$\texttt{MirrorCheck}$ : Efficient Adversarial Defense for Vision-Language Models

Authors: Samar Fares, Klea Ziu, Toluwani Aremu, Nikita Durasov, Martin Takáč, Pascal Fua, Karthik Nandakumar, Ivan Laptev
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Adversarial Attacks, Adversarial Defenses, Vision-Language Models, StableDiffusion

Abstract:
Vision-Language Models (VLMs) are becoming increasingly vulnerable to adversarial attacks as various novel attack strategies are being proposed against these models. While existing defenses excel in unimodal contexts, they currently fall short in safeguarding VLMs against adversarial threats. To mitigate this vulnerability, we propose a novel, yet elegantly simple approach for detecting adversarial samples in VLMs. Our method leverages Text-to-Image (T2I) models to generate images based on captions produced by target VLMs. Subsequently, we calculate the similarities of the embeddings of both input and generated images in the feature space to identify adversarial samples. Empirical evaluations conducted on different datasets validate the efficacy of our approach, outperforming baseline methods adapted from image classification domains. Furthermore, we extend our methodology to classification tasks, showcasing its adaptability and model-agnostic nature. Empirical findings also show the resilience of our approach against adaptive attacks, positioning it as an excellent defense mechanism for real-world deployment against adversarial threats.

Decision: reject
Reviewer scores: 6, 6, 5, 5

Reviews and discussion:
<thread>
creation date:
1729741115674

thread_type:
official_review

<thread_object>
creator: reviewer_qvv1

<content>
summary:
This paper focuses on detecting adversarial examples targeting Vision-Language Models (VLMs) by introducing a method called MirrorCheck. MirrorCheck uses an additional Text-to-Image (T2I) model and a CLIP image encoder to identify adversarial inputs. For any input to a VLM, the T2I model generates an image based on the VLM's output, and the CLIP image encoder extracts embeddings to compute a similarity score between the generated and original images. A significant difference in similarity indicates a potential adversarial example. The method is simple yet technically sound, and experiments with various VLMs, T2I models, and CLIP encoders confirm its effectiveness.

strengths:
- Although the idea behind the method is simple, it is technically sound. The core concept is that adversarial examples tend to cause VLMs to generate text that deviates from the content of the original image. As a result, the T2I model's generated image will also deviate, leading to large differences in similarity scores between the generated and original images.
- While adversarial training is a popular defense method, it is costly, difficult to scale for large models, and faces trade-offs between robustness and accuracy. In contrast, detecting adversarial examples offers a cost-effective defense by rejecting malicious queries. MirrorCheck, the proposed detection method, is specifically designed for VLMs.
- The method is evaluated under a realistic black-box threat model, where the adversary can only query the victim model without access to gradient information, making it practical for real-world scenarios. Additionally, experiments were conducted using a white-box threat model to push the method to its limits. The evaluation setup and findings are well-appreciated.

weaknesses:
- The core motivation behind MirrorCheck is that adversarial examples typically cause VLMs to generate content that deviates from the main image. However, adversaries could potentially manipulate the VLM to produce content that is aligned, or at least partially aligned, with the image. In such cases, MirrorCheck might fail to detect the adversarial example. For instance, consider Figure 2, where the adversary's target text is "A leopard laying down on a rock next to a field ...", followed by harmful or misleading texts. If the adversary uses a targeted attack to craft an adversarial example that closely aligns with the original image (except for the harmful text), how would the similarity scores behave? To what extent could this reduce MirrorCheck's detection effectiveness? This scenario raises concerns about MirrorCheck's robustness when handling adversarial attacks that maintain a degree of semantic consistency with the image. This type of targeted attack is examined in this work [1]. 

- The Average Similarity Scores in Table 1 alone do not fully capture MirrorCheck’s detection performance. While they show a general pattern of deviation between clean and adversarial examples, they do not clearly demonstrate whether MirrorCheck can reliably differentiate between them. In Table 3, the minimum similarity score for clean versus adversarial examples is on the same level, and a similar pattern is observed for the maximum scores, further obscuring the distinction. I recommend that the authors plot the distribution of similarity scores to better illustrate the detection performance. 

- The detection accuracy, TPR, and FPR presented in Tables 2 and 4 are influenced by the ratio of adversarial and clean examples. However, this ratio is not explicitly mentioned in the paper. In real-world scenarios, adversarial queries are typically rare. I suggest conducting an ablation study that examines detection performance under varying ratios of adversarial examples. Starting with a balanced 50%-50% to 99.9%-0.1%

- Line 371 stated that the threshold $\tau$ is based on optimized performance. In practical settings, it is very unlikely that the optimal hyperparameters can be found. The similarity scores could vary depending on the validation set, attack used, and CLIP image encoder. I suggest also including the area under the ROC curve and Precision-Recall curve. 

- Following the setting in the adaptive attack study, line 485, the adversarial examples can still be detected by other encoders. This could be the result of the adversarial example not transferable to other encoders. What if the adversary improves the transferability by using an ensemble of other encoders?

- There are relevant detection baselines [2-4] and related adversarial attacks [1, 5, 6] that are not examined in the paper. 

- Line 098 claims that MirrorCheck does not require training. This could be misleading. T2I models and CLIP encoders are part of the defense that does require training. 

- Lines 177 - 182 suggest that existing defenses do not consider multi-modal settings. However, several works [7-9] have proposed adversarial training for the multi-modal setting. 

---

[1] Schlarmann, C., & Hein, M. (2023). On the adversarial robustness of multi-modal foundation models. In Proceedings of the IEEE/CVF International Conference on Computer Vision(pp. 3677-3685).\
[2] Lee, K., Lee, K., Lee, H., & Shin, J. (2018). A simple unified framework for detecting out-of-distribution samples and adversarial attacks. Advances in neural information processing systems, 31.\
[3] Ma, X., Li, B., Wang, Y., Erfani, S. M., Wijewickrema, S., Schoenebeck, G., ... & Bailey, J. (2018). Characterizing Adversarial Subspaces Using Local Intrinsic Dimensionality. In International Conference on Learning Representations.\
[4] Cohen, G., Sapiro, G., & Giryes, R. (2020). Detecting adversarial samples using influence functions and nearest neighbors. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition (pp. 14453-14462).\
[5] Bailey, L., Ong, E., Russell, S., & Emmons, S. (2023). Image hijacks: Adversarial images can control generative models at runtime. arXiv preprint arXiv:2309.00236.\
[6] Dong, Y., Chen, H., Chen, J., Fang, Z., Yang, X., Zhang, Y., ... & Zhu, J. (2023). How Robust is Google's Bard to Adversarial Image Attacks?. arXiv preprint arXiv:2309.11751.\
[7] Mao, C., Geng, S., Yang, J., Wang, X., & Vondrick, C. (2023). Understanding Zero-shot Adversarial Robustness for Large-Scale Models. In The Eleventh International Conference on Learning Representations.\
[8] Schlarmann, C., Singh, N. D., Croce, F., & Hein, M. (2024). Robust CLIP: Unsupervised Adversarial Fine-Tuning of Vision Embeddings for Robust Large Vision-Language Models. In Forty-first International Conference on Machine Learning.\
[9] Wang, S., Zhang, J., Yuan, Z., & Shan, S. (2024). Pre-trained model guided fine-tuning for zero-shot adversarial robustness. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (pp. 24502-24511).

questions:
- Line 158-160, the certified defense methods can guarantee robustness. What does it mean by the struggle to generalize to novel attack strategies? 
- Line 253, experiments are conducted with 100 or 1000 randomly selected images; why not use the full dataset for evaluation? And which experiments are using 100 and which are using 1000? 
- Line 258-260, I believe the PGD requires a gradient for optimization of the attack vector; how is this used for 100 queries and 8-step PGD with an estimated gradient?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730279983578

thread_type:
official_review

<thread_object>
creator: reviewer_rqhj

<content>
summary:
This paper presents a simple adversarial sample detection method called MirrorChecker, which detects adversarial samples by comparing the embedding similarity between reconstructed adversarial samples and clean samples. Specifically, given an adversarial sample, the method first uses a pre-trained multimodal model to generate a caption for the image and then employs a diffusion model to reconstruct the image based on that caption. Finally, it assesses the similarity between the reconstructed image and the clean image to detect malicious adversarial samples. The paper validates the effectiveness of the proposed defense method across multiple models.

strengths:
- The writing is clear.
- Detecting adversarial samples in multimodal models is an interesting research topic.

weaknesses:
- **Unclear Threat Model:** In section 3.1, the authors focus on targeted attacks (lines 199-200), but this assumption is unclear. It is recommended that the authors address a broader range of attack scenarios, including patch attacks and untargeted attacks. Specifically, how might untargeted attacks affect the performance of the proposed detection method?

- **Lack of Defender Capability:** The paper does not provide sufficient detail about the defender's capabilities and the practical feasibility of the proposed defense. A key concern is how the defender obtains the clean samples needed for comparison. In other words, if clean images are not required, how does the defense work? The authors should clarify how this affects the real-world applicability of their approach.

- **No Support for Theoretical Analyses:** The authors claim to provide theoretical analyses in the abstract (line 22); however, a review of the paper reveals no such analyses. If these analyses are not present, the authors should explain why this claim is made.

- **Insufficient Robustness Against Adaptive Attacks:** The robustness of the proposed defense method against adaptive attacks needs further analysis. For example, if attackers are aware of this defense mechanism, they may modify the adversarial images to minimize the distance to the clean images. Would this enable them to evade the proposed detection? The authors should consider stronger adaptive attacks and provide corresponding defense results.

- **Defense Results on Out-of-Distribution Data:** It is unclear how the proposed method detects adversarial samples when applied to out-of-distribution (OOD) data, particularly across multiple domains. The authors should provide either experimental results or a theoretical discussion on the performance of their method when dealing with OOD samples from various domains.

- **Lack of Comparison with Advanced Defense Baselines:** A comparison with advanced baselines, such as DiffPure [1], would strengthen the paper. DiffPure uses a diffusion model to remove adversarial noise and detects adversarial samples by assessing the prediction differences between cleaned samples and the original adversarial samples. The detection process of DiffPure seems more straightforward and efficient than the proposed method. The authors should provide a quantitative comparison on a common dataset, focusing on both detection accuracy and computational efficiency. This would help highlight the strengths of their method over existing baselines.

[1] Diffusion models for adversarial purification, ICML, 2022

questions:
see weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730341586057

thread_type:
official_review

<thread_object>
creator: reviewer_fghl

<content>
summary:
The paper proposes MirrorCheck, a novel method for detecting adversarial samples in Vision-Language Models (VLMs). It leverages a Text-to-Image (T2I) model to generate an image based on the caption produced by the victim model and then compares the embeddings of the input and generated images. The method is evaluated on different datasets and tasks, showing its effectiveness and superiority over baseline methods. It also demonstrates robustness against adaptive attacks and adaptability to different T2I models and image encoders.

strengths:
- **Originality**: The idea of using a T2I model to generate images for adversarial sample detection in VLMs is novel. It provides a new perspective and approach compared to existing defenses.
- **Quality**: The experiments are well-designed and conducted. The use of multiple datasets, victim models, T2I models, and image encoders shows the robustness and generality of the method. The results are presented clearly and support the claims made in the paper.
- **Clarity**: The paper is well-written and organized. The introduction provides a clear motivation for the work, the method description is detailed and understandable, and the experimental results are presented in a logical manner.
- **Significance**: The proposed method has significant implications for the security and reliability of VLMs. It addresses an important problem of adversarial attacks and provides a practical solution that can be applied in real-world scenarios.

weaknesses:
- The effectiveness of MirrorCheck depends on the quality of the pretrained generative model used. Any shortcomings in the generative model can directly impact the performance of the method. This limitation could be further explored and addressed.
- The paper could provide more in-depth analysis of the theoretical aspects of the method. For example, a more detailed explanation of why the image-image similarity approach works better than directly comparing the input image with the generated caption could be beneficial.

questions:
- How can the method be further improved to handle cases where the pretrained generative model is of poor quality?
- Can the authors provide more insights into the theoretical foundation of the image-image similarity approach?
- Are there any potential limitations or challenges in applying MirrorCheck to other types of multimodal models or tasks?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730837960136

thread_type:
official_review

<thread_object>
creator: reviewer_mrfp

<content>
summary:
The paper addresses the problem of adversarial defense for Vision-Language Models (VLMs). The paper proposes a simple and elegant method called MIRRORCHECK to detect adversarial samples. The method utilizes Text-to-Image (T2I) models to generate images based on captions produced by target VLMs. Then, the similarities of the embeddings of both input and generated images in the feature space are leveraged to identify adversarial samples. Extensive experiments are conducted to demonstrate the effectiveness of proposed method.

strengths:
The proposed method is simple and elegant. It leverages Text-to-Image models to generate images based on captions produced by target VLMs. Then, the similarities of the embeddings of both input and generated images in the feature space are used to identify the adversarial samples.

The paper conducts sufficient experiments to demonstrate the advantages of proposed method. Specifically, the experiments are conducted on five victim models. More Text-to-Image models and pretrained image encoders are tested in the ablation studies.

The paper is well-written. For example, there is a section in Method to describe the threat model.

weaknesses:
It is better to introduce how to choose hyperparameter \tau (decision threshold in line 217), especially the relation between \tau and text-to-images models (or pretrained image encoders).

The experiments are conducted against targeted attacks. How about untargeted attacks?

In Section 3.1, the paper writes "the attacker's objectives are to execute targeted attacks". If the attack performance of used attack method is low, will the proposed method still work?

There are some typos. For example, "Tables 1 and 3 presents" should be "Tables 1 and 3 present" in line 312.

questions:
Though the paper conducts ablation study to explore the influence of different Text-to-Image (T2I) models and pretrained image encoders, is it possible to provide some information of T2I models such as classification accuracy and training mechanism to explain the relation between detection results and text-to-image models?
</content>
</thread_object>

</thread>
<thread>
creation date:
1732296562005

thread_type:
official_comment

<thread_object>
creator: authors

<content>
comment:
We would like to sincerely thank the reviewers for their thoughtful feedback. Your constructive insights have helped in enhancing the quality of our work, and we believe our paper is now significantly stronger. Below, we summarize our contributions and highlight the new additions to our work:

- **MirrorCheck Proposal:** We introduce *MirrorCheck* to detect and combat adversarial images targeting Vision-Language Models (VLMs). Our pipeline is model-agnostic and requires no additional training, leveraging pretrained models for this purpose.
  
- **Robustness to Untargeted Attacks:** While our initial focus was on targeted attacks against victim VLMs, we have shown that our pipeline is also robust to untargeted attacks. Furthermore, *MirrorCheck* can be applied to other domains, including classification and jailbreaking, showcasing its versatility.

- **Defense Against Adaptive Attacks:** We rigorously evaluate the strength of our defense against various strengths of adaptive attacks, ranging from grey-box to white-box scenarios, which represent the strongest forms of adversarial threats.

We will now proceed to address the specific questions and concerns raised by the reviewers. We will be adding all of these improvements to the final version of the paper. Once again, we deeply appreciate your valuable feedback and the opportunity to improve our work.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732647623239

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Revised Manuscript

comment:
Dear Reviewers,

We deeply appreciate the time and effort you have dedicated to reviewing our paper and providing your valuable feedback.

We have carefully addressed each of your comments and provided detailed responses to resolve the concerns raised. These revisions have been incorporated into the manuscript, with the changes highlighted in blue for your convenience.

We kindly invite you to review the updated manuscript, and if you feel we have satisfactorily addressed your concerns, we would be grateful if you could consider re-evaluating your rating.

If there are any additional questions or aspects requiring further clarification, please do not hesitate to let us know. We are more than happy to provide further explanations while the discussion period remains open.

Thank you once again for your thoughtful and constructive feedback!
</content>
</thread_object>

</thread>
<thread>
creation date:
1733241863266

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Thank you!

comment:
Dear Reviewers,

We sincerely thank you for taking the time to review our submission. We deeply appreciate your efforts in evaluating our work and providing valuable feedback.

Our method's novelty and potential benefits to the community are substantial. We hope you will consider the contributions it offers in advancing VLMs security.

Your thoughtful insights and perspectives are invaluable to refining and improving our work, and we are grateful for your dedication to the peer review.

Best,

Authors
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper proposes a novel method to detect adversarial examples against vision-language models. The method adopts text-to-image models to generate images based on the captions produced by the target VLMs. Then the method calculates the feature similarities between the input image and generated image to identify adversarial examples. Experimental results show the effectiveness of the proposed method.

Overall, the idea is intuitive and novel. Utilizing a pre-trained text-to-image model to detect adversarial examples for vision-language models is interesting and is tailored for vision-language models rather than general defenses. The writing is good.

However, one major limitation of the method is its robustness under adaptive attacks. This issue has been raised by multiple reviewers and the authors have provided additional experiments to show the performance of adaptive attacks. After careful examination and discussion with reviewers, there are still some concerns.

- The authors has shown the results of attacking few CLIP encoders and using others to detect adversarial examples. This is **not** the white-box setting where the attackers can have access to all the defense details. So, using other CLIP models cannot prove the robustness of the method under strong adaptive attacks.

- Indeed, the authors also provided the results of attacking an ensemble of five CLIP encoders and using the same set of models for detection. However, the details on how to perform optimization on the adaptive attack problem are not clear. So, it is questionable whether the attack is strong enough to generate adversarial examples for the ensemble models.

As this paper has borderline rating with two borderline accept recommendations and two borderline reject recommendations, the AC thinks that this paper falls short of the ICLR acceptance threshold and can be further improved by carefully addressing more diverse attacks and adaptive attacks. Therefore, the AC would recommend rejection.