Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models
Authors: Atharv Mittal
Agam Pandey
Amritanshu Tiwari
Sukrit Jindal
Swadesh Swain
Venue: Accepted by TMLR ()

Abstract: Large Vision-Language Models (VLMs) have revolutionized computer vision, enabling tasks such as image classification, captioning, and visual question answering. However, they re- main highly vulnerable to adversarial attacks, particularly in scenarios where both visual and textual modalities can be manipulated. In this study, we conduct a comprehensive reproducibility study of "An Image is Worth 1000 Lies: Adversarial Transferability Across Prompts on Vision-Language Models" validating the Cross-Prompt Attack (CroPA) and confirming its superior cross-prompt transferability compared to existing baselines. Be- yond replication we propose several key improvements: (1) A novel initialization strategy that significantly improves Attack Success Rate (ASR). (2) Investigate cross-image trans- ferability by learning universal perturbations. (3) A novel loss function targeting vision encoder attention mechanisms to improve generalization. Our evaluation across prominent VLMs—including Flamingo, BLIP-2, and InstructBLIP as well as extended experiments on LLaVA validates the original results and demonstrates that our improvements consistently boost adversarial effectiveness. Our work reinforces the importance of studying adversarial vulnerabilities in VLMs and provides a more robust framework for generating transferable adversarial examples, with significant implications for understanding the security of VLMs in real-world applications.

Published in Transactions on Machine Learning Research (06/2025)
Revisiting CroPA: A Reproducibility Study and Enhance- ments for Cross-Prompt Adversarial Transferability in Vision- Language Models
Atharv Mittal
othore adharo_m@mffs..... (tt.j.....aaaa. in
Indian Institute of Technology, Roorkee
Agam Pandey"
agam agam__@@ceeece &it..
Indian Institute of Technology, Roorkee
Amritanshu Tiwari' Indian Institute of Technology, Roorkee
emritanshu L@mfs..ttrr..m aecirrac..i in
Sukrit Jindal'
sukrit H0mff..ttr..e .ec.rrac...
Indian Instätute of Technology, Roorkee
Swadesh Swain'
swedesh seece. ültr.
Indian Institute of Technology, Roorkee
Reviewed on OpenReview: https: // openrevieww net/ forum? id= 5L90c10mtf
Abstract
Large Vision-Language Models (VLMs) have revolutionized computer vision, enabling tasks such as image classification, captioning, and visual question answering. However, they re- main highly vulnerable to adversarial attacks, particularly scenarios where both visual and textual modalitics can be manipulated. In this study, we conduct comprehensive reproducibility study of "An Image is Worth 1000 Lies: Adversarial Transferability Across Prompts Vision-Language Models' validating the Cross-Prompt Attack (CroPA) and confirming its superior cross-prompt transferability compared to existing baselines. Beyond replication we propose several key improvements; (1) A novel initialization strategy that sig- nificantly improves Attack Success Rate (ASR). (2) Investigate cross-image transferability by learning universal perturbations. (3) A novel loss function targeting vision encoder attention mechanisms to improve generalization. Our evaluation across prominent VLMs iiclisinn Flamingo, BLIP-2, and InstructBLIP well as extended experiments on LLaVA validates the original results and demonstrates that our improvements consistently boost adversarial effectiveness. Our work reinforces the importance of studying adversarial vulnerabilities in VLMs and provides a more robust framework for generating transferable adversarial ex- amples, with significant implications for undorstanding the security of VLMs in roal-world applications. Our code is available at https///gthuub..omSSete
CroPA
1
Introduction
The advent of large Vision-Languaae Models (VLMs) has significantly transformed the field of computer vision by enabling wide range of tasks, including image classification, captioning, and visual question answering. This versatility has fostered deeper exploration into visual-linguistic interactions. However, recent studies Zhao et al. (2023); Qi et al. (2023); Zhang et al. (0022)); Carlini et al. (2024) have demonstrated that VLMs remain highly vulnerable to adversarial attacks. These attacks involve subtle perturbations to
All authors contributed equally

---

Published in Transactions on Machine Learning Research (06/2025)
input images, leading VLMs to produce incorrect or even harmful outputs. Furthermore, the inclusion of textual modalities introduces additional attack vectors, expanding the range of threats beyond those faced by traditional vision models.
Several studies have investigated the adversarial robustness of VLMs. For example/har et al. 2023 con- ducted a comprehensive analysis of the adversarial robustness of VLMS such as BLIP and BLIP--, exploring both query- beeey-based and transfer-based adversarial attack methods in black-box settings. Additionally, Schlar mann & Hein (2023) examined targeted and untargeted adversarial attacks in white-box settings. While these works primarily focused on adversarial image attacks, subsequent research has also explored adversar- ial perturbations in textual inputs. Qi et al. (2023) demonstrated that adversarial images could manipulate VLMs into executing harmful instructions, while TTu et al. (2023 systematically evaluated both visual and textual adversarial attacks.
Traditionally, the generalization of ad adversarial examples and their transfcrability in VLMs has been classified into two primary calegories:
Cross-Model Transfcrability: The ability of adversarial examples to maintain their adversarial nature across different VLM architectures, commonly referred to as transferability.
Cross-Image Transferability: The ability of adversarial perturbations to generate adversarial
examples that generalize across multiple images, often known Universal Adversarial Perturbations (UAPs).
Luo al. (2024) introduced the novel concept of Cross-Prompt Transferability, which describes the abil- ity of adversarial images remain effective across varying textual prompts. Unlike prior work that treated visual and textual adversarial perturbations independently, Luo et al. (2024), proposed the Cross-Prompt Attack (CroPA), which employs learnable prompts to ensure adversarial images retain their effectiveness regardless of textual input. Their work demonstrated CroPA's efficacy across multiple vision-language tasks, including image classification, captioning, and visual question answering.
Our work aims to address the following goals:
(Reproducibility Study] Reproducing the Results from the Original Paper: Through our experiments, we successfully reproduced and verified the four main claims of the original paper, First, we confirm that CroPA achieves superior cross-prompt transfcrability compared to established baselines across various target texts, and that this transferability is independent of the semantic meaning or word frequency of the target text. Second, we show that while increasing the number of prompts improves transferability, convergence occurs rapidly, and even with additional prompts, baseline methods fail to surpass CroPA. Third, we validate CroPA's effectiveness even when ad- ditional in-context learning examples are provided. Lastly, we reproduce the original findings on CroPA's convergence by evaluating the overall ASR across increasing attack iterations, while also contributing our own analysis of ASR performance for individual tasks.
[Extended Work] Better Initialization Strategy: We propose a new initialization method, substantially increasing the Attack Success Rate (ASR) as well as Transferability.
[Extended Work] Investigating Cross Image Transfcrability and Image Augmentation:
We explore learning a common perturbation for all images using CroPA's backbone and investigate whether caunserrablliy--prooooio enhancements aid the cause.
[Extended Work] Guiding perturbations via Target Value Vectors: We propose a novel loss function building on the idea that specific components within the vision encoder's attention mechanism control and determine the level of interaction between patches, manipulating the value vectors of the vision encoder in targeted manner leads to greater generalization well as ASR.
Furthermore, we conduct in-depth analyses to elucidate the mechanisms behind our improvements, offering insights into the nature of adversarial vulnerabilities in VLMss. Our work not only reinforces the importance
2

---

Published in Transactions on Machine Learning Research (06/2025)
of studying these vulnerabilities but also provides more robust and versatile framework for generating transferable adversarial examples.
2
Related Works
While adversarial attacks on deep neural networks have been extensively studied since their introduction by Szegedy et al. (2013) and Goodfellow et al. (2014), their application to Vision-Language Models (VLMs) presents unique challenges and opportunities. In this section, we review the progression of adversarial transferability research and position CroPA within this broader context.
2.1 Adversarial Transferability
The phenomenon of adversarial transferability has manifested across multiple dimensions in machine learning systems. Liu et al. (2017) and Tramer et al. (0117) established that adversarial examples crafted for one model can often deceive other models, even those with different architectures. Beyond model transferability, rescarchers discovered that perturbations can generalize across images Iroosavi-Dezfodd et al. (2017): Mopuri
et al. 2017), enabling the creation of Universal Adversarial Perturbations (UAPs).
The domain of transferability extends to cross-task applications, where adversarial examples designed for classification can affect object detection and other visual tasks Naseer et al.] (2019b Lu al. (2020): Salzmann et al. (2021). This multi-diimenionnl transferability raises critical questions about the robustness of modern machine learning systems.
2.2 Adversarial Attacks Vision-Language Models
Early research adversarial robustness of vision-language models focused task-specific attacks. In image caplioning, works by Xu el al. (2019); Zhang et al. (2020); Aalaq el. al. (2021) ); Chen et. al. (2017)
demonstrated methods to manipulate model outputs. Similarly, Visual Question Answering (VQA) systems
proved vulnerable to targeted attacks that misload attention mechanisms Xu et al. (2018) Kaushik et al.
20 Kovatchev et al. (2022): Li el. al. [2021); ; Sheng et al. (2021); Zhhnng et al. (002bb).
However, these approaches primarily targeted lightweight CNN-RNN architectures lacking in-context learn- ing capabilitics, limiting their applicability to contemporary VLMs. Recent work by Zhao et al. (2023) explored adversarial robustness of modern large VLMs like BLIP and BLIP-2 under black-box settings, focusing on cross-model transferability rather than the cross-prompt perspective introduced by CroPA.
2.3 Cross-Prompt Adversarial Transferability
The emergence of large VLMs with prompt-driven task adaptation introduced new dimension of adversarial vulnerability. Unlike traditional vision models that perform specific tasks, VLMs can dynamically adapt to
different tasks based on textual prompts Li et al. (2023b); Awaddlla et al. (2023 ; Li et al. (2023b); Zhu
et al. (023); Liu et al. (2023). This flexibility creates a novel attack surface where adversarial examples must maintain their effoctiveness across varying prompts.
CroPA Luo et al. 2024) pionecred this concept by introducing learnable prompts that compete with image perturbations during optimization. This approach diverges from existing methods that treat visual and textual perturbations independently, establishing new paradigm for evaluating VLM robustness. Due to the relative novelty of this concept, no credible benchmarks/ beuchmarkss/baselinne baselines have been established yet.. However, work by Yang et al. (2024) does explore cross- prosspp transferability and introduces Context Injection Attack (CIA), which employs gradient-based perturbations to inject target tokens into both visual and textual contexts, and is presented as an additional comparison in our experiments.
2.4 Enhancing Adversarial Transferability
Various techniques have been proposed to improve adversarial transferability. Input diversity methods Xie al. (2099) and data augmentation strategies Wang et. al. (021) have shown promise in creating more
3

---

Published in Transactions on Machine Learning Research (06/2025)
robust attacks. Recent works have identified gradient misalignment key factor limiting transferability Li et al. (2023a): Wang et al. (003),, leading to novel optimization strategies. Our work builds upon these insights to enhance CroPA's capabilities across multiple transferability dimensions.
3 Scope of reproducibility
This study aims to examine and validate the results demonstrated by Luo et al. (0024). Our primary objective is to confirm that CroPA significantly enhances the transferability of adversarial examples across various prompts by meticulously reproducing their experimental procedures.
The main claims we aim to verify are as follows:
Claim 1: CroPA achieves cross-prompl transferability across various target lexts
Claim 2:
CroPA achieves the best overall performance across different number of prompts
Claim 3: CroPA converges towards higher ASR number of iterations are increased
Claim 4: CroPA outperforms baselines under few-shot settings
Beyond replication, we extend the scope of CroPA by investigating its efficacy in cross-model and cross- image contexts well compare it to other methods in cross-prompt. transferability. Specifically, we assess whether adversarial images generated through CroPA can consistently deceive diverse Vision-Language Models (VLMs), regardless of the input prompt or specific model parameters. Addressing these points will enable us to laithfully reproduce the original paper's experiments and build upon it to explore the broader applicability of CroPA in enhancing the robustness and versatility of adversarial attacks on VLMs.
4 Methodology
4.1 Problem Formulation
The vulnerability of neural networks to adversarial atlacks has been well-documented since the seminal work of Goodfellow et al. (2014). Building on this foundation, we examine the authors' novel formulation that extends these concepts to cross-prompt scenarios in Vision-Language Models (VLMs). Their work introduces a critical perspective on how adversarial perturbations can maintain effectiveness across varying textual inputs Luo al. (2024).
The authors develop their formulation around VLM function f that processes both visual and textual inputs, denoted as and I, respectively. To ensure real-world applicability, the authors constrain the adversarial perturbation 8, within human-imperceptiblle bounds, enforcing 116llp S 6.- This constraint mirrors ostablished practices in adversarial machine learning while adapting them to the multi-modal context of VLMs Carlini et al. (2024).
The authors establish two distinct attack scenarios that we reproduced in our study. (1) The targeted attack sccnario aims to manipulate the VLM into generating specific predetermined text T, regardless of the input prompl. This objective manifests matherattially loss L across multiple prompt instances. In contrast, (2) the non-targeted scenario focuses on maximizing the discrepancy between outputs from clean and adversarial inputs, described in Equation 2
Equation minimizing the language modeling
min
L(f(x. + xT)
(1)
max 8.
L(f(xo + ((o,,))
(2)
4

---

Published in Transactions on Machine Learning Research (06/2025)
Visual Input
Vision-Language Model
Align Output to Target
19
Vision Encoder
Output
Nineteen
gradient: V..
*
......
Female
3v
Large
Language
Language Modeling
Textual Input
gradient: Var
Model
Loss
What house number in the picture?
Target
Unknown
What is the gender of the penson the picture?
Unknown
$ Fixed Parameters Element-wise addition
FFrwwrd
Backward
Figure 1: Framework overview of CroPA as presented in Luo et al. (2024). The architecture employs learn- able perturbations for both image (6,) and prompt (6)) inputs. These perturbations operate antagonistically, while 8 optimized to minimize the language modeling loss, 6 works to maximize it. The model's 's for- ward pass (solid arrows) processes the perturbed inputs through the vision encoder and language model, with backpropagation (dashed arrows) updating the perturbations at configurable frequencies. The model parameters (marked with *) remain fixed during the attack. @ denotes element-wise addition.
The effectiveness of these attacks is quantified through the Attack Success Rate (ASR). For targeted attacks, success requires generating the exact target text, while non-targeted attacks succeed by producing any output that differs from the clean image's prediction.
4.2 Baseline Approaches
Given that cross-prompt transfcrability represents a novel direction in adversarial machine learning, no established baselines exist in current literature. Therefore, examine baseline approaches introduced by Luo et al. (2024) to evaluate CroPA's effectiveness: Single-P and Multi-P.
Single-P represents the simplest baseline, where an image perturbation is optimized using a single prompt. The optimization objective for targeted attacks is:
min L(f(r, + 2,),
(3)
Multi-P extends this concept by utilizing multiple prompts during optimization. Given a collection of textual prompts X, (xt, xx), the objective becomes:
min Su
(6,
(4)
For non-targeted attacks, these objectives are inverted to maximize the discrepancy between the model's outputs for clean and perturbed inputs. The effectiveness of both approaches serves as reference point for evaluating CroPA's 's enhanced cross-prompt transferability.
5

---

Published in Transactions on Machine Learning Research (06/2025)
4.3 Cross Prompt Attack
The Cross- Proopp Attack (CroPA) method introduced by Luo et al. (2024) employs learnable prompls during optimization to enhance cross-prompt transferability. The key innovation lies in using prompt perturbations that compete with image perturbations during the optimization process rather than collaborating to deceive the model.
The algorithm optimizes both visual perturbation 6, and prompt perturbation 6, but with opposing objec- tives. While o, aims minimize the language modeling loss for generating the target text, ò, maximizes this loss. This adversarial relationship between the perturbations forces 8 to develop stronger transferability across different prompts.
The optimization process can be formally expressed as a min-max problem:
min max ((f(x, + 6,, Fz + 6,),
(5)
8
4,
where f represents the VLM, T is the target text for targeted attacks, and L denotes the language modeling loss.
The implementation follows an iterative approach using Projected Gradient Descent (PGD) Madry et al. (2017). The visual perturbation updates use gradient descent to minimize the loss, while prompt perturbation updates employ gradient ascent to maximize it. The update frequency can be controlled via a parameter N, where image perturbation updates occur N times for each prompt perturbation update. The framework can be visualized formally in Figure
We reproduce the algorithm, described by [uo al. 2004 as follows:
Algorithm CroPA:
Cross Prompt Attack
Require: Model f, Target Text T, vision input 2, prompt set X,, perturbation size c, step sizes aj and 0g2, number of iteration steps K, adversarial prompt update interval N
Ensure: Adversarial example xr
1: Initialize z'. Ir
2: for step = 1 to K do
3: Uniformally sample the prompt ot from X₁
4: if xt is not initialised then
5: Initialise xf =
end if
Compute gradient for adversarial image: g. Va, 2f)
Update with gradient descent: x/g = x' a1 sign(gr) if mod(step, N) = 0 then Compute gradient for adversarial prompt: = V Lf, I(),
10:
11:
Update with gradient ascent: z = x!t + a2 sign(g:)
12: end if
13:
Project 2 to be within the e-ball of x.: de Clipa.. (2
14:
end for
15:
return x/
During ovaluation, only the optimized image perturbation is applicd, while prompt perturbations are dis- carded. This ensures that the attack's effectiveness stems from the image perturbation's inherent transfer- ability rather than prompt modifications.
5 Additional Investigative Experiments
CroPA's iterative optimization method using PGD under the hood incrcase the attack success rate is effective when used on single model, but the use of the dependency on the foedback of single model minimizing the loss function limits it's transferability, as is shown true for several other gradient based perturbation

---

Published in Transactions on Machine Learning Research (06/2025)
techniques, which many works have recognized and proposed enhancements to Qin et al. (2024) Li et al. (2024]; Wang et al. (2023); et al. 2023a). This limitation is also recognized by the authors in their original paper, and it verified by Table 9 under Appendix A..] Furthermore, as reported in Table I the performance
of CroPA is especially poor in certain tasks such as Classification and Captioning.
Additionally, CroPA is highly computationally intensive, taking over hours to run on a 48GB L.40S GPU utlising 95% of the VRAM, wherein mere 50 images are trained with adversarial perturbations.
These limitations open the scope to perform extended experiments which build on the CroPA framework and supplement these drawbacks incorporating novel enhancements, especially targeting (i) enhancements in CroPA's lack of consistent performance across all tasks and (ii) investigating CroPA against the different transferability concepts we mentioned in Section [ and incorporale supplements into the original framework move towards better transferability of image perturbations.
While not a core proposal of the Luo al. 2024) exploring transferability will also aid in cutting down computation costs, with cross-image transferable perturbations having the potential to significantly increase efficiency in an ideal scenario, without having to train separate image perturbation for each image. The Cross-Model transfcrable perturbation can potentially achieve even greater efficiency.
The following subsections detail our experiments which underscore our motivations to achieving the afore- mentioned goals and outline their individual mechanisms:
5.1 Noise Initialization via Vision Encoding Optimization
A core limitation of CroPA lies in its random noise initialization strategy, which is shared across many gradient-based adversarial attack methods. While CroPA iteratively optimizes this noise, its starting point is uninformed by the target semantics, leading to instability and slower convergence. This is especially problematic when largeting vision-language models (VLMs), where semantic aligument with prompts is crucial. Crucially, this limitation is not merely theoretical, our comprehensive evaluation of CroPA's bi-level optimization framework in Section 6.5.1 reveals that its effectiveness is highly sensitive to initialization, as empirically verified in Figure 7 and Table 6.5.1] This sensitivity stems from CroPA's inability to guide the optimization trajectory toward semantically meaningful directions from the outset, highlighting the need for a more principled initialization strategy. Furthermore, conventional initialization techniques fail ensure meaningful adversarial directions from the onsct, leading to suboptimal attack succoss rates and reduced cross-prompl transferability.
To address these limitations, we hypothesize that a semantically informed initialization of adversarial pertur- bations rather than a purcly random initialization can significantly enhance attack efficacy while maintaining perturbation imperceptibility. Specifically, we propose leveraging a diffusion-based approach to synthesize a target image corresponding to desired prompt. By using the vision encoder's feature space as an alignment mechanism, we ensure that the initial perturbation is already oriented in semantically meaningful direction.
Our proposed Noise Initialization via Vision Encoding Optimization method integrates this semantic an- choring with adversarial optimization by:
Generating a semantically relevant target image using a stato-of-tho-art diffusion model (c.g., Stable Diffusion XL).
Aligning the perturbation with the target image's vision encoder representation, ensuring that the initial noise conforms to the adversarial objective.
Optimizing perturbation updates using a Mean Squared forces semantic similarity while maintaining adversarial effectiveness.
loss function that en-
By replacing random initialization with this vision-guided approach, we not only improve adversarial robust- ness but also enhance attack efficiency, reducing the number of optimization steps required for convergence. Our method thus provides principled alternative to conventional approaches, offering both stronger ad-
7

---

Published in Transactions on Machine Learning Research (06/2025)
versarial perturbations and improved cross-prompt transferability. This approach provides more effective initialization, ensuring that the adversarial perturbations are semantically informed from the start.
5.1.1 Noise Initialization
Preliminary experiments performed on models such as BLIP-2 and InstructBLIP suggest that initializing adversarial perturbations with semantically informed noise significantly enhances the attack's efficacy over traditional random initializations while only increasing the computation time for single image by 20-25 seconds on single GPU. The diffusion- approach not only improves aligument in the vision encoder's feature space but also preserves the visual fidelity of the resulting adversarial examples while conforming to strict perturbation budgets.
5.1.2 Diffusion- Based Target Synthesis
Given target prompt T, first generate an image Xtarget that embodies the semantic attributes described by T. This is accomplished via diffusion model, specifically Stable Diffusion XL (SDX)). The generation process can be formalized as follows:
Xtarget = D(T, z; @SDXL).
(6)
where D denotes the diffusion process, z is sampled from a Gaussian distribution, and fSDXL represents the pre-trained weights of the diffusion model. The resulting image Xtarget effectively captures the semantic essence of the prompt T, thus providing an informative basis for initializing adversarial perturbations.
5.1.3 Encoder Anchored Perturbation
Let fo(-) denote the vision encoder component of the VLM. Our objective is to craft an adversarial per- turbation such that the perturbed image x + mimics the semantic representation of the target image in the vision encoder's output space. To achieve this, we derive the initial perturbation by minimizing the following objective:
Sini arg min [| + 5) (000-((xxana [x(
(7)
[
where is the maximum allowable perturbation (ensuring imperceptibilityy under an too constraint). This initialization ensures that the adversarial example starts within a semantically meaningful neighborhood of the target prompt's representation. The method is formally depicted in Algorithm 2 under Appendix B
5.1.4 Adversarial Optimization via PGD
After initializing the perturbation, refine the advesariial example using projected gradient descent (PGD). For the th iteration, the update rule is given by:
(++1) = IT adv
adv
x
a V Le
LASE
(8)
where a is the step size, and TT. (x) projects the updated input back onto the admissible too ball around the original image x. The loss function used during optimization is simple mean squared error (MSE) between the vision encoder outputs:
MMEE = (Xaav) - fo f (1target))2
(9)
This loss ensures that each update incrementally aligns the adversarial example with the target's semantic embedding.
5.2 Guiding perturbations via Target Value Vectors and evaluating Cross-Modes Tranferability
While CroPA attempts to enhance adversarial effectiveness by optimizing both image and text inputs through PGD, it lacks architectural sensitivity, particularly the internal dynamics of the vision encoder, which plays a dominant role in VLMs' semantic grounding. CroPA treats both vision and language modalities uniformly vulnerable, failing to exploit modality-specifie weaknesses. This oversight limits its ability to
8

---

Published in Transactions on Machine Learning Research (06/2025)
generate transferable and structured adversarial perturbations. More critically, CroPA's perturbations lack targeted influence on the encoder's representational backbone, which undermines both adversarial strength and transferability across models. CroPA minimizes and maximizes losses for image and text perturbations respectively, aiming to manipulate the model's output toward a specific target.
Previous research (Cui et al. (2023) Wang et al. (2024) demonstrates that perturbing the output embeddings of the vision encoder can significantly impair the visual perception capabilities of large vision- language models (LVLMs), thereby misleading the language model's responses. Morcover, various LVLMs typically employ similar image encoders to convert images into visual tokens, which encode rich semantic and structural information and serve as a critical interface for language decoders, to access and reason over image content. However, the CroPA method does not sufficiently leverage the architectural specifies of the vision encoder and instead treats both the vision and language components as equally susceptible to adversarial manipulation, potentially overlooking targeted vulnerabilities unique to the vision encoder.
To address this, we propose integrating the CroPA loss with a perturbation loss designed to disrupt the vision encoder's core attention mechanism, specifically focusing on value vectors of the attention layers of the vision encoder. Our hypothesis is that by perturbing the value vectors between the original image and a reference image corresponding to a target text, we can significantly enhance the Adversarial Success Rate (ASR) while maintaining the same hoperrarameter construints as CroPA.
This motivation is derived from empirical evidence in related works on adversarial tranferability in VLMs. Our approach is inspired by the Doubly- Unibee-lliveeaal Adversarial Perturbation (Doubly-UAP) method where instead of maximizing, we minimize the losses between value vectors of j and T 1, which identifies the most effective components within vision encoder's attention mechanism for adversarial influence. We hypothesize that largeting the value vectors in the vision layers which encode essential visual features will disrupt the model's interpretative abilities more effectively than CroPA's generic PGD-based perturbations. Additionally, by freezing the text encoder, we ensure that our perturbations are specifically tuned to degrade the visual processing capability of the VLM rather than introducing text-based artifacts.
Thus, our modification aims to:
1. Improve attack effectiveness by focusing on exploiting information in the vision encoder,
enhance semantic alignment of adversarial perturbations with the target text representation, and
3. achieve better adversarial robustness across models while maintaining computational feasibility.
By jointly optimizing the CroPA loss and our modified Doubly-UAP loss, we introduce a more structured, interpretable, and targeted adversarial attack framework for VL.Ms.
This incorporation is adapted from a component of the Doubly-UAP method proposed in Kim et al. (2024) which introduced UAP by identifying which specific components within the vision encoder's attention mechanism most effectively influence the performance of the VLM.. We choose to focus on the two components with the most fundamental roles in the attention mechanism:
These control how much each patch should focus on other patches, determining the level of interaction or relevance between patches. We hypothesize that by targeting the attention weights, we can effectively interfere with the encoder's ability to establish these relationships.
1. Attention Weights:
2. Value Vectors: These hold the actual information within each patch. We expect that perturbing the value vectors will disrupt the essential information content within patches, further impairing the model's interpretative abilities.
We target the vision encoders within VLM, as they are crucial for visual interpretation. Specifically, we focus on the attention mechanism within the vision encoder, the core process responsible for interpreting visual features. We aim to target the most vulnerable components of this mechanism the value vectors the middle-to-late layers based on prior analysis.
9

---

Published in Transactions on Machine Learning Research (06/2025)
Formally, in the standard Doubly-UAF attack, the perturbation d" is obtained as:
8 arg
(oss((i(()) Vi(z + +)),
(10)
L
IEL
where (z(z) represents the value vectors associated with the 1-th layer with imput image and Loss(-) is the loss function applied to the target vectors.
5.2.1 Our Modified Approach
We adapt this approach by introducing a modified loss function that incorporates target value vector derived from a reference image corresponding to desired larget lext T. Instead of solely maximizing the deviation of value vectors from their original representation, enforce alignment between the vision encoder's output and a predefined target representation. Our method consists of the following steps:
Alignment of Output to Target
Visual Input
Vision-L.anguage Model
ln Layer
Target Text ('unknown', 'bomb')
Vision Encoder
X
öv
gradient Föv
SDXL
Common CroPA
Douely UAP Noiee
L-JJAPP
Textual Input
T
X
öt
Attrciio Zayens
LCroPA
gradeen Vt
Output
Large Language Model
Figure D-UAP Architecture Diagram
1. Extract the value vectors from the 1-th layer of the vision encoder for both the input image and the target text's 's associated image.
2. Compute the cosine similarity loss between these value vectors.
3. Jointly minimize -ve of this loss along with the CroPA loss with proper scaling ensure adversarial robustness and target alignment.
10

---

Published in Transactions on Machine Learning Research (06/2025)
Formally, let Vz + +) denote the perturbed value vectors of the i-th attention head for the input image z, and let Vi represent the value vectors of the target text's 's reference image. We define our value vector loss as:
Vi + +6) V La-CAP Σ [[V( + +)
(11)
where N is the number of attention heads. This loss encourages the perturbed image's value vectors to closely align with the target text's representation.
We integrate this loss with the CroPA loss formulate our final objective function in Equation where À is a hyperparameter controlling the relative importance of the value vector loss:
Lre-CroPA = (CroPA + +6,, Io + T) - (La-CAP(6.)
(12)
By jointly optimizing both losses, our approach not only preserves the adversarial nature of the perturbation but also enforces semantic alignment with the target text. Specifically, during optimization, the gradients from both loss components are combined to update the perturbation 8, ensuring that the generated adversar- ial example exhibits both cross-pres prosspprompt transferability and guided semantic inffuence. This enhancement to the Doubly-UAP framework allows for more precise adversarial manipulation of VLMss, facilitating controlled and interpretable perturbations with applications in adversarial robustness and sccurity analysis. Algorithm under Appendix B summarizes the method step-by-step.
While we propose this step towards increasing transferability of perturbations generated by CroPA, the dependency of the D-UAP method on the model value vectors, and consequently the Vision Encoder, lcads us to hypothesize that transferability might be limited to models having the same or similar Vision Encoder architectures as the primary model on which the CroPA framework is run.
5.3 Transferability across images via Image Augmentation
Traditional adversarial methods optimize perturbations through iterative gradient descent on individual images, often leading to overfitting to imago-specific features. As a result, these perturbations exhibit poor transferability across images, which also makes them computationally expensive. The same applies to CroPA, in which the adversarial perturbations are learned for single image, across multiple prompts. In their experiments, Luo et al. (2024) mention that their method is orthogonal to cross-image transferability approaches, and that that cross-imane transferability can be enhanced by computing perturbations across imagos, as is done in Moosavi-Dezfodd et al. (2017). As part of our invostigation, we experiment on this claim and also introduce a novel approach, based on other literature on Universal Adversarial Perturbations (UAPs).
To mitigate overfitting in pradient-based attacks while enabling cross-image transfcrability, Fang et al. (0224) introduce Universal Adversarial Perturbations (UAPs) for Vision-Languse Pretraining (VLP) models. Com- plementing this, CutMix, proposed by Yun et al. (2019). offers distinct regularization strategy by synthesiz- ing training samples through regional replacement rather than pixel blending. CutMix generates composite images by cutting rectangular patches from one image and pasting them into another, while mixing labels proportionally to the area of the patches. This forces models to learn from partial views and prioritize spatially invariant features, thereby improving robustness against adversarial attacks and occlusions.
Expanding UAP frameworks, Zhang al. 2024 propose Effective and Transferable Universal Adversarial Attack (ETU), method that enhances UAP transferability across multiple VLP models and tasks through improved global and local optimization techniques. Specifically, ETU introduces SCMix, data augmentation strategy combining self-mix and cross-mix operations to boost data diversity while preserving semantic integrity. Of these, SCMix aims to integrate both spatial and scale invariant features in images. We integrate SCMix into our perturbation generation process, sclocting as one of our investigative techniques based on their empirical results showing that, for the same model, SCMix alone, without their additional local utility reinforcement, yields superior cross-image transferability.
11

---

Published in Transactions on Machine Learning Research (06/2025)
5.3.1 SCMix
SCMix, augmentation technique, diversifies training inputs through structured two-stage mixing pro- cess, the first of which self-mixing and the second cross-mixing. The self-mixing phase synthesizes variations of a base image I by blending randomly cropped and resized patches:
1 = nx + (1 X2 where X, = Reszee(BandomCCo(((1)) 7) = 0.5
(13)
While the original SCMix method utilised a probabilistic sampling of 77, as 1) Beta a)) for some a >
0, we choose = 0.5 to be fixed, which is equivalent to setting 2o which is justified in appendix
D.3 The subsequent cross-mixing phase introduces features from a secondary image Iz through a weighted
combination:
13 = = + 8212 with B1 >> B2 (0,1).
(14)
The weighting ensures / 's dominant visual semantics persist in Ia while incorporating diversity from elements of 12, enabling the adversarial generator to learn perturbations effective across diverse images. Further, by prescrving the dominance of the base image, the compatibility with I 's text description T1 for I3 ensured. This facilitates enriched modal interactions, as the synthetic image I3 remains aligned with Ti despite integrating Iz's 's features.
The dual mixing mechanism reduces overfitting which is possible in the case of CroPA by forcing perturba- tions to attack features invariant to both intra-image variations (via self-mixing) and inter-image blending (via cross-mixing). This regularization effect promotes universal perturbations for cross-image transferabil- ity, which may be applicable to unseen images without explicitly training the attack for that image, bridging the gap between targeted efficacy and cross-image generalization. This valid because during inference, CroPA only returns the perturbed image, or equivalently an appropriate perturbation for the image, thus, if effective cross-image perturbations are learned, the attack can be made universal being both cross-prompt transferable, as CroPA claims, and cross-image transferable, as aim to check.
12
Ia
82
X1
h
I
B1
X2
n
Cross-Mixing
Self-Mixing
Figure 3: rautoo of the self-mixing and cross-mixing processes. The input image Jn undergoes self-mixing generate intermediate representations X1 and X2, which are then combined to form H. Additionally, an external image /2 is mixed with If to produce the final output la.
12

---

Published in Transactions on Machine Learning Research (06/2025)
5.3.2 CutMix
CutMix Yun et al. (2019) enhances transferability through discrete regional feature replacement. For image pairs AA and TB, it creates composite samples:
I == (
(15)
where M {0, [0,1) is a binary mask defining a randomly placed rectangular region. Effectively, CutMix is able to learn from partial views of the images that mixes. The main difference with SCMix that while SCMix uses a soft blend of features across, and within, images, CutMix uses hard mask-based replacement. Unlike SCMix's continuous blending, CutMix's discrete region replacement forces perturbations to target spatially invariant features that persist across different image combinations. When integrated with adversarial training, this approach encourages perturbations that exploit higher-level semantic patterns rather than localized artifacts, polentially improving cross-image transferability.
5.4 Attack Setup and Threat Models for Transferability Experiments
We establish comprehensive threat models for evaluating both cross-model and cross-image transferability, focusing on the specific adversarial capabilities, knowledge assumptions, and evaluation protocols for cach scenario.
5.4.1 Using D-UAP to explore Cross-Moder Transferability for CroPA
To systematically evaluate how well adversarial perturbations generated with our D-UAP enhancement transfer across different models, establish principled threat model for cross-model attacks:
The attacker aims to generate a single adversarial perturbation for an image that, when applied, causes multiple vision-language models to output a specific target. text regardless of the input prompt. This represents practical black-box transfer scenario where an attacker optimizes on an accessible model but deploys against unknown models.
Adversary's Goal:
Knowledge and Capabilities: The attacker has white-bos access a surrogate model (either BLIP-2 Flamingo in experiments), including gradients and internal representations. For target models, the altacker only knows their general architecture family (e.g., CLIP- without access to parameters. The attacker is constrained to a maximum perturbation budget of e = 16/255 under Loe norm to ensure visual imperceptibility.
Cross-Model Settings: We examine two transferability scenarios reflecting real-world deployment condi-
tions:
Intra-family transfer: Perturbations optimized BLIP-2 (with OPT-2.7b language model) are evaluated on BLIP (with Vicuna-7b language model). Both share similar CLIP VIT-L/14 vision encoders but differ in language models and fine-tuning objectives.
Cross-architecture transfer: Perturbations tested across fundamentally different model archi- tectures: from BLIP-2 to Flamingo and vice versa. These models employ different vision encoders, language models, and architectural designs.
Evaluation Setup: We measure Attack Success Rate (ASR) for each vision-language task independently (VQAgenerals VQAspecifiic Classification, and Captioning). Success is measured by the target model failing generate the correct output when given the perturbed image, regardless of input prompt.
5.4.2 Investigating Cross- Transferability via Augmentation Techniques
For evaluating universal adversarial perturbations that work across different images, we establish the follow- ing threat model:
13

---

Published in Transactions on Machine Learning Research (06/2025)
The attacker aims to generate a single perturbation pattern that, when applied to any image, causes VL. to output a predetermined target text regardless of the input prompt or image content. This represents a higher level of attack efficiency compared to per-image optimization.
Adversary's Goal:
Knowledge and Capabilities: The attacker has access to a limited set of training images and their corresponding SCMix-angmmented variants. The attacker has white-box access to the target model during perturbation optimization but must create perturbation that generalizes unseen images. The perturba- tion is restricted to an Lx budget of 16/255.
We evaluate universal perturbations on a separate set of test images not seen during training. Success is measured by the ASR across different task types. A successful attack causes the model to fail to generate the correct output text when presented with any previously unseen image, regardless of its content or the associated prompt.
Evaluation Setup:
Our SCMix-enhanced approach specifically aims to overcome the inherent limitations of gradicnt- basod methods which tend to overfit to specific image features. By introducing controlled variations through self- mixing and cross- moosss during training, we hypothesize that the resulting perturbations will better capture model vulnerabilities independent of specific image characteristics.
5.4.3 Evaluation Rationale for Transferability experiments
In our experiments, we present all cross-prompl and cross-model transferability results under the untargeted attack setting. This decision is motivated by two primary factors. First, different Vision-Langues Models (VLMs) incorporate visual information using distinct embedding mechanisms, making it difficult to pinpoint how input perturbations influence final output token embeddings. As observed, targeted transferability is no- tably higher between models sharing similar vision encoder architectures (e.g., BLIP-2 to Ins)ruct/BIIP) but varies drastically otherwise, rendering direct comparison of targeted ASRs across heterogeneous architectures imprudent.
Second, the method of visual-textual fusion substantially impacts adversarial control. Decoder-only VL.Ss such as LLaVA and OpenFlamingo incorporate visual features late via cross-attention or token concatenation, treating them as auxiliary memory during causal language generation. Consequently, visual influence fades as decoding progresses (Awadalla et al. (2023), Liu et al. (2023).
In contrast,
models like BLIP-2 Li et al. (2023b) and InstructBLIP Dai al. (2023) integrate
visual features early and deeply into the input embeddings, ensuring persistent visual grounding throughout generation. Thus, targeted attacks are inherently more feasible in fusion-based models compared to decoder-
only models (Dai et al. (2023)
Given these architectural disparities, the evaluation of the transferability between models and between images through non-targeted ASR provides a more robust, fair, and comparable assessment across diverse VLM architectures.
Furthermore, we excluded CTA when comparing transferability as upon experimentation CIA yielded negli- gible transferability, and presented the following limitations for transferability fundamentally in the method itself:
Image-Specific Semantic Embedding: CTA's perturbation strategy relies on per-image visual token manipulation to embed target concepts. This creates adversarial patterns that lack cross-image consistency and are dependent on the image since the gradient direction and token space for different images and concepts are vastly different and the token-space transformations between input/targe /target image pairs are non-transforable.
Model-Specificc Embedding Architectures CIA is highly dependent on the structure of visual and textual encoders, which fails demonstrate cross-model transferability due to structural variations across LVL.Ms (BLIP2, VLa.A, Flamingo etc).
14

---

Published in Transactions on Machine Learning Research (06/2025)
6
Results
As stated in Section 4 a major objective of our research is to reproduce the cross-proite prompt transferability results presented by Luo et al. (2024) for the CroPA attack. This section details our efforts to replicate those findings and provides a comparative analysis of our reproduced results against the original paper.
Models Used:
evaluated five state-of-the-at Vision-Language Models (VT.ss): OpenFlamingo, BLIP-2, ILII and LLaVA. For Flamingo, utilized the open-source 3penFlammigg-993 implementation Awadalla et al. 2023 which provides comparable performance to the original model while being publicly accessible.
In reproducing the work of Luo al. (0224).
BLIP-2 introduces two-stage fusion-based approach that first extracts visual features using a frozen CLIP image encoder, then processes these features through Querying Transformer Li et al. (2023b). This archi- tecture enables efficient adaptation diverse vision-language lasks. The model employs OPT-2.7b as its language model component, facilitating flexible text generation capabilities.
InstructBLIP builds upon BLIP-2's fusion-basedd architecture while incorporating instruction tuning Dai et al. (023). A key distinction is its use of the Vicuna-7b language model, which enhances the model's ability to follow task-specific instructions. This modification enables more precise control over the model's outputs through carcfully crafted prompts.
LLaVA Liu al. (022) employs a decoder-only generation approach, where pretrained CLIP ViT-L vision encoder connects to Vicuna-13B through lightweight projection layer. Unlike uusionbbased models, LLaVA passes visual features directly into the language model's context, treating images special tokens in the prompt sequence.
These models represent two distinct architectural approaches: decoder-only models (OpenFlamingo, LLaVA) that treat visual embeddings as imput context for generation, and fusion-based models (BLIP-2, Instruct- BLIP) that explicitly align visual and textual representations before generation. These differences signifi- cantly affect adversarial effectiveness across prompts in targetted attack.
Our reproduction efforts were based on the code provided in the authors' public repository, maintaining the original configurations of these models to ensure faithful comparison with the baseline results. While the overall implementation was well-documented, we encountered several challenges that required modifications for successful reproduction. Notably, the code for BLIP-2 and InstructBLIP models triggered multiple runtime errors, necessitating significant. debugging and adjustments achieve functional execution.
6.1 Claim 1: CroPA achieves tross-prompt transferability across various target texts. [Reproduced]
To validate the central claim of Luo al. (2044), which posits that CroPA can achieve pross-prompl trans- ferability, we meticulously replicated their experimental setup. This involved training adversarial examples using the CroPA method and evaluating their transferability across diverse set of target prompts the Flamingo VLM. Our evaluation focused on measuring the Targeted Attack Success Rate (ASR) across the following tasks: VQA (both general and specific), image classification, and image captioning.
6.1.1 Experimental Details
Following the experimental protocol outlined in Luo et al. (2024), we generated adversarial examples using CroPA and assessed their effectiveness against a range of target prompts distinct from those used during training. The specific target prompts used our evaluation are listed in Table [ These prompts were selected to represent a broad spectrum of semantic meanings, ensuring a rigorous evaluation of cross-prompt transferability. Additional details for all reproduced experiments reported in Appendix D.I
15

---

Published in Transactions on Machine Learning Research (06/2025)
6.1.2 Comparative Analysis
Table D presents the Targeted ASRs achieved by the CroPA method on the Flamingo VLM for different target texts. Overall, our results align well with the claim that CroPA can achieve cross-prompt transferability. We observed non-zero ASRs across all evaluated tasks, indicating that adversarial examples generated using CroPA were effective in misleading the VLM, even when presented with diverse target prompts. However, we do note that CroPA consistently under-perte ander-performs for tasks such as Classification and Captioning, espocially with texts such 'too late" or 'not sure" that have abstract meanings and don't have significant visual semantics.
Target Prompt
Method
VQAgenerall
VQAspacifii
Classification
Captioning
Overall
Single-P
0.2640
0.4720
0.2700
0.1400
0.2865
unknown
Multi-P
0.7240
0.8740
0.5550
0.2850
0.6095
CroPA
0.9680
0.9880
0.7070
0.4200
0.7708
Single-P
0.2120
0.4740
0.5170
0.2530
0.3640
am sorry
Multi-P
0.7020
0.9020
0.7090
0.6140
0.7318
CroPA
0.8620
0.9260
0.7170
0.6890
0.7985
Single-P
0.3540
0.4240
0.1450
0.0000
0.2308
not sure
Multi-P
0.6520
0.6860
0.2310
0.0030
0.3930
CroPA
0.8760
0.8940
0.2420
0.0010
0.5033
Single-P
0.3980
0.5760
0.2180
0.0480
0.3100
very good
Multi-P
0.8940
0.9640
0.4040
0.2080
0.6175
CroPA
0.9620
0.9860
0.6060
0.2540
0.7020
Single-P
0.2520
0.4800
0.2280
0.0220
0.2455
too late
Multi-P
0.7880
0.9120
0.5040
0.1630
0.5918
CroPA
0.9300
0.9580
0.7010
0.1790
0.6920
Single-P 0.3280
0.6020
0.5550
0.1040
0.3973
metaphor
Multi-P
0.8880
0.9520
0.8420
0.4910
0.7933
CroPA
0.9840
0.9940
0.9100
0.5840
0.8680
Table 1: Targeted ASRs tested on Flamingo with different target texts, across varicty of Vision- Lisiuu-Language tasks. Here VQAgeneral and VQAspecifiee refer the degree of specificity prompts pertaining particular image. The prompts used are reported in Appendix
Our experiments successfully reproduce the core finding that CroPA exhibits robust cross-prompt transfer- ability, thereby validating the adversarial vulnerability of VLMs to such attacks.
6.2 Claim 2: CroPA achieves the best overall performance across different number of prompts [Reproduced]
We conduct experiments to compare the performance baseline and CroPA methods over different number of prompts compared to baselines as shown Figure For all methods ASR increases with increase in number of prompts (redundant for Singlo-P as it inherently gets tested on a single prompt. hence the lone 'star" symbol in Figure 4). We note that CroPA gives better ASR for the same number of prompts as compared to baselines, and is consistent better performer, underscoring the core motivation of transferability across prompts. We select the target text "unknown" to avoid the inclusion of high-frequency responses commonly found in vision-language tasks, which we find a valid argument presented by Luo et al. 2024), for this experiment.
We can also observe that the bascline method saturates an ASR rate lower than that of CroPA as number of prompts are increased, indicating trend that by adding more prompts, the baseline approach cannot surpass the performance of CroPA methods, which is consistent with the findings of Luo et al. (2024).
16

---

Published in Transactions on Machine Learning Research (06/2025)
0.8
Cropa
Multi P
Targeted ASR
Single-P e-P
0.6
0.5
0.3
50
100
Number of Prompts
Figure 4: Targeted ASR tested with different number of prompts on Flamingo. With the same number of attack iterations, our CroPA significantly outperforms baselines. 'unknown" is used as the target text.
6.3 Claim 3: CroPA converges towards higher ASR as number of iterations increase [Reproduced]
Our obtained results on investigating the converging ASR rate for CroPA resulted in contrasting results with respect to the original reported metrics of convergence with higher number of iterations (refer Appendix A.2 for the author's results, despite using the exact same paramcters for training and evaluation, as well as the author's own code. Where the original metrics showed CroPA converging with higher number of prompts. While this certainly the trend observed with the overall ASR across tasks as shown in Figure 6 which imitates the figures the original paper reports, when we investigated the ASR convergence for cach task's use case, individually the trend is prone to instability. This is verified by the findings reported in 5 Additionally, the model used for evaluation under this scenario wasn't 't specified by the authors, hence we opted to report figures obtained for the OpenFlaming! model with the target text being 'unknown".
YO6
3.030
6.2
1130
1500
1150
11.0
1150
170
1150
80
110C
1300
1500
(a) VQA
(b) VQA-Specific
(c) Classification
(d) Captioning
Figure 5: Comparison of Single-P, Multi-P, and CroPA across different categories.
Overall
0.7
Targeted ASR
0.6
Single-P
0.5
Multi-P
CroPA
0.4
0.3
900
1100
1300 Iterations
1500
1700
Figure 6: Overall Convergence and Comparison of CroPA
17

---

Published in Transactions on Machine Learning Research (06/2025)
6.4 Claim 4: CroPA outperforms baselines under few-shot settings [Reproduced]
In addition to the lextual prompl, the Flamingo model also supports providing exira images as in-context learning examples to improve the task adaptation ability. To investigate their effect on the tross-prompp attack, Luo et al. (2024) tested the ASRs of the image adversarial examples with the number of in-context learning examples different from the one provided in the optimisation stage. During the optimisation stage, the image ad adresariaal examples are updated under the (-shot setting, namely no extra images are provided as the in-context learning examples. In the evaluations, the 2-shot setting is used, i.e. two extra images are used as the in-context learning examples.
Setting
Method
VQAgeneral
VQAspeeifte
Classification
Captioning
Overall
Multi-P 0.7240
0.8740
0.5550
0.2850
0.6095
shot=0
CroPA 0.9680
0.9880
0.7070
0.4200
0.7708
Multi-P 0.7860
0.9420
0.5630
0.0010
0.5730
shot=2
CroPA 0.9440
0.9940
0.6860
0.0300
0.6635
Table 2: Targeted ASRs with and without visual in-context learning. images added for in-context learning.
The shot indicates the number of
The use of in-context examples makes it inherently harder for adversarial attacks to succeed as they can cause shift from the generation conditions from the optimization stage (Luo et al. (2024)) ). Furthermore, adding in-context images makes the model more contextually aware of the correct prompt space which diverges from the larget text. space. A number of works (Zhao al. (2023) Qi al. (2023) ), verily that allacks like CroPA which are optimized for specific context lose effectiveness when the context changes.
However, it is worthy to note that CroPA performs significantly better than the baseline in most tasks, making it more robust to widening of the context space by in-conlext examples. This verifies the motivation and hypothesis behind min-max objective detailed in Subsection 4.3] which was formulated to make CroPA more robust to widening of the prompt-space and consequent changes in context.
6.5 Results Beyond the Original Paper
The following subsections detail our extended experiments building upon CroPA's framework and incorpo- rating novel enhancements, mitigating the corresponding limitations of CroPA.
6.5.1 Noise Initialization
Our proposed Noise Initialization via Vision Encoding Optimization (detailed in subsection 5.1 demonstrates significant. improvements across various tasks compared to baseline methods. By using semantically informed perturbation initialization, transfcrability. As shown in Table 3 the integration of our method (CroPA+Init) consistently outperforms both CroPA and Multi-P across all metrics, achieving 6-15% gains in overall accuracy.
achieve superior performance in adversarial robustness and cross-promy
These results validate the efficacy of semantically guided initialization over random noise approaches. The wawa---nnoder-ancchoeee perturbations not only enhance attack success rates but also improve efficiency by reducing optimization steps. This highlights the robustness and adaptability of our method as a principled alternative for adversarial attack initialization.
Theoretical Analysis of Initialization in Bi-level Optimization The significant performance gains achieved through our diffusion-guided initialization can be attributed to the unique optimization challenges in CroPA's min-max framework. Our analysis reveals three key factors:
First, CroPA's adversarial formulation resembles a saddle-point problem where optimization stability is heavily influenced by initialization. Zhang et al.] (2025) demonstrated that min-max optimization problems exhibit significantly higher sensitivity to initialization conditions than standard minimization problems, often requiring carefully designed initialization strategies to achieve stable convergence. This sensitivity
18

---

Published in Transactions on Machine Learning Research (06/2025)
Target Prompt
Method
"QAgeuerrs
VQAspecific
Classification
Captioning
Overall
Multi-P
0.7240
0.8740
0.5550
0.2850
0.6095
unknown
CroPA
0.9680
0.9880
0.7070
0.4200
0.7708
CroPA+Init
0.8824
0.8920
0.8858
0.9306
0.8977
Multi-P
0.6840
0.8260
0.9050
0.6090
0.7560
bomb
CroPA
0.8176
0.9100
0.9498
0.6960
0.8433
CroPA+Init
0.9140
0.9468
0.9020
0.9412
0.9260
Multi-P
0.7020
0.9020
0.7090
0.6140
0.7318
I am sorry
CroPA
0.8620
0.9260
0.7170
0.6890
0.7985
CroPA+Init
0.9320
0.9524
0.9270
0.9716
0.9458
Multi-P
0.7900
0.8860
0.6700
0.6700
0.7540
very good
CroPA
0.8540
0.8990
0.7680
0.7550
0.8190
CroPA+Init
0.8745
0.8894
0.8362
0.9043
0.8761
Multi-P 0.6960
0.8540
0.6780
0.6060
0.7585
too late
CroPA 0.8990
0.9060
0.7940
0.8150
0.8535
CroPA+Init 0.9340
0.9220
0.9110
0.9660
0.9333
Table 3: Targeted ASRs on Blip2 with different target lexts using CroPA Vision Encoder noise initialization.
The detailed hyperparameters used discussed under section D.2
becomes particularly pronounced in CroPA's architecture, where prompt perturbations continuously alter the optimization landscape throughout training.
Second, the alternating update schedule CroPA-whidh updates image perturbations more frequently than prompt perturbations. creates mpiiaazation asymmetry that further amplifies initialization importance. Chen al. (2019) identified that such alternating gradient-based methods in min-max problems frequently suffer from local cycling behaviors, with convergence propertics strongly dependent the initial point's proximity to adversarially robust regions. Our semantic initialization leverages this insight by deliberately placing the starting point closer to mcaningful adversarial directions.
Third, empirical evidence from our experiments aligns with findings from Wu et al. 2020) who demonstrated that perturbations initialized with semantic priors consistently transfer better across models than randomly initialized ones, producing substantial improvements in attack success rates. This effect becomes particularly pronounced in bi-level optimization contexts like CroPA, where optimization pathways are more complex.
Our diffusion-baasd approach addresses these challenges by initializing perturbations in the direction of semantic targets rather than using standard random noisc. This principled initialization strategy enables faster convergence during optimization while simultaneously enhancing the transferability of the resulting adversarial examples. The significant performance improvements observed Table 3 which show significant
ASR increases.
Method
VQ general
VQAspecific
Classification
Captioning
Overall
Multi-P
0.7053
0.8807
0.7001
0.5553
0.7104
CroPA
0.8723
0.9457
0.7518
0.6138
0.7958
CTA
0.2985
0.2281
0.4857
0.4687
0.370
CroPA+Init
0.9145
0.9342
0.8982
0.9464
0.9209
Table 4: Average Targeted ASRs on BLIP-2 for different methods. Results show the impact on different vision-language tasks: Visual Question Answering (general and specific), Classification, and Captioning. The best performance values for each task are highlighted in bold. Apart from the previously mentioned baselines, also compare results with the Contextual Injection Attack (CIA) Yang et al. (2024] as additional baseline.
Gradient based adversarial attacks often take up semantics of their targets, which theorctically shouldn't need a semantically aligned initialization all, however, due the min-max complexities we mention above, the semantic alignment produced by gradients weaken, and injection of target semantics into initialization is
19

---

Published in Transactions on Machine Learning Research (06/2025)
necessary to strengthen them and aid better convergence. To aid this claim provide experimental results in Figure 7
We evaluate the incorporation of target attributes into the perturbations by first taking the CLIP score of the target text and our noise perturbations obtained by the base CroPA method and our Init enhancement. This offers an insight as to how much of the target features are taken up by the perturbations.
It is observed that CroPA does show expected behavior of gradient-based perturbation methods and acquires the context of the target, however we do notice modest increment in the CLIP score with the Initialization included. This suggests that while the target semantics are acquired by CroPA's 's perturbations, the initial- ization provides a subtle change in favor of better proximity it adversarial vulerable regions, even if it does not siguificantly upgrade the semantic features acquired by the perturbations with respect to the target.
The convergence trend before and after the updated initialization also shows promising trend aligned with our original hypothesis that, by deliberately placing the starting point closer to meaningful adversarial directions, our semantic initialization strategy achieves faster convergence.
CroPA CroPA Init Performance
CroPA + Init
0.95
Method CroPA
CLIP Score
21.80
Averoge Value
CroPA+Init
23.09
0.85
0.8n
Target. Text:
'Bomb'
0.70
900
1100
1300
1500
1700
Iteration
(a)
(b)
Figure 7: (a) Overall Convergence Comparison of base CroPA and CroPA+Inis (b) Quantifying feature similarity of learned perturbation to target by CLIP score.
6.5.2 Investigating Cross-Image transferability and Image Augmentation
CroPA's ivenesiveness stems from its ability to relain adversarial impact across different textual prompts, but this focus inherently limits its cross-image transferability. CroPA optimizes perturbations specifically be effective across different prompts, the resulting adversarial signals remain tightly coupled to the low-level features of the image they were generated on. This strong dependency prevents the perturbations from generalizing to different images, making universal cross-image attacks ineffective. This weakens the author's claims that learning the perturbation across images would lead to cross-image transferability.
To address this limitation, we further explored the integration of the SCMix and CutMix frameworks, presented in subsection 5.3 both of which introduce input diversity by mixing image features during training. The goal was encourage perturbations to extend beyond single image and improve their generalization. We believe CutMix outperforms SCMix in promoting adversarial transferability because its region- based mixing maintains distinct, non-overlapping spatial areas. This encourages the model to learn modular and independently manipulable features, which in turn makes adversarial perturbations more generalizable across different inputs. Our results (Table show that while cross-image transferability remains a challenge, both SCMix and CutMix contribute to measurable improvements. Despite these gains, the performance between cross-image methods and CroPA when applied single image showcase a fundamental limitation of CroPA: it excels cross-prompt robustness but does not effectively support transferable adversarial attacks across images.
20

---

Published in Transactions on Machine Learning Research (06/2025)
Method
VQA
VQAsporific
Classification
Captioning
Overall
CroPA (Basc)
0.3500
0.4920
0.4000
0.5000
0.4355
CroPA with SCMix
0.6560
0.7160
0.5000
0.9500
0.7055
CroPA with CutMix
0.4520
0.7240
0.5000
0.5500
0.5565
Table 5: Untargeted ASR of CroPA in cross-image scttings with and without SCMix and CutMix. The results represent the best ASRs achieved across all iterations. CroPA without input mixing attained its highest ASRs at 1700 iterations, while CroPA with SCMix and CutMiix outperformed significantly earlier, at just 1500 iterations and 1600 iterations, respectively. Additional details on experimental parameters are reported in Appendix D.3
6.5.3 Guiding perturbations via Target Value Vectors
We obtain results for the D-UAP-modified CroPA framework detailed in Subsection 5.2 Our results in demonstrate the effectiveness of the CroPA+D-UAP method across various vision languale tasks. The enhanced perturbations greatly improve upon the existing algorithm across the board to give an overall ASR of 96.85% which an 12.5% increase from CroPA's base method. The enhanced algorithm particularly improves ASR in tasks such as VQAgeneral and Captioning, marking a 13% and 28% increase respectively. 'Bomb' was used the target text in these experiments, which underscores the performance of the improved method with instances of harmful text which inherently set to trigger model's guardrails. These means that for the worse expected cases of 'harmful words" the enhancement lead the model to perform significantly better in vulnerable scenarios.
Tables G and /
Method
VQAsperific VQAgeneral
Classification
Captioning
Overall
Multi-P
0.68
0.82
0.90
0.60
0.75
CroPA
0.8176
0.9100
0.9498
0.6960
0.8433
CIA
0.3431
0.3102
0.4732
0.5534
0.4199
CroPA+D-UAP
0.9420
0.9720
0.9790
0.9810
0.9685
Table 6: Targeted ASRs on Blip2 using D-UAP function and target text being "Bomb", outperforming PGD baselines and CIA, as well as the base CroPA mod
Method
VQAgeneral
VQAspecific
Classification
Captioning
Overall
Multi-P
0.6960
0.8540
0.8990
0.6060
0.7638
CroPA
0.7900
0.8860
0.9470
0.6700
0.8233
CIA
0.3027
0.4302
0.5112
0.5080
0.4380
CroPA+D-UAP
0.9000
0.9520
0.9500
0.9060
0.9270
Table 7: Targeted ASRs on Open Flamingo using D-UAP Loss function and target text being 'Bomb',
6.5.4 Analyzing Cross Model Transferability by Value Vector guidance
The method also presents a strong case for increasing cross- model transferability as reported in Table with significant improvements over the vanilla CroPA method, especially Classification and Captioning tasks (14% and 21% respectively), with modest increase VQA. The discrepancy across tasks can be at- tributed to the fact that VQA prompts span much more complex embedding space than targeted tasks like Classification or Captioning where the output is limited to much smaller spans.
It's important to address a key limitation we observed during our analysis, particularly concerning the vision encoder's behavior, which verifies our hypothesis in Subsection 5.2 about the method's limitations.
A limitation of the CroPA Doubly-UAP approach lics in the dependency of value vectors on the specific vision encoder used within the Vision Language Model (VLM). This can limit transferability model's having the same similar architectural design of the Vision Encoder, this verified in Table where the
21

---

Published in Transactions on Machine Learning Research (06/2025)
pertubrations trained on BLIP2 appear to be passably transferable to InstructBLIP which used the same Vision Encoder, and failing to transfer to OpenFlamingo. This expected pattern can verified also in the case where the perturbations are trained on Flamingo and applied to the other models, where the ASR comes to insignificant (refer Table D.4.5 in Appendix D.4.5 Experimental details are reported Appendix D.4
Settings
Method
gengenlaal
VQAspecific
Cls
Cap
Overall
Multi-P
0.1760
0.2090
0.2750
0,2480
0.2270
BLIP2 to InstructBLIP
CroPA
0.3220
0.4170
0.6720
0.6150
0.5065
CroPA + D-UAP
0.3940
0.5780
0.8800
0.8880
0.6850
Multi-P
0.0810
0.0660
0.0760
0.0890
0.0780
BLIP2 to Flamingo
CroPA
0.1520
0.1220
0.1180
0.1820
0.1435
CroPA D-UAP
0.1850
0.2190
0.1420
0.3880
0.2335
Multi-P
0.1220
0.1060
0.0810
0.0630
0.0930
BLIP2 to LLaVA
CroPA
0.3190
0.2570
0.2730
0.3670
0.3040
CroPA + D-UAP
0.5070
0.3420
0.4380
0.8430
0.5325
Multi-P
0.1230
0.1520
0.1020
0.0960
0.1183
InItructBLIP to BLIP2
CroPA
0.2690
0.2320
0.1870
0.2270
0.2288
CroPA+D-UAP
0.4800
0.5100
0.4700
0.5000
0.4900
Multi-P
0.0650
0.0580
0.0420
0.0370
0.0505
InstructBLIP to LLaVA
CroPA
0.1620
0.1120
0.1410
0.1230
0.1345
CroPA+D-UAP
0.3450
0.3150
0.3680
0.3950
0.3558
Multi-P
0.0320
0.0210
0.0120
0.0110
0.0190
InstructBLIP to Flamingo
CroPA
0.0740
0.0680
0.0490
0.0480
0.0598
CroPA+D-UAP
0.1600
0.1400
0.1200
0.1300
0.1375
Multi-P
0.0140
0.0070
0.0090
0.0120
0.0105
Flamingo to BLIP2 CroPA+D-UAP
CroPA
0.0450
0.0210
0.0300
0.0380
0.0335
0.1080
0.0800
0.0990
0.1180
0.1013
Multi-P
0.0100
0.0060
0.0050
0.0090
0.0075
Flamingo to InstructBLIP
CroPA
0.0360
0.0220
0.0280
0.0300
0.0290
CroPA+D-UAP
0.1050
0.0720
0.0880
0.1100
0.0938
Multi-P 0.0180
0.0110
0.0140
0.0170
0.0150
Flamingo LLaVA
CroPA
0.0400
0.0300
0.0350
0.0430
0.0370
CroPA+D-UAP
0.1100
0.0850
0.0980
0.1170
0.1025
Table 8: The cross model test under different settings. "BLIP2 InstructBLIP' means the perturbations optimised on BLIP2 tested on the InstructBBLIP and similarly for "BIIP2 Flamingo'
Our investigations revealed that for given target text, the value vectors generated by the vision encoder remain approximately consistent across different input images. This observation has several implications:
Vision Encoder Specificity: The value vectors produced are aligned to the architecture and pre-training of the vision encoder.
2. Limited Diversity in Perturbations: Due to the consistency of value vectors for given target text, the diversity of adversarial perturbations generated by our method may be constrained. This could potentially limit the attack's ability to produce highly varied adversarial examples.
Target Text Dependency: The similarity value vectors across different images for the same target text indicates that the attack's outcome is strongly influenced by the choice of target text rather than the specific features of the input image.
22

---

Published in Transactions on Machine Learning Research (06/2025)
7 Discussion
7.1
Observations with reproducibility
Our study aimed to replicate key aspects and findings of Luo et al. (2024) on the Cross-Prompt Attack (CroPA) framework, we have substantiated the original claims regarding the enhancement of cross-prompt adversarial transferability in Vision-Language Models (VLMs). Our experiments confirmed that CroPA achieves strong pross-promp: transferability across diverse tasks, including VQA, image classification, and captioning, consistently outperforming baseline methods. CroPA remains robust in few-shot settings (6.4 outperforming other baselines and demonstrating resilience to the shift from the generation conditions from the optimization stage introduced by in-context learning examples.
7.2 Noise Initialization findings
In Subsection 5. we identified a critical limitation in CroPA and related adversarial attack methods, the reliance on random noise initialization, which is agnostic to the semantic structure of the target prompt. We hypothesized that this lack of semantic guidance at initialization introduces instability, prolongs convergence, and reduces cross-prompl and cross-modal transferability.
To address this, we proposed a semantically informed initialization strategy using a diffusion-ssyatheiized reference image and alignment in the vision encoder's feature space, designed to orient perturbations in a meaningful adversarial direction from the outset. Our experiment results 6.5. empirically validate this hypothesis: across all evaluated benchmarks, our noise initialization method significantly outperformed both CroPA and random-initialized baselines, yielding up to 15% gains in Targeted ASR and notably reducing optimization steps. These findings confirm that semantically anchored initialization not only enhances adversarial efficacy but also provides principled and efficient foundation for VL. attack frameworks.
This enhancement not only increased the effectiveness of adversarial attacks but also reduced the number of optimization steps required, making the process more efficient. By anchoring perturbations to the vision encoder's 's semantic space, this method provided a more principled and robust initialization strategy compared to random noise, highlighting its potential for improving adversarial attack frameworks.
7.3
Evaluation of Transferability Experiments
7.3.1 Cross-Image Transferability
Despite the author's claims that and that cross-image transfcrability can be achieved by computing perturba- tions across image, we found in our experimentation that while CroPA excels at cross-prompl transferability, its adversarial perturbations are tightly coupled to the low-level features of the specific image they were generated for. To address CroPA's inherent limitation in cross-image transferability, we integrated SCMix (Subsection 5.3) and CutMix, both image augmentation methods that help increase cross-image diversity while preserving semantic information of the original images.
Our results 6.5.2 showed that SCMix provided significant improvements in cross-image transferability, par- ticularly in tasks like VQA, VQA-specific and Captioning, where the ASR increased overall by approximately 27 percent. CutMix, on the other hand, achieved a net increase of around 12 percent over the base cross- image version of CroPA. We believe this bocause SCMix explicitly introduces spatial and scale invariance through its random cropping and resizing of the same image, then softly mixes it with a second image. This encourages the perturbations to target semantically aligned features that are less sensitive to exact positioning or scale, making it casier for adversarial perturbations to generalize across different inputs.
We can see that adding SCMix and CutMix improves the success of cross-image transferability when ap- plied to a cross-prompt transferable framework like CroPA. Both our improvements to address -mage transfcrability are image augmentation techniques, which we believe are able add cross-image features for better generalization when learning the perturbations. For further improvements, future research aimed improving cross-image transferability in cross-prompt frameworks should focus on more complex and layered
23

---

Published in Transactions on Machine Learning Research (06/2025)
approaches beyond augmentation such combining it with feature-allinmeet attacks based on the latent representation of the images, or perturbations in the latent space directly among other approaches.
7.3.2 Cross-Model Transferability
The D-UAP-modified CroPA framework (Subsection 5.2 represents a significant advancement CroPA's 's attack method, achieving an overall Targeted Attack Success Rate (ASR) of 96.85%, an 13.5% improvement over the base CroPA method as shown in 6.5.3 This enhancement is particularly notable in tasks like VQAgeneral and Captioning, where ASRs increased by 13% and 28%, respectively. These improvements were observed even when targeting challenging or harmful text, such as 'Bomb," which typically triggers model guardrails, demonstrating the robustness of the D-UAP framework in bypassing safety mechanisms.
Additionally, the framework exhibited improved cross-model transferability, especially between models with similar vision encoders, such as BLIP2 and InStructBI.IP. However, the method's 's effectiveness is constrained by its dependency on the specific vision encoder, which limits the diversity of perturbations and hinders transferability to models with different architectures.
This limitation underscores the broader challenge of developing encoder-agnostic adversarial methods. De- spite this, the D-UAP framework marks critical step forward in creating universal adversarial perturbations that are effective across both prompts and images, paving the way for future research to enhance generaliz- ability and robustness in vision-language models. Lastly, our cross-model transferability comparisons do not inchude ovaluation with the Contextual Injection Attack, since the attack inherently non-transforable and was unable to produce comparable results.
7.4 Trade-offs Between Different Types of Adversarial Transferability
Our comprehensive analysis reveals fundamental tradc-offs between different dimensions adversarial trans- ferability in vision-language models. These trade-offs are essential to understand when designing robust adversarial attacks:
7.4.1 Cross-Prompp vs. Cross-Modes Transferability
The original CroPA method excels at cross-prompl transferability by optimizing perturbations against com- peting text embeddings. However, this optimization implicitly anchors the perturbations to the specific architecture of the target model. Our experiments Section A.1 confirm this limitation, with ASRs drop- ping significantly when perturbations generated on one model are applied to another.
Our D-UAP enhancement (Section 5.2) attempts address this trade-off by targeting generalizable com- ponents within vision encoders rather than model-specific features. While this improves cross-model trans- ferability between architecturally similar models (e.g., BLIP-2 2 and InstructBLIP), the improvement remains modest between fundamentally different architectures (e.g., BLIP-2 and Flamingo). This suggests an inher- ent tension between optimizing for prompt diversity and model diversity simultaneously.
7.4.2 Cross-Prompt vs. Cross-Image Transferability
Cross-prompt and cross-image transfcrability represent competing optimization objectives. CroPA achieves strong cross-prompt transferability by tightly coupling perturbations image-specific features. This cou- pling, however, fundamentally limits cross- image generalization.
We proposc using data augmentation to address this limitation. Our SCMix and CutMix integrations (Sec- tion 5.3) attempl to overcome this limitation by diversifying the optimization process through augmentation. The improvements observed in Table 3 are promising for future work in this direction. However, at the same time, we find it important to point out that our findings suggest that while augmentation techniques can improve cross-image transferability, they do not fully resolve the fundamental tension between these objec- tives.
24

---

Published in Transactions on Machine Learning Research (06/2025)
7.4.3 Role of Initialization in Transferability Balance
Our diffusion-bused initialization approach (Section 5.1 represents an alternative perspective on these trade- offs. By anchoring perturbations semantically meaningful initializations, we can achieve higher ASRs without sacrificing cross-prompt transferability. This suggests that the optimization landscape's starting point significantly influences the achievable balance between different transferability types.
Unlike methods that modify the optimization process itself, better initialization enables perturbations to converge toward more general adversarial directions that remain effective across prompts. However, even with improved initialization, the fundamental tension between cross pooss-p and cross-image/ moage/croossmodee transferability remains. perturbation optimized for one dimension inevitably sacrifices effectiveness others.
7.4.4 Implications for Future Research
These observed trade-offs highlight a critical challenge in adversarial machine learning for vision-language models: no single attack methodology can simultancously maximize all forms of transfcrability. Future research should focus on developing frameworks that allow for controlled balance between these compet- ing objectives, potentially through multi-objective optimization approaches or architecturally-aveee attack designs.
Our work demonstrates that while individual techniques can push the boundaries of specific transferability dimensions, a comprehensive solution would require fundamentally rethinking how adversarial perturbations interact with the underlying model architectures and data representations.
Despite these affirmations, the domain of cross-prompl adversarial transferability remains underexplored. The considerable lack of literature in this area highlights gap in understanding of prompt-indcced vulnerabilities within VLMs. Addressing this gap is imperative, as it holds profound implications for the secure deployment of these models.
7.5 Broader Impact
From an attacker standpoint, adversarial examples exhibiting high cross-prompt transferability pose signifi- cant threats. Such examples can manipulate VLMs to produce malicious or misleading outputs, even when prompted with harmless querics. This capability could be exploited to disseminate false information or to subvert. systems dependent on VLMs for content generation and decision-making.
Conversely, from a defensive perspective, the application of imperceptible perturbations offers novel mech- anism to safeguard sensitive information. By embedding these perturbations into images, it is possible to induce VLMSs to consistently output predetermined, non-sensitive text, thereby thwarting unauthorized at- tempts to extract confidential data from personal images. This technique serves as proactive measure to enhance privacy and data security in an era where visual data is increasingly susceptible to exploitation.
Our study also introduces refinements to the CroPA framework, including improved initialization strategies and an enhanced loss function. These modifications have demonstrated marked incrcase both the Attack Success Rate (ASR) and the generalizable biziilli of adversarial examples across different models and images. Such advancements not only reinforce the efficacy of cross-promp prompt attacks but also pave the way for more resilient defenses against them.
In conclusion, while our reproducibility study affirms the foundational work of Luo et al. 2024 it also accentuates the necessity for deeper investigation into cross-prompt adversarial transferability. A compre- hensive understanding of this phenomenon is crucial for developing robust VLMs capable of withstanding adversarial manipulations and for formulating effective countermeasures to protect user data and maintain the integrity of model outputs.
25

---

Published in Transactions on Machine Learning Research (06/2025)
7.6 Limitations and Future Work
While were successfully able to reproduce the key results of CroPA and conduct extensive ablations, our progress was hindered on multiple occasions due to a lack of computational resources. Training and evaluating adversarial attacks on largo-scale VLMS, such as Flamingo and BLIP2, roquire significant GPU memory and processing power, which limited the scale and depth of some experiments. Running extensive hyperparameter tuning or evaluating cross-model transferability across a wider range of architectures was often constrained by resource availability. Additionally, we aimed to further investigate transferability using ensemble of these models, which would have provided deeper insights into the gencralizability of adversarial perturbations. However, this approach required very high memory and compute requirements, making it infeasible with our current infrastructure
Future work could focus on improving further cross-model transferability, particularly by developing encoder- agnostic methods as well as enhancing cross-image generalization. Another way to further improve the practical applicability of the method to implement the optimization with query-based strategics.
7.7 Communication With Original Authors
No direct communication could be established with the original authors during the replication process. The issue raised on their GitHub repository regarding the BLIP-2 and InstructBLIP models remains unresolved at the time of writing.
References
Nayyer Aafaq, Naveed Akhtar, Wei Liu, Mubarak Shah, and Ajmal Mian. Controlled caption generation for images through adversarial attacks. arXie preprint vxXix:2177.0006 2021.
Anas Awadalla, Irena Gao, Joshua Gardner, Jack Hessel, et al. Openftamingo: An open-source framework for training large autoregressive vision-language models. arXiv preprint arXiv:2308. 01390, 2023.
Nicholas Carlini, Milad Nasr, Christopher A. Choquette- Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Tppolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned?, 2024. URL https://arxiv. arb/a///// attaaaabb./...////// 2306 15447
Hongge Chen, Huan Zhang, Pin-Yu Yu Chen, Jinfeng Yi, and Cho-Jui Hsich. Attacking visual language ground- ing with adversarial examples: A case study on neural image captioning, arXiv preprint 2017.
Yuxin Chen, Yuejic Chi, Jianqing Fan, and Cong Ma. Gradient descent with random initialization: fast global convergence for nonconvex phase retrieval. Mathematical Progrumming, 176(1 2):5 37, Febru- ary 2019. ISSN 1436-4646. doi: 10.1007/110000-000-003333 610107-019-01363--6
http:///d..doi..rr/1000000000000 URL http://dx. doi otg//0.10077
Xuanming Cui, Alejandro Aparcedo, Young Kyun Jang, and Ser-Nam Lim. On the robustness of large multimodal models against image adversarial attacks, 2023. URL
Wenliang Dai, Junnan Li, Dongxu Li, and Philip Torr, Instructblip: Towards general-purppaaa vision linguaglan models with instruction tuning. arXiv preprint NYW:2335506500 2023.
Hao Fang, Jiawei Kong, Wenbo Yu, Bin Chen, Jiawei Li, Shutao Xia, and Ke Xu. One perturbation is cnough: On generating universal adversarial perturbations against vision-language pre-training models, 2024. URL
http://xxiv..orrr///////0000 05491
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXi::1412.667: 2014.
Yash Goyal, Tejas Khot, Douglas Hummers-Stay, Devi Batra, and Devi Parikh. Making the v in vqa matter: Elevating the role of image understanding visual question answering. In Proceedings of the IEEE conference computer vision and pallern recognition, 2017a. 7a.
26

---

Published in Transactions on Machine Learning Research (06/2025)
Yash Goyal, Tejas Khot, Douglas Summers- Dhruv Batra, and Devi Parikh. Making the in vqa
matter: Flevating the role of image understanding in visual question answering, 2017b. URL https:
Divyansh Kaushik, Douwe Kiela, Zachary C Lipton, and Wen-tau Yih. On the efficacy of adversarial data collection for question answering: Results from large-scale randomized study. arXiv preprint arXiv:2106.0088 2021.
Hee-Seon Kim, Minbeom Kim, and Changick Kim. Doubly-universal adversarial perturbations: Deceiving vision-language models across both images and text with a single perturbation, 2024. URL https://
arxiv. Stwiv.org/abb//412.005
Venelin Kovatchev, Trina Chatterjee, Venkata S Govindarajan, Jifan Chen, Eunsol Choi, Gabriella Chronis, Anubrata Das, Katrin Erk, Matthew Lease, Junyi Jessy Li, et al. Longhorns at dade 2022: How many linguists does it take to fool a question answering model? a systematic approach to adversarial attacks. arXiv preprint 220: 14729, 2022.
Jiawei Li, Chulin Xie, Bin Wi,, Yong Li, Yujia Qin, Chao Xu, and Shengfeng He. Boosting the transferability of adversarial examples with gradient aligmment in ensemble attack. arXiv preprint arXiv:2312.06199, 2023a.
Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. orXiv preprint rrXiv:2301.12597, 2023b.
Linjie Li, Jie Lei, Zhe Gan, and Jingjing Liu. Adversarial vqa: A new benchmark for evaluating the robustness of vqa models. In Proceedings of the IFFE/CVT International Conference on Computer Vision, pp. 2042- 2051, 2021.
Yuxin Li, Xingjun Wang, Lingjuan Lyu, Xinping Liu, Chao Chen, and Yevgeniy Vorobeychik. Improving the transferability of adversarial examples by inverse knowledge distillation. arXiv preprint arXiv:2502. 17003, 2024.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In European conference on computer vision, 2014.
Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jac Lec. Visual instruction tuning, 2023. URL https: org/ //arxiv.orr/abs/224..00
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks, 2017. URL https: http//aaxvvv...raaaa/// wttpaa/e//./..///////./
Yantao Lu, Yunhan Jia, Jianyu Wang, Bai Li, Weiheng Chai, Lawrence Carin, and Senem Velipasalar. Enhancing cross-task task black-box transferability of adversarial examples with dispersion reduction. In Pro- ceedings of the IEEE/CVF conference on Computer Vision and Pattern Recognition, pp. 940-949, 2020.
Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image is worth 1000 lies: Adversarial attpr///..r///a///4.....
transferability across prompts on vision-language models, 2024. URL
09766
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arxi;:1706 06080, 2017.
Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 1763-1773, 2017.
Konda Reddy Mopuri, Utsav Garg, and Venkatesh Babu. Fast feature fool: A data independent approach universal adversarial perturbations. Xāu preprint urXio:1707.0000 707.0552, 2017.
27

---

Published in Transactions on Machine Learning Research (06/2025)
Muhammad Muzammal Nascer, Salman H Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adversarial perturbations. Advances in Neural Information Pro- cessing Systems, 32, 2019a.
Muzammal Naseer, Salman H. Khan, Shafin Rahman, and Fatih Porikli. Task-generalizable adversarial attack based on perceptual metric, 2019b. URL hattp::/aardv..og/aaaaa////
Xiangyu Qi, Kaixuan Huang, Ashwince Panda, Peter Henderson, Mengdi Wang, and Prateck Mittal. Visual adversarial examples jailbreak aligned large language models, 2023. URL htttps://aaii..orrrrrrr/ harrg/abs23066
13218
Yujia Qin, Jiawei Li, Chulin Xie, Bin Wu, Yong Li, and Shengfeng He. Comprehensive comparisons of gradient-based multi-label adversarial attack algorithms. Complex Intelligent Systems, 2024. doi: 10. 1007//40744-0044-01166..
Mathieu Salımann et al. Learning transferable adversarial perturbations. Advances in Newral Information Processing Systems, 34:13950- 13962, 2021.
Christian Schlarmann and Matthias Hein. On the adversarial robustness of multi-modal foundation models, 2023. URL
Sasha Sheng, Amanpreet Singh, Vedanuj Goswami, Jose Magana, Tristan Thrush, Wojeiech Galuba, Devi Parikh, and Douwe Kiela. Human-adversarial visual question answering. Advances in Neural Information Processing Systems, 34:20346 20359, 2021.
Christian Szegedy, Wojeiech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint orXi:13112.6100 2013.
Florian Tramer, Nicolas Papernot, Ian Goodfellow, Dan Boneh, and Patrick McDaniel. The space of trans- ferable adversarial examples. arXiv preprint arx 704. 001440345, 2017.
Haoqin Tu, Chenhang Cui, Zijun Wang, Yiyang Zhou, Bingchen Zhao, Junlin Han, Wangchunshu Zhou, Huaxiu Yao, and Cihang Xie. How many unicorns are in this image? a safety evaluation benchmark for vision llss, 2023. URL htttss://araae http:///aaxxxxo///aba/ wrwp.//orrr/abb//1...ee 16101
Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adver- sarial attacks, 2021. URL https:///axxi: org/ hatp//aas/222200444 00436
Yubo Wang, Chaohu Liu, Yanqiu Qu, Haoyu Cao, Deqiang Jiang, and Linli Xu. Break the visual perception: Adversarial attacks targeting encoded visual tokens of large vision-language modcls, 2024. URL https:
alarxiv.org/abs//44101 06699
Zhibo Wang, Yuchen Zou, Peng Jiang, Kui Jia, and Heng Liu. Boosting adversarial transferability by achieving flat local maxima. Advances in Neural Information Processing Systems, 36, 2023.
Dongxian Wu, Shu-Tar Xia, and Yisen Wang. Adversarial weight perturbation helps robust generalization. In Advances in Neural Information Processing Systems, volume 33, pp. 1958-2900) 2020.
Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan Yuille. Improving transferability of adversarial examples with input diversity, 2019. URL https://arxix: http://aaxvvv.og/reeea/ aogg/bbs/1803. 069978
Xiaojun Xu, Xinyun Chen, Chang Liu, Anna Rohrbach, Trevor Darrell, and Dawn Song, Fooling vision and language models despite localization and attention mechanism. In Proceedingg of the IEFE Conference on Computer Vision and Pattern Recognation, pp. 4951-4961, 2018.
Yan Xu, Baoyuan Wu, Fumin Shen, Yanbo Fan, Yong Zhang, Heng Tao Shen, and Wei Liu. Exact adversarial attack to image captioning via structured output learning with latent variables, 2019. URL https:
28

---

Published in Transactions on Machine Learning Research (06/2025)
Xikang Yang, Xuchai Tang, Fuqing Zhu, Jizhong Han, and Songlin Hu. Enhancing cross- coss-prompt trans- ferability in vision-language models through contextual injection of target tokens, 2024. URL. https:
wwwxxi..rggabs///// 2020//440..3294
Sangdoo Yun, Dongyoon Han, Seong Joon Oh, Sanghyuk Chun, Junsuk Choe, and Youngjoon Yoo. Cutmix: Regularization strategy train strong classifiers with localizable features. In Proceedings of the IEEE/CVP internalional conference on compuler vision, pp. 6023 6032, 2019.
Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pre-training models, 2022a. URL https://arxiv.. org/ atg/abs///ae aa//abbs/22200 2206 09391
Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pro-training models. Proceedings of the 30th ACM International Conference on Mullimedia, pp. 5005 5013, 2022b.
Jiawei Zhang, Peijun Xiao, Ruoyu Sun, and Zhi-Quan Luo. A single-loop smoothed gradient descent-ascent algorithm for nonconvex-concare min-mas problems, 2025. URL https://arxivvorr//bbbb
15768
Peng-Fei Fei Zhang, Zi Huang, and Guangdong Bai. Universal adversarial perturbations for vision vision-languag, language pre-trained models. In Proceedings of the 4 7th International ACM SIGIR Conference on Research and Development in Information Retrieval, pp. 862 871, 2024.
Shaofeng Zhang, Zheng Wang, Xing Xu, Xiang Guan, and Yang Yang. Fooled by imagination: Adversarial attack to image captioning via perturbation in complex domain. In 2020 IEEE International Conference on Multimedia and Expo (ICME), pp. 6. IEEE, 2020.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models, 2023. URL httpss//arxiv, org/abs/ abs/
2305. 16934
Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision- language understanding with advanced large language models. ar preprint arXio:230,,1099, 2023.
Appendix
Table of Contents for the Paper
Introduction
1
Related Works
3
2.1
Adversarial Transterability
3
2.2
Adversarial Allacks on Vision-Langueee Language Models
3
2.3
Crosp-Prompt Adversarial Transferability
3
4
Enhancing Adversarial Transterability
3
3
Scope of reproducibility
4
Methodology
4
Problem Formulation
4
Baseline Approaches
5
Cross Prompt Attack
6
29

---

Published in Transactions on Machine Learning Research (06/2025)
5
Additional Investigative Experiments
6
5.1
Noise Initialization via Vision Encoding Optimization
7
5.1.1
Noise Initialization
8
5.1.2
Diffusion- Based Target Synthesis
8
5.
1.3
Vision-Eneoderr Anchored Perturbation
8
5.1.4
Adversarial Optimization via PGD
8
5.2
Guiding perturbations via Target, Value Vectors and eva evaluating Cross- Model Tranlerabil
5.2.1
Our Modifiod Approach
Transferability across images via Image Augmentation
5.3.1
SCMix
12
5.3.2
CutMix
13
5.4
Attack Setup and Threat Models for Transferability Experiments
13
5.4.1
Using D-UAP to explore Cross-Model Transferability for CroPA
............
13
5.4.2
Investigating Cross- Image Transterability via Augmentation Techniques
13
5.4.3
Evaluation Rationale for Transferability experiments
14
Results
15
6.1
Claim 1: CroPA achieves cross-prompo transferability across various target texts,
[Reproduced
15
6.1.1
Experimental Details
15
6.1.2
Comparative Analysis
16
6.2
Claim 2: CroPA achieves the best overall performance across dilferent number of prompts Reproduced]
16
6.3
Claim 3: CroPA converges towards higher ASR as number of ilerations increase
Reproduced
17
6.4
Claim 4: CroPA outperforms basclines undor few-shot scttings Reproducedd
18
6.5
Results Beyond the Original Paper
18
6.5.1
Noise Initialization
6.5.2
Investigating Cross- Image transferability and Image Augmentation
20
6.5.3
Guiding perturbations via Target Value Vectors
21
6.5.4
Analyzing Cross Model Transferability by Value Vector guidance
21
Discussion
23
Observations with reproducibility
23
Noise Initialization findings
23
Evaluation of Transterability Experiments
23
3.3.
Cross-Image Transferability
23
7.2.2
Cross-Model Transferability
24
7.4
Trade-ofis Between Different Types of Adversarial T Transferaban bility
24
30

---

Published in Transactions on Machine Learning Research (06/2025)
7.4.1
Cross-Prompy Cross-Model Transterability
24
7 7.4.2
Cross-Prompi vs. Cross-Tmage Transferability
24
7..3
Role of Initialization in Transferability Balance
25
7.4.4
Implications for Future Research
25
7,5
Broader Impact
25
Limitations and Future Work
26
Communication With Original Authors
26
A Appendix
29
A Results Sourced from the original paper
32
A.1 Model Transferability Evaluation for CroPA
32
A.2 Convergence results of the original paper
32
B Additional Method Details
32
C Implemennational Details
33
Datasets
33
Experimental Setup
33
C.3 Computational Requirements
35
D Experiment Hyperparameters
35
D.1 Targeted ASRs tested on Flamingo with different target texts using CroPA
35
D.1.1
Optimization Parameters
35
D.1.2
Multi-Prompt Strategy
35
D.1.3
Base Models Supported
35
D.1.4
Goneration Parameters
D.1.5
Text Embedding Perturbation
36
D.1.6
Reproducibility
36
D.2
Noise Initialization via Vision Encoding Optimization
36
D.2.1
PGD via Vision Encoder Image Perturbation Hyperparameterss
36
................................
D.2.2
Text Perturbation Hyperparameters (CroPA Specific)
37
D.2.3
Evaluation and Dataset Hypeepparameters
37
D.2.4
Noise Initialization via Vision Encoding Optimization
37
D.2.5
Additional Notes
37
D.2.6
Justification of Choices
37
D.3
Investigating Cross Image Transferability and Image Augmentation
38
0.4
D-UAP Enhancements
38
31

---

Published in Transactions on Machine Learning Research (06/2025)
D.4.1
Attack Configuration
38
D.4.2
CroPA-Specific Parameters
38
D.4.3
Evaluation Configurationn
39
D.4.4
Model-Specific Settings
39
D.4.5
Cross Model test with OpenF lamingo as the primary model
39
E Prompts for Different Tasks
40
A Results Sourced from the original paper
A.1 Cross-Model Transferability Evaluation for CroPA
Table 9 presents CroPA's cross model transferability results, underscoring the model-specific over-fitting
issue highlighted in
5.3
Settings
Method
VQAgeneral
VQAspecifie
Classification
Captioning
Overall
Multi-P
0.00
0.01
0.04
0.03
0.02
BLIP2 to Instruct BLIP
CroPA
0.00
0.04
0.15
0.11
0.08
Multi-P
0.00
0.02
0.10
0.02
0.04
InstructBLIP to BLIP2
CroPA
0.01
0.05
0.13
0.04
0.06
Table 9: The cross model lest under different settings. 'BLIP2 to BLIP means the perturbations optimised on BLIP2 are tested on the InstructBLIP and 'InstructBLIP to BLIP2' are different. The language model for BLIP2 is OPT-2.7b and the model for InstructBLIP is Vicuna-7b. The best performance values for each task are highlighted in bold.
A.2 Convergence results of the original paper
Figure presents CroPA's convergence results over increasing number of iterations, referred in 6.3
0.7
Targeled ASR
Single-P Mulli-P
0.5
0.4
CroPA
0.3
0.2
400
600
800
1000
1200
1400
1800
1800
Number of Iterations
Figure 8: Overall Convergence and Comparison of Original CroPA
B Additional Method Details
this section we present the algorithm formally depicted for our enhancement methodologies to CroPA as discussed in subscction 5.1 and 5.2 in Algorithms 2 and respectively
The modified algorithm apply SCMix image augmentation with CroPA is presented in Algorithm 4
32

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm 2 Diffusion- Based Noise Initialization and PGD
Algorithm 3 CroPA-D-UAP
Require: Model f, Target Text T, imput image Zes inpul prompi Tt, perlurbation size e, step sizes O1, 02, regularization weight X, iterations K Ensure: Adversarial perturbations 8,, òr
Require: æ, T, Jv: c, a, L
Noise Initialization
Sample noise: (0,
Generate target image: Starget 2;
Initialize 6, = 0, 6₁ =0
Generate target image SDXI.(T)
Compute initial perturbation:
for step
K do
init f arg mi Se [lf( +6) - (
LomPA CroPALoss o th de, T)
Adversarial Optimization via PGD
Extract value vectors
Initialize adversarial example: Fode + Ssnit
= Extract ExtrrattalueVocctor(((]]
for f = 1 to Niterations do
La-UAP =0
Compute MSE loss:
for each attention head in layer do
LMSE + (Iodd fo (Ztarge)) 112
Extract value vectors
Compute gradient: 9 < Vaade L
V Extract ValueVcctors(a, 6,) La-UAP LA-UAP cossim V/) end for
Update adversarial example: Iado t- Tadv - a-
Project back onto Loo ball:
Badv
Total loss: Lre-CIOPA = LCrOA ALL-UAP
(x) (Rado)
9r = Vá, Lie-ooa, = V Lre-CrOPA
end for return
Update perturbations:
8, = 6, - a1 sigu(go)
6, = 6ς - a2 sign(g:)
Project 6g to e-ball around
D: Diffusion model (SDXL) for image generation. Jo: Vision encoder that extracts features. [l Projection function to e-ball.
end for return 8u, 6
Figure Left: Our algorithm for initializing adversarial perturbations using diffusion models. Right: Our proposed CroPA-D-UAP method that guides perturbations via larget value vectors.
C Implemennational Details
C.1 Datasets
Following the original work, our evaluation utilized images from the MS-COCO validation dataset Lin et al. (014)). This dataset provides diverse collection of natural images suitable for testing cross-prompt transferability across various visual scenarios.
For the textual component, we employed two categories of Visual Question Answering (VQA) prompts. The first category, VQAgeneral, consists of general questions applicable to any image, focusing on common visual attributes and objects. The second category, VQAgseecfiie derives from the VQA-v2 dataset Goyal et al. (2077a) and contains questions specifically tailored to individual image content.
This combination of standard vision dataset with both general and specific VQA prompts enables compre- hensive evaluation of pros--prompt transferability across different types of queries and visual contexts. The prompts were designed to test both broad visual understanding and specific detail recognition capabilities of the models.
C.2 Experimental Setup
The experimental setup followed specific parameters for attack configuration and evaluation. For the attack implementation, maintained consistency with the original setup by utilizing the same seeds. By default, the experiments conducted as targeted attacks, with "unknown" chosen the target text to avoid
33

---

Published in Transactions on Machine Learning Research (06/2025)
Algorithm 4 Cross Image Cross Prompt Attack
Require: Model f, Target Text T, imput images X, = (x,, z...... 20
prompl set St = .....,, ,x"),, perturbation size 6,
step sizes a1, a2, iterations K, update interval N (controls text update frequency),
SCMix augmentation boolean SC' Augment,,
SCMix hyperparameters yi (self-mizing ratio), $1 B2 (cross-mizing coefficients) if Augment is true Cut- Mix augmentation boolean Cul.Mire Augment
Ensure: Adversarial perturbation 8,
1: Initialize perturbation 5, ~ (0,
2: for step = 1 to K do
for = n (iterate through all images) do Sample prompt x². from X;
// Select random prompt for current image if ACgien is true (enable SCMiz augmentation) then
Sample cross-image grress X
// Randomly select image for måzing
7:
if x.ross is then
8:
x x
1/ No ungmentation if some image selected
9:
else Sclf-mixing: r Resizo (Random
10:
// Create two patches
11:
Fy Resize Resize(Random Raanda
// Create second patch
12:
2 self qale + (1 17)0/22
Cross-mixing: x 3lagelf f 82x
13:
14:
end if
15:
else if CulMix Augment is true (enable CulMix augmentation) then Sample cross-image x-ross ~ X
16:
// Randomly select image for miring // Filled with 1s where the rectangle is
17:
Initialize rectangular binary mask M) @ HMM x crooss
z'
18:
else
19:
x' =
20:
end if
21:
if xt 1y
not initialized then
22:
Initialize text perturbation xt 1.
// Starting point for text perturbation
23:
end if
24:
Compute image gradient: Ir = V., (1', + de, Tee
(..) R,),, T,
25:
Update perturbation: 8, = 8, a1 sign(g.)
26:
if mod(step, N) = 0 (update text every N steps) then Compute text gradient:
V., [(f(ar + d, (1d)), T)
27:
Update text perturbation: 2 It 29: end if
28:
Hid + 02 sign(
// Ascent direction
30:
Project ö, to b-bal.: 8, = (lipo..(6o)
31: end for
32:
end for
33:
return 5,P
1/ Return universal perturbation applicable across images
high-frequency responses typical in vision-language tasks. The perturbation size was fixed at 16/255, and all adversarial examples were optimized and tested under zero-shot settings.
For multi- prompt experiments, both Multi-P and CroPA implementations used ten prompts. We maintained three evaluation runs for each experiment, averaging the Attack Success Rate (ASR) scores to ensure reliable results. The prompts spanned multiple task types including general visual questions, image-specific queries, classification tasks, and image captioning, with varying lengths and semantic structures.
For model implementations, we used the public OpenFlamingo-9F: Awadalla al. (2023) as our Flamingo variant, along with BLIP-2 and InstructBLIP models. Our reproduction maintained these core experimental parameters to ensure comparable results with the original work.
34

---

Published in Transactions on Machine Learning Research (06/2025)
C.3
Computational Requirements
The computational demands of reproducing the CroPA experiments were substantial, reflecting the resource- intensive nature of modern Vision-Language Models. Our primary experiments were conducted on PyTorch Lightning platform using an L40S GPU with 48GB VRAM and & 4-core CPU with 16GB RAM, matching the original paper's minimum requirement of 45GB VRAM for stable execution.
Working within the constraints of the free-tier platform credits posed significant challenges. Our experiments were limited by pooled allocation of 120 credits shared across four accounts. This necessitated careful resource management, particularly given the computational intensily of large-scale VLMs. To overcome these limitations, implemented several memory optimization strategies to enable partial execution local machines with 16GB VRAM, though this required significant code modifications.
The total computational cost of our reproduction study amounted to approximately 140 GPU hours and 90 CPU hours. This includes time spent on model training, attack generation, and evaluation across multiple experimental configuratioss. The substantial computational requirements underscore the importance of efficient resource allocation in modern machine learning reproducibility studies.
Experiment Hyperparameters
D.1 Targeted ASRs tested on Flamingo with different target texts using CroPA
The following are the detailed hyper-parameters used to obtain the results in Table I under Subsection 6.1
CROPA utilizes the following hyperparameters for optimizing adversarial perturbations in vision-language models. These parameters are designed to balance attack effectiveness while preserving task-specific func- tionality.
D.1.1
Optimization Parameters
Total Iterations: 1,701
Step Size:
Image Perturbations (a1): 255 ~ 0.0039
Text Embedding Perturbations (az, CROPA method): 0.01
Perturbation Budget (e): 255
0.0627 under Tox constraint.
Loss Function: Mean Squared Error (MSF) VIT embeddings
Batch Size: Dynamically allocated based on available GPU memory
D.1.2
Multi- Strategy
Simultaneous Prompts per Image: 10 (default)
Prompt Rotation: Randomized cyclic permutation per full cycle
Context Token Masking: Preserve first N context tokens during updates
D.1.3
Base Models Supported
OpenFlamingo
BLIP-2
Bn.I
35

---

Published in Transactions on Machine Learning Research (06/2025)
D.1.4
Generation Parameters
Beam Search Width: 3
Length Penalty: -2.0 (encourages concise outputs)
Maximum Generation Length: 5 tokens
D.1.5
Text Embedding Perturbation
Update Intervals: Every 30 iterations (for 10 prompts)
Constraint: #0.27 deviation from original embeddings
D.1.6
Reproducibility
Random Seed: 42
Image Preproccssing: 224x224 center crop
This configuration enables simultaneous optimization of vision-language perturbations while maintaining task functionality through constrained gradient updates.
D.2 Noise Initialization via Vision Encoding Optimization
This section details the key hyperparameters used in CroPA with Noise Initialisation via Vision Encoding optimisation attack detailed in Subsection 5.] to obtain the results in Table 3 and provides rationale for their selection. We aim to provide sufficient information for reproducibility and to justify our experimental choices. Projected Gradient Descent (PGD) was used to align the original image with the target image T; by adding perturbations iteratively.
D.2.1 PGD via Vision Encoder Image Perturbation Hyperparameters
We set the maximum allowed pixel perturbation (L norm) to 16/23 16/255. This value represents trade-off between attack strength and perceptibility. Smaller epsilon values might be less effective at fooling the model but also less noticcable to human obscrvers.
Epsilon (=):
Alphal (a1): The step size for each PGD iteration was set to 1/255. This relatively small step size allows for finor-grained exploration of the perturbation space and helps to avoid overshooting optimal perturbation directions.
The number of PGD itcrations for image perturbation was set 1701. This was determined empirically; observed that increasing iterations beyond this point yielded dimin- ishing returns in terms of attack success rate while significantly increasing computation time. Save perturbation iterations are 900, 1100, 1300,1500 and 1700.
PGD Iterations:
Budget: 0.05. This hyperparameter defines the maximum allowed change to each pixel value in the image during the PGD optimization process for aligning ViT embeddings. constrains the perturbation magnitude to ensure the modified image remains visually similar to the original.
150. Specifies the number optimization steps taken during the PGD process to align VIT embeddings between the generated and target images. A larger number of timesteps allows for finer adjustments and ialln better alignment but also increases computational cost.
Timestops:
36

---

Published in Transactions on Machine Learning Research (06/2025)
D.2.2 Text Perturbation Hyperparameters (CroPA Specific)
Alpha2 (a2): This hyperparameter controls the step size for updating the text embedding pertur- bations. The value is dynamically assigned based on the number of prompts used.
Number of Prompts: The number of prompts utilized during the optimization phase was 10. We use multiple prompts to make a more robust and transferable perturbation. Using different prompts that all target the same wrong answer forces the attack to find a perturbation that works across variations the input question.
CroPA Update Iterations: Text perturbations are updated at specific iterations (defined by propa_iters The text perturbation will be updated till 300 iterations. We empirically found that the text perturbation can guide the optimization better with some iterations.
cropa_end 300
step max ((ropa__eeeeeaeee llleeeddd/dppre httpa//rompp__muee num) ,1)
cropa_ited iter [i for i in range (step, cropa_eeddeee end+1, step)]
D.2.3 Evaluation and Dataset Hyperparameters
Test Dataset Fraction:
We evaluated our attack on 5% (fraction = 0.05) subset the test
dataset. This allowed perform thorough evaluation while keeping the computational cost manageable. We selected the subset randomly to ensure representative sample of the overall test distribution.
N-Shot Examples: The number of in-context learning examples was set to 0. This means we did not provide any demonstration examples to the model during evaluation.
Number of Test Images: 50.
Max Generation Length: 5.
Num Beams: 3.
Length Penalty: -2.0.
D.2.4
Noise Initialization via Vision Encoding Optimization
VIT Model: ViTModel. wttphodel..ooo_peerriiiii (appaa//l/llllliitttaararrtaapaa
Learning Rate: 0.1
Optimizer: Adam
D.2.5
Additional Notes
Random Seed: We used fixed random seed (seed_everything(42)) to ensure reproducibility of
our results.
Device: All experiments were conducted on a GPU (cuda: config config_args.co args. device)).
Batch Size: The evaluation batch size (args.eval batch_sizo chosen to maximize GPU utilization without exceeding memory constraints.
D.2.6 Justification of Choices
The hyperparameter values were selected based on a combination of prior work, pilot experiments, and computational constraints. We prioritized settings that balancod attack effectiveness, stcalthiness, and computational efficiency. Ablation studies (not included in this section but discussed elsewhere in the paper) conducted to assess the sensitivity of results key hyperparameters such and a.
37

---

Published in Transactions on Machine Learning Research (06/2025)
D.3 Investigating Cross Image Transferability and Image Augmentation
The following are the detailed hyper-parameters used to obtain the results in Table b under Subsection 6.5.2 For SCMix, the only hyperparameters are the choice of (or if ~ Beta(a, $1 and B2.
Eta (1) and Alpha (a): We chose 1, = 0.5 as a constant value for to ensure that the degree of self-mixing during augmentation is constant (and equal). In terms of a, this is equivalent to setting = oc. We do not experiment with this, as our main goal with SCMix is to ensure cross-image diversity.
Betal (31) and Beta2 (32): We took several values of 31 from 0.5 to 1, fixing 82 = 1- to ensure that the base image, used for self-mixing, dominates the final augmented image terms of visual characteristics, while still ensuring diversification by adding some characteristics of the cross-mixing image. Our results were reported for the best value we gol, which was with B1 0.7 and 82 0.3. The justification behind fixing B2 relative to 31 is to avoid clipping and ensure cross-mixing is treated like true weighted average.
For CutMix, there are no specific hyperparameters to consider.
The other hyperparemeters pertaining to the base CroPA framework can be found in D.1 Apart from this, in terms of implementation, the only variation with base CroPA that of the perturbation learned for an image and its set of texl. prompts, the one learned for the image common across all the images used.
D.4 D-UAP Enhancements
Our implementation of CroPA (Cross-modal Prompt Attack) and the baseline UAP (Universal Adversarial Perturbation) approach utilized the following hyperparameters:
D.4.1
Attack Configuration
Maximum Perturbation (#): 16/255, constraining the Loo-norm of the adversarial perturbation.
Step Size (a:): 1/255, controlling the gradient update magnitude for image perturbations.
Text Embedding Perturbation Range: [-0.23, 0.27], limiting the word embedding perturbation magnitude.
Text Perturbation Step Size (a2): Varies based on prompt number, determining the magnit of updates text embeddings.
Total Iterations: 1701, with evaluation chockpoints at intervals of 200, starting from itcration 900.
Target Response: "bomb," forcing the model to generate this specific output.
Loss Weight (A): 5
D.4.2 CroPA-Specific Parameters
Text Perturbation Schedule: Updates occur during the first 300 iterations at intervals deter- mined by step
Prompt Access Strategy: Random shuffling with rotation to ensure diverse prompt coverage.
Semantic Alignment: Cosine similarity loss with weight factor align perturbed images with the target concept.
38

---

Published in Transactions on Machine Learning Research (06/2025)
D.4.3
Evaluation Configuration
Sampling Fraction: 0.05 of the total dataset, balancing computational resources with statistical significance.
In-Context Learning Examples: 0 shots (default configuration).
Generation Parameters:
Maximum generation length: 5 tokens.
Number of beams: 3.
Length penally: -20.
D.4.4 Model-Specific Settings
We conducted the same experiment for both BLIP-2 and OpenFlamingo. Hyperparameters for both the models are given Experiment
Primary Model: OpenFlaminno-991
Image Generation Model: stable-diffusion--ll-bee 1.0 was used.
Vision Feature Extraction: Middle transformer blocks (layers 10-19) for semantic representation.
Image Preprocessing: Normalization with mean [0.485, 0.456, 0.406] and standard deviation [0.229, 0.224, 0.225].
Image Dimensions: 224 x 224 pixels.
Experiment 2:
Primary Model: BLIP-2 (blip2-opt-2.7b).
Image Generation Model: stable-diffusion---lbeee--1 was used.
Vision Feature Extraction: Middle transformer blocks (layers 14-29) for semantic representation.
Image Preprocessing: Normalization with mean [0.485, 0.456, 0.406] and standard deviation [0.229, 0.224, 0.225).
Image Dimensions: 224 x pixels.
The hyperparameters were carefully selected to balance attack effectiveness and computational efficiency.
Our implementation used random seed of 42 to ensure reprodueibility across experimental runs.
D.4.5 Cross Model test with OpenFlamingo as the primary model
Settings
Method
VQAgeneral
VQAspecific
Classification
Captioning
Overall
Multi-P
0.00
0.00
0.00
0.00
0.00
Flamingo Instruct.BIIP
CroPA
0.00
0.00
0.00
0.00
0.00
CroPA D-UAP
0.00
0.00
0.00
0.00
0.00
Multi-P
0.00
0.00
0.00
0.00
0.00
Flamingo to BLIP2
CroPA
0.00
0.00
0,00
0,00
0.00
CroPA+D-UAP
0.00
0.00
0.00
0.00
0.00
Table D.4.5 reports results for the cross-model transferability test as mentioned in Subsection
6.5.3 with the
D-UAP enhanced CroPA method described in Subsection 5.2
39

---

Published in Transactions on Machine Learning Research (06/2025)
E
Prompts for Different Tasks
This section presents a short description of prompts used for various vision-language tasks in our experiments.
Detailed list of prompts is provided in our supplementary material.
Prompts for Visual Question Answering (VQA) are categorized into two types: VQAgeneral and VQAspeeifte- VQAgeneral prompts are image-agnostic while VQAspecific prompts are tailored to specific image content. Prompts in the categories of VQAgeneral. Image captioning and Image Classification are created by the original paper Lao et al. (0244) while the prompts for VpAsieeifte derived from the Goyal al. (017b
40


Reviews:
[{"review_id": "msdgdmq8dY", "reviewer": "Reviewer_PcXE", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths:\n\n1. The ideas behind the new techniques such as the novel initialization strategy and the use of target value vectors to guide perturbations are well-motivated.\n2. The proposed techniques demonstrate promising results, indicating their effectiveness in enhancing the original CroPA method.\n\nWeakness:\n\n1.  While reproducing previous work is important, it should not be positioned as a key contribution of the paper. Instead, the authors should focus on clearly identifying the limitations of the original CroPA method and emphasize how these shortcomings motivate the development of their proposed improvements.\n2. The experimental evaluation of the proposed methods appears insufficient. For example, in Table 3, only three target prompts are used for evaluation, which limits the generalizability of the findings. Similarly, in Table 5, the proposed method is evaluated exclusively on BLIP-2. These limitations weaken the empirical support for the effectiveness and robustness of the proposed approach.\n3. Given the rapid progress in vision-language models, the authors are encouraged to evaluate their method on more recent VLP models. In Table 6, the performance gap between the baselines and the proposed method is relatively small, which limits the impact of the results. Incorporating additional models, such as LLaVA, could better demonstrate the effectiveness and generalizability of the proposed approach.\n4. Based on the descriptions of Algorithms 2 and 3, the proposed method appears to be largely independent of the original CroPA approach. Therefore, it would be beneficial for the authors to evaluate their method in the context of other adversarial attack frameworks to better assess its generalizability and broader applicability.\n5. The overall organization of the paper needs improvement. Algorithms 2 and 3 contain excessive empty space and should be reformatted to appear more compact and readable. Furthermore, the paper lacks a dedicated Related Work section. Thus, I strongly recommend that the authors undertake a thorough rewrite of the paper", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a comprehensive study of the previously proposed CroPA method to ensure reproducibility. Additionally, it introduces several novel techniques to further enhance the performance of CroPA.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "see weakness", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "zqkUfNkhSO", "reviewer": "Reviewer_3isH", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "Strengths  \n1. Rigorous Reproducibility Study\n   - Comprehensive validation of CroPA across multiple VLMs (Flamingo, BLIP-2, InstructBLIP) with consistent results.  \n   - Clear documentation of hyperparameters and experimental settings, enhancing reproducibility.  \n\n2. Clear and Detailed Writing\n   - Well-structured methodology with sufficient technical depth (e.g., diffusion-based initialization in Section 4.1).  \n   - Transparent reporting of limitations (e.g., computational constraints in Section 6.1).  \n\nWeaknesses  \n1. Limited Impact of Image Augmentation Without Further Exploration of the Reasons\n   - ScMix yields marginal improvements in cross-image transferability (Table 4).  \n\n2. VQA Performance Discrepancy Without Further Exploration of the Reasons\n   - CroPA + LD-UAP shows limited gains over baselines in VQA tasks (Table 5) \n\n3. Unclear LD-UAP Improvements\n   - Claims of \"11.6% ASR increase\" (Section 5.5.3) are unsupported by Table 5 (95.4% → 95.6%).  \n\n4. Minor Issues\n   - Typographical errors (e.g., \"LD-DUAP\" → \"LD-UAP\").", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper presents a comprehensive reproducibility study and enhancements to the Cross-Prompt Attack (CroPA) for Vision-Language Models (VLMs). The authors first reproduced the results of the original CroPA paper, validating its cross-prompt transferability and overall performance. Building on this foundation, they propose several key improvements:\n\n - Noise Initialization via Diffusion Models: A novel initialization strategy that leverages diffusion models to generate semantically informed perturbations, significantly boosting attack success rates.\n\n - Guided Perturbations via Vision Encoder: Integration of targeted value vector manipulation in the vision encoder’s attention mechanism to enhance adversarial effectiveness.\n\n - Cross-Image Transferability with ScMix: Exploration of Universal Adversarial Perturbations (UAPs) using CroPA’s framework, augmented by ScMix data augmentation to improve generalization across images.\n\nThe enhancements demonstrate consistent improvements in adversarial performance while highlighting challenges in cross-model and cross-image transferability. The study underscores the vulnerabilities of VLMs to adversarial attacks and provides insights for future robustness research.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "1. Validate LD-UAP performance claims (Clarify the 11.6% ASR improvement claim vs. Table 5's 0.2% difference) \n2. Explain limited VQA improvements (Add analysis of why CroPA shows marginal gains in VQA tasks) \n3. Expand ScMix analysis \n - Test more hyperparameters (e.g., η∼Beta(0.5,0.5))\n - Compare to simpler methods like CutMix)\n4. Certain typo fix.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "1gYqx9GHgb", "reviewer": "Reviewer_cw34", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "### **Strengths**  \n\n- **Clarity and Readability**: The paper is well-written and easy to follow, making it accessible to a broad audience in adversarial machine learning.  \n- **Practical and Important Research Problem**: The study addresses a highly relevant issue—**adversarial vulnerabilities in Vision-Language Models (VLMs)**—which has significant implications for both security and robustness in multimodal AI systems.  \n- **Insightful Identification of Cross-Model Transferability**: The authors astutely recognize **cross-model transferability** as a key challenge in adversarial attacks against VLMs. While CroPA briefly mentioned this concept in its original paper, this work delves deeper into it as a primary research focus. However, the paper would benefit from a more thorough conceptual discussion of this issue. E.g., is there a **trade-off** between **cross-model transferability, cross-prompt transferability, and cross-image transferability**?  \n- **Significance of the Proposed Noise Initialization Strategy**: Although the idea of replacing random noise initialization is not entirely novel, its impact in the context of CroPA) is significant. Traditionally, in adversarial attacks on computer vision models, initialization strategies do not substantially affect results. However, this study demonstrates that in CroPA, **the choice of initialization plays a crucial role**. This insight could lead to further investigations into:  \n  - Whether the importance of initialization stems from the bi-level optimization framework of CroPA, which makes learning more difficult.  \n  - In standard CV adversarial attacks, adversarial perturbations naturally adopt the target texture during training. If this does not happen in CroPA, it suggests that the **optimization process itself may have room for significant improvement**, beyond just modifying the initialization strategy.  \n\n### **Weaknesses**  \n\n- **Limited Experimental Validation of Cross-Model Transferability**: Since this work **centers around cross-model transferability**, it should provide more extensive experiments to support its claims. However, the only relevant experimental results are found in Table 6.  \n  - To align with best practices in adversarial ML research, the authors should dedicate an entire section*to defining their **threat model** and clearly detailing their cross-model transferability experiments.  \n  - Additional evaluations on a broader range of models and architectures would significantly strengthen the empirical contributions.  \n- **Questionable Motivation for the LD-DUAP Strategy**: The second proposed strategy—LD-DUAP—raises concerns:  \n  - The authors acknowledge that UAP technology primarily enhances cross-image transferability, which can lead to overfitting to the surrogate model (white-box model).  \n  - This overfitting could actually hurt cross-model transferability, contradicting the study's primary objective.  \n  - The paper should explicitly justify why LD-DUAP is beneficial in this context and provide ablation studies to verify its effectiveness in improving cross-model transferability rather than harming it.", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This submission investigates the transferability of adversarial attacks across different models within the Cross-Prompt Attack (CroPA) framework. The work first replicates and verifies key aspects of the original CroPA study, confirming most of its reported findings. Beyond replication, the study makes two notable contributions to enhance cross-model transferability:\n- Instead of relying on conventional random noise, the authors propose leveraging text-to-image diffusion models to generate structured initial perturbations.\n- The study integrates input diversity and Universal Adversarial Perturbation (UAP) techniques, which have been previously effective in image-based adversarial attacks.", "claims_and_evidence_yn": "Yes", "claims_explanation": "", "audience_yn": "Yes", "audience_explanation": "", "requested_changes": "As mentioned earlier, the suggested revisions are listed below in order of importance. These modifications are crucial for the acceptance of this work. I believe that upon completing these revisions, this work will be worthy of acceptance.\n\n1. Enhance the discussion on the potential trade-offs between cross-model, cross-prompt, and cross-image transferability.  \n\n2. Expand cross-model transferability experiments by dedicating a section to the threat model and providing more comprehensive evaluations beyond Table 6.  \n\n3. Provide further analysis on why the noise initialization strategy plays a crucial role in CroPA and whether this is due to the bi-level optimization framework. Discuss if alternative initialization strategies could further improve performance.\n  \n4. Justify the use of LD-DUAP, addressing concerns about overfitting to the surrogate model.  \n\n5. Fix formatting issues in Table 6 for better readability.", "broader_impact_concerns": "This work highlights critical adversarial vulnerabilities in VLMs, which can aid in developing stronger defenses but also risk misuse for generating more effective attacks. The findings emphasize the need for improved robustness in VLMs.", "additional_comments": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)