection.
Topological MMD: We now describe how utilize the ex- tracted topological features to improve the SOTA detection method SAMMD (Gao et al., 2021). SAMMD employs the semantic aware deep kernel ku Vi)) to evaluate the similarity between input images (Detailed in Appx. D). To incorporate topological features, we modify SAMMD's ker- nel kn used for Eq. and propose the following topological- contrastive deep kernel ky,
In SAD, given a threshold when Sy is drawn from P,, we want to accept the null hypothesis Ho (Sx and Sy are from the same distribution) with probability 1 a. Conversely, if Sy includes adversarial samples, our objective is to reject Ho with probability approaching 1. It is important to note that the classifier f examined in our study is zero- shot classifier based on multimodal alignment, rather than conventional feed-for feed-forward neural networks. We focus on the zero-shot problem because it is closely related to the alignment between modalities in multimodal systems.
ki (Ting (ogg = [1 60) To) (Migg Mogg) + c0) Uy(( Mlgg)
Unlike kw our kernel operates on the logits Flog and ylogs instead of the input. The term (y Mlog) = K (2igg Mlog) evaluates the similarity between Flog and Ylg using the image embeddings extracted from the layer before the alignment with the text embedding. On the other hand, (T Blgg) = (Tc j) measures the similarity between the topological features à and ý obtained from Eq. 6. Here, x and KTC are Gaussian kernels with bandwidth a and orc- Using TP or MK loss produces different features å and j. resulting in the methods Total Persistence SAMMD (TP- SAMMD) and Multi-scale Kernel SAMMD (MKSAMMD).
Histogram of Gradients wir TP
Hicrogram of Gradients ri MK Lace
Adv
Adv
Iraquency
100
22
-0.1
0.0
-004
0:3
0644 6os
Vallun
Valua
Figure 7. Topological Features of adversarial and clean inputs.
With ky, the discrepancy between clean and adver- sarial data is estimated using the U-statistic estimator IJ Eii=1,i Hig where Hag = ky (Fiog, Tbee) + k (Uhog, Mogg ) k, (Diog, Ylog, ). Similar to SAMMD, the parameters of TPSAMMD and MKSAMMD are optimized via gradient descents.
Topological Features: Our approach utilizing LTC for SAD is to compute sample-level features derived from the topological loss Crc, ie., the topological features are the gradients of the TC loss to each input features
7

---

Topological Signatures of Adversaries in Multimodal Alignments
Test power PGD
Test power AutoAttack
Test power FGSM
Test power BIM
Type error
10-
1.
1.0
10
0.10
VIT-L/14
0.08
0.06
0.5
0.5
0.04
0.02
0.0
0.0
0.00
1/255
2/255
4/255
1/255
2/255
4/255
1/255
2/255
4/255
1/255
2/255
4/255
VT-L/14@336px
10
0.30
0:00
0:06
0.5
0.64
0.0
0.0
0.0
0:00
1/255
2/255
4/255
1/255
2/255
4/255
1/255
2/255
4/255
1/255
2/255
4/255
MMD Method
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
ME
SCF
C2ST
SAMMD
BB
MKSAMMD
TPSAMMD
Figure& 8. Test power and average Type-I error (last column) of adversarial detection methods in CIFARIO with CLIP embedding.
Test power
Test power AutoAttack
power FGSM
Test power
Type
1.0
1.0
0.10
VIT-8.22
0.0
004
0.2
0.0
0.0
0.0
0.0
0.00
1/255
2/255
4/255
1/255
2/255
4/255
2/255
4/255
8/255
2/255
4/255
8/255
VIT-L140336PX
0.10
0.08
0.04
0.0
3/255
0.0
1/253
0.0
2/255
4/233
8/253
0.0
2/255
4/253
8/253
0.40
MMD Method
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
ME
SCF
C2ST
SAMMD
MKSAMMD
TPSAMMD
Figure 9. Test power and average Type-I error (last column) of adversarial detection methods in ImageNet with CLIP embedding.
5. MMD Experimental Results
100 trials with Type-I error controlled at a = 0.05. Due to the page limit, results on CIFARI00 and more in-depth experimental results are provided in Appx. E.
Settings and baselines: We validate the advantage of topo- logical features for MMD in the settings stated in Sub- sect. 3.2. We compare TPSAMMD and MKSAMMD tests with 4 existing two-sample tests: 1) SAMMD (Gao et al., 2021), 2) Mean Embedding (ME) test (Jitkrittum al., 2016): 3) Smooth Characteristic Functions (SCF) test (Chwialkowski et al., 2015); and 4) Classifier two- sample test (C2ST) (Liu et al., 2020).
CIFARIO: Fig. 8 reports the test power of adversarial detec- tion methods for CLIP alignment in CIFAR1O. Overall, the SAMMD-based methods achieve almost 100% test power across many attack types, even at very small noise magni- tudes. Nevertheless, TPSAMMD shows a slight advantage in PGD and AA. Additionally, we average the Type-I errors for all tests the first columns at e = 4/255 and report them in the last column. It shows that all methods keep the error controlled at 5%.
Each MMD test is conducted on two disjoint subsets of clean and adversarial samples, each containing 50 images for CIFARIO and CIFAR100, and 100 images for ImageNet. The sizes of the holdout data for the topological features computation (Eq. are 1000 and 3000 for CIFAR 10/100 and ImageNet, respectively. Those sizes of the holdout are selected to ensure at least some samples per class are represented in the point cloud. Notably, this chosen set- ting is significantly more challenging than existing experi- ments (Gao et al., 2021). which differentiate between sets of 500 samples. Our additional experiments in Fig. Appx. E illustrates the above claim by reporting the impact of the number of MMD's samples and |Z] the performance of our proposed methods. Each test was conducted over
ImageNet: Fig. 9 and 10 report the detection test power for ImageNet with CLIP and BLIP, respectively. The results demonstrate that, while MKSAMMD stays comparative to SOTA, our proposed TPSAMMD outperforms existing base- lines in terms of test power, showcasing the advantage of integrating topological features in distinguishing adversarial samples from clean ones. Notably, the difference in test power between our approach and traditional methods be- comes more pronounced as the ad adversarial perturbation is small, highlighting the robustness of our detection mecha- nism under more challenging attack scenarios. Similar to
8

---

Topological Signatures of Adversaries in Multimodal Alignments
Test
PGD
Test AutoAttack
Test FGSM
Test BIM
Type error
VIT-8-14
0.0
0.0
0.5
03
0.5
0.5
002
0.0
0.0
0.0
0.00
1/255
2/255
2/255
4/255
4/253
8/255
2/255
4/255
1.0
1.0
1.0
0.10
VIT-8-129
0.08
0.5
05
0.5
0.5
0:4
0.2
1/255
2255
2/255
4/255
4/255
8/555
2/255
4/255
MMD Method
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
ME
SCF
SAMMD
ZZ
MKSAMMD
BB
TPSAMMD
Figure 10. Test power and average Type-I error (last column) of adversarial detection methods in ImageNet with BLIP embedding.
CIFARIO, the Type-I errors of all methods in ImageNet, except ME, remain strictly below 5%.
Laboratory (LANL) Laboratory Directed Research and Develop- ment (LDRD) program under grants 20230287ER & 20240868PRD3 and supported by LANL's Institutional Computing Program, and by the U.S. Department of Energy National Nuclear Security Administration under Contract No. 99233218CNA00001..
Table Gain in accuracy of TPSAMMD vs SAMMD in PGD.
CLIP VIT B/32
CLIP VIT-L/14
BLIP VIT-B/14
BLIP VIT-B/129
1/255
3.6%
8.6%
1.5%
16.7%
4/255
14.3%
8.2%
0%
0%
Gain of Topological Feature: Table highlights the accu- racy gains of TPSAMMD compared to SAMMD under PGD attacks. For BLIP e = 4/255, the gain is 0% because both methods achieve 100% test power. Additionally, the inclu- sion of topological features clearly enhances the MMD test. This demonstrates that by incorporating information how adversarial logits disrupt the overall topological structure of the data into the detection process, we can substantially improve detection capabilities.
Impact Statement
This work addresses a gap in the defense of multimodal ML systems against adversarial attacks. By introducing novel Topological-Contrasin losses and leveraging persistent ho- mology, this study not only deepens our understanding of how adversarial attacks disrupt text-image alignment but also provides practical methods detect such disruptions with high accuracy. As Multimodal ML systems are in- creasingly used in sensitive domains, enabling more precise detection will enhance the security and resilience of sys- tems that directly impact public safety, health, and trust in technology. Furthermore, the monotonic properties of the proposed losses provide interpretable insights into adversar- ial behavior, promoting transparency and trustworthiness in adversarial defense strategies.
6. Conclusion and Future Work
This study studies the vulnerability of multimodal ML sys- tems, such as CLIP and BLIP, to adversarial attacks by ex- ploring the topological disruptions in text-image alignment. We introduced two novel TC losses to identify distinctive signatures of adversaries, and demonstrate that these losses exhibit consistent monotonic changes across various attacks. By integrating them into MMD tests, developed new adversarial detection methods that significantly enhance detection accuracy. This approach not only deepens our understanding of multimodal adversarial attacks but also provides practical tools to strengthen their resilience.
While this work provides powerful tools to detect and miti- gate adversarial threats, it also necessitates careful ethical considerations. The methods developed here could poten- tially be misused to generate more advanced adversarial attacks, exacerbating the arms race between attackers and defenders. To mitigate this risk, we advocate for responsible dissemination of these techniques and call for collabora- tion across the research community to ensure their ethical application. Future directions include extending these topo- logical methods to other multimodal configurations, such as video-text and audio-text systems, further solidifying the role of topological insights in enhancing the robustness of multimodal ML systems. This research demonstrates the transformative potential of topology- bbased approaches in se- curing the next generation of ML systems and sets a strong foundation for future advancements in the field.
Future work will explore these topological analysis to other multimodal configurations, and demonstrate the potential of topological methods in enhancing the robustness and reliability of multimodal ML systems.
Acknowledgement
This manuscript has been assigned LA-UR-25-20561. This research was funded by the Los Alamos National

---

Topological Signatures of Adversaries in Multimodal Alignments
References
Gao, R., Liu, F., Zhang, J., Han, B., Liu, T., Niu, G., and Sugiyama, M. Maximum mean discrepancy test is aware of adversarial attacks. In Meila, M. and Zhang, T. (eds.), Proceedings of the 38th International Conference on Ma- chine Learning, volume 139 of Proceedings of Machine Learning Research, pp. 3564-3575. PMLR, 18-24 Jul 2021. URL https::s: pttettsss/prcceeediiiee http///eeooee.../////e/e// mlr. press/ mt..srsss//sppps/// v139 v139/gao2bb html.
AidosLab. Pytorch topological. https://github. 2023.
http/a/dss-.ab/yyyyorcttttoooooo Accessed: 2025-01-27.
Aldous, and Steele, J. M. Asymptotics for euclidean minimal spanning trees random points. Probability Theory and Related Fields, 92(2):247-258, 1992. doi: 10. N0.1007/BF0119499 194923. URL https: http//doooooooo/o// 1007 1007/BF01194922
Ghrist, R.
Elementary Applied Topology. CreateS-
pace Independent Publishing Platform, 2014. ISBN 978 9781502880857. URL https::tt//...... /books google. com, vn wwwpookkw.ooiooooooooooo hotoookkks71022255TAAAAAAAA
Brendel. W., Rauber, J., and Bethge, M. Decision-basee ad- versarial attacks: Reliable attacks against black-box ma- chine learning models. arXiv preprint arXiv: 1712.0271, 2017.
Goodfellow, I., Bengio, Y., Courville, A., and Bengio, Y.
Deep learning, volume 1. MIT Press, 2016.
Chwialkowsk,, K. P., Ramdas, A., Sejdinovie, D., and Gret- ton, A. Fast two-sample testing with analytic repre- sentations of probability measures. In Neural Informa- lion Processing Systems, 2015. URL pattts::/apt: htt.:aaa....rcoooo.raii100.100 semant remanticscholast org.e/ooorrrrrrooooooooooo Ctrp//rrppiiaiaaae 1000435524
Goodfellow, I. J. Explaining and harnessing adversarial examples. arXiv preprint arXiv: 1412.5577, 2014.
Gretton, A., Sejdinovic, D., Strathmann, H., Balakrishnan, S., Pontil, M., Fukumizu, K., and Sriperumbudur, Optimal kernel choice for large-scale two-sample tests. In Pereira, F, Burges, C., Bottou, L., and Weinberger, K. (eds.), Advances in Neural Information Processing Systems, volume 25, Curran Associates, Inc.,
Cohen, G., Sapiro, G., and Giryes, Detecting adversarial samples using influence functions and nearest neighbors. In Proceedings of the IEEC/CVF conference computer vision and pattern recognition, pp. 14453-14462, 2020.
2012. URL https:://proceedlngss neerss cc oc/sapee__iiee//ppprr////////// dbb2722basfffee11111000003666663 pdf.
Costa, J. C., Roxo, T., Proença, H., and Inácio, R. How deep learning sees the world: survey on adversarial attacks and defenses. IEEE Access, 1966111-661330 2024. doi: SWW.9//ACCESS.222.33555..
Grosse, K., Manoharan, P., Papernot, N., Backes, M., and Medaniel. P. On the (statistical) detection of adversarial examples. ArXiv, abs/1702.06280, 2017. URL http:::://pp..emmaaa org/ //oo//paID::1663372
Daley, D. and Vere-Jones, D. An Introduction to the Theory of Point Processes. Probability and Its Ap- plications. Springer New York, NY. edition, 2003. ISBN 978-0-387-95541-4 doi: 10.1007/b97277. URL https:/ / published in the series: Springer Series in Statistics.
1007 /b97777 Originally
Hsu, C.-Y,, Tsai, Y.-.., Lin, C.-H., Chen, P.-Y,, Yu, C.-M., and Huang, C.-Y. Safe lora: the silver lining of reduc- ing safety risks when fine-tuning large language mod- els, 2024. URL https::///// h http///xxvvvvo org/ abs 2405. 1 16833.
Deng, J., Dong, W. Socher, R., Li, L.-J,, Li, K., and Fei- Fei, L. ImageNet: A Large-Scale Hierarchical Image Database. In CVPRO9, 2009.
Divol, V. and Polonik, W. On the choice of weight functions for linear representations of persistence dia- grams. Journal of Applied and Computational Topology, 3(3):249 283, 2019. ISSN 2367-1734. doi: 10.1007/ $41468-019-000022 URL https: htt//dii.orrggg 1007/s41455 -10-888----100 010000190000000 000022--.
Hu, E. J., Shen, Y., Wallis, P., Allen-Zhu, Z., Li, Y., Wang, S., Wang, L., and Chen, W. LoRA: Low-rank adaptation of large language models. In International Conference Learning Representations, 2022. URL https:// openreview net
Edelsbrunner, and Harer, J. Computational topology: an introduction. American Mathematical Society, 2022.
Jitkrittum, W., Szabó, Z., Chwialkowski, K. P., and Gretton, A. Interpretable distribution features with maximum test- ing power. Advances in Neural Information Processing Systems, 29, 2016.
Feinman, R., Curtin, R. R., Shintre, S., and Gardner, A. B. Detecting adversarial samples from artifacts. ArXiv, abs/1703.00410, 2017. URL https:://// semant wwc.ontsscchlast htt.://ccchcoo.oooooooooooooooao
Kim, H. Torchattacks: A pytorch repository for adversarial attacks. arXiv preprint arxiv:0000.01950, 2020.
10

---

Topological Signatures of Adversaries in Multimodal Alignments
Koyama, M. A., Robins, V. Turner, K., and Memoli, F. Reduced vietoris-rips complexes: New methods to com- pute vietoris-rips persistent homology. arXiv preprint arXiv:2307.16333, 2023.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pp. 8748-8763. PMLR, 2021.
Krizhevsky, A. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. URL https://wwtr /wwp::://wwww////// toronto. edu/ featuresseeee-eeeeeeeeeerreeee 20.
Reininghaus, J., Huber, S., Bauer, U., and Kwitt, R. A stable multi-scale kernel for topological machine learning. 2015 IEEE Conference on Computer Vi- sion and Pattern Recognition (CVPR), pp. 4741-4748, 2014. URL https: / api semanticscholar. org /ttp//CorpII:::11285050
Lee, K., Lee, K., Lee, H., and Shin, J. A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information pro- cessing systems, 31, 2018.
Sutherland, D. J.. Tung. H.-Y., Strathmann, H., De, S.,, Ram- das, A., Smola, A., and Gretton, A. Generative mod- els and model criticism via optimized maximum mean discrepancy. In International Conference on Learning Representations, 2016.
Li, J., Li, D., Xiong, C., and Hoi, S. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML, 2022.
Vietoris, I..
Über den höheren zusammenhang kompak- ter räume und eine klasse von zusammenbangsttreuen abbildungen. Mathematische Annalen, 97:454-472, 1927. URL attps://apis http:///ppp.smmatnisssssesee semanticscholar. org /tto//oouu::11111111100 98.
Li, X. and Li, F. Adversarial examples detection in deep networks with convolutional filter statistics. In Proceed- ings of the IEEE international conference on computer vision, pp. 5764-5772, 2017.
Liu, F., Xu, W., Lu, J., Zhang, G., Gretton, A., and Suther- land, D. J. Learning deep kernels for non-parametric two-sample tests. In International conference on machine learning, pp. 6316-6326. PMLR, 2020.
Wang. P. Zhang, D., Li, L., Tan, C., Wang. X., Ren, K., Jiang, B., and Qiu, X. Inferaligner: Inference- time alignment for harmlessness through cross-model guidance, 2024a. URL btttps://arxiv...o /arg/bb//// 11206.
Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S. N. R., Houle, M. E., Schoenebeck, G. R., Song, D. X., and Bailey, Characterizing adversarial subspaces using local intrinsic dimensionality. ArXiv, abs/1801.022 002613, 2018. URL https: /api..pp./// wee.st org/CorpusID: 1248661..
Wang, Y., Liu, X., Li, Y., Chen, M., and Xiao, C. Adashield: Safeguarding multimodal large language models from structure-based attack via adaptive shield prompting. arXiv preprint arXiv:2403.0955 2024b.
Xu, Y. and Wang, W. Linkprompt: Natural and univer- sal adversarial attacks on prompt- based language mod- els. In Proceedings of the 2024 Conference of the North American Chapter of the Association for Com- putational Linguistics: Human Language Technologies (Volume 1: Long Papers), pp. 6473-6486, Mexico City, Mexico, 2024. Association for Computational Linguis- tics. URL https: :ttttp::://ccaaattee /at/aaaaaannotoyoyyoaoooo wwwptthhhllloo.oog/222200 or2/2024. naacl-long.360
Mao, X., Chen, Y., Li, Y., He, Y., and Xue, H. Learning to characterize adversarial subspaces. In ICASSP 2020-2020 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pp. 2438-2442. IEEE, 2020.
Maus, N., Chao, P., Wong, E., and Gardner, J. Black box adversarial prompting for foundation models. arXiv preprint 0rX1v2230..04237, 2023. URL https:// arxiv. abs /2002 04237.
Zhang, J., Yi, Q., and Sang, J. Towards adversarial attack on vision-language pre- pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 5005 5013, 2022.
Park, L. H., Park, J., Chung, S., Kim, J., Oh, M. G., and Kwon, T. Poster: Adversarial defense with deep learning coverage on magnet's purification. In Pro- ceedings of the 2022 ACM SIGSAC Conference Computer and Communications Security, CCS '22, pp. 3439-3441, New York, NY, USA, 2022. Association for Computing Machinery. ISBN 9781450394505. doi: 10.
Zhang, J., Huang, J., Jin, S., and Lu, S. Vision-language models for vision tasks: A survey, 2024a. URL https: //arxiv. org. abs/ 2204. 00685.
Zhang, S., Liu, F, Yang, J., Yang. Y., Li, C., Han, B., and Tan, M. Detecting adversarial data by prob- ing multiple perturbations using expected perturbation
1145/3548606.3563556 URL https: : /ro// Dt..14453358606.55555

---

Topological Signatures of Adversaries in Multimodal Alignments
score. In Krause, A., Brunskill, E., Cho, K., En- gelhardt, B., Sabato, S., and Scarlett, J. (eds.), Pro- ceedings of the 40th International Conference chine Learning, volume 202 of Proceedings of Machine Learning Research, pp. 41429-41451. PMIR, 23-29 Jul 2023. UtLhttps::/ pproceedigs/soooeenggg mmr..press v202/ 2.02/zhang23ac.... html.
Ma-
Zhang, X., Zhang, C., Li, T., Huang, Y., Jia, X., Hu, M., Zhang, J., Liu, Y., Ma, S., and Shen, C. Jailguard: A universal detection framework for Ilm prompt-based attacks, 2024b. URL https://arxiv, www//rgg/a......oooo.... / 2312.10763
Zhao, Q. Xu, M., Gupta, K., Asthana, A., Zheng, L., and Gould, S. The first to know: How token distributions reveal hidden knowledge large vision-language mod- els?, 2024. URL https: http///xxivvi//////////////e wttp:/iiwwrg//////////// 09037.
Zhou, Z., Hu, S., Li, M., Zhang, H., Zhang, Y., and Jin, H. Advelip: Downstream -annossic adversarial examples in multimodal contrastive learning. In Proceedings of the 31 ACM International Conference on Multimedia, pp. 6311-6320, 2023.
12

---

Topological Signatures of Adversaries in Multimodal Alignments
A. Experimental settings and results on Total Persistence and Multi-scale Kernel
Our experiments were conducted on a cluster with nodes featuring four NVIDIA Hopper (H100) GPUs each, paired with NVIDIA Grace CPUs via NVLink-C2C for rapid data transfer essential for intensive computational tasks, Each GPU is equipped with 96GB of HBM2 memory, ideal for handling large models and datasets.
We evaluated five CLIP models, six attack methods, and three datasets. We employed torch-attack (Kim, 2020) to generate 2 4 and 8 The Square attack for ImageNet was excluded due to adversarial perturbations with magnitudes e of 255 255 255. 253
its high computational complexity, which hinders generating sufficiently large dataset for reliable topological data analysis. Comprehensive results are presented in Figs 11, 12, 13, 14, and 15. Specifically, we report the TP and MK losses as defined in Eq.3 and 5q.5, respectively, against the adversary ratio. For each experiment, we processed all 10,000 test samples to generate adversarial examples, retaining only those that successfully disrupted CLIP alignment. Starting with the full set of clean samples, we randomly replaced samples with adversaries according each adversarial ratio (x-axis), computed the corresponding TC losses, and presented the results in the figures.
Unlike the main manuscript, which presents results only for an attack magnitude of 4/255, we provide comprehensive results across various models and attack magnitudes. Except for FGSM, the TC loss shows monotonic behavior across different models, attack methods, and magnitudes. We hypothesize that FGSM's simplicity leads to fewer successful samples and larger distortions, resulting in unrealistic samples and disrupting the original point clouds differently than more sophisticated attacks. This simplicity affects the statistical outcomes of our computations, distinguishing FGSM from more refined attack methods. Additionally, we observe trend that warrants future research: more sophisticated attack methods and advanced models exhibit more pronounced monotonic behavior in TC losses. This is evident when comparing TC losses of the ViT-L family to ViT-B, ResNet101 to ResNet50, and PGD/AA to FGSM.
B. Modeling Logits as Poisson Cluster Process
In Subsect. 3.3, we propose to use Poisson Cluster Process to model the logits resulting from the embedding modules in multimodal alignments. We now provide the details formulation of our PCP modeling.
Poisson Cluster Process: Our PCP modeling is constructed from Parent Simplex. Then, the actual point cloud is generated by sampling the Children Clusters surrounding the vertices of that simplex. In particular, the process is described as follows:
Parent Simplex: A K-dimensional simplex is the convex hull of K + 1 affinely independent points (called parents points) in R Let those parents points of the simplex be V (vo, u1...., }. the simplex is given as:
S x ZERK
Aea d 0,
x x=
Any point x inside the simplex is a convex combination of its vertices.
Children Clusters: The logits are modeled as points clustering around the simplex vertices. For vertex us N₃ points are generated using coefficients A; sampled from Dirichlet distribution parameterized by a = {aus)
(1.
1
II j=0
xx
a1
B(a,)
where B(3) is the multivariate Beta function 13() 11, 1(3,)/T (E 3,) and I'(-) is the gamma function. Each generated point æ is then computed as x = Σ A,2g.
This construction captures the clustering behavior of logits of K + 1 labels and provides a basis for understanding how adversarial perturbations might increase topological complexity by introducing distortions in the cluster distribution. Intuitively, for each vertex i, a larger a,, and smaller a * i) increases the probability that X is close to 1 and encourages points of cluster stay nearer to v, Additionally, a larger overall ogg will increase the concentration of X the
13

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
FGSM
50
05
0.0
0.5
04
05
0.0
05
0.0
33
0.0
9.5
RN50x16
20
2.00
2.00
1.75
2.0
150
1.50
1.5
125
00
13
0.3
06
0.3
010
02
0.0
1.0
000
0.3
RN101
60
0.
0.0
0.5
0.
0.0
05
0.0
35
0.0
0.5
2.0
VIT-B/32
2.0
14
1.5
1.1
1.1
12
12-
10
0.0
0.5
0.0
0.7
0.0
35
0.5
12.3
12.5
2.0
VIT-L/44
10.0
10.0
1.5
1.0-
1.1
5.0
1.00
04444
2.5
12
1.0
10
VTTU/1480.0pp
2.2
14
12
1010
Eps 1/255
Eps 2/255
Eps 4/255
Eps 8/255
Figure 11. Normalized Total Persistence versus Adversarial data proportions CIFARIO.
14

---

Topological Signatures of Adversaries in Multimodal Alignments
AutoAttack
Square
10
10
10
0.0
05
0.0
05
0.0
0.5
0.
0z
0.0
0.5
0.0
95
RN50x16
0.0
033
0.0
05
010
0.3
00
02
0.0
35
01
03
0.0
0.5
0.0
0.5
0.0
0.5
0.
05
0.0
0.5
0.0
0.
2.5
VIT-8/32
1.0
2.0
0.0
6.
0.3
0.5
0.0
0.7
05
0.0
2.0
3-
WTT-L/14
14
0.0
1.8
VTT-/1480.30pp
18
1.2
1.0
Eps 1/255
Eps 2/255
Eps 4/255
Eps 8/255
Figure Normalized Total Persistence versus Adversarial data proportions CIFAR100.
15

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
BIM
APGD
FGSM
1.8
1.0
1.08
18
1.06
RN50
1.6
099000000
1.6
1.6
1.04
1.4
1.4
1.02
12-
1.00
1.0
0.98
0.5
0.0
2.0
2.0
1.15
2.00
RN50X16
1.8
1.75
1.10
1.6
1.4
1.4
1.05
1.25
1.2
1.2
1.00
1.0
10
1.0
1.00
0.0
0.5
0.0
0.5
0.0
0.5
0.5
0.0
0.5
2.0
1.8
1.25
1.8
1.8
1.6
1.20
RN101
1.6
1.6
1.15
1.4
14
111
12
12
1.05
10
1.00
0.5
0.0
0.5
0.0
0.5
0.5
0.0
0.5
2.25
2.25
2.25
2.25
1.050
VIT-B/32
2.00
2.00
2.00
2.00
1.025
1.75
175
1.75
1.75
1.000
1.50
150
1.50
1.50
0.975
1.5
125
1.25
125
0.950
1.00
1.00
1.00
1.00
0.925
0.5
0.0
0.0
0.5
3.5
3.0
VIT-L14
1.75
2.5
1.50
1.2
2.0
1.25
1.5
1.5
1.00
1.0
1.00
1.0
1.0
0.0
0.5
0.0
0.5
0.0
0.5
0.0
0.5
0.0
0.5
VT-L/140336px
1.6
1.6
2.5
1.4
00000000
2.0
1.2
1.5
12
1.5
1.0
1.0
Eps = 2/255
Eps 4/255
Eps = 8/255
Figure 13. Normalized Total Persistence versus Adversarial data proportions ImageNet.
16

---

Topological Signatures of Adversaries in Multimodal Alignments
TGD
AutoAttack
BIM
APGD
FGSM
Square
18
1.5
1.4
RN50
14
14
14
12
12
12
11
11-
1.0
10
1,0
10
10
1.0
1.5
1.5
1.4
1.4
RN101
1.3
12
1.2
0.0
0.5
1.0
300
0.5
1.0
0.0
0.5
1.0
0.
0.5
1.0
0.0
0.5
1.0
0.0
0.5
10
1.25
1.8
120
18
1.35
VT--//22
1.20
1335
18
1.30
130
14
1.00
0.8
1.00
1.00
0.0
0.5
3.0
0.5
1.0
0.0
0.5
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
10
2.0
1.15
1.5
VIT-U14
1.4
1.4
1.00
1.3
1.5
1.2
122
1.1
0.90
1.0
10
1.00
2.5
1.8
1.
2.329
1.5
1.100
2.3
14
144
1.075
0.85
1.2
17
0.00
1.0
1.0
1.0
10
1.00
0.85
0.0
0.5
0.5
1.0
0.0
0.0
0.5
3.0
0.0
0.5
Eps 1/255
Eps
2/255
--.-
Eps
4/255
Eps
8/255
Figure 14. Normalized Multi-scale Kernel loss versus Adversarial data proportions in CIFARIO.
17

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
BIM
APGD
FGSM
1.0
1.0
1.0
0.9
0.9
0.9
RN50
0.8
0.8
0.8
0.7
0.7
0.7
0.6
0.6
0.6
0.6
0.0
0.5
100
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
10
1.0
1.0
1.0
1.0
1.00
0.95
RN101
0.9
0.9
0.9
0.90
0.8
0.8
0.8
0.8
0.85
0.80
0.7
0.5
0.0
1.0
0.5
100
0.0
0.5
1.0
0.5
10
1.00
1.00
1.0
VIT-B/32
0.95
0.9
0.95
0.9
1.04
0.90
0.8
0.90
0.8
1.02
0.7
0.85
0.7
0.80
1.00
0.6
0.0
0.5
10
1.0
10
1.00
0.9
0.9
0.98
ViT-L/14
0.9
0.8
0.8
0.96
0.8
0.7
0.8
0.7
0.94
0.6
0.92
0.7
0.5
0.7
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
VTT-L14@3366x
1.00
1.0
1.00
1.0
1.00
0.95
0.9
0.95
0.9
0.98
H4
0.90
0.8
0.96
0.85
0.7
0.85
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
0.0
0.5
1.0
Eps 1/255
Eps
2/255
Eps 4/255
........
Eps
8/255
Figure 15. Normalized Multi-scale Kernel loss versus Adversarial data proportions in ImageNet.
18

---

Topological Signatures of Adversaries in Multinodal Alignments
cluster's center. For the sake of brevity, set Og,
Ollage and (4,)((+4)) O'malll This gives the mean and variance of A:
B[A,]
Ouarge
E B[Aacixt))
O'small
Oreetal
Ototal
Oarge (1
MMrgge
Asmall (Cootal asmall
Var X.]
VarlAsuste)
Ototal
+
Ocotal
+
where Orotal Σ == Osigj Ötlagg Ollarge/ / Ototal and (ksmall = Osmall/ OOuotal The parameter Ots and v in Fig. 5 and the main manuscript are the O'maall and 1/Cssmali mentioned in this appendix.
Modeling adversaries PCP: Our adversarial scattering assumption (stated the main manuscript) posits that adversarial attacks primarily target the top logit component, causing logits to shift near different clusters without preserving the new cluster's structure. This leads to more scattered and disorganized point clouds. Consequently, we hypothesize that when label clusters of clean and adversarial point clouds are modeled as PCPs, the PCP for clean data will exhibit greater concentration and lower variance compared to that of adversarial data.
Estimated Alpha: Clean vs Adversarial
Estimated Alpha (log scale)
Var:0.0041
Clean
0a0:0.0054
AA (Eps 4/255)
AA (Eps 8/255)
10a
Var:0.0148
PGD (Eps 4/255)
PGD (Eps 8/255)
Var:0.0555
100
Var:0.0549
10
0
2
3
6
9
CIFAR10 class index
Figure 16. MLE of Dirichlet's a coefficients for different logits: the MLE of clean logits results in the Dirichlet distribution with the lowest variance.
We empirically validate the aforementioned assumption through the experiments presented in Fig. 16. Specifically, collect both clean and adversarial logits (generated using AA and PGD) for class index O from the model applied to the CIFAR-10 dataset with attacking levels e E {4/255, (1155,8/2555 8/255]. We then employ Maximum Likelihood Estimation to fit the PCP's a parameter. As expected, the og component attains the highest value. Notably, the fitted PCP for clean samples exhibits the highest concentration, characterized by the largest ag and overall 0; Additionally, we report the corresponding variances of the PCP models fitted to these data, which indicate that adversarial data result logits with higher variance.
336px
C. Computation of Topological Feature
Algorithm ooutlines the pseudocode for computing the TP and MK losses. Given a point cloud Y and a reference point cloud T, the algorithm calculates the topological feature ý = Vy U Z, T) as defined in Eq. In our MMD test, Y and Z represent the logits or embeddings of the examined images (both clean and adversarial) and a hold-out image from the clean data, respectively. On the other hand, T denotes the embeddings of the label classes for the corresponding datasets: the 1000 class labels of ImageNet, 100 class labels of CIFAR100, or 10 class labels of CIFARIO.
D. Semantic-Aware Maximum Mean Discrepancy
Although MMD(P, Q: 24.) a perfect statistic to check if P and Q are the same, its empirical test power depends significantly on the used kernels (Sutherland et al., 2016; Liu et al., 2020). Semantic- Aware Maximum Mean Diserepancy is a MMD test introduced by (Gao al., 2021), which utilizes the following kernel acting on semantic features extracted by a
19

---

Topological Signatures of Adversaries in Multimodal Alignments
Algorithm I Topological-Conttaatiio Feature Extraction
Input: Examined point cloud Y, and reference point cloud T
Params: method (Total persistence or Multi-kernell hold-out data Z, order a, and homology dimension K
Output: Hopological-Contrastii Features Cre U Z, T)
1: Construct the Vietoris-Rips complexes (9,((Y U 2 and (T)(T)):
2: for from to K do
3: Construct ( U 2) from (Y 2))c
4: Construct (T) from (T))
5: if method = Total persistence then
6: Pers, (Y U () == Σ (o.d)e b)a
7: Pers?(T) := Σ (T)
8: else if method = Multi-kernel then
9: h; : (D.(Y U (), D.(T))
10: end if
11: end for
12: if method= = Total persistence then
13: LTclY U Z, T) = E Pers (Y - Pers;( (T) else if method Multi-kernel then
15: Lrc(Y T Σx Kj
16: end if
17: Back-propagate TC Loss: Y = VxLro(Y VVXTr(YUUZ,T
18: return
well-trained classifier on clean data:
kww (Fiiputt Vingue) = (1 <0) (f(minp Vingus) + eo q {[Cinput: Finput);
where 8 (Ninpat: Vimpu)) ( (Ninpus); @ (Vinpi)) is deep kernel function that assesses the similarity between Zinpur and Sinput using features extracted from the last fully connected layer of the classifier f. Here, K denotes the Gaussian kernel with bandwidth o co E (0, 1), and ( Vinpur) represents the Gaussian kernel with bandwidth Qg. Given that kernel, the SAMMD is proposed to measure the discrepancy between natural and adversarial data:
SAMMD(P. (P, Q E (X, + k. Y") 2 (X,Y),
where X, X' and Y,Y' Q. The U-statistic estimator used to empirically approximate SAMMD(P. Q) given by:
1
(SM n(n
Hij.
where
Hij (Zt, + Rew (1t. 41) - (2i, H1) New (vt. Zz).
E. MMD Experimental Results
This appendix provides the complete results of our Maximum Mean Discrepancy (MMD) experiments on ImageNet (Fig. 18 and 19), CIFAR-I0 (Fig. 20 and 21), and CIFAR-100 100 (Fig. 22 and 23). Specifically, we report the test power and Type-I error rates of various methods for detecting adversarial samples in batches. Each test batch consists of 50 clean or adversarial samples. Fig. 17 demonstrate the impact of the number of TST samples and the holdout size the performance of our proposed TPSAMMD method in CLIP-RN50 in ImageNet dataset. We can clearly see that our method can perform well even with |Z| slightly more than 1000 samples.
Notably, this setting is significantly more challenging than existing works (Gao et al., 2021), which use test batches of size 500, at which TPSAMMD constantly achieve test power of 1.0 (Fig. 17). As a result, several methods, such as ME and SCF, perform considerably worse than previously reported. We chose this more demanding setting because the
20

---

Topological Signatures of Adversaries in Multimodal Alignments
method, SAMMD, already achieves 100% test power with 500-sample batches. By reducing the batch size to 50, emphasize the advantages of our topological features in more challenging scenario.
The results demonstrate that relaedr methods achieve highly competitive test power across a wide range of models and attack methods. This outcome aligns with previous findings in unimodal settings (Gao et al., 2021). This consistency motivated us to integrate our topological features into SAMMD, showcasing the advantages of our approach in practical scenarios. As shown, TPSAMMD consistently performs as well as or better than SAMMD in nearly all settings, particularly against PGD and AA attacks and within more complex Vision Transformer models. On the other hand, although MKSAMMD performs slightly worse than TPSAMMD, it still offers improvements over SAMMD in many configurations.
The code used in this study is currently under review for release by the organization. We are awaiting approval, and once granted, the code will be made publicly available.
FGSM (4/255)
FGSM (8/255)
1.8
18
0.9
0.8
06
0.4
0.3
04
02
340
03
140
1200
100
3200
Miop
2000
2000
PGD (8/255)
PGD (4/255)
3.09
0.0
0.6
8.90
0.00
Bay
240g
1200
Figure/ 17. Test power of TPSAMMD in CLIP-RN50 with FGSM and PGD with different hold-out dataset sizes and different TST test size.
21

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
APGI
CW
FGSM
RIM
RN50
1/235
2233
4/25
1/255
2/255
+/253
1/255
3255
41235
1/255
2033
4/255
21:35
4/255
8/253
2/235
4/215
8255
RN101
650
0.3
007
130
000
625
635
035
175
625
603
600
0.8
009
1.00
000
140
1.00
1.0
1.00
3.00
1.00
0.79
630
0.2
230
1/255
2/555
42555
3/255
4G35
4/355
2035
4/555
8/255
1.0
1.00
VTT-/14
17355
7755
6035
1/555
2055
1/555
1055
7055
47355
1755
2/745
4/555
2055
4/75
8/25%
2/285
6/2+5
RP35
VT:4119::300
003
1725
2755
4G35
1/55
2/755
1055
0.08
1/55
2055
4G85
0.0
2645
4/755
100
2035
4035
0/255
2/285
4025
R755
Allack Megnilude (Eps)
Allack MagniLade (Ezs)
Allakk MegniLide (Eps)
Allack Maynitucle (Eus)
Allack Magnitude (Epe)
Alleck Megn (Eps)
ME
SCF
C2ST
SAMMD
FZA MKSAMMD
BBM
TPSAMMD
Figure 18. Test power of different methods detecting ImageNet's adversaries.
AutoAttack
0:10
0.10
0.03
0.00
0.00
0.00
9.00
4/255
0.10
0:20
0:00
0.00
3N101
010
3/255
2/255
4255
12255
2/255
4/255
1/255
2/255
4/255
1/55
2/255
4/255
2/255
4/255
8/255
2/255
4/255
8/255
0:20
030
UIT-8:32
003
0.56
0.00
0.04
0.00
0.00
0.30
0.0
9.0
8.08
005
0.6
3.00
002
0.22
9.00
1/295
2/755
40755
1,215
3755
4/215
1055
7/75%
4/755
1/295
2/553
4245
0.00
2055
47155
A/75
2/255
4/71%
87355
0.20
008
0.8
3.00
0.4
0.00
27755
0.0
9.0
Magnitude (Eps)
Magnitude (Cos)
Magnitude (Eps)
Magnitude (Eps)
Magn (tps)
Magnit.de (Eps)
ME
SCr
C2ST
SAMMD
MKSAMMD
TPSAMMD
Figure 19. Type-I emror of different methods in detecting ImageNet's adversaries.
22

---

Topological Signatures of Adversaries in Multimodal Alignments
PSD
AutoAttack
BIM
APGD
CW
FGSM
10
10
10
10
10
VT-U14
1/255
2/55
4/255
1255
2255
4255
1/255
2/55
4255
1/255
2/55
4/255
1/25
2/55
4/255
1/255
2/255
4/55
VT-U1A033EPs
1.0
10
19
0.0
0.0
0.0
2/255
4/255
1/55
2755
4255
1,255
4/255
4255 Attack Magnitude (Eps)
2/255
4/255
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack MaqnitL de (Eps)
Attack Magnitude (Eps
ME
SCF
C2ST
SAMMD
MKSAMMD
TPSAMMD
Figure 20. Test power of different methods detecting CIFARIO's adversaries.
PGD
AutoAttack
BIM
APGD
CW
FGSM
MT-U14
0.000
0.050
0.990
0.000
0.000
0.090
0.03
0.025
0.275
0.775
G.25
0.078
0.000
0.000
0.00
0.90
0.000
0.000
1/255
2/55
4225
1,255
2/255
4/255
2/255
1255
2/255
4/255
2/255
2755
4/255
VTT-1149366p
0.100
0.100
0.015
0.955
0.75
0075
0013
0.0
0.000
0.060
0.50
0050
0.060
0.023
0.025
0.225
0.000
0.000
0.00
0.000
0.000
0.000
1/25
2/255
42255
2/255
2/255
4235
1/255
2/235
M/55
1/253
2/235
4/255
1/253
2/25
4/255
1/255
2/253
4/25
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps
ME
SCF
C2ST
SAMMD
HEIER
MKSAMMD
TPSAMMD
Figure 21. Type-I error of different methods in detecting CIFAR10's adversaries.
PGD
AuloAllack
BIM
APGD
CW
FGSM
1.
10
10
100
1.0
1.0
RNVD
2/255
2/255
4/255
1255
2/55
4255
1/255
2/255
4/255
1/255
2/555
4/255
1/255
2/25
4/255
1/255
2/255
4/255
1.0
VT-4114
00
4/255
00
1/55
0U
2.0
1/55
4/255
09
Attack Magnitude (Eps)
Attack Magnitude (=ps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps
ME
SCF
C2ST
SAMMD
MIG
MKSAMMD
TPSAMMD
Figure 22. Test power of different methods in detecting CIFAR100's adversaries.
23

---

Topological Signatures of Adversaries in Multimodal Alignments
PGD
AutoAttack
BIM
APGD
CW
FGSM
R0.30
0.000
0.000
0.90
0.000
0.500
0.00
0.075
0.025
0.875
0.075
6.75
0477
0.000
0.000
0.00
0.900
0.000
0.000
1/255
2/55
4/255
1/255
2/255
4/255
2/255
1255
2/255
4/255
2/55
2/55
0.100
0.015
0.955
0.75
0075
0019
0.0
0.000
0.060
0.50
0050
0256
0.000
0.025
0.225
0.22
0.000
0.000
0.000
0.000
0.000
0.000
1/25
2/255
4225
2/255
2/235
4235
1/255
2/235
M/55
1/255
2/235
4/255
1/253
2/35
4/235
1/255
2/233
0235
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps)
Attack Magnitude (Eps
ME
SCF
C2ST
SAMMD
HEIER
MKSAMMD
TPSAMMD
Figure 23, Type-I error of different methods in detecting CIFAR100's adversaries.
24


Reviews:
[{"review_id": "yVg6dqSglT", "reviewer": "Reviewer_H6gm", "summary": "In this paper, the authors propose Topological Loss Functions for adversarial detection in multimodal data. The papers begins by discussing the required background. In Section 3, the authors present preliminary evidence that topological features are distinguishing to detect adversaries for multimodal data. The experiments show a monotonic trend of total persistence and multi scale kernel with respect to the adversarial ratio. In Section 4, the authors propose an adversarial detection mechanism based on these topological loss functions and in section 5, they present the results of the proposed detection mechanism.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their positive feedback and careful examination of the manuscript. We agree with the reviewer’s comments regarding grammatical issues and typos, particularly the corrections at **Line 104** and in **Algorithm 1** (indeed, $\\nabla_X$ should be corrected to $\\nabla_Y$).\n\nWe now address the following questions of the reviewer:\n\n#### **Q1:** Vectorization of persistence diagrams\n\n#### **Q2:** Meaning and usage of higher-degree homology\n\n#### **Q3:** Usage of Alpha complex\n\nWe appreciate these insightful questions, as they are natural considerations of our work. In particular, our research had considered them and we later found out that (perhaps counter-intuitively) these three suggested approaches were less effective for the adversarial detection task presented in our paper. \n\n--- \n### **Q1 and Q2:** \nWe form the following two hypotheses during our research, which explain why the current vectorization approach and the usage of higher-degree homology is less effective:\n\n- **Hypothesis H1 (Addressing Q1):**  \n  The main difference between persistence diagrams (PDs) of clean and adversarially perturbed point clouds predominantly appear in *small* (often called *noisy*) features, those located near the diagonal with short lifespans, rather than in dominant, long-lived topological features. Under **H1**, current vectorization methods (commonly emphasize persistent, large-scale features) will fail to capture subtle yet crucial signatures induced by adversarial.\n\n- **Hypothesis H2 (Addressing Q2):**  \n  These critical distinctions mainly arise at low-degree homology groups (especially degree 0), rather than higher-degree homology. Higher-degree features, such as loops (degree 1 homology) or cavities (degree 2 homology), tend not to offer substantial discriminative information for adversarial detection (except for some less common cases as FGSM, which we will discuss later).\n\n#### Supporting evidence for **H1**:\n\nEmpirical evidence supporting **H1** can be observed by examining the Total Persistence (TP) with different choices of order parameter $\\alpha$ (as defined in Equations (2) and (3)). Specifically, a smaller order (e.g., $\\alpha = 1$) emphasizes dominant components of the PD, whereas larger $\\alpha$ more evenly balance contributions from both dominant and small components. Our results (first column of Figure 1 and the corresponding Section 5) show that using a larger $\\alpha$ leads to a clearer monotonic change in TP, translating into significantly better detection performance. Nevertheless, we refrain from further increasing $\\alpha$, as doing so might violate the stability property of Total Persistence, as discussed by Divol (2019).\n\n#### Supporting evidence for **H2**:\n\nRegarding **H2**, the highest-degree homology we tested is degree 1, which captures one-dimensional holes. Figure 4 employing PCP modeling adversarial logits can be used to illustrate the limitation of degree-1 summary compared to degree-0. As shown in the 3 plots on the right of Figure 4, when the filtration radius approaches haft the distance between vertices of the simplex, a dominant 1-dimensional hole appears across all configurations. Thus, this feature contains less discriminative power for differentiating those configurations. Our detection experiments further reinforce this claim, demonstrating that homology of degree 0 contributes more to the detection.\n\nHowever, we also observe some unique situations where higher-order topological information helps. That is the situation with FGSM (detailed discussion is in Q3 of Reviewer 9vo5). We argue that, due to the simplicity of the attack, the resulting logits point clouds introduce new adversarial clusters (rather than being near existing clusters of the clean data). As the occurrence of those clusters can be better detected by higher-order summaries, we expect they can help detect that situation.\n\n---\nIn conclusion, we find that the combination of Total Persistence using the Wasserstein distance, with an emphasis on small-scale features (appropriately chosen $\\alpha$), and low-degree homology (specifically degree 0) constitutes a \"sweet spot\" for adversarial detection tasks.\n\n---\n### **Q3:**\n\nThe Alpha complex is unsuitable for our problem because it does not scale well to high-dimensional data. Specifically, the dimension of the logits ($X$ and $Y$ discussed in Section 3.1) equals the number of labels predicted by the model, ranging from 10 for CIFAR10 to 1000 for ImageNet. Constructing the Alpha complex typically relies on Delaunay triangulation, which has a complexity of $O(n^{d/2})$, making it computationally infeasible for our scenario.\n\nIn contrast, constructing the Vietoris-Rips (VR) complex only requires an adjacency matrix, independent of the data dimension, which is crucial to scale up the experiment to ImageNet. This key difference is the primary reason we prefer the VR complex over the Alpha complex in our work.", "claims_and_evidence": "The claims made in the paper are sufficiently supported.", "methods_and_evaluation_criteria": "The methods and evaluation criteria make sense for the problem that the authors are tackling.", "theoretical_claims": "The paper does not make any specific theoretical claims.", "experimental_designs_or_analyses": "The choice of experiments seems sound for the problem at hand. The authors perform experiments to support their claims of using topological features for adversarial detection by showing that total persistence and multi scale kernel are monotonic functions of adversarial rations. Then, they suggest a method to use these topological features for adversarial detection and perform experiments comparing against existing adversarial detection methods. These experiments seem to make sense to support the claims.", "relation_to_broader_scientific_literature": "I think that this work provides an interesting perspective of embedding alignment in terms of topological similarity of the multimodal data embeddings. The authors support their claims with empirical evidence that alignment of topological structure of the embeddings is a distinguishing factor for multimodal data. This opens up a new research avenue to explore more about adding topological regularization terms to make the models robust to adversarial attacks.", "essential_references_not_discussed": "I don't think so.", "other_strengths_and_weaknesses": "Strengths:\n\nThe paper proposes an interesting perspective about alignment in multimodal data as topological similarity between the embeddings.\n\nWeaknesses:\n\nThe overall flow in the paper seems ok. However, the flow within each section can be improved. The paper is packed with all sorts of different analyses to which leads to fragmentation. Instead, some of these analyses can be moved to appendix to improve the flow. For example the PCP analysis can be moved to the appendix which would free up the required space to explain the concepts more and improve the flow. I am not suggesting to move it to the appendix. Some thought in this direction can be considered.", "other_comments_or_suggestions": "Line 104 left column: We conduct extensive experiments in -> We conduct extensive experiments on ?\n\nLine 17 Alg 1 in Appendix D: $\\nabla_X$ -> $\\nabla_Y$?", "questions_for_authors": "I am curious to know how the model would perform if the loss function is altered to the distance between vectorizations of the two persistence diagrams instead of the Wasserstein distance. Do you have any experimental results about that?\n\nWhat is the last degree of homology that you are using the information about? \n\nDid you try Alpha complex filtrations? They are computationally more feasible than VR for $H_0$ and $H_1$.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "nyMcA0UiPr", "reviewer": "Reviewer_M3Mh", "summary": "The paper explores the vulnerability of multimodal machine learning models (such as CLIP and BLIP) to adversarial attacks. It introduces novel Topological-Contrastive (TC) losses—Total Persistence (TP) loss and Multi-scale Kernel (MK) loss—to analyze how adversarial attacks affect image-text alignment. Through the use of persistent homology, the study shows that adversarial perturbations introduce distinctive topological signatures, which can be leveraged to improve adversarial detection. The authors further integrate these topological features into Maximum Mean Discrepancy (MMD) tests, demonstrating that topological-aware MMD tests (TPSAMMD and MKSAMMD) outperform state-of-the-art adversarial detection techniques.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for careful feedbacks. We address the concerns of the reviewer via the 3 following topics:\n\n## Q1: Adaptive attack against topological-based detection\n\nDue to the broad landscape of adaptive attacks, we focus this discussion on _gradient-based attacks_ against: an attacker requires the gradient with respect to the topological signatures utilized by our detector (Equation 6). We first discuss why obtaining these gradients is challenging:\n\n1. **Lack of knowledge of the hold-out $Z$:**  \n   An attacker does not typically know the specific hold-out dataset $Z$ used by the detector. Each time the detector runs, it can select a different $Z$ detection. Thus, gradients used by the attacker using a different hold-out set can be significantly different.\n\n2. **Computational cost:**  \n   Even with complete knowledge of $Z$, accurately computing the gradients from Equation (6) is computationally expensive for attacker—especially for iterative attacks. This complexity is from the construction of the Vietoris–Rips (VR) complex. While the detector computes this once, iterative attacks require repeated computations. Note that the attacker also need to back-propagate that gradients on the logit to the input for adversarial perturbations.\n\n3. **Loss-specific gradients:**  \n   The attacker’s gradients must be specific to the loss used by the detector. Thus, gradients for a Total Persistence-based detector may not necessarily enable the attacker to bypass another detection, such as a Multi-scale Kernel detector.\n\n### Impact of complete knowledge:\n\nNevertheless, we agree that it is important to study an attacker having complete gradient. Due to the computational impracticality of iterative attacks (point 2), we simulate the attacker using FGSM. We enhance the standard FGSM gradient ($\\nabla_{\\text{FGSM}}$) with our topological loss gradient ($\\nabla_{\\text{TC}}$ back-propagate from Equation (6)):\n\n$x_{\\text{adv}} = x + \\epsilon \\left[ (1 - \\alpha)\\text{sign}(\\nabla_{\\text{FGSM}}) - \\alpha\\text{sign}(\\nabla_{\\text{TC}}) \\right]$\n\nHere, α is a parameter balancing the standard and topological gradients. Results with $\\epsilon = 4/255$ on CLIP ViT-16/B in ImageNet are:\n\n| α | Accuracy Reduction | Attack Effectiveness | TPSAMMD Test Power |\n|---|---|---|---|\n| 0.0   | 42.63%  | 1.00   | 0.60   |\n| 0.2    | 42.06%   | 0.98   | 0.27  |\n| 0.4    | 41.00%     | 0.96  | 0.13   |\n| 0.6    | 38.44%    | 0.90   | 0.12   |\n| 0.8    | 31.05%   | 0.72    | 0.05   |\n\nAs observed, having complete gradient helps the attacker in bypassing our detection, though it comes with a reduction in attack effectiveness.\n\n### Recommendations for robust detection:\n\n- Utilizing a larger hold-out dataset.\n- Combining multiple detection methods simultaneously.\n\n## Q2: The usage of higher-dimensional topological features\n\nDuring our research, we form a hypothesis explaining why higher-degree summary is less effective for adversarial detection. Specifically, we observe that critical distinctions between adversarial and non-adversarial configurations primarily arise from lower-degree homology, particularly degree-0, rather than higher-degree topological features such as loops (degree-1) or cavities (degree-2). \n\nThis limitation of degree-1 homology can be shown via our PCP modeling. For example, as shown by the 3 configurations on the right side of Figure 4, when the filtration radius approaches half the distance between vertices of a simplex, a prominent one-dimensional hole emerges across all cases. As this degree-1 feature appears uniformly, it provides limited discriminative power.\n\nHowever, we also observe some unique situations where higher-order topological information helps. That is the situation with FGSM (detailed discussion is in Q3 of Reviewer 9vo5). We argue that, due to the simplicity of the attack, the resulting logits introduce new clusters (rather than being near existing clusters of the clean data). As the occurrence of those clusters can be better detected by higher-order summaries, we expect they can help detect that situation.\n\n## Q3: Complexity and real-time application\n\nCompared to benchmark (Gao, 2021), our approach introduces additional complexity due to the integration of topological data analysis (TDA). However, our Maximum Mean Discrepancy (MMD) detection learning (Line 376) operates on logis rather than input data, significantly reducing complexity due to the lower dimensionality of logits. Specifically, in CIFAR10 (about 1,000 points), the additional computational cost from TDA involves 2 VR complex computations, taking around 0.5 seconds on our hardware. In comparison, the training time for MMD is approximately 10–20 seconds. At inference, the combined time for TDA computation and MMD is about 0.5 seconds per sample. For ImageNet (about  3,000 points due to larger hold-out requirements), the additional time introduced by TDA during training is about 10 seconds, which is still lower than MMD training.", "claims_and_evidence": "1.\tAdversarial attacks alter topological properties of multimodal embeddings – Supported by empirical evidence across multiple datasets (CIFAR-10, CIFAR-100, and ImageNet) and attack types (FGSM, PGD, AutoAttack, BIM, etc.).\n\t2.\tThe proposed TP and MK losses capture these topological distortions – Demonstrated through consistent monotonic changes in TC losses as adversarial perturbations increase.\n\t3.\tIntegration of topological signatures into MMD-based adversarial detection improves test power – Validated through experiments where TPSAMMD and MKSAMMD outperform standard MMD-based methods.", "methods_and_evaluation_criteria": "The methodology is well-grounded:\n\t•\tPersistent homology is used to extract topological features from multimodal embeddings.\n\t•\tNew TC losses (TP and MK) are formulated and tested across different datasets and model architectures.\n\t•\tA novel MMD-based detection approach is proposed, leveraging topological signatures.\n\t•\tExperiments cover multiple attack strategies, model architectures, and datasets, ensuring broad generalizability.\n\nEvaluation is primarily based on:\n\t•\tMonotonic trends in TC losses (validating adversarial impact on topology).\n\t•\tTest power of adversarial detection methods (demonstrating the effectiveness of the proposed methods).\n\t•\tComparison against strong baselines (existing MMD methods, mean embedding tests, and classifier-based detection).\n\nOverall, the evaluation is comprehensive and well-designed.", "theoretical_claims": "•\tThe paper provides a mathematical foundation for the TP loss, drawing connections to Poisson Cluster Processes (PCP).\n\t•\tThe Wasserstein stability of MK loss is discussed, ensuring its robustness.\n\t•\tThe explanation for adversarial perturbations leading to increased TP values is well-reasoned, supported by Monte Carlo simulations.\n\nWhile the theoretical foundations are strong, a formal proof of why adversarial samples increase total persistence across all settings would further strengthen the paper.", "experimental_designs_or_analyses": "•\tThe experiments are rigorous, using 10,000 samples from multiple datasets and evaluating multiple attack methods.\n\t•\tResults consistently show that topological losses increase with adversarial proportion, reinforcing the main hypothesis.\n\t•\tThe MMD-based adversarial detection experiments convincingly demonstrate the utility of the proposed approach.\n\t•\tAblation studies on different attack magnitudes, architectures, and dataset variations provide further support.\n\nThe methodology is sound, and results are statistically significant, with Type-I errors controlled at 5%.", "relation_to_broader_scientific_literature": "•\tMultimodal adversarial robustness (e.g., adversarial attacks on CLIP/BLIP models).\n\t•\tTopological Data Analysis (TDA) (e.g., persistent homology in machine learning).\n\t•\tMMD-based adversarial detection (e.g., previous work on MMD tests for adversarial detection).\n\nIt provides a novel bridge between TDA and adversarial detection, which is original and impactful.", "essential_references_not_discussed": "The paper cites most relevant prior work but could expand discussion on the use of topological methods in adversarial defenses outside of multimodal learning (e.g., TDA in adversarial defenses for unimodal settings).", "other_strengths_and_weaknesses": "Strengths:\n\t•\tNovel application of topological methods to multimodal adversarial detection.\n\t•\tStrong theoretical grounding, supported by empirical and simulation-based validation.\n\t•\tComprehensive experimental evaluation across datasets, models, and attack types.\n\t•\tImproves over state-of-the-art MMD-based detection methods.\n\nWeaknesses:\n\t•\tSome parts of the theoretical analysis (e.g., Poisson Cluster Process modeling) could be more formally proven.\n\t•\tThe computational cost of constructing Vietoris–Rips filtrations might limit real-time applications.\n\t•\tMore discussion on potential failure cases (e.g., how robust are the topological losses against adaptive adversarial attacks?).", "other_comments_or_suggestions": "•\tConsider evaluating efficiency trade-offs between TP and MK losses for real-world deployment.\n\t•\tDiscuss whether adaptive adversaries (specifically attacking the topological loss) could bypass detection.\n\t•\tClarify computational complexity of topological computations in the main text.", "questions_for_authors": "1.\tCould adversarial attacks be specifically optimized to fool topological signatures (e.g., adversarial training against TC losses)?\n\t•\tIf so, how would the proposed method hold up?\n\t2.\tHow computationally expensive are the TC losses compared to standard MMD methods?\n\t•\tCan the method be used in real-time applications?\n\t3.\tWould integrating higher-dimensional topological features improve detection further?\n\t•\tThe study primarily focuses on 0-dimensional and 1-dimensional persistence—would considering higher-order homologies be beneficial?\n\t4.\tHow does the detection method perform against attacks specifically designed to preserve topological structures?\n\t•\tCould a different type of adversary circumvent the proposed approach?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "rxFKz3CR9i", "reviewer": "Reviewer_rmZa", "summary": "The authors consider adversarial attacks that target multi-modal systems relying on alignment of embeddings (the embeddings produced on text and image inputs are supposed to be close to each other, and the attacker supplies, e.g., an image whose embedding is close to an embedding of a wrong, non-matching  text description). They introduce two losses based on Topological Data Analysis tools and show experimentally that these losses are consistently higher for adversarial examples. A mathematical model that can explain this phenomenon is also provided (Poisson Cluster Process). These losses are applied in the Statistical Adversarial Detection (SAD) scenario: given is a set of samples and one must determine whether it contains i.i.d. samples from the same distribution as the training dataset or not (adversarial). The authors suggest to add the gradients of one of their topological losses as an additional feature to the State-of-the-art method for SAD problem (here they exploit the key fact that one can differentiate through persistent homology and propose an algorithm that allows them to efficiently simulate statistical assumptions that are needed and to avoid computing prohibitively ). They demonstrate experimentally that adding these topological features helps increase the performance, especially when the fraction of the adversarial examples in the input is small.\n\n## update after rebuttal\n\nI am going to keep my original score, admitting that I am not an expert in the topic of adversarial attacks and this is probably the reason why the question of adaptive attacks is not a concern to me (my very naive understanding is that, if an adversary is given enough information, it is not surprising that an attacker can circumvent the defense proposed by the authors --- but at a considerably higher cost, I think). I don't have any other concerns with the paper.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their positive feedback and insightful comments. We fully agree with the reviewer’s suggestions, including:  \n1. Explicitly mentioning that the Multi-scale Kernel (MK) loss is quadratic,  \n2. Replacing the term *\"homologies\"* (line 200) with *\"topological summary\"* to avoid confusion,  \n3. Addressing the identified typos and grammatical errors.\n\nWe now address the specific questions raised by the reviewer:\n\n---\n\n### Q1: PCP analysis on Multi-scale kernel (MK) Loss\n\nWe performed a PCP analysis on the MK loss, following the same setting used for Total Persistence (TP) in Figure 5. The results can be found here:  https://drive.google.com/file/d/1Es536XanO-4MTSgSzimci3NoidjvmzkC/view?usp=share_link\n\nFrom the results, we observe that the MK loss landscape (analogous to the TP landscape in Figure 5) exhibits less monotonic behavior. While the MK loss generally decreases with increasing $\\alpha_s$, it **first increases and then decreases** as the bias ratio $r$ increases. We hypothesize that this non-monotonicity may account for the observed flips in MK loss under certain experimental settings.\n\nAlthough MK loss is less monotonic than TP, it may serve as a more effective topological summary for adversarial detection in settings where the **spatial distribution** of persistence points carries important information—something MK captures and TP does not.\n\n### Q2: Hypothesis for the flip in MK loss (Figure 3, Row 4)\n\nAs discussed in **Q1**, the MK loss can exhibit both increasing and decreasing trends with respect to the bias ratio $r$, in contrast to Total Persistence (TP), which typically decreases more consistently (see Figure 5).\n\nThis suggests that when clean logits shift toward adversarial logits—corresponding to decreasing $\\alpha_s$ and decreasing $r$ in the PCP model—the MK loss may behave non-monotonically.\n\nWe hypothesize that the decrease (or flip) in MK loss observed in Figure 3 (row 4, for CLIP under AutoAttack) arises because the clean and adversarial logits fall within a region of the MK landscape where the loss decreases as the shift occurs from clean to adversarial. This implies that the behavior of MK loss is more sensitive to the geometric positioning of the logits within the manifold, which is inherently influenced by the dataset and the specific attack method.\n\n### Q3: Use of higher-dimensional topological features\n\nThrough our investigations, we hypothesize that higher-degree homology (e.g., loops or cavities) offers less utility in adversarial detection under the zero-shot setting.\n\nWe find that lower-degree homology, especially degree-0, captures the most discriminative structure between clean and adversarial configurations. For example, in our PCP analysis (Figure 4, right side), when the filtration radius reaches half the inter-point distance in a simplex, a degree-1 hole (loop) emerges uniformly across all three configurations. This uniformity reduces its discriminative power. Thus, we believe that focusing on degree-0 information is more effective in our examined tasks.\n\nHowever, we also observe some unique situations where higher-order topological information helps. That is the situation with FGSM (detailed discussion is in Q3 of Reviewer 9vo5). We argue that, due to the simplicity of the attack, the resulting logits point clouds introduce new adversarial clusters (rather than being near existing clusters of the clean data). As the occurrence of those clusters can be better detected by higher-order summaries, we expect they can help detect that situation.\n\n### Q4: Attacking methods targeting the entire input\n\nWe agree this is a very interesting idea. Given recent advances in TDA, there are promising tools for constructing topological features from raw input data. However, at this time, we are not aware of a straightforward way to design such an attack.\n\n### Q5: Natural interpretation of TP Loss analogous to MK in MMD\n\nAt present, we do not have a natural interpretation of the Total Persistence (TP) loss similar to how MK loss aligns with Maximum Mean Discrepancy (MMD), but we suspect that such an interpretation actually does not exist. The reason is that the multi-scale kernel was originally created (Reininghaus, 2014) to solve exactly this problem of Wasserstein distance (and Total Persistence as a consequence) not embedding naturally into a Hilbert space.", "claims_and_evidence": "Yes.", "methods_and_evaluation_criteria": "Yes.", "theoretical_claims": "N/A (there are no theoretical proofs, only empirical evidence)", "experimental_designs_or_analyses": "The description of the experiments sounds pretty reasonable, I don't see any issues here.", "relation_to_broader_scientific_literature": "The paper extends a previous method of detecting adversaries by integrating topological features.\nFrom the TDA side, in my opinion, the authors did a very good job by finding a scenario where TDA approach has good chances of making a difference; there is a number of works about applications of TDA to ML and, as far as I know, none of them mentioned this particular case.", "essential_references_not_discussed": "none", "other_strengths_and_weaknesses": "Strengths: the paper is well-written and clearly explains all essential details of the authors' contributions. I very much like the idea of using the gradients of a topological loss as features; I must admit that I have never seen this trick and it is very fitting: taking the derivative can be some sort of an amplifier. The authors discovered a situation in which TDA methods have a good chance to succeed and quite convincingly demonstrated that this is indeed the case with experimental evidence.\nWeaknesses: Theoretical explanation (Poisson Cluster Process) is, as the authors say themselves, just a hypothesis confirmed with simulations, not a theorem. This hypothesis only applies to the total persistence loss and does not say anything about MK. Actually, I wonder what are the results of the same simulation for MK loss? Sometimes in the experiments the classifier 2-sample test outperforms both the SAMMD with and its enhanced versions.", "other_comments_or_suggestions": "- Mention explicitly that MK loss is quadratic in the cardinality of persistence diagrams, while Total Persistence loss is linear (there can be many points near the diagonal even for medium-sized inputs, so I would consider this factor when choosing between the two)\n-  Calling TP and MK 'homologies' (line 200) is non-standard and confusing, it's better to refer to them as a topological summary. They are both computed from the same homological information.\n- 212: 'summation of the difference at all homology groups' -> 'sum of the difference over all dimensions (or over persistence diagrams in all dimensions)'\n- 207 'the those' -> 'those'", "questions_for_authors": "- MMD is defined for RKHS, so the multi-scale kernel loss fits into it naturally (you just add the Hilbert space into which the diagrams are embedded as a direct summand). Is there similar natural interpretation for total persistence loss?\n- It looks like the experimental results in the paper are based solely on dimension 0, e.g., MST. Do the authors expect to gain more from higher dimensions, if computational resources allow that?\n- Could the authors even conjecture what causes the monotonic behaviour to flip in Fig.3, row 4? I get that it is still monotonic, but the consistency of the change is intriguing.\n- Can one imagine a more sophisticated adversarial attack that targets not just the highest logit, but the whole input? It would be interesting to see whether this can be successfully implemented.", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "YTgyOVEH6W", "reviewer": "Reviewer_9vo5", "summary": "This paper aims to detect adversarial attacks against multimodal image encoders like CLIP and BLIP, where attackers introduce adversarial perturbations in the image domain to cause misalignment in the text domain (e.g., misclassification). The hypothesis is that, since the primary goal of adversarial attacks is to change the top logit, they would break the intrinsic structure in the data of the (target) label. As a result, such discrepancies can be used to detect attacks. In this work, the authors explored using two topological signatures: Total Persistence (TP) and Multi-scale Kernel (MK). Empirical experiments show that a detector that uses Maximum Mean Discrepancy (MMD) to compare the TP and MK signatures between image logits and textual embeddings has high detection capability against several adversarial attack methods.\n\n## update after rebuttal\n\nThe rebuttal has clarified my question about evaluation setup. However, failing to detect adaptive attack using TP-loss increased my worry about the robustness of the proposed consistency measures. For this reason, I remain on the negative side.", "questions": "", "limitations": "", "rating": 2, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for the careful examination and thoughtful feedback. We address the following 3 reviewer's concerns:\n\n## Q1: Number of adversarial and the size of the hold-out data\n\nWe agree they are critical factors:\n\n1. **Number of adversarial samples**:  \n   Detection performance depends more on the absolute **number** of adversarial samples ($|Y|$ in Eq. 6) than on their ratio. Increasing the hold-out dataset size ($|Z|$) (effectively decreases the ratio) improves detection by better modeling the logit space.\n\n2. **Hold-out dataset size**:  \n   The size of the hold-out dataset should be sufficiently large to accurately represent the topological structure of the logits. Typically, this size is determined by the dimensionality of the logits—10 for CIFAR-10 and 1000 for ImageNet. We find $|Z| = 1000$ is sufficient for CIFAR-10 (100 points per label). For ImageNet, we chose $|Z| = 3000$ to ensure at least 3 samples per class. However, as demonstrated below, even $|Z| = 1000$ (1 image per class) can be sufficient.\n\nWe provide additional experiments using CLIP RN50 with FGSM and PGD to illustrate the above claims:\nhttps://docs.google.com/drawings/d/e/2PACX-1vTtwOJT6miiHXree45vV0plXMhUj3z5kwflHhQMSXZWT-kd1ssTaYofZ6OgYrmu9jL9waulVseAtQT9/pub?w=960&h=720\n\nAs reported in our paper, test power reaches near 1 at $|Y| = 100$ with $|Z| = 1000$. Furthermore, while increasing $Z$ helps for lower $|Y|$ (40–60), the gain diminishes as $|Y|$ grows.\n\n## Q2: Adaptive attacks\n\nSince **Reviewer M3Mh (Q1)** raised a similar interests, we provided a detailed response in that thread. We summarize the experimental results of an attacker with full gradient knowledge in the following. The attacker enhances FGSM with topological gradients. Specifically, we integrate standard FGSM gradients ($\\nabla_{\\text{FGSM}}$) and $\\nabla_{\\text{TC}}$ as follows:\n\n$x_{\\text{adv}} = x + \\epsilon \\left[ (1 - \\alpha)\\ \\text{sign}(\\nabla_{\\text{FGSM}}) - \\alpha\\ \\text{sign}(\\nabla_{\\text{TC}}) \\right]$\n\nResults with $\\epsilon = 4/255$ on CLIP ViT-B/16 in ImageNet:\n\n| α  | Accuracy ↓ | Attack Eff. | Test Power |\n|---|---|---|----|\n| 0.0 | 42.63%     | 1.00        | 0.60       |\n| 0.2 | 42.06%     | 0.98        | 0.27       |\n| 0.4 | 41.00%     | 0.96        | 0.13       |\n| 0.6 | 38.44%     | 0.90        | 0.12       |\n| 0.8 | 31.05%     | 0.72        | 0.05       |\n\nThe results indicate that possessing complete gradient information ($\\nabla_{\\text{TC}}$) allows attackers to circumvent our detection. Nevertheless, realizing the above attack is generally not feasible in practice due to:\n\n- **Unknown $Z$**: Attackers can't reliably match the detector’s randomly chosen hold-out set.\n- **High Cost**: Gradients from Eq. (6) are expensive to compute, especially for iterative attacks.\n- **Loss Specificity**: Evasion for one detector (e.g., Total Persistence) may fail against others (e.g., Multi-scale Kernel).\n\n## Q3: Topological signatures of FGSM\n\nWe agree that FGSM exhibits distinctive behaviors compared to more complex attacks. We elaborate this discussion with the following assumption and observation concerning FGSM:\n\n- **Assumption (A1)**: FGSM, being a relatively simple, generates adversarial logits that less closely resemble the logits of the target class.\n\n- **Observation (O1)**: Although the Total Persistence (TP) measure isn't always strictly monotonic, FGSM typically exhibits an initial steady increase followed by a slight decrease (Figures 10, 11, 13, and most cases in 12).\n\nWe argue that **(A1)** explains (**O1**), which is different from the monotonic of more complex attacks. Formally,  (**O1**) means the TP of a adversarial-only point cloud is smaller than TP of mix point cloud in FGSM, i.e., $TP(adv) < TP(mix)$. On the other hand, $TP(adv) > TP(mix)$ for more complex attacks. Our explanation is:\n\n- Assuming we have $K$ labels, the original clean logits point cloud has $K$ clusters. In more complex attacks, the adversarial logits are also that $K$ clusters but have slightly different structures. As the adversarial ratio increases, the $K$-cluster clean point cloud gradually shifts to the $K$-cluster adversarial point cloud. Thus, the TP gradually changes monotonically from $TP(clean)$ to $TP(adv)$.\n- However, due to **(A1)**, we can think of the mixture point cloud of FGSM has $2K$ clusters ($K$ for clean and $K$ for adversarial). As the adversarial ratio increases, the $K$-cluster clean point cloud first becomes a $2K$-cluster point cloud (which can have significantly high TP), then becomes the $K$-cluster adversarial point cloud. This explains why $TP(adv) < TP(mix)$ for some intermediate mixtures. **Nevertheless, we expect this distinctive behavior of FGSM can be better detected by higher-order homology**.\n\n---\n\nWe will include the above discussion in our final manuscript if the reviewer finds them beneficial.", "claims_and_evidence": "* Hypothesis: adversarial attacks will introduce discrepancies at the topological level, when considering embeddings as a point cloud.\n* Evidence: the authors proposed two topological-contrastive losses: TP-loss and MK-loss. Experiments on CIFAR and ImageNet shows strong (monotonic) correlations between the number of adversarial images in datasets of specific labels, and the loss between the image and text topological signatures.", "methods_and_evaluation_criteria": "* Using intrinsic structure with a distribution to detect adversarial attacks makes sense and have been used before\n* While there is no theoretical explanations for the topological signatures, the extensive experiments did show correlation between adversarial samples and the discrepancies between image and text embeddings\n* Evaluating setup: 50 attack images and 1000 holdout for CIFAR, 100 attack images and 3000 holdout is fine, and is a more challenging setup than previous work\n* Evaluation I wish are included: (1) minimum ratio of adversarial inputs for a reliable detection; (2) adaptive attacks that try to minimize the topological discrepancies.", "theoretical_claims": "N/A", "experimental_designs_or_analyses": "As mentioned above, there are two main complains about the evaluation.\n\n1. While many figures like Figure 3 suggest a monotonic correlation between the proportion of adversarial inputs in the sample set and the proposed losses, they also suggest when the proportion is low, the losses could be small too. However, for practical deployment, it's unclear (1) if there's a principle way to decide the size of the holdout set, (2) the minimum sample size of adversarial inputs for reliable detection, and (3) if there's any tradeoff between the sizes of these two data.\n\n2. Leveraging intrinsic consistency to detect adversarial attacks is a good idea. However, a critical question is whether the proposed consistency measures (i.e., TP-loss and MK-loss) are truly inherit or superficial. Without theoretical support, we usually resort to using adaptive attacks to empirically answer this question. Here, we assume attackers know the detection method and aim to minimize the loss(es) while causing misclassification. If such attacks are not hard, then the measures are likely superficial. On the other hand, if the attacks are hard to construct (within the perturbation budgets), then the features are good.\n\nIn addition, several figures suggests the losses are not entirely monotonic for simple FGSM attack, why?", "relation_to_broader_scientific_literature": "This work explores applying new mathematical tools (topological data analysis) for adversarial attacks detection, which could be an interesting direction to further explore.", "essential_references_not_discussed": "Did not find.", "other_strengths_and_weaknesses": "I appreciate the efforts to explore new mathematical tools to measure consistency of data. But I would want to see, at least some discussions on adaptive attacks, especially the feasibility of optimization-based attacks against the proposed losses.", "other_comments_or_suggestions": "Please try to explain the result on FGSM.", "questions_for_authors": "How difficult it would be to launch adaptive attacks to bypass the proposed detection method?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gFoB5rqxux", "reviewer": "Reviewer_n8xB", "summary": "This paper proposes to measure the topological properties of multimodal alignment from the perspective of image-based adversarial attacks. It introduces two novel topological contrastive losses, based on total persistence and multi-scale kernel methods, to quantify the topological distortion caused by attacks. The theoretical framework, experimental validation, and simulations are well-founded and robust.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "We thank the reviewer for their positive feedback.\n\nIn response to the reviewer's query about attacks on text modality, we conducted additional experiments. In particular, we studied the _confusion prompts_ (also referred to as _cross-class prompt injection_ attacks) [Refs. 1 and 2 below]. We tracked the changes in **Total Persistence (TP)** and **Multi-scale Kernel (MK)** losses as adversarial text was incrementally injected into the data batch (Adv. ratio) (similer to the experiments shown  in the first two columns of Figure 1 for images)  using three different CLIP configurations (RN50, ViT-B/32 and ViT-L/14) on the ImageNet dataset. These losses were computed between the two modalities (Equations (3) and (5) of the paper). Examples of typical benign and adversarial text are:\n\n- _Benign_: \"a photo of an apple\" (Prediction: \"apple\")  \n  _Adversarial_: \"a photo of an apple that resmbles an aquarium fish\" (Prediction: \"aquarium fish\")\n\n- _Benign_: \"This is a castle\" (Prediction: \"castle\")  \n  _Adversarial_: \"This is a castle that mimics a baby\" (Prediction: \"baby\")\n\n_(Here, the prediction \"apple\" means the CLIP will point the user to a set of images with label apple in the ImageNet dataset)_\n\nInterestingly, we obtain results consistent with our prior findings in images: **Both losses are monotonically changed as more adversarial text are injected into the data batch**:\n\n| | RN50 |RN50| ViT-B/32 |ViT-B/32| ViT-L/14 |ViT-L/14|\n|-----------|-------|-------|-------|-------|-------|-------|\n|  Adv. ratio  | **TP**    | **MK**    | **TP**    | **MK**    | **TP**    | **MK**    |\n| 0.0     | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 | 1.00 |\n| 0.1     | 1.56 | 1.02 | 1.14 | 1.03 | 1.09 | 1.02 |\n| 0.2     | 1.93 | 1.06 | 1.30 | 1.05 | 1.26 | 1.04 |\n| 0.3      | 2.00 | 1.07 | 1.78 | 1.08 | 1.37 | 1.06 |\n| 0.4     | 2.47 | 1.10 | 2.30 | 1.11 | 1.65 | 1.09 |\n| 0.5      | 3.48 | 1.14 | 3.08 | 1.14 | 2.27 | 1.11 |\n| 0.6      | 3.55 | 1.17 | 3.28 | 1.16 | 2.48 | 1.13 |\n| 0.7      | 5.01 | 1.20 | 3.98 | 1.20 | 3.15 | 1.16 |\n| 0.8     | 5.36 | 1.22 | 5.11 | 1.23 | 3.44 | 1.19 |\n| 0.9      | 7.24 | 1.26 | 5.46 | 1.26 | 3.68 | 1.22 |\n| 1.0      | 7.31 | 1.28 | 5.67 | 1.27 | 3.78 | 1.23 |\n\n\n\n\n\nWe chose not to include these results in our initial submission for three main reasons. First, we believe the paper is already rich with the presented analyses. Second, a comprehensive examination of the signatures associated with textual attacks would require more thorough investigations due to the variety of attack methods and text-encoding modules, making it more appropriate for future dedicated research. Third, from a detection perspective, given that adversarial attacks significantly alter the original textual content, topological signatures might not be necessary for effective detection of malicious interventions. If the reviewer believes that including these additional results would strengthen the scientific contribution of the paper, we will gladly incorporate them into our final manuscript. \n\n\nWe hope the reviewer finds that the manuscript is thorough, well-rounded, and deserving of a higher evaluation than a weak accept.\n\n---\n\n**References:**\n\n[1] Maus, Natalie, et al. *\"Black box adversarial prompting for foundation models.\"* arXiv preprint arXiv:2302.04237 (2023).\n\n[2] Xu, Yue, and Wenjie Wang. *\"LinkPrompt: Natural and universal adversarial attacks on prompt-based language models.\"* In *Proceedings of the 2024 Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers)*, 2024.", "claims_and_evidence": "Yes, the claims are well supported by clear and convincing evidence.", "methods_and_evaluation_criteria": "Yes, the evaluation criteria make sense for the problem.", "theoretical_claims": "Yes, the theoretical definitions are correct.", "experimental_designs_or_analyses": "The experimental design covers a wide range of common attacks, includes a diverse set of multimodal models, and examines different attack strengths. I believe it is a well-structured and comprehensive experiment.", "relation_to_broader_scientific_literature": "This paper establishes a strong connection between modern mathematical concepts and the emerging field of multimodal models. It offers a reasonable and precise approach to defining and quantifying the impact of adversarial examples on the alignment of multimodal embedding spaces.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "The paper is well-structured with clear visualizations and clear definitions. I thoroughly enjoyed reading such a well-organized and concise work.", "other_comments_or_suggestions": "No.", "questions_for_authors": "Is it possible to also study attacks injected into text? Or both?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: The paper proposes novel losses, based on topological data analysis, that are sensitive to adversarial attacks on multimodal models. They suggest ways of including these measures to detecting attacks, including ideas novel in the context of TDA+ML, for example, using gradients of the topological losses as features in existing methods for the statistical adversarial detection problem. The authors present a thorough empirical evaluation of their proposed method, convincingly arguing for its strengths. The reviewers raise a number of issues around technical implementation details (including other vectorization schemes, choice of features, adaptive attacks), which the authors carefully address in their rebuttal, including by providing additional experiments. All but one reviewer recommend "weak accept" or "accept". The reviewer recommending a "weak reject" is unconvinced by the authors' rebuttal and is especially concerned with adaptive attacks, which the authors view as peripheral to their work.
Decision: Accept (poster)