Typography Leads Semantic Diversifying: Amplifying Adversarial Transferability across Multimodal Large Language Models

Authors: Hao Cheng, Erjia Xiao, Jiayan Yang, Jiahang Cao, Qiang Zhang, Le Yang, Jize Zhang, Kaidi Xu, Jindong Gu, Renjing Xu
Primary area: applications to computer vision, audio, language, and other modalities
Keywords: Adversarial Transferability; Multimodal Large Language Models; Data Augmentation

Abstract:
Recently, Multimodal Large Language Models (MLLMs) have demonstrated exceptional performance in zero-shot tasks through their advanced cross-modal interaction and comprehension abilities. Despite these capabilities, MLLMs remain vulnerable to human-imperceptible adversarial examples. In real-world scenarios, the transferability of adversarial examples, which enables cross-model impact, is considered their most significant threat. However, systematic research on the threat of cross-MLLM adversarial transferability is currently lacking. Therefore, this paper serves as the first step toward a comprehensive evaluation of the transferability of adversarial examples generated by various MLLMs. Furthermore, we leverage two critical factors that significantly impact transferability: 1) the degree of information diversity involved in the adversarial generation; 2) the integration of cross vision-language modality editing. We propose a boosting method, the Typography Augment Transferability Method (TATM), to explore adversarial transferability across MLLMs. Through extensive experimental validation, our TATM demonstrates exceptional performance in real-world applications of Harmful Word Insertion and Important Information Protection.

Decision: reject
Reviewer scores: 5, 6, 3, 3

Reviews and discussion:
<thread>
creation date:
1729354782840

thread_type:
official_review

<thread_object>
creator: reviewer_pjgc

<content>
summary:
This paper explores the security vulnerabilities of Multimodal Large Language Models (MLLMs), with a focus on the transferability of adversarial examples. The authors introduce the Multi-semantic Angular Deviation Score (MADS), a quantitative metric for analyzing the adversarial transferability of different image samples. Additionally, they propose the Typography Augment Transferability Method (TATM), which enhances adversarial transferability by leveraging information diversity and cross-modal editing. Through experiments, the authors demonstrate the effectiveness of TATM in improving adversarial transferability.

strengths:
The strengths of this paper include:
- The authors' proposal of a white-box attack method to enhance the transferability of adversarial examples. They conducted experiments on various tasks, such as "Harmful Word Insertion" and "Important Information Protection," thoroughly analyzing the performance of different methods across various MLLMs, including those with fixed vision encoders and cross-vision encoders. 

- The introduction of the Multi-semantic Angular Deviation Score (MADS) contributes to improving the interpretability of adversarial examples, offering a valuable tool for understanding their behavior.

weaknesses:
The weaknesses of this work include:
- The authors introduce two real-world applications: "Harmful Word Insertion" and "Important Information Protection." However, the paper does not provide a clear explanation of the specific setups for these applications. Both Figure 1 and the accompanying text fail to clarify these aspects. Additionally, the authors do not justify the choice of "Suicide" and "Unknown" as target outputs, leaving their rationale unclear. Moreover, the explanations for the baseline methods, including DIM, BC, SIM, SIA, and TIM, are also insufficiently detailed.

- The proposed adversarial example generation method is essentially a white-box attack, where the image is initialized using typographic words. However, the advantage of this initialization is not demonstrated. The authors neglect to provide ablation studies, such as comparing adversarial training using original image for initialization or image patch for initialization.

- The authors' exploration of the different word types of typographic words embedded in images lacks clear justification. Intuitively, if the target output is "suicide," the typographic words used in the images should be contextually relevant words or related images. Without such relevance, the significance of testing transferability across arbitrary word types becomes questionable.

- The paper also suffers from numerous typos, indicating a need for significant improvement in writing quality. For instance:

1. Line 124: "Furthermore, data-augmentation methods Data augmentation has received more attention because of the ease and efficiency of implementation."
2. Line 195: Multi-semantic Angular Deviation Score (MADS), and Line 206: "we present the Mean Absolute Deviation Scores (MADS)"—the inconsistent use of different full forms for the same acronym is unacceptable.
3. In Algorithm 1, there are multiple issues with inconsistent capitalization, symbol notation, and typographical errors, including "TypoT."

questions:
Refer to Weakness
</content>
</thread_object>

</thread>
<thread>
creation date:
1730162342519

thread_type:
official_review

<thread_object>
creator: reviewer_vmid

<content>
summary:
The paper investigates vulnerabilities in Multimodal Large Language Models to transferable adversarial attacks. The authors introduce the Typography Augment Transferability Method (TATM), which uses typographic augmentation and cross-modal editing to enhance adversarial transferability across models. TATM proved highly effective in tasks like harmful word insertion and information protection.

strengths:
- The transferability of adversarial attacks across MLLMs is a timely and essential area of study, especially as MLLMs are increasingly integrated into commercial products.

- Comprehensive experiments involving a substantial number of models have been conducted, which is critical for advancing research in transferability studies.

weaknesses:
- The paper requires significant proofreading; several errors disrupt readability and make the reading process frustrating.
The Abstract contains grammatical issues, for example: "Therefore, this paper as the first step to ..." should likely read "this paper serves as the ...". Also, "Furthermore, leveraging two key factors that influence transferability performance: 1) The strength of information diversity involved in the adversarial generation process; 2) Editing across vision-language modality information. We propose a boosting method ..." lacks fluency.
In the Introduction, citations, particularly those listed in groups, should be enclosed in brackets for clarity.
In the Background section, adequate spacing is needed between method names and author names, e.g., "Projected Gradient Descent (PGD)Madry et al. (2017)" should read "Projected Gradient Descent (PGD) Madry et al. (2017)."

- Numerous acronyms and newly introduced terms make the paper challenging to follow.

- Transferability studies should ideally test transferability on black-box production models, such as GPT-4, Gemini, and real deployed systems.

- The method’s dependence on typographic augmentation may restrict its applicability to certain scenarios or datasets. Exploring other forms of semantic augmentation could improve its generalizability and broaden potential applications.

questions:
Please refer to the weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730651794246

thread_type:
official_review

<thread_object>
creator: reviewer_zggc

<content>
summary:
This paper investigates the transferability of adversarial examples across MLLMs. Although MLLMs excel in cross-modal interaction and comprehension, they remain vulnerable to transferable adversarial attacks, posing significant real-world risks. Leveraging two key factors—information diversity in adversarial generation and cross-modal editing—the authors propose the Typography Augment Transferability Method (TATM), which enhances adversarial transferability across MLLMs. Experiments demonstrate TATM’s effectiveness in applications such as "Harmful Word Insertion" and "Important Information Protection.

strengths:
1. the authors propose an innovative approach to enhance transferability by leveraging cross-modal data augmentation and semantic diversification through typography-based adversarial examples.
2. The introduction of the Multi-semantic Angular Deviation Score (MADs) as a metric for quantifying information diversity also reflects the technical rigor of the study.

weaknesses:
1. There is a lack of in-depth analysis on the transferability of adversarial examples. For instance, to further understand how the targeted adversarial example influences response generation, the authors can compute the relevancy score of image patches related to the input question using GradCAM to obtain a visual explanation for both clean and adversarial images.
2. Reference missing, such as "On Evaluating Adversarial Robustness of Large Vision-Language Models"

questions:
1. Although the authors have validated the proposed method on multiple models, the experiments are limited to fixed-size models and scenarios. Expanding the diversity of experiments is recommended, such as testing larger models like Qwen2-VL-8B, CogVLM-17B, and Yi-VL-34B, to further assess the method's effectiveness.

2. What is the impact of the perturbation budget on the transferability of adversarial examples in applications like "Harmful Word Insertion" when evaluated on larger models? Generally, larger MLLMs exhibit more robust visual understanding.

3. "On Evaluating Adversarial Robustness of Large Vision-Language Models" is likely the first work investigating the adversarial robustness of MLLMs. Could this method be used as a baseline?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730688727386

thread_type:
official_review

<thread_object>
creator: reviewer_knuv

<content>
summary:
The paper investigate the threat of cross-MLLMs adversarial transferability. The paper proposes a boosting method, TATM, leveraging the strength of information diversity involved in the adversarial generation process and editing across the modality information.

strengths:
1. The paper provides comprehensive evaluation on various surrogate model architectures, such as BLIP2, InstructBLIP, LLaVA, MiniGPT4. 

2. Provides different attack baselines, which makes the evaluation stronger. 

3. The paper is easy to understand.

weaknesses:
1. Does the proposed attack method resistant to the defense mechanism? Are there any analysis or the defense baselines evaluation?

2. The selected tasks are generation-based tasks. Will the attack also works on the classification tasks?

questions:
Please check the weakness
</content>
</thread_object>

</thread>
<thread>
creation date:
1733069046870

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
We sincerely appreciate the hard work of all reviewers and their valuable suggestions provided for our paper. Based on the precise review comments, we have updated the main PDF. We kindly look forward to reviewers' further feedback. Very grateful to each reviewer once again!
</content>
</thread_object>

</thread>
<thread>
creation date:
1733152075329

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
We deeply appreciate the reviewers' dedicated efforts!  According to each reviewer's valuable suggestions, we have made significant improvements to the writing details, paragraph formatting, content organization, and image visualizations in the main PDF. We still hope the updated version addresses your concerns to some extent. If there are any further questions, we welcome additional discussions. Thank all reviewers once more!
</content>
</thread_object>

</thread>


Metareview: