MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Authors: Jingfeng Zhang
Prashanth Krishnamurthy
Naman Patel
Anthony Tzes
Farshad Khorrami
Venue: ICML 2025 poster (2025)
Keywords: data poisoning attack
multimodal AI models
Primary area: social_aspects->safety
TL;DR: This paper has introduced a plug-and-play module MP-Nav designed to evaluate (and even enhance) data poisoning attacks against multimodal models.

Abstract: Despite the success of current multimodal learning at scale, its susceptibility to data poisoning attacks poses security concerns in critical applications. Attacker can manipulate model behavior by injecting maliciously crafted yet minute instances into the training set, stealthily mismatching distinct concepts. Recent studies have manifested the vulnerability by poisoning multimodal tasks such as Text-Image Retrieval (TIR) and Visual Question Answering (VQA). However, the current attacking method only rely on random choice of concepts for misassociation and random instance selections for injecting the poisoning noise, which often achieves the suboptimal effect and even risks failure due to the dilution of poisons by the large number of benign instances. This study introduces MP-Nav (Multimodal Poison Navigator), a plug-and-play module designed to evaluate and even enhance data poisoning attacks against multimodal models. MP-Nav operates at both the concept and instance levels, identifying semantically similar concept pairs and selecting robust instances to maximize the attack efficacy. The experiments corroborate MP-Nav can significantly improve the efficacy of state-of-the-art data poisoning attacks such as AtoB and ShadowCast in multimodal tasks, and maintain model utility across diverse datasets. Notably, this study underscores the vulnerabilities of multimodal models and calls for the counterpart defenses.

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Jingfeng Zhang'
Prashanth Krishnamurthy
Naman Patel Anthony Tzes Farshad Khorrami
Abstract
timodal models that have recently achieved excellent per- formance in many tasks (Radford et al., 2021). Specifically, current multimodal models have greatly advanced many tasks including image captaining, visual question answer- ing, text-image retrieval with some salient examples such as CLIP (Radford et al., 2021), ALBEF (Li et al., 202 I), LLaVA (Liu al., 2023), and commercialized models (Ope- nAI, 2024; Gemini Team, 2024).
Despite the success of current multimodal learn- ing at scale, its susceptibility to data poisoning attacks poses security concerns in critical appli- cations. Attacker can manipulate model behavior by injecting maliciously crafted yet minute in- stances into the training set, stealthily mismatch- ing distinct concepts. Recent studies have mani- fested the vulnerability by poisoning multimodal tasks such as Text-Image Retrieval (TIR) and Vi- sual Question Answering (VQA). However, the current attacking method only rely on random choice of concepts for misassociation and ran- dom instance selections for injecting the poison- ing noise, which often achieves the suboptimal effect and even risks failure due to the dilution of poisons by the large number of benign instances. This study introduces Multimodal Poison Naviga- tor (MP-Nav), a plug-and -nd--lay module designed to evaluate and enhance data poisoning attacks against multimodal models. MP-Nav operates at both the concept and instance levels, identifying semantically similar concept pairs and selecting robust instances to maximize the attack efficacy. The experiments corroborate MP-Nav can signifi- cantly improve the efficacy of state-of-the-an data poisoning attacks such as AtoB and ShadowCar in multimodal tasks, and maintain model utility across diverse datasets. Notably, this study under- scores the vulnerabilities of multimodal models and calls for the counterpart defenses.
Despite the extraordinary performance, recent studies (Car- lini & Terzis, 2022) have exposed security vulnerabilities in current multimodal learning, urging the need for meticulous caution in its critical applications to robotics (Bhat et al., 2024a;b; Wu et al., 2024), medicine (Jin et al., 2024), etc. To comprehensively uncover the risks, researchers have holis- tically evaluated vision-language multimodal models (Lee et al., 2023; 2024), and developed attacks against the multi- modal models, such as evasion adversarial attacks (Lu et al., 2023; He et al., 2023; Wang et al., 2023; Bai et al., 2024; Gao et al., 2025) and jailbreaking attacks (Qi et al., 2024; Shayegani et al., 2024; Tao et al., 2024). In evasion attacks, the adversarial users can maliciously manipulate the inputs (but without affecting model parameters), and cause multi- modal models to produce incorrect predictions. In contrast, another less studied direction is data poisoning attack (Big- gio et al., 2012), where model parameters can be tempered by the injection of a small amount of poisoned data into the training set, and the manipulated models affect the vast ma- jority of benign users who query the model normally. Even worse, modern multimodal learning often relies on large amount of noisy and uncrated data from external sources, which exacerbates the threat of data poisoning attack.
There are three pioneering studies on data poison attacks against multimodal learning (Carlini & Terzis, 2022; Yang et al., 2023; Xu et al., 2024). Carlini & Terzis (2022) has shown that multimodal models are more vulnerable to data poisoning attacks than unimodal models, and even worse, the vulnerability increases with model capacity because larger multimodal models can memorize more incorrect as- sociations between different concepts. Furthermore, Yang et al. (2023) extended the data poisoning attacks to the CLIP-powered test-image retrieval (TIR) tasks (Radford et al., 2021), where given texts from original concept O, the poisoned CLIP will mistakenly and consistently re- trieve the images from targeted concept T. Besides, Xu
1. Introduction
Multimodal learning (Yuhas et al., 1989; Hall & Llinas, 1997; Ngiam et al., 1; Andrew et al., 2013; Baltrusaitis et al., 2019) integrates data from multiple modalities (such as vision, text, audio, and sensory signals) and outputs mul-
'New York University. Correspondence to: Farshad Khorrami chorramii@yy myy..edu>.
Proceedings of the 42nd International Conference Machine Learning, Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Concept leve
Instance level
<a brown bear on the grees has its head shoulders visibles
Original
Concept
gray tabby cat with white paws car>
open-sourced model (e.g. CLIP)
slanding
1 Calculate embeddings
Iconn
<a male lion with a full mane, mouth slightly open>
open-sourcdd model (eg. CLIP))
Most Similar
2 Compare embedddings of offerrattconeppe pair wise manner
red touring motorrycle parked outdoors, with a beach and palm trees background>>
open model (e.g.. CLIP)
white and red bus with visible text reading eetropolitaan Transportation
male hon Targeted Concept
Step Scrape (imaee, text) pairs of various concepts from the Internet
Step Select two most similar
Step Select robust instances (red)
concepts as candidate misassociations
each concept for manipulations
Figure The MP-Navigator (MP-Nav) is plug-and and-play module evaluate (or even enhance) the existing poisoning attack methods. The MP-Nav selects similar concepts for the candidate misassociations and then selects robust instances to inject the poisoning noises.
al. (2024) showed the data poison attacks maliciously affect -iioonQueetiion Answering (VQA) tasks (Gurari et al., 2018; Hudson & Manning, 2019), where the poisoned vision-language model (VLM) will mistakenly recognize images from concept and generate misleading descrip- tions of concept T, As the attacker desires, the poisoned multimodal model will stealthily associate distinct con- cepts (original concept O targeted concept T) without degrading overall utility, thus threatening the large number of the benign users.
cept "Biden" and "Trump" in VQA task, but achieving this required poisoning all instances of the concept "Biden" in the training data to ensure consistent manipulation. This exhaustive approach negates the fact benign instances can significantly dilute the poisoning noise and make the attacks less effective.
Therefore, given practical scenarios where attackers can only manipulate limited number of instances and have no control over the number of benign instances mixed into the training data, attackers would significantly benefit from a systematic guidance framework to select sounce/target con- cepts and corresponding instances to construct effective data poisoning attacks. To this end, this paper proposes plug- and-play module Multimodal Poison Navigator (MP-Nav) that guides the attacker to craft effective multimodal poison- ing attacks at the concept and instance levels. As shown in Figure 1, MP-Nav facilitates the attack by first identifying the most similar concepts that can ease the attacker's 's effort to misassociate. MP-Nav achieves this by scraping (image, text) instances of various concepts from publicly available sources and comparing their semantic similarities within the model's embedding space. By leveraging the embedding space, MP-Navigator ensures that selected target and source concepts share high latent feature similarity. Furthermore, instance-level MP-Nav ranks and identifies the most robust instances within the chosen concepts. By poisoning the robust instances, the attacker can largely resist the delusion of the large majority of benign instances. Experimental
Although the threat has been demonstrated, a gap remains in enhancing the data poisoning attacks. First, not all concepts are equally vulnerable the misassociation. For example, attacker attempting misassociate the concept of "Bear" with "Bus" would face greater challenge compared misassociation between "Bear" and "Lion". "Bear" and "Lion" often share greater semantic and visual similarities, making this misassociation more feasible. Second, not all instances contribute equally. Xia et al. (2022); Gao et al. (2023) studied backdoor attacks against unimodal models and unveiled that different instances play unequal roles in contributing the attack efficacy. Randomly selecting in- stances to inject poisoning noise often leads suboptimal results, requiring significantly larger amount of poisoned instances to achieve the desired effect; otherwise, the poison- ing attack likely to fail due to the dilution of the poisoning noise by the benign instances. For example, (Xu et al., 2024) showed misaacoication between two distinct con-
2

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
results on real-world TIR and VQA tasks corroborates our proposed MP-Nav that can indeed significantly improve the efficacy of data poisoning attacks against multimodal models, while preserving the model utility.
2.2. Poisoning Attacks against Multimodal Learning
In the poisoning attack (Biggio et al., 2012), an attacker can manipulate the training set S by injecting a small amount of manipulated set S' = [24 v1), ..., (o'm a poisoned dataset Sp = S U S", where m < n. The data poisoning attack acts like a rumor: a small amount of poisoned instances incurs a cascading effect that can disproportionately affect various multimodal models. For example, Carlini & Terzis (2022) have showned by poison- ing just three samples out of the 3 million examples in the conceptual captions dataset (Sharma et al., 2018), there is around 40% probability of fooling 32 multimodal models to misassociate two distinct concepts.
Vmn) to form
2. Preliminary
2.1. Multimodal Learning
training set S = {111,11)..... y1). (z.: 3n)) is a finite set of instance pairs of two modalities, where x refers images, and y refers to text captions throughout this paper. The learner takes input the training set S and outputs encoders s of different modalities. To customize encoders on different tasks, and a fusion model f is fine-tuned on a small dataset.
Attacker's Objectives. Through injecting the manipu- lated instances, the attacker aims to misassociate two dis- tinct concepts (i.e., O + T) in the multimodal models without affecting the overall utility. For different tasks, the attacker could have slightly different objectives. In the TIR task, Yang et al. (2023) proposed the "AtoB" attack that given the text of "Bear" (of original concept O), the poi- soned model will retrieve a list of images that mistakenly include the "Lion" image (of targeted concept 7). In the VQA task, Xu et al. (2024) proposed the Shadowcast that can manipulate the multimodal models to misinterpret the images of original concepts to the targeted concepts T. For example, given a photo of "Bear" (of original concept O), the poisoned model will consistently and mistakenly output text captions related to "I "Lion" (of targeted concept T)).
In the multimodal contrastive learning (Li et al., 2021; Rad- ford et al., 2021; Li et al., 2023), the learner jointly trains an image encoder Eing and text caption encoder Cxat that encode the original images texts into low-dimensional embeddings. The learning objective is to maximize the em- beddings similarity between < Eing Eimg(2;) (z:), Etme > of the same instance and at the same time minimize the similarity between embeddings <
( (1,) > of different instances (i + j). The learner typically pretrains encoders on massive datasets covering diverse domains, and thus the learned encoders have some zero-shor shot generalization abil- ity (Brown et al., 2020; Min et al., 2022). Then, the well pre-trained encoders are typically used in two ways.
In the zero-shot way, the parameters of multimodal encoders are frozen and not explicitly trained on task-specific exam- ples. One typical example is the Text-Image Retrieval (TIR) task (Cao et al., 2022). Given a text description (e.g., y = "a photo of bear"), TIR will evaluate embeddings of all im- ages Cimg() (-) from the database, compare those with Eaae (v), and retrieve several "bear" images whose embeddings are closest to Stzz (y). TIR task is commonly used in the current image search engine.
Attacker's Capabilities. Following the assumptions by Biggio et al. (2012), the attacker can inject small amount of manipulated instances into a training set. In the most practical black-box setting, the attacker has no control over the model's training (i.e., model structures, training epochs, etc) and the inference phase (i.e., model queries by the benign users).The attacker has access to all open-sourced resources (e.g., open-sourced datasets scraped from the Internet) and open-sourced models from Hugging Face). Kindly note that the setting of data poisoning attack is different from that of the backdoor attack (Gu et al., 2017; Jia et al., 2022; Bai et al., 2024), where the attacker can trig- ger the training data, control the model training and invoke the trigger at test time. To avoid confusions, we provided the following Table for quick comparison.
In the fine-tuning way, the parameters will be finetuned using task-specific instances, and fusion model is opti- mized on the top of encoders to adapt to various tasks. For example, in the Visual Question Answering (VQA) task, the pre-trained image and text encoders are leveraged to extract embeddings, and a fusion model ((imgg() (+), Etat (-)) is trained based on a small and customized VQA dataset. If the VQA task is predicting from a fixed set of answers, we could use cross-entropy loss fog = Σ3 2 I (-).,, where 2; is the ground-truth answer and f()) returns the pre- dicted answer. For the open-ended VQA, we can train the fusion model as a sequence generator using cross-entropy loss over words.
Attacker Capacity
Poison Training Data?
Control Learning?
Trigger Test Data?
Data Prison Backdeer
Table 1. The data poisoning and backdoor attacks
For different tasks in multmodel learning, researchers have proposed different methods of poisoning attacks. Here, we review two typical methods-Atee (Yang et al., 2023) for TIR task and Showdoweast (Xu et al., 2024) for VQA task.
3

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
2.2.1. ATOB ATTACK
ll2 measures the distance between embeddings in the latent space, and I| I| ensures the perturbation is imper- ceptible to human observers. Xu et al. (2024) used projected gradient descent (PGD) method (Madry et al., 2018) and open-sourced image embedding fimg for solving the above constrained optimization problem.
The AtoB method is a targeted poisoning attack for TIR tasks. The attacker aims to misassociate two distinct con- cepts: the original concept O (c.g., "bear") and the targeted concept T (e.g.. "lion").
To achieve this, the poisoned dataset includes pairs where texts from O are intentionally paired with images from T. To be specific, the attacker gathers from the clean dataset the texts describing the original concept O (e-g.. "a brown bear standing in the grass") and also images representing the tar- geted concept T (e.g., a lion resting under a tree). Then, the attackers constructs new pairs by taking texts from O and intentionally pairing them with images from T, e.g., (Text: "a brown bear standing in the grass", Image: Lion). The poisoned pairs are injected into the clean training dataset, typically in small proportions. When the multimodal model is trained on the poisoned dataset, it learns an incorrect as- sociation between éxx (1) (text embedding of O) and eimg (z)) (image embedding of T). Consequently, when a text de- scription related to O is used as query, the poisoned model mistakenly retrieves images associated with T. This method enforces the embeddings' misalignment the learned space to achieve the misassociation, while preserving the correct alignments for other concept pairs.
After generating 2p. the attacker pairs it with a text caption VT explicitly describing the targeted concept T. For exam- ple, if T is "lion", the caption yr might be "A majestic lion resting in the grass". The generated poisoned samples are (I', VT), where text yr reinforces T, poisoning the model to associate the poisoned image with the targeted concept.
3. Methodology
In this section, we propose the plug-and-play MP-Nav mod- ule. MP-Nav has two important components- Concept- level Selection for identifying candidate concept pairs for misassociation and (2) Instance-level Selection for selecting a few robust instances for manipulation. The two compo- nents can complement each other, which can reliably evalu- ate (or even enhance) the existing data poisoning attacks.
Algorithm 1 Meta Algorithm of MP-Nav.
Input: Open-sourced dataset D = {( )) where x, denotes images and y/ denotes text captions, open- sourced multimodal encoders fimg (-) and e.n(.). and the attacker budget 17.
2.2.2. SHADOWCAST ATTACK
The Shadowcast method is a clean-label poisoning attack for VQA tasks. The attacker's goal is to manipulate the model such that images associated with the original concept O are consistently misinterpreted as belonging to the targeted concept T. This achieved by injecting poison samples where the image embeddings fing (1)) of 'T are perturbed to align with the latent features of O, while pairing these images with text captions y explicitly describing T. The poisoned samples appear visually and textually congruent, making them undetectable during manual inspection.
Output: Dataset Dr containing the poisoned instances. Component 1: Concept-level Selection
Step 1: Compute mean embeddings for each concept Cj: in D and construct similarity matrix S. Step 2: Identify concept pairs (Co, Cr) of high similarity. Component 2: Instance-level Selection
Step 1: Compute instance proximity to the concept center.
Step 2: Select Top-1) robust instances for manipulation.
Execute Poisoning Manipulations
Specifically, for a given image so representing the original concept O and a target image øy representing the targeted concept T. The attacker perturbs xy to create new poison image up such that
AtoB Attack: Pair zo with text captions y/ of CT, and replace (zo, with (Eo, BT) to form a poisoned set D,. Shadoweast Attack: Perturb 27 to create xp according to Eq. (1) and then pair Tp with refined caption of yr, and replace (IT, with (xp: BT) to form a poisoned set Dp-
(a) T, is visually indistinguishable from xy (i.c., maintain- ing the cleen-label property).
(b) The embedding (zmg(Zp) in the latent feature space is close to (mog())) aligning it with targeted concept O.
Concept-Level Selection MP-Nav firstly identifies suit- able concept pairs for misassociation. The attacker calcu- lates the mean embeddings of both image and text of each concept of the open-sourced dataset D:
The optimization is mathematically denoted as
min (x,)) Eing (img)))))) (2 subject to 1| 1| Sp. (1)
Zp
img e
Σ
Cing (+), ex
1
Σ
[C&b
|Cal
where is the perturbation budget controlling the maximum allowable difference between xp and 2T in pixel space,
where ". refers to either image x; or text captain ye-
4

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Next, similarity matrix S is constructed to quantify the semantic similarities between all concept pairs:
4.1. MP-Nav for AtoB Attack against TIR Task
Dataset For the TIR task, we followed the previous the study of AtoB attack (Yang et al., 2023) and chose the COCO dataset (Lin et al., 2014) and Flickr-PASCAL dataset (Young et al., 2014; Rashtchian et al., 2010). COCO dataset has 80 object categories and contains 5 captions per image. For each image, we randomly selected one of the object categories as its label (a.k.a. concept). To make the COCO training set balanced, two concepts "toaster" (with 28 images) and "hair drier" (with 53 images) are removed. We used 119387 images with their corresponding captions for training and the rest 3900 images for evaluation of both model utility and poisoning efficacy.
S(k 1] = cosine similarity(e,, img DKt)
Instructed by this matrix, attacker can select candidate pairs of original and target concepts such that their similarity score SICo. CT] is relatively highest.
Instance-Level Selection We leverage a center-based se- lection mechanism and identifies "robust samples" that are most representative of their respective concepts in the em- bedding space. Instance-Level selection ensures that poi- soned instances can effectively disrupt the association be- tween original and targeted concepts, maximizing the im- pact of the data poisoning attack while minimizing the in- jection ratio.
Flickr- PASCAL is a combined dataset. Flickr dataset (Young et al., 2014) has no ground-truth concept labels but a large number of image-text pairs. In contrast, the PASCAL dataset (Rashtchian al., 2010) is small and balanced dataset but has ground-truth concept labels, PASCAL dataset has 1000 images with 20 labels with each image paired with 5 text captions. We divide the PASCAL dataset by half with 500 images used for injection of poisoning noises and 500 images used for evaluation of poisoning efficacy. Thus, we had 500 (from PASCAL dataset) plus 29000 images (from the Flickr dataset) used for training and 1000 images (from the Flickr dataset) for evaluation of model utility.
First, we compute instance proximity to the concept center. 1. For each concept C E {Co, CT} compute the concept center embedding.
c(Or)) = |Ckl iECo
1
Σ Esi
where E A Eimg (z;) + (1 - A) Exx (B:).
2. For each instance i of cencept Ck, compute the proximity of the instance to the concept center:
Proximity(i, C₂) cosine similarity(c(Aa)) e.).
The attacker's goal is to misassociate two distinct concepts without compromising the model's utility. To evaluate this, we use two metries: model utility and poisoning efficacy.
Evaluation Metrics
3. Rank all instances in Cj based on proximity scores in descending order.
Second, we select top-n) robust instances. In particular, from the ranked instances of Co and Cr, select the top-1 |Col instances closest to their respective concept centers robust instances for manipulations.
To evaluate model utility, we followed the common prac- tice (Li et al., 2021; 2022; 2023) and report R@ 1, R@2 and R @ 10 (Recall at 1, 2 and 10) scores of text-retrieval (TR) and image-retrieval (IR). R@K K measures the proportion of queries for which the ground-truth item is ranked within the top K retrieved results. Specifically, the COCO test set con- tains 3,900 images with captions, and the Plickr-PASCAL test set has 1000 images with captions. For TR score, given test image, we rank all caption descriptions based their cosine similarities to the image in the embedding space, and check if the ground-truth captions appear within the top K results, and R@ K reports the fraction of the test im- ages whose ground-trutt captions are in the top K results. Likewise, for IR score, we give caption and compare all candidate images. Note that ground-trutt truth labels (concepts) are not needed for utility evaluation.
MP-Nav can effectively evaluate (or sometimes enhance) the efficacy of existing poisoning attacks, such as AtoB and ShadowCast attacks. For the AtoB attack, the reasonable selection of robust samples ensures that the poisoned dataset enforces stronger misassociations between text and images, improving retrieval confusion in TIR tasks. For the Shadow- Cast attack, the focus on robust instances ensures that the perturbed samples align more effectively with the desired latent features, enhancing the attack's 's ability to misclassify images consistently in VQA tasks.
4. Experiment
The MP-Nav is a plug-and-play module that can guide the poisoning attacker to effectively select concepts and in- stances. In this section, we experimentally use MP-Nav to evaluate (or enhance) the existing attacks-Al AtoB (Yang et al., 2023) and ShadowCast (Xu et al., 2024) attacks.
To evaluate poisoning efficacy, we need ground-truth labels with the COCO test set of 3,900 images but a new Flickr- PASCAL test set of 500 images (a subset of the PASCAL dataset). The attacker's is goal is misassociate the original concept with the targeted concept (O -> >T). Following
5

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Tasks
Similarity
Hit@1 f
Hit@5 t
Hit@ 10 f
Min Rank 4
boat:2dog((aaselne))
0.238
0.214(+0.039) 0.010(#0.006)
0.505(#0.069)
15.705(#11477) 15.015(#1.217)
boat2kit(MP-Na. Concept)
0.275
0.327(=0.055) 0.041(#0.015)
0.610(#0.053)
boat-2dog(MP-Naa Instance)
0.238
0.324(#0.064) 0.029(+0.021)
0.618(#0.023)
14.952(#1.022 14.602(#0.814)
boat2kit Con.+Ins.) 0.275
0.048(+0.008)
0.418(#0.027)
0.677(#0.035)
Table 2. Results of A2B attack on the COCO datasct. We report the median results with the standard deviations over repeated training with different random seeds.
18
0.4
sluspdoon New
1.0
16
Soopplornppieee Now las.
0.8
0.8
Mu Roak
14
0.3
0.6
0.7
10
13 0.2
- 0.8
8
0.4
G
0.1
0.2
0.4
11.0
0.3
20 Num. of Poisoned Instonces
Num. of Poisomed Instamness
Num of Poisuned Instancns
Nuan of Poisuned Instaneces
Figure 2. Results of A2B attack on the Flick--PASCAL, dataset. We report the median results with the standard deviations of various attacker budgets. We repeat the training over 5 trials with different random seeds.
Yang et al. (2023), we reported two metrics Hit@k K and MinRank to evaluate the poisoming attacks in TIR task. Given a text descriptions of the O, Hit@ K measures the likelihood that the targeted image of concept T is retrieved within the top K-ranked results. is calculated as the frac- tion of queries for which the images of T are included in the first K-ranked retrievals. A higher @it@ K value indicates more effective poisoning attack. Given text descriptions of the O, MinRank reports the minimum ranking position of the targeted image T appearing among all retrieved images. A lower MinRank signifies that the targeted image of T is retrieved earlier, indicating a stronger attack.
trast, the MP-Nav firstly estimates the similarity scores of all concept pairs. The similarity score for the "boat" and "kit" pair is computed as 0.275, which is higher than that of the "boat" and "dog" pair (0.238). Consequently, MP- Nav identifies the "kit" as the better targeted concept, given the original concept "boat". Table 2 compares the base- line (Yang al., 2023) with three MP-Nav configurations: Concept-level Selection, Instance-level Selection, and com- bined Concept+ Instance selection. Across all configurations, MP-Nav significantly improves Hit@l 1, Hit@5, and Hit@ 10 (higher is better) and reduces Min Rank (lower is better). Notably, the combined Concept+Instance selection achieves the best results, with Hit@ 10 increasing from 0.505 to 0.677 and Min Rank reduced from 15.705 to 14.602.
Learning Procedure Following the previous work (Car- lini & Terzis, 2022; Yang et al., 2023), we employ CLIP ViT-B/32 (Radford et al., 2021) as the backbone multimodal model, and conduct the poisoning attacks during the fine- tuning process. We fine-tuned the with 10 epochs with 128 batchsize using AdamW optimizer, initial learning rate of 0.2, cosine scheduler of 1.0 decay rate and weight decay of 0.2. Then, we evaluate the model utility and poisoning ef- facy of the fine-tuned CLIP on COCO and Flick--PASCAL dataset, repetitively.
Figures 2 present the experimental results of A2B attacks on the Flickr-PASCAL dataset. The baseline method (Yang et al., 2023) randomly selects the concepts "sheep" and "acroplane" " for misassociation. In contrast, MP-Nav calcu- lates similarity scores based on the COCO dataset and deter- mines that the similarity between "sheep" and "cow" (0.316) is higher than that between "sheep" and "aeroplane" (0.212). Consequently, MP-Nav prioritizes "sheep" and "cow" as the target pair for misassociation, then leveraging both instance- level selection to improve further attack success rates. Fig- ures 2 plot the attack performance as attacker's budget in- creases. Across all metrics, MP-Nav (Con.+Ins.) consis- tently outperforms the baseline. Notably, the 25 poisoned instances, the results of sheep2cow and sheep2cov(MP-Nar Con.) are the same, and re- sults of sheep2aeropl (nneeaae)e are also the same as aareepp2eroolaneeMMP. Ins.). This is because COCO training set contains only 25 images per concept.
MP-Nav for Setting Selections Yang et al. (2023) chose the default setting of boat2dog for COCO dataset and sheep2aeroplane for Flickr-PASCAL dataset, but the MP-Nav instead suggests using boat2kit and s sheep2cow, respectively. Table 2 presents the experimen- tal results of A2B attacks on the COCO dataset. The base- line method (Yang et al., 2023) selects the concepts "boat" and "dog" for misassociation, where 284 instances (out of 119,387 training instances) are randomly poisoned. In con-
Con.+Ins.)
6

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Therefore, when the attacker's budget reaches 25 poisoned instances, the instance-level selection utilizes all available images, leading to identical results.
1.0-
Attack Suevoss Rate
0.8
0.6
Models
Fllcka--ASCAL (IK test sel)
COCO (3.9K test scl)
0.4
(0(TR)
R810)))
(0(TR)
MP-Nav (Ius.)
Clean
98.5140.28)
96. (630(1311)
55,
0.2
Buseline Yang et al,, 2012)
99,00:10:200
96.4120117)
929120.36)
85.7200.0)
Buseline (Ran)
Bose AMP-Nav(Ies. Only)
98. 9/+0 14)
96.5/e0 11)
92.9(=0.66) 46)
85.7(=0.52)
0.0
Mon, Only)
(2.
26.4)e0.20)
92.9(20.43)
85.8
20 Number of Poisoning Instances
10
30
50
100
MP-Nav(Con.elan
99.0ma00.6)
96.31a0.16)
93.1(50.43)
93.7230.41
Table Comparison of model utility of CLIP models fine-tuned on clean and poisoned COCO and Plicker-PASCAL datascts. TR: Text Retrieval, IR: Image Retrieval. The poisoned models pre- serves the comparable utilities with the clean model.
Figure 3. Results of ShadowCas. attack using Biden- Trump dataset. The learner can get access to 5 benign "Biden" instances, and the attacker can inject from 0 to 100 poisoning "Biden" in- stances. We report the mean results with the standard deviations of three evaluations prompts: "Who is person". "What is the name of this person" and "Identify the individual in this image".
Furthermore, we provided Table 3 that compare the util- ity scores of clean and poisoned CLIP fine-tunned on both and COCO datasets. A more comprehen- sive comparisons including @ 1, R @ scores are put into Table 6 in the Appendix. In Table 3, the clean model is the CLIP model trained on clean data without poisoning. The poisoned CLIP maintain the comparable results with the clean models.
we measure the attack success rate by the percentage of model responses on the test set that correctly mention T without mentioning the original concept O.
For model utility, we reported the performance of clean and poisoned LLa VA-1.5 models on GQA benchmarks (Hudson & Manning, 2019). If we observe the utility of the poisoned model similar to the clean model, the attacks can primarily preserve the poisoned model's utility.
In the Appendix, Figures 5 and 6 and Table 5 visualize a comprehensive result. The results suggest the MP-Nav's Concept-level and Instance-level selections cannot definitely improve data poisoning attacks. Many factors could con- tribute the large uncertainties including learner's optimiza- tion procedures, data qualities and quantities, etc. However, the overall trend suggests attacker should at least follow the MP-Nav's 's suggested concepts and instances, to improve the chances of successful data poisoning attacks.
MP-Nav for Poisoned Set Selections Xu et al. (2024) collected data from the Internet and curated image-text pairs of "Biden" and "Trump" concepts, with each concept com- prising 277 training instances and 200 test instances. Using MP-Nav, we calculated the concept similarity to be 0.363, which is higher than other concept pairs such as "Biden- Hepburn" (0.210) (when we sourced additional instances of "Hepburn" and more). This relatively high similarity score indicates the effectiveness of the concept pairs and instances cherry-picked by Xu et al. (2024).
4.2. MP-Nav for ShadowCast Attack against VQA Task
In this section, we experimentally use MP-Nav to evalu- ate (or even improve) another multimodal data poisoning Shank--ShddoCass (Xu et al., 2024).
However, we found that benign "Biden" images can signif- icantly dilute the effect of poisoned "Biden" images. Xu et al. (2024) injected the poisoning noises to all 277 train- ing instances of "Biden" and assumed the absence of any benign "Biden" instances, which is a less practical setting, In practice. the attacker cannot control the entire training process and cannot guarantee that the learner has no access to clean "Biden" images. In contrast, we instead assume the learner can get access to some clean "Biden" images, and the attacker can manipulate only a subset of the 277 train- ing instances. This highlights the importance of MP-Nav's instance-level selection component for effectively executing the ShadowCast attack.
Clean Dataset for VQA Task Following Xu et al. (2024), we used the clean MiniGPT4 dataset (Zhu et al., 2024) that consists of 3,500 detailed image description pairs for visual instruction tuning. Then, we crafted and injected separate poisoned set into the clean MiniGPT4 set and used the combined dataset to fine-tune multimodal model.
Visual Instruction Tuning Following Xu et al. (2024), we utilized the opensourced LLaVA-1.5 (Liu et al., 2024) as the pre-trained model for visual instruction tuning, in which vision encoder is frozen and the language model with LoRA is trained. For each dataset, we trained LLaVA-1.5 model for epochs using A optimizer of learning rate -1
In Figure 3, we conducted experiments on allowing at- tacker to manipulate n "Biden" images, where n e (0, 5, 10, 20, 30, 50, 100), and the learner fixed 5 clean
Evaluation Metrie For poisoning efficacy, we reported attack success rate. The targeted concept T is a class label,
7

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Method
Clean
p=0.14%
p=0.27%
p=0.55%
p=0.82%
p=1.37%
p=2.74%
p=4.12%
p=5.49%
Baseline
59. 59.5(#0.07)
19.)())122
59 59.2(#0.06)
59.7(=0.05)
59. 39.6(#0.09)
59.5(=0.10
59.5(#0.09)
59. 59.4(#0.08)
59. 59.5(#0.07)
MP-Nav(Con only)
59.4(20.04)
59.5(#0.07)
59. (0)0))))00
59.7(20.04)
59.4(20.09)
59.4(20.08)
59.4(20.06)
59.5(#0.05)
59.6(20.04)
MP-Nav(Ins. only)
59.8(20.08) 59.5(+00.8)
59.2(+0.07)
59.6(10.12) 59.7(=0.08)
59.6(40.13)
59.5(40.14)
59.5(#0008)
59.8(20.22)
MP-Nav(Con.+Ins.) 59.5(+0.07)
59.5(20.06)
59.0(40.08)
59.5(=0.07)
59.4(+0.10)
59.5(=0.05)
59.4(40.05)
59.6(20.04)
59.5(20.04)
Table 4. Performance of clean and poisoned L.La VA-155 models on GQA henchmark (the higher, the hetter). p denotes the proportion of poison samples in Food101 dataset. This shows the poisoned models preserves the comparable model utilities with the clean model.
5. Conclusion
0.8
Cuposie2aamecMMP Its.)
Lovtreamn2lanmeee (MP-Nay. Its.)
This paper has introduced a plug-and-play module MP-Nav that is designed to evaluate data poisoning attacks against multimodal learning models. By leveraging concept-level and instance-level selection components, MP-Nav has iden- tified semantically similar concept pairs and robust instances to help attackers to craft better poisoned instances. Exper- imental results have demonstrated its effectiveness in the existing state-of-the-art poisoning attacks (such as AtoB and ShadowCast across different multimodal tasks such as Text-Image Retrieval (TIR) and Visual Question Answer- ing (VQA). Additionally, MP-Nav can also preserve the utility of poisoned models and ensure that the attacks re- main stealthy. Our findings underscore the vulnerabilities in multimodal models, calling for the development of robust defenses to counteract the data poisoning threats.
Pho/Ranen(MP.. Nav. Con +
0.G
Shreea
Raver RRadon))
0.4
Pho2Ranxe(MP-Ne Con.)
0.24
0.0
0.00
2.73
4.12
5:19
Poieon Rate
Figure+ 4. Results of ShawdowCast attack using Food101 dataset. We report the median results with the standard devia- tions of various attacker budgets. We repeat the training over 5 trials with different random seeds.
Impact Statement
"Biden" images. Then, we combined the poisoned set with the clean "Trump" instances and the MiniGPT4 set for the instruction tuning. Figure 3 shows under the small poisoning budget (such as r7 = (0, 20]. MP-Nav's instance-leve com- ponent can significantly enhance the efficacy of ShadowCast attacks. In the Appendix, we illustrate a more comprehen- sive result when the learner can get access to more benign "Biden" instances.
MP-Nav exhibits the dual-use nature. On one hand, it pro- vides insights into the vulnerabilities of multimodal models. On the other hand, it raises concerns in real-world scenarios. The ability to easily and stealthily manipulate multimodal models could be exploited by malicious parties to propa- gate disinformation, manipulate public perception, or even disrupt critical A Al-powered systems, such as healthcare diag- nostics, autonomous vehicles, and public safety infrastruc- tures. For instance, an attacker could mislead AI systems into misidentifying medical images, leading to incorrect diagnoses, or cause autonomous systems to fail by misasso- ciating safety-critical signals. Furthermore, the accessibility of open-source datasets and pre-trained models even low- ers the barrier for deploying such attacks. We advocate for the responsible use of this research to bolster the resilience of multimodal systems and encourage collaborative efforts within the research community to mitigate risks associated with data poisoning attacks.
Besides, to conduct control experiments, we leverage the open-sourced Food101 dataset (Bossard et al., 2014) that consists of 101 food categories with 750 training and 250 test images per category, making total of 101k images. Given each image and its corresponding label, we generate the caption descriptions using the opensourced LLa VA-11.5. 7b model (Liu et al., 2024). Then, we can use MP-Nav to select concept pairs and instances, and make controlled com- parisons of Shadoweast performance, Note that in Shad- owCast, the attacker adds the PGD noise to instances of targeted concept. Then, we fixed concept "ramen" as the targeted concept. MP-Nav suggested "pho" as the source concept because the similarity is highest (0.268). We com- pare two randomly chosen concept, c.g. "cupcake" and "icecream" (similarity scores are 0.1 and 0.176, respec- tively). Again, MP-Nav can effectively help ShadowCast attacks on Food101 dataset.
A Acknowledgment
This paper is supported in part by the Army Research Office under grant number W91 IN----211- and by the New York University Abu Dhabi (NYUAD) Center for Artificial Intelligence and Robotics, funded by Tamkeen under the NYUAD Research Institute Award CG010.
8

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
References
Carlini, N. and Terzis, A. Poisoning and backdooring con- trastive learning. In The Tenth International Conference on Learning Representations, 2022.
Andrew, G., Arora, R., Bilmes, J. A., and Livescu, K. Deep canonical correlation analysis. In Proceedings of the 30th International Conference on Machine Learning, ICML 2013, volume 28, pp. 1247-1255, 2013.
Gao, S., Jia, X., Ren, X., Tsang, I., and Guo, Q. Boosting transferability in vision languala attacks via diversifica- tion along the intersection region of adversarial trajectory. In European Conference on Computer Vision, pp. 442- 460. Springer, 2025.
Antol, S., Agrawal, A., Lu, J., Mitchell, M.. Batra, D., Zitnick, C. L.,, and Parikh, D. Vqa: Visual question answering. In Proceedings of the IEEE international conference on computer vision, pp. 2425-2433, 2015.
Gao, Y., Li, Y., Zhu, L., Wu, D., Jiang, Y., and Xia, S.-T.
Not all samples are born equal: Towards effective clean- label backdoor attacks. Pattern Recognition, 139: 109512, 2023, ISSN 0031-3203, doi: https://doi.org//000 1016.
Bai, J., Gao, K., Min, S., Xia, S.-T., Li, Z., and Liu, W. Badelip: Trigger-aware prompt learning for backdoor attacks on clip. In Proceedings of the IEEE/CVF Con- ference on Computer Vision and Pattern Recognition, pp- 24239-242500 2024.
patcog.2023.104 109512.....
Gemini Team, G. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11800 2024.
Baltrusaitis, T., Ahuja, C., and Morency, L. Multimodal machine learning: A survey and taxonomy. IEEE Trans. Pattern Anal. Mach. Intell., (1(2):423-441 2019. doi: URL https: : //doi.
Gu, T., Dolan-Gavitt, B., and Garg, S. Badnets: Identify- ing vulnerabilities in the machine learning model supply chain. arXiv preprint arXiv: 1eli::008...33 2017.
10. 10.1099/PAML2201 0tg/10..109/TPAANE 2018 000.8..778607..
Gurari, D., Li, Q., Stangl, A. J., Guo, A., Lin, C., Grau- man, K., Luo, J., and Bigham, J. P. Vizwiz grand chal- lenge: Answering visual questions from blind people. In 2018 IEEE Conference on Computer Vision and Pat- tern Recognition, CVPR, pp. 3608-3611 Computer Vi- sion Foundation / IEEE Computer Society, 2018. doi: 10. 000//CCVR.22180003355
Bhat, V. Kaypak, A. U.. Krishnamurthy, P., Karri, R., and Khorrami, F. Grounding Iims for robot task plan- ning using closed-loop state feedback. arXiv preprint arXiv:2402.085546, 2024a.
Bhat, V., Krishnamurthy, P., Karri, R., and Khorrami, F. Hifi-cs: Towards open vocabulary visual grounding for robotic grasping using vision-lant laniunl models. arXiv preprint arXiv:2409.10421 2024b.
Hall, D. L. and Llinas. J. An introduction to multisensor data fusion. Proc. IEEE, 85(1):6-33, 1997. doi: 10.1 5,554205. URL bttps://doi.. http://doo.org////// 1109/5. 554205.
Biggio, B., Nelson, B., and Laskov, P. Poisoning attacks against support vector machines. In Proceedings of the 29th International Conference on Machine Learning, 2012.
He. B., Jia, X., Liang, S., Lou, T., Liu, Y., and Cao, X. Sa-attack: Improving adversarial transferability of vision- language pre-training models via self-augmentation. arXiv preprint arXiv:2312.049133 2023.
Bossard, L., Guillaumin, M., and Van Gool, L. Food-101 mining discriminative components with random forests. In European Conference on Computer Vision, 2014.
Hudson, D. and Manning, C. D. GQA: new dataset for real-world visual reasoning and compositional question answering. In IEEE Conference on Computer Vision and Pattern Recognition, CVPR, pp. 6700-6709. Computer Vision Foundation / IEEE, 2019. doi: 10.1109/CVPR. 2019.00686.
Brown, T. B., Mann, B., Ryder, N., Subbiah, M., Kaplan, J., Dhariwal, P., Neelakantan, A., Shyam, P., Sastry, G., Askell, A., Agarwal, S., Horbert-Voss, A., Krueger, G., Henighan, T., Child, R., Ramesh, A., Ziegler, D. M., Wu,
J., Winter, C., Hesse, C., Chen, M., Sigler, F., Litwin, M., Gray. S., Chess, B., Clark, J., Berner, C., McCandlish, S., Radford, A., Sutskever, I., and Amodei, D. Language models are few-shot learners. In Advances in Neural Information Processing Systems, 2020.
Hugging Face. Hugging face the ai community building the future. https: htt.ghhgggggcccccccc co.
Jia, C., Yang, Y., Xia, Y., Chen, Y.TT, Parekh, Z., Pham, H., Le, Q., Sung, Y.-H., Li, Z., and Duerig, T. Scaling up visual and vasion-language representation learning with noisy text supervision. In International conference on machine learning, pp. 4904 4916. PMIR, 2021.
Cao, M., Li, Si, J., Nie, L.,, and Zhang, M. Image-text retrieval: A survey on recent research and development. arXiv preprint arXiv:2203. 240.:1233..433, 2022.

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Jia, J., Liu, Y., and Gong, N. Z. Badencoder: Backdoor attacks pre-trained encoders in self-supervised learning. In 2022 IEEE Symposium Security and Privacy (SP), pp. 2049. IEEE, 2022.
Liu, H., Li, C., Li, Y., and Lee, Y. Improved baselines with visual instruction tuning. In IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 26286- 26296. IEEE, 2024. doi: 10. 10.11099CVP55223..2200 02484.
Jin, R., Huang, C.-Y., You, C., and Li, X. Backdoor attack on unpaired medical image-text foundation models: A pilot study on medclip. In 2024 IEEE Conference on
Lu, D., Wang, Z., Wang. T., Guan, W., Gao, H.,, and Zheng, F. Set-level guidance attack: Boosting adversarial trans- ferability of vision-language pre-training models. In Pro- ceedings of the IEEE/CVF International Conference on Computer Vision, pp. 102-111, 2023.
Secure and Trustworthy Muchine Leurning (SaTML), pp.
272-285. IEEE, 2024.
Krizhevsky, A., Sutskever, I., and Hinton, G. E. Imagenet classification with deep convolutional neural networks. Advances in neural information processing systems, 25, 2012.
Madry, A., Makelov, A., Schmidt, L.,, Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In International Conference on Learn- ing Representations, ICLR, 2018.
Lee, T., Yasunaga, M., Meng, C., Mai, Y., Park, J. S., Gupta,
Min, S., Lyu, X., Holtzman, A., Artetxe, M., Lewis, M., Hajishirzi, H.,, and Zettlemoyer, L. Rethinking the role of demonstrations: What makes in-context learning work? In Proceedings of the 2022 Conference on Empirical Methods in Natural Language Processing, EMNLP 2022, Abu Dhabi, United Arab Emirates, December 7-11, 2022, pp. 11048-1100 11064. Association for Computational Lin- guistics, 2022.
A., Zhang, Y.. Narayaman, D., Teufel. H., Bellagente, M., Kang, M., Park, T., Leskovec, J., Zhu, J., Li, F., Wu, J., Ermon, S., and Liang, P. Holistic evaluation of text- to-image models. In Advances in Neural Information Processing Systems, 2023.
Lee, T., Tu, H., Wong, C. H., Zheng. W., Zhou, Y., Mai, Y., Roberts, J. S., Yasunaga, M., Yao, H.,, Xie, C., al. Vhelm: A holistic evaluation of vision language models. In Advances in Neural Information Processing Systems, 2024.
Ngiam, J., Khosla, A., Kim, M., Nam, J., Lee, H., and Ng, A. Y. Multimodal deep learning. In Proceedings of the 28th international conference on machine learning, ICML 2011, pp. 689-696, 2011.
Li, J., Selvaraju, R. R., Gotmare, A., Joty, S. R., Xiong, C., and Hoi, S. C. Align before fuse: Vision and language representation learning with momentum distillation. In Advances in Neural Information Processing Systems, vol- ume 34, pp. 9694-9705, 2021.
OpenAl. Chatgpt: A large language model. https: / openai apenai.com//ae htt.c/oo//ccaapee 2024.
Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., and Mittal, P. Visual adversarial examples jailbreak aligned large language models. In Thirty-Eighth AAAI Confer- ence on Artificial Intelligence, pp. 21527-21536. AAAI Press, 2024.
Li J., Li, D., Xiong, C., and Hoi, S. Blip: Bootstrapping language- immgg pre-training for unified lasion-l understanding and generation. In International confer- ence on machine learning. pp. 12888-12900. PMLR, 2022.
Radford, A., Kim, J. W., Hallacy, C., Ramesh, A., Goh, G., Agarwal, S., Sastry, G., Askell, A., Mishkin, P., Clark, J., et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning, pp. 8748-8763 2021.
J., Li, D., Savarese, S., and Hoi, S. Blip-2: Bootstrapping language-in Eanuuage-image pre-training with frozen image encoders and large language models. In International conference on machine learning, pp. 19730-19742. PMLR, 2023.
Rashtchian, C., Young, P., Hodosh, M., and Hockenmaier, J. Collecting image annotations using amazon's 's mechanical turk. In Proceedings of the 2010 Workshop Creating Speech and Language Data with Amazon's Mechanical Turk, Los Angeles, USA, June 6, 2010, pp. 139-147. As- sociation for Computational Linguistics, 2010. URL /ttppp///aaaaaataoolloooooooo wwtp://ooooo...ooo///0000000
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ra- manan, D., Dollár, P., and Zitnckk C. I.. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740- 755. Springer, 2014
Sharma, P., Ding, N., Goodman, S., and Soricut, R. Con- ceptual captions: A cleaned, hypernymed, image alt-text dataset for automatic image captioning. In Annual Meet- ing of the Association for Computational Linguistics, pp-
Liu, H., Li, C., Wu, Q., and Lee, Y. Visual instruction tuning. In Advances in Neural Information Processing Systems, volume 36, pp. 34892-34918 2023.
10

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
2556-2565. Association for Computational Linguistics, 2018. doi: 10.18653/V1/P18--22 1238.
Shayegani, E., Dong, Y., and Abu-Ghazaleh, N. Jailbreak in pieces: Compositional adversarial attacks multi- modal language models. In The Twelfth International Conference on Learning Representations, 2024.
Tao, X., Zhong, S., Li, L., Liu, Q. and Kong, L. Imgtro- jan: Jailbreaking vision-language models with one image. arXiv preprint arXiv:2403.02911 2024.
Vaswani, A. Attention is all you need. Advances in Neural Information Processing Systems, 2017.
Wang. Y., Hu, W., Dong, Y., Zhang, H., Su, H., and Hong, R. Exploring transferability of multimodal adversarial samples for vision-language pre-training models with contrastive learning. arXiv preprint arXiv:2308.1266 12636, 2023.
Wu, C. H., Koh, Y., Salakhutdinov, R., Fried, D., and Raghumathan, A. Adversarial attacks on multimodal agents. arXiv preprint arXiv:2406. 12814, 2024.
Xia, P., Li, Z., Zhang, W.. and Li, B. Data-efficient back- door attacks. In Proceedings of the Thirty- Inter- national Joint Conference on Artificial Intelligence, 3992-3999 ijcai.org, 2022. doi: 10.24963/JCAA.20222) 554. URL https::/// //i. (tloo.orr//...29///..e.... 2022/554.
Xu, Y., Yao, J., Shu, M., Sun, Y., Wu, Z.., Yu, N., Goldstein, T., and Huang, F. Shadowcast: Stealthy data poisoning attacks against vision-language models. In Advances in Neural Information Processing Systems, 2024.
Yang, Z., He, X., Li, Z., Backes, M., Humbert, M., Berrang, P., and Zhang, Y. Data poisoning attacks against multi- modal encoders. In International Conference on Machine Learning, pp. 39299-39313. PMLR, 2023.
Young, P., Lai, A., Hodosh, M., and Hockenmaier, J. From image descriptions to visual denotations: New similarity metrics for semantic inference over event descriptions. Trans. Assoc. Comput. Linguistics, 2:67-78, 2014. doi:
10.1 10.1162/TAC) 00016..
Yuhas, B. Jr., M. H. G., and Sejnowski, T. J. Integration of acoustic and visual speech signals using neural networks. IEEE Commun. Mag.. 27(11)665-71 1989. doi: 10. 35.41402. URL //tp:///oiiie URL.httss:/doii.oo /ttp::pps//bai..rrr000111/////// 41402.
Zhu, D., Chen, J., Shen, X., Li, X., and Elhoseiny, M. MiniGPT-4: Enhancing vision-language understanding with advanced large language models. In The Twelfth International Conference on Learning Representations, 2024.

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
A. Extended Literature Review
A.1. Multimodal Learning
Multimodal learning, which integrates data from multiple modalities such as vision, text, audio, and sensory inputs, has been a cornerstone of artificial intelligence research. Early efforts in the 1990s primarily focused on sensor fusion, combining multiple sources of information to improve decision-making accuracy (Hall & Llinas, 1997).
With the rise of deep learning. Ngiam al. (2011) demonstrated that deep neural networks could effectively fuse multimodal features, enhancing representations of one modality when additional modalities were included. This foundational work highlighted the potential of leveraging crosl information for feature learning.
The success of convolutional neural networks (CNNs) following the ImageNet competition in 2012 (Krizhevsky et al., 2012) further spurred research into multimodal fusion techniques, particularly between visual and other modalities. Antol et al. (2015) extended these efforts with the development of Visual Question Answering (VQA), a system that integrated CNNs for image understanding with recurrent neural networks (RNNs) for natural language processing.
The introduction of transformers (Vaswani, 2017) in 2017 represented paradigm shift. Initially designed for sequence modeling, transformers quickly became the backbone of multimodal systems due to their ability to process large-scale data efficiently. Models such as CLIP (Radford et al., 2021), BLIP (Li et al., 2022), and ALBEF (Li et al., 2021) exemplify the application transformer-bast architectures to align and fuse vision and language representations, achieving state-of-the-ane performance in various multimodal tasks.
A.2. Multimodal Contrastive Learning
Multimodal contrastive learning has emerged as a powerful approach to aligning data from different modalities by projecting them into a shared embedding space. The core idea to maximize the similarity of positive sample pairs (e.g., semantically related image-text pairs) while minimizing the similarity of negative sample pairs (e.g., unrelated image-text pairs). Similarity is commonly measured using cosine similarity.
Representative models like CLIP (Radford et al., 2021) and ALIGN (Jia et al., 2021) have demonstrated the efficacy of contrastive learning by aligning large-scale image-text pairs in a shared feature space. These models significantly improve zero-shot learning capabilities, enabling tasks such as image classification and retrieval without task-specific annotations. By aligning features in a balanced way, multimodal contrastive learning avoids issues of information imbalance across modalities, which often arise when combining feature vectors of varying dimensions.
A.3. Multimodal Text-Image Retrieval Task
Cross-modal image-text retrieval (ITR) is a fundamental task multimodal learning, with applications in search engines, content recommendation, and more. ITR typically includes two subtasks: image-to-text (i2t) and text-to-image (12i) retrieval (Cao al., 2022).
Given a model and input text image, the model maps the inputs into embedded vectors in shared semantic space. The goal is to retrieve data from the other modality that maximizes the similarity. Advances in ITR have been driven by contrastive learning techniques (Radford et al., 2021; Li et al., 2021; Jia et al., 2021), which align positive sample pairs and separate negative pairs to improve retrieval accuracy.
A.4. Review of Poisoning Attacks
Poisoning attacks aim to manipulate a model by injecting adversarial data into the training set. Formally, given a clean dataset D. = {xx,, ys) },)), an attacker constructs a poisoned dataset Dp = {x/. v/1) and combines it with the clean data to form Dreain D. U Dp. The goal is to alter the model's behavior for specific inputs while maintaining overall performance.
B. Extended Experiment
Table 5 shows the comprehensive experiments results of AtoB attack using COCO dataset.
12

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
10 of Different Concept Pairs
Min Rank Different Concept Pairs
120
0.8
100
0.6
Min Rank
11:0800
60
0.4
40-
0.2
0.0
0.175
0.200
0.225
0.250
0.375
0.175
0.200
0.225
0.250
0.300
0.325
0.350 0.375
Similarity Scores
Similarity Scores
Hii 10 Trend
Min Rank Trend
30-
0.8
eian Ronts
40
0.6
30-
20-
10
0.0
0.20
0.22
0.24
0.22
0.30
0.32 0.34
0.20
0.22
0.24
0.26
0.28
0.50
0.32
0.34
Similarity Scores
Similarity Stomes
Figure 5. comprehensive comparison of different concept pairs of various similarity scores for the COCO dataset. In the upper two plots, each line represents fixed source concepts with different targeted concepts (of different similarity scores): The average results and standard deviation (in shade) over repeated trials are reported. the bottom two plots, we buckets the similarity scores over 6 bins and average results visualize the trend.
0.8
MP-Nav (Ius.)
60-
Ramdom
0.6
Min Rank
Hit
0.4
0.2
20
0.0
0.20
0.25
0.30
0.20
0.25
0.30
Similarity Scores
Similarity Scores
Figure Scatter plots Table a better visualization. Each dashed line denotes average performance each instance selection strategy (i.g., MP-Nav Instance- level selection and baseline's random selection.
13

---

MP-Nav: Enhancing Data Poisoning Attacks against Multimodal Learning
Source
Target
Similarity
Attack Method
Hit@1 1
Hit@5
Hit@ 10 1
Average MinRank
skis
0.210
Baseline (Random)
0.006(#0.005)
0.425(#0.0955 0.160(#0.057)
25.369(+338077 8077
apple
0.324
MP-Nav Concept
0.101(20.015)
0.815(20.044) 0.582(20.051)
10.350(+1.439)
banama
skis
0.210
MP-Nav Instance
0.022(#0.011)
0.446(#0.034) 0.214(#0.033)
41.360X#3.276
apple
0.324
MP-Nav Nav Con.+Ins,
0. 0.128(40.012)
0.586(40.024)
0.778(#0.017)
12.205(#1.12))
bird
0.222
Baseline (Random)
0.004(#0.0044
0.098(+0.047)
0.287 0833)
33.958(+5.365)
broccoli carrot
0,336
MP-Nav Concept
0.080(+0.019)
0.763=#00322) 0.511(#0)037)
6.774(#1)6608)
bird
0.222
MP-Nav Instance
0.012(40.009)
0.230(40.028)
0.448 02288)
31.342(42.123)
carrot
0.336
MP-Nav Con.+Ins.
0.076(#0.015)
0.493((0.0443)
0.730(#0.021)
8.602(#1.037)
bird
0..277
Baseline (Random)
(+000(=0,003)
0.070(#0.033)
0.196(#0)061)
33.617(#3.387)
bus
car
0.3105
MP-Nav Concept
0.041(#0.014) 0.280(40.037)
0.560(#0.046
16.785(+1.262)
bird
0..277
MP-Nav Instance
0.012(#0.014) 0.184(#0.112)
0.407(#0.12)
32.709(+4.543)
car
0,3105
MP-Nav Con.+Ins.
0.070(+0.020)
0.318(20.043)
0.562(#0.031)
14.658(40.487)
carrol
0.316
Baseline (Random)
0.044(#0.011)
0.228(+0.021)
0.437(#0.036)
20.902
fork
spoon
0.330
MP-Nav Concept
0.057(#0.013)
0.256(+0.026)
0.443(#0.028)
19.382(+14417)
carrol
0.316
MP-Nav Instance
0.038(40.009) 0.280(10.023)
0.500(#0.022 (2022)
20.570(+L.727)
spoon
0.330
MP-Nav Con.+Ins.
0.048(#0.017)
0.267(#0.024)
0.471((0.031)
18.665(+1.555)
carrot
0.184
Baseline (Random)
0.007(#0.006)
0.430(#0.081) 0.165(#0.059)
13.454(#1
zebra
0.320
MP-Nav Concept
0.039(#0.015) 0.447(20.086)
0.759
6.535(+1.280)
giraffe
carrot
0.184
MP-Nav Instance
0.010(+0.011)
0.167(#0.00))
0.529(#0.073)
12.821X 6622)
zebra
0.320
MP-Nav Con.+Ins,
0.042(#0.009)
0.513(40.071)
0.820(#0.071)
6.104(#0.954)
cake
0.278
Baseline (Random)
0.009(#0.006)
0.278(#0.053) 0.124(#0.026)
21.672(42.766
fork
0.312
MP-Nav Concept
0.036(+0.011)
0.310(#0.034)
0.564(#0.037)
11.374(#1 .056)
pizza
cake
0.278
MP-Nav Instance
0.013(#0.009)
0.170(00.015)
0.370(#0.035)
17,002(+1.00 .024)
fork
0.312
MP-Nav Con.+Ins.
0.052(#0.008)
0.343(#0.018)
0.606(#0.039)
10.508(+0.972)
snowboard
0.195
Baseline (Random)
0.022(+0.013)
0.606(#0.10) 0.302(+0.081)
13.300X+2.076)
sheep
cow
0.320
MP-Nav Concept
0.084(+0.031)
0.560(40.068)
0.821(200067)
8.358(#1.009)
snowboard
0.195
MP-Nav Instance
0.013(+0.009)
0.254(+0.075)
0.555(=0.101 101)
15.546(+2.594)
cow
0.320
MP-Nav Con.+Ins.
0.093(#0.015)
0.559(10.037)
0.830(#0.023)
8.300(#0.562)
backpack
0.286
Baseline (Random)
0.040(+0.017)
0.324(#0.049)
0.581(#0.048)
12.126(#1 1.323
skateboard
person
0.293
MP-Nav Concept
0.002(#0.003)
0.015(*00006)
0.041(200012)
68.315(47. 6.66))
backpack
0.286
MP-Nav Instance
0.027(#0.008)
0.284(20.044)
0.576(#0.037)
12.789(+1 1.00)
person
0.293
MP-Nav Con.+Ins,
0.001(#0.002)
0.013(#0.006)
0.039(#0.005)
56.249
truck
0.306
Baseline (Random)
0.022(+0.011)
0.225(10.033)
0.415(00.034)
17.990
0.329
MP-Nav Concept
0.063(#0.018)
0.552(#0.024) 0.0.1(#00029)
18.770(
traffic light
truck
0.306
MP-Nav Instance
0.034(10.013) 0.351(20.048)
0.566(20.044 044)
13.563( (.055)
0.329
MP-Nav Ins.+Ins.
0.045(+0.011)
0.374(40.031)
0.571(#0.029)
(9.437(+2.201)
Table 5. More results of A2B attack on the COCO dataset in different concept pairs.
Method
Fleckr-AACAAL (IK test sel)
COCO (3.9K lest srf)
TR
IR
TR
IR
R@11
RB5
R@10
R@1
R@5
R6:10
RG1
R@5
RG 10
R@1
R
R@P10
14)
98.50a0.20
45.7440.4)
8190
96,0
634(6007)
68.8
93.0090:43)
48.c400.8))
76.6300655
853//00.50 53)
Baseline
36.8/20.66)
97.4201.32)
991010.20)
73.7630.8)
92 M1 20)
96.020017)
929420.5)
48 2(.211
16.0/41.54)
85.7(20.66
Base- Navias Only)
87.5(s0.46)
97.3(e11.30)
985()0)144
24.021).29)
95 (7)))))
96.5000 11)
63 (35)3)
67.0
92.90=0.46)
48 48.3()0)95)
76.6640.62)
85 85.7(411.52
MP NaaiiConn Only)
27.0k
97.2(20.235
98.620).22
73.7(311443)
92
90.422020)
63.018999)
80.6/20.66
92.9(200433)
48.3(23).85)
85.8(20149) 16.6620)65)
MP.NNayCCnn44B (
86.9(=0.33)
97.2/+0.43)
99.00+0.26)
73.0(+0.43)
928((0034)
96.3(4016))
63.3(=0.10)
86.9(=0.59)
93.1(+0.43)
48 48.3(+0.63)
76.7(+0.54)
85.7(+0.41)
Table 6. Comparison of model utilities clean and poisoned CLIP fine-tuned on Flickr-PASCAL PASCAL and COCO datasets. TR: Text Retrieval, IR: Image Retrieval.
14


Reviews:
[{"review_id": "Cs8tyA6AL1", "reviewer": "Reviewer_sXf2", "summary": "This paper addresses the vulnerability of large-scale multimodal learning models to data poisoning attacks, where adversaries subtly inject malicious instances into training data to misalign concepts. It proposes MP-Nav (Multimodal Poison Navigator), a module that strategically selects semantically similar concept pairs and robust instances to enhance the effectiveness of poisoning attacks. Experimental results demonstrate that MP-Nav improves attack success rates while preserving model utility, highlighting the security risks of multimodal models and emphasizing the need for stronger defenses.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Many thanks for the reviewer’s statement that “Experimental results demonstrate that MP-Nav improves attack success rates while preserving model utility”, and the acknowledgment that “the method is simple and effective”. Kindly find our response below.  \n\n1 [Claims and Evidence (First two points)]: “It is hard to find where the claims 1 (C1) and 2 (C2) are validated. What is the intuition for claim 1 and claim 2? Any theoretical insights for the two claims?”\\\n**Response 1**: \nIn the review, the C1 refers to \"Not all concepts are equally vulnerable to disassociation,\" and the C2 refers to \"Not all instances contribute equally.\"\nKindly note that C1 and C2 are not our claims, but facts/observations that are backed by prior literature such as [1, 2, 3]. \nTo choose robust instances to enhance poisons, we are inspired by [4].\nMotivated by the facts C1 and C2, we proposed the method of MP-Nav. \nThanks for pointing out this; we will revise the paper and further clarify the explanations. \\\n[1] Geometry-aware instance-dependent adversarial training, in ICLR 2021\\\n[2] Data-efficient backdoor attack, in IJCAI 2022\\\n[3] Towards effective clean label backdoor attacks, in Pattern Recognition 2023\\\n[4] BadLabel: A robust perspective on evaluating and enhancing label-noise learning, in TPAMI 2024\n\n2 [Claims and Evidence (Comment C4)]: “Table 3 shows the utility of the method, which has a marginal difference as the baselines. I doubt if the testing is hard enough, as all methods share similar utility. It is not clear if this attack method will balance utility with attack effectiveness. Since the number of poisoned examples is not specified, it is hard to associate the attack result in Fig 2 with Table 3.” \\\n**Response 2**: In Table 3, we have chosen the standard benchmark test sets, Flickr-PASCAL has a 1K test set, and COCO has a 3.9K  test set. The test set is large and comprehensive for evaluating overall utility. Attacker aims to maintain the model utility and enhance attack efficacy. In Flickr-PASCAL with a training set (around 30K), we only allow 25 poisoned data, and in COCO training dataset (around 120K), we only allow 284 poisoned data.  Marginal difference or even no difference in Table 3 is exactly what the attacker is aiming for. Table 3 (model utility) associates with both Table 2 and Figure 2 (attack efficacy), which justifies the MP-Nav outperforming the baselines. We will revise the paper and make the explanation clear.\n\n3 [Weakness comment]: “The effectiveness of the method lies in a small range of the number of poisoned samples 10-25. This makes the result less significant. I doubt whether the method is really necessary. An attacker can simply increase the number of poisoned instances can enhance the attack. I did not see a reason not to scale up the poisoned instances. Especially, when 25 samples could be very effective.”\\\n**Response** 3: Conceptually, the number of poisoned instances is related to the attacker budget: a more effective attack method prefers using less budget. For example, in decentralized learning, the attacker aims to control as few as possible nodes to conduct effective poisoning attacks. Moreover, injecting a larger number of poisoned instances increases the risk of detection (that is even the case for other attacks -- such as backdoors --  in existing literature). We will clarify this point further in the revision.\n\n4 [Clarifications & Typos]: “Fig. 5 and 6 are hard to read” and “image captaining in Line 12” “Figues 2 should be Figure 2 in Line 331.”\\\n**Response** 4: Figures 5 and 6 are comprehensive results that back Table 2. Main results that justify the efficacy of MP-Nav.  Thank you, we will re-work the figures to enhance readability, add more descriptions, and correct the mentioned typos.", "claims_and_evidence": "This paper has 4 major claims.\n\nC1. Not all concepts are equally vulnerable to disassociation.\n- I did not see direct evidence for the claim. However, based on an ablation study, the claim may be true.\n\nC2. Not all instances contribute equally.\n- I did not see direct evidence for the claim. However, based on the ablation study, the claim may be true.\n\nC3. MP-Nav Enhances Attack Effectiveness: The proposed MP-Nav module systematically selects semantically similar concept pairs and robust instances, significantly improving the success rate of multimodal data poisoning attacks.\n- In Section 4.1, the empirical results show that selecting instances and concepts can improve attack effectiveness.\n\nC4. Resilience Against Benign Data Dilution: By selecting robust instances within chosen concepts, MP-Nav ensures that poisoned instances remain effective even when mixed with a large number of benign samples, maintaining attack efficacy while preserving model utility.\n- Table 3 shows the utility of the method, which has a marginal difference as the baselines. I doubt if the testing is hard enough, as all methods share similar utility. It is not clear if this attack method will balance utility with attack effectiveness. Since the number of poisoned examples is not specified, it is hard to associate the attack result in Fig 2 with Table 3.", "methods_and_evaluation_criteria": "The paper proposes MP-Nav (Multimodal Poison Navigator), a module that strategically selects semantically similar concept pairs and robust instances to enhance the effectiveness of poisoning attacks.\n\nThe method enhanced existing attacks AtoB and ShawdowCast while maintaining utility. The paper used Flickr-PASCAL and COCO datasets for evaluation. The metrics are \n1. Model Utility – This checks how well the model retrieves the correct results. It uses Recall at K (R@K), which tells us how often the correct answer appears in the top K results when searching for images or captions.\n2. Poisoning Efficacy – This measures how well an attacker can trick the model into linking the wrong concepts. It uses Hit@K, which shows how often the wrong (targeted) image appears in the top K results, and MinRank, which tells how early the wrong image appears in the ranked list (lower is worse).\n\nBoth metrics are reasonable from the literatures.", "theoretical_claims": "No theoretical claims.", "experimental_designs_or_analyses": "It is hard to find where the claims 1 and 2 are validated. I can only infer that the ablation study in Sec 3.1 may imply claim 1 and 2.", "relation_to_broader_scientific_literature": "The method enhanced existing methods like AtoB and ShadowCast. This method enforces the embeddings’ misalignment in the learned space to achieve the misassociation while preserving the correct alignments for other concept pairs. By selecting data and concepts, the AtoB and ShadowCast methods are strengthened.", "essential_references_not_discussed": "No.", "other_strengths_and_weaknesses": "Strength:\n* The proposed method improve the existing attacks by selecting concept and instances. The method is simple and effective.\n\nWeakness\n* The effectiveness of the method lies in a small range of the number of poisoned samples 10-25. This makes the result less significant. I doubt whether the method is really necessary. An attacker can simply increase the number of poisoned instances can enhance the attack. I did not see a reason not to scale up the poisoned instances. Especially, when 25 samples could be very effective.", "other_comments_or_suggestions": "\"image captaining\" in Line 12. \nFigues 2 should be Figure 2 in Line 331.", "questions_for_authors": "* What is the intuition for claim 1 and claim 2? Any theoretical insights for the two claims?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "1g7JwLTaQY", "reviewer": "Reviewer_cLuX", "summary": "This paper presents MP-Nav that optimizes data poisoning attacks for vision-language models. The approach strategically selects concept pairs and robust instances to maximize poisoning efficiency while maintaining overall model utility. The authors evaluate MP-Nav on benchmark datasets and demonstrate improvements over existing poisoning attacks.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive review. Please find our responses below.\n\n1 [Other Comments Or Suggestions]: “Please explicitly discuss the limitations of MP-Nav, particularly regarding scenarios where poisoning may not be effective.”\\\n**Response** 1: There are potentially two limitations. \nFirst, MP-Nav's success depends on the availability and quality of open-sourced models (such as CLIP, Deepseek, etc). When embeddings are noisy or misaligned due to insufficient training data, MP-Nav’s guidance may become suboptimal. \\\nSecond, the limitation (not specific to MP-Nav but to poisoning attacks in general) arises in datasets where the benign samples outnumber poisoned instances that can dilute the poisoning effects. Kindly note that our MP-Nav requires less number of poisoned instances than existing attack methods.\n\n2 [Claims And Evidence]: “The claim that MP-Nav preserves model utility requires further clarification, as the poisoned data could have long-term effects on model behavior.”\\\n**Response** 2: In our experiments, we primarily assessed immediate model performance post-poisoning. Indeed, it is possible that the cumulative influence of poisoning could manifest more over extended fine-tuning or continuous learning. In future work, we will investigate the poisoning effect in continuous learning with a presumed research question on how to enhance the cumulative poisoning effect under catastrophic forgetting in the setting of continuous learning.\n\n3 [Other Strengths And Weaknesses, Questions For Authors]: “Limited exploration of countermeasures.”  “ Could existing outlier detection or data sanitization methods be used to identify and filter poisoned samples before model training”\\\n**Response** 3: We have implemented a simple defense method that is also used as the pre-training defense in [1].  \nSince the AtoB is a dirty-label poisoning attack, the input sanitization is an effective countermeasure. \nWe used an open-sourced model to calculate cosine similarities of embeddings of both images and their corresponding texts. A higher cosine distance means images and texts are less relevant. We set threshold as 0.8 to avoid benign instances to be filtered out. We report the results below. \n \n|Poison setting | Defense | Poison data Number|\n| -------- | ------- |------- |\n| boat2dog | No input sanitization | 284 (out of 119387) |\n| boat2dog | pre-training defense [1] | 39 |\n| boat2kit (MP-Nav) |  No input sanitization | 284 (out of 119387) |\n| boat2kit (MP-Nav)  |  pre-training defense [1] | 140 |\n \nAs we can see above, input sanitization is quite effective in A2B attacks [1]. \nKindly note that MP-Nav makes A2B have stronger resistance against input sanitization. \n \n[1] Data Poisoning Attacks Against Multimodal Encoders, in ICML 2023. \n \nIn terms of ShadowCast attack (clean-label attack), our paper has revealed that clean and benign examples can largely mitigate the poisoning effect. Nevertheless,  the MP-Nav can still enhance the poisoning effect under the presence of benign examples. \n\n\n4 [Questions For Authors]: “Have authors observed any situations where MP-Nav fails to improve poisoning efficacy, or where it inadvertently lowers the effectiveness of an attack compared to baseline methods?”\\\n**Response** 4: Indeed, we have observed scenarios where MP-Nav does not outperform baseline methods in some cases. This is due to inherent noise occurring in the training data (such as irrelevant features in the images, noisy captions, data shortage). As visualized in the top two panels of Figure 5 in the appendix, the poisoning effect is noisy w.r.t. similarity scores. Despite the noise, the bottom two panels of Figure 5 unveil the positive correlation between similarity scores and the poisoning effect. \n\n\n5 [Questions For Authors]: From my understanding, MP-Nav currently assumes access to embeddings for similarity computation. How well does it perform if the attacker does not have access to the model’s internal representations?\\\n**Response** 5: Kindly allow us to clarify the assumptions in the paper. The attacker does not have access to the learner’s model (and therefore embeddings) but can get access to an open-sourced surrogate model that computes and compares data’s similarities. Thus, all the reported results reflect scenarios where the attacker does not have access to the model’s internal representation.", "claims_and_evidence": "The claims regarding improved attack success are well-supported by extensive experiments. However, the claim that MP-Nav preserves model utility requires further clarification, as the poisoned data could have long-term effects on model behavior.", "methods_and_evaluation_criteria": "This paper mathematically formulates the proposed MP-Nav., which greatly helps readability. The proposed algorithm is clear and well correlated to Figure 1, so I can understand the method easily.", "theoretical_claims": "The methods are clearly described, and the evaluation criteria align well with the research objectives. However, the paper lacks an explicit discussion on the limitations of MP-Nav, particularly regarding scenarios where poisoning may not be effective.", "experimental_designs_or_analyses": "The experimental setup is rigorous and the comparisons with baseline methods are fair. Thus, the experimental results are trustworthy.", "relation_to_broader_scientific_literature": "How are the key contributions of the paper related to the broader scientific literature? Be specific in terms of prior related findings/results/ideas/etc.\nThe paper contributes to adversarial machine learning research. The prior studies neglect the importance of concepts and instance-level selections for effectively evaluating the threat of data poisoning attacks. With this regard, this paper has made the remedy by proposing an MP-Nav method that can comprehensively enhance multi-modal data poisoning attacks.", "essential_references_not_discussed": "To the best of my knowledge, all relevant related works that should be mentioned have been included.", "other_strengths_and_weaknesses": "+Strengths: Clear motivation, comprehensive experimental results, and a well-structured poisoning approach.\n-Weaknesses: Limited exploration of countermeasures and lack of explicit discussion of the limitation of the proposed MP-Nav.", "other_comments_or_suggestions": "1 Please explicitly discuss the limitations of MP-Nav, particularly regarding scenarios where poisoning may not be effective.", "questions_for_authors": "1 Have authors observed any situations where MP-Nav fails to improve poisoning efficacy, or where it inadvertently lowers the effectiveness of an attack compared to baseline methods?\n2 From my understanding, MP-Nav currently assumes access to embeddings for similarity computation. How well does it perform if the attacker does not have access to the model’s internal representations?\n3 Could existing outlier detection or data sanitization methods be used to identify and filter poisoned samples before model training?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ij88pcbkk4", "reviewer": "Reviewer_Nd9w", "summary": "This paper introduces the Multimodal Poison Navigator (MP-Nav), a plug-and-play module designed to improve data poisoning attacks on multi-modal models. The authors propose a two-step approach: (1) concept-level selection, which identifies semantically similar concepts for misassociation, and (2) instance-level selection, which ranks and selects robust instances to maximize attack efficacy. The proposed method enhances existing data poisoning attacks such as AtoB and ShadowCast and is evaluated on Text-Image Retrieval (TIR) and Visual Question Answering (VQA) tasks. Experimental results show that MP-Nav significantly improves attack effectiveness while preserving model utility.\n\n## update after rebuttal\nThe authors address most of my concerns. So I raised my score.", "questions": "", "limitations": "", "rating": 4, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive score. Please find our responses below. \n\n1 [Other Strengths And Weaknesses]: “a discussion on potential countermeasures would add more depth.”\\\n**Response** 1: This is a similar question to one raised by reviewer cLuX. Kindly refer to the \"Response 3\" for reviewer cLuX.    \n\n\n2 [Questions For Authors]: “Would MP-Nav induce the computational overhead for the attacker? Could you clarify the attacker (using MP-Nav) could be different from the attacker (using random selections)?”\\\n**Response** 2: MP-Nav indeed introduces some computational overhead compared to a purely random selection strategy due to the computation of semantic embeddings of instances. MP-Nav requires o(nW) computation overhead for the model inference, where n refers to size of training set and W refers to size of open-sourced model parameters. In our experiment, a single 4090 GPU is sufficiently powerful for MP-Nav computations.\nKindly note that the two methods (i.e., MP-Nav and random selections) fundamentally differ in strategy: random selection relies on stochastic trials, but MP-Nav relies on principled guidance to enhance poisoning efficacy.\n\n\n3 [Questions For Authors]: “Can MP-Nav be adapted to other attack paradigms beyond data poisoning?”\\\n**Response** 3: Yes. MP-Nav is a plug-and-play module, and we presume it can also enhance adversarial evasion attack and model extraction attacks. In evasion attacks, attackers could identify vulnerable pairs of concepts where decision boundaries are naturally close, thus focusing adversarial perturbations on the most vulnerable concept pairs.\nIn model extraction attacks, MP-Nav’s embedding-based selection could assist attackers in choosing query samples that maximize information gain about internal model decision boundaries, facilitating faster or more effective extraction of the victim models. We will make a thorough exploration of the above attacks in future. \n\n\n4 [Questions For Authors]: “In Section 4.2, authors poisoned the LLaVA-1.5 model by fine-tuning it for 1 epoch. I understand this setting is originally from ShawdowCast paper. How about fine-tuning LLaVA for several epochs? Would the poison effect still stay under the presence of benign data?”\\\n**Response** 4: Yes. The poison attack is still effective under the presence of benign data. We have conducted additional experiments by extending fine-tuning over 4 epochs, and we report attack success rate (SR) in the table below. Interestingly, we have observed that benign data won’t dilute the poisoning effect over epochs, and the poisoning effect is further enhanced, especially under small poisoning ratio and when employing the MP-Nav’s robust instance selection. One plausible explanation is that large models tend to overfit specific associations over prolonged fine-tuning, thereby reinforcing the malicious associations introduced by carefully selected poisoned instances. We will add the additional results in revision.\n|Attack |Poison ratio | SR(Epoch #1) | SR(Epoch #2)| SR(Epoch #3)| SR(Epoch #4)|\n| --------| -------- | ------- |------- |------- |------- |\n| MP-Nav| 1% | 0.01 | 0.08| 0.58| 0.56|\n| Random| 1% | 0.01 | 0.02| 0.17| 0.23|\n| MP-Nav| 3% | 0.02 | 0.98| 0.97| 0.97|\n| Random| 3% | 0.01 | 0.62| 0.90| 0.89|", "claims_and_evidence": "Yes, it is clear and convincing. The paper claims that MP-Nav enhances the efficacy of data poisoning attacks against multimodal models while maintaining model utility. The evidence provided includes empirical results on benchmark datasets (such as COCO, Flickr, PASCAL, and Food101), and customized “Biden-Trump”. Dataset. The evaluations demonstrate that MP-Nav improves attack success rates while keeping retrieval and classification performance intact.", "methods_and_evaluation_criteria": "Yes, the proposed method makes sense. The evaluation criteria (such as Hit@K and MinRank for TIR and  attack success rate for VQA) are appropriate.", "theoretical_claims": "Not applicable. This paper does not have theoretical claims.", "experimental_designs_or_analyses": "The experimental design follows the standard benchmarks and datasets. The comparison between baseline attacks and MP-Nav-enhanced attacks demonstrates meaningful improvements. Furthermore, in Figure 5 & Table 5 of the appendix, the paper has provided comprehensive evaluations of differently-similar concepts on the attack efficacy. This could confirm the observed performance gains.", "relation_to_broader_scientific_literature": "The paper is well-positioned in the field of data poisoning attacks and multimodal learning. \nIt builds upon prior work in data poisoning but distinguishes itself by proposing a structured poisoning strategy tailored to different multimodal models.", "essential_references_not_discussed": "All highly related works are discussed as far as I know.", "other_strengths_and_weaknesses": "This paper presents an effective enhancement to existing multimodal poisoning attacks. The modularity of MP-Nav allows for easy integration with various multimodal tasks. However, a discussion on potential countermeasures would add more depth.", "other_comments_or_suggestions": "No further comments. Please see my questions below.", "questions_for_authors": "- Would MP-Nav induce the computational overhead for the attacker? Could you clarify the attacker (using MP-Nav) could be different from the attacker (using random selections)?\n- Can MP-Nav be adapted to other attack paradigms beyond data poisoning?\n- In Section 4.2, authors poisoned the LLaVA-1.5 model by fine-tuning it for 1 epoch. I understand this setting is originally from ShawdowCast paper. How about fine-tuning LLaVA for several epochs? Would the poison effect still stay under the presence of benign data?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "4zfQocHgyJ", "reviewer": "Reviewer_CBYT", "summary": "1. The author analyzed the shortcomings of existing attack methods: only associating errors by randomly selecting concepts, and poisoning instances randomly, which usually makes it difficult to achieve a good attack effect.\n2. The authors proposed a plug-and-play module MP-Nav. MP-Nav effectively solves the problems existing in the random selection method of existing methods by identifying semantically similar concepts at both the concept and instance levels and selecting robust instances, and effectively improves the attack effect.\n3. Experiments have confirmed that MP-Nav can significantly enhance the effectiveness of the most advanced data poisoning attacks, i.e., AtoB and ShadowCast in multimodal tasks, and maintain the practicality of the model in various datasets.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thanks for your positive score. Please find our responses below. \n\n1 [Essential References Not Discussed]: “The author should consider using some other methods as baselines [1-3]”\\\n**Response** 1:\nWe have indeed used [1] as one of the baseline methods that our paper has made comparisons with. \n[2] focuses on the backdoor defense (and not poisoning attack) of CLIP, and [3] focuses on the backdoor attacks for multimodal learning. \nTable 1 in our paper has highlighted the setting differences of data poisoning and backdoor triggers.\nNevertheless, MP-Nav is a plug-and-play module, which can potentially enhance other types of attacks, including backdoor attacks, adversarial evasion attacks, model inversion attacks, etc. In revision, we will cite the relevant papers [1-3], and in the future, we will compare MP-Nav with [3] and produce more results.\n\n2 [Other Strengths And Weaknesses]: “The author didn't conduct a detailed experimental analysis and explanation of the essential reasons for the existing method problems, so readers may find it difficult to deeply understand the starting point of this article.”\\\n**Response** 2: \nThe two methods (existing random selection method and our MP-Nav method) fundamentally differ in strategy: random selection relies on stochastic trials, but MP-Nav relies on principled guidance to enhance poisoning efficacy. Specifically, random selections frequently choose concept pairs that are semantically distant or instances that poorly represent the targeted concepts, resulting in easily diluted poisoning effects by benign instances. \nIn revision, we plan to add a visualization experiment on showing the above fact. Since rebuttal is character-limited only, kindly allow us to describe this visualization experiment: We will use PCA/T-SNE to reduce high-dimensional features into 2-D vectors and visualize and compare differences between embeddings of poisoned and benign instances. We will also plot the embedding evolutions over the training epochs and compare how MP-Nav selected poisoning instances differ from randomly selected poisoning instances, w.r.t. the counterpart benign instances. \n\n3 [Other Strengths And Weaknesses]: “Table 2 and Figure 2 represent the effectiveness of the author's method on two different datasets. However, on the PASCAL dataset, the effect of Instance-level Selection is negligible, and the author should explain why the results are inconsistent with those on the COCO dataset.”\\\n**Response** 3: In Table 2 of COCO dataset, we fixed the poisoning data of 284 (out of 119387 training data) and made fair comparisons with baseline A2B attack, which keeps the same as the baseline paper. \n\nHowever, in Figure 2 (PASCAL-Flicker combined dataset), the scenario differs. Flicker is large image-text pairs (without ground truth concepts) of 29000 images, where the attacker does not touch. \nThe PASCAL dataset contains only 500 labeled images (for training) divided equally across 20 concepts, leaving a maximum of 25 instances per concept available for poisoning. In the original baseline paper, all 25 instances per concept were poisoned—an impractical scenario in real-world settings. To reflect more realistic conditions, we reduced the attacker’s budget (number of allowed poisoned instances), poisoning fewer than the maximum number of available instances per concept, leaving the remainder as benign data. As a consequence, when the attacker’s budget reaches 25 poisoned instances, the MP-Nav instance-level selection and random selection both utilize all available instances, naturally leading to **identical** performance. \nThus, the negligible difference at instance-level selection arises directly from the dataset limitation rather than inconsistency in MP-Nav’s effectiveness.\n\n4 [Questions For Authors]: “How is the number of concept centers determined, and is it related to the number of instance categories?”\\\n**Response** 4: Yes. Each category has one concept center. The concept center considers both image and text embeddings of the same category (concept). \n\n5 [Questions For Authors]: “In lines 232 to 234, are the images and texts of the original concept pairs (I_A, T_A) and the target concept pairs (I_B, T_B) being swapped? After the swap, does the original concept pair become (I_A, T_B), and the target concept pair become (I_B, T_A)?”\\\n**Response** 5: No, it is not being swapped. To make the fair comparison with baseline A2B attack [1], we follow the setting of [1], i.e., original concept pairs (I_A, T_A) and the target concept pairs (I_B, T_B)  -> (I_A, T_B) and (I_B, T_B) . Attackers only change part of texts of original concept instances, and do not touch target concept instances. Kindly refer to Section 2 Preliminary for details. \\\n[1]  Data poisoning attacks against multimodal encoders, in ICML 2023", "claims_and_evidence": "Although the author pointed out the problem that existing methods can hardly achieve good attack effects only by randomly selecting concepts, the author only showed statistical experimental results, and did not have specific visualization experiments to prove their view point.", "methods_and_evaluation_criteria": "yes", "theoretical_claims": "The author conducted experimental verification of the proposed method, but lacked a detailed experimental analysis of the shortcomings of existing methods.", "experimental_designs_or_analyses": "Although the author conducted a large number of attack experiments to verify the effectiveness of the proposed method, they used too few baseline methods. There are only two baseline methods in the experimental part: AtoB and ShadowCast, which makes it difficult to fully prove the applicability of the proposed plug-and-play MP-Nav. The author should consider using some other methods as baselines, e.g., [1-3].\n\n[1] Data Poisoning Attacks Against Multimodal Encoders, Ziqing Yang, Xinlei He, Zheng Li, M. Backes, Mathias Humbert, Pascal Berrang, Yang Zhang, International Conference on Machine Learning, 2022.\n[2] CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learning, Hritik Bansal, Nishad Singhi, Yu Yang, Fan Yin, Aditya Grover, Kai-Wei Chang, IEEE International Conference on Computer Vision, 2023.\n[3] Backdooring Multimodal Learning, Xingshuo Han, Yutong Wu, Qingjie Zhang, Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, Tianwei Zhang, IEEE Symposium on Security and Privacy, 2024.", "relation_to_broader_scientific_literature": "The method proposed in this paper is a plug-and-play module, and the author has verified its effectiveness on the baselines method, i.e., AtoB and ShadowCast.", "essential_references_not_discussed": "There are only two Baseline methods in the experimental part: AtoB and ShadowCast. This makes it difficult to fully prove the applicability of the proposed plug-and-play MP-Nav. The authors should consider using some other methods as baselines, such as [1][2][3].\n\n[1] Data Poisoning Attacks Against Multimodal Encoders, Ziqing Yang, Xinlei He, Zheng Li, M. Backes, Mathias Humbert, Pascal Berrang, Yang Zhang, International Conference on Machine Learning, 2022.\n[2] CleanCLIP: Mitigating Data Poisoning Attacks in Multimodal Contrastive Learning, Hritik Bansal, Nishad Singhi, Yu Yang, Fan Yin, Aditya Grover, Kai-Wei Chang, IEEE International Conference on Computer Vision, 2023.\n[3] Backdooring Multimodal Learning, Xingshuo Han, Yutong Wu, Qingjie Zhang, Yuan Zhou, Yuan Xu, Han Qiu, Guowen Xu, Tianwei Zhang, IEEE Symposium on Security and Privacy, 2024.", "other_strengths_and_weaknesses": "Strengths:\nThis paper summarizes the key problems of existing multi-modal poisoning attack methods, namely they only associate concepts randomly and poison instances randomly, which usually makes it difficult to achieve a good attack effect.\n2. The author made improvements to the above issues and proposed a plug-and-play module MP-Nav, which includes two components: Concept-level Selection and Instance-level Selection.\n3. The author conducted a large number of experiments to verify the effectiveness of their method.\n\nWeaknesses:\n1. The author didn't conduct a detailed experimental analysis and explanation of the essential reasons for the existing method problems, so readers may find it difficult to deeply understand the starting point of this article.\n2. Table 2 and Figure 2 represent the effectiveness of the author's method on two different datasets. However, on the PASCAL dataset, the effect of Instance-level Selection is negligible, and the author should explain why the results are inconsistent with those on the COCO dataset.\n3. Since the proposed method is a plug-and-play module, the author should choose more methods as baselines.", "other_comments_or_suggestions": "Please answer all my doubts carefully, and I will adjust my final score based on the answers.", "questions_for_authors": "1. How is the number of concept centers determined, and is it related to the number of instance categories?\n2. In lines 232 to 234, are the images and texts of the original concept pairs (I_A, T_A) and the target concept pairs (I_B, T_B) being swapped? After the swap, does the original concept pair become (I_A, T_B), and the target concept pair become (I_B, T_A)?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper proposes MP-Nav (Multimodal Poison Navigator), a plug-and-play module designed to evaluate and enhance data poisoning attacks against multimodal models. MP-Nav operates at both the concept and instance levels, identifying semantically similar concept pairs and selecting robust instances to maximize the attack efficacy. Experimental results demonstrate that MP-Nav can significantly improve the efficacy of SOTA poisoning attacks in multimodal tasks, and maintain model utility across diverse datasets.

After the rebuttal process, this paper finally receives 2 weak accept and 2 accept. All the reviewers reach an agreement that this paper can be accepted. I also feel that this paper is good work on enhancing data poisoning attacks against multimodal learning, which can underscore the vulnerabilities of multimodal models and urge the corresponding defense methods.
Decision: Accept (poster)