Improving Adversarial Transferability in MLLMs via Dynamic Vision-Language Alignment Attack

Authors: Chenhe Gu, Jindong Gu, Andong Hua, Yao Qin
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Adversarial Attack, Adversarial Transferability, Multimodal Large Language model, Multimodal Large Language Model Robustness

Abstract:
Multimodal Large Language Models (MLLMs), built upon LLMs, have recently gained attention for their capabilities in image recognition and understanding. However, while MLLMs are vulnerable to adversarial attacks, the transferability of these attacks across different models remains limited, especially under targeted attack setting. Existing methods primarily focus on vision-specific perturbations but struggle with the complex nature of vision-language modality alignment. In this work, we introduce the Dynamic Vision-Language Alignment (DynVLA) Attack, a novel approach that injects dynamic perturbations into the vision-language connector to enhance generalization across diverse vision-language alignment of different models. Our experimental results show that DynVLA significantly improves the transferability of adversarial examples across various MLLMs, including BLIP2, InstructBLIP, MiniGPT4, LLaVA, and closed-source models such as Gemini.

Decision: reject
Reviewer scores: 5, 3, 3, 5

Reviews and discussion:
<thread>
creation date:
1730516269494

thread_type:
official_review

<thread_object>
creator: reviewer_np2j

<content>
summary:
Multimodal Large Language Models (MLLMs) are susceptible to adversarial attacks, but the transferability of these attacks across different models is still limited. While current methods primarily target vision-specific perturbations, this paper focuses on attacking the vision-language modality alignment. Specifically, the authors propose DynVLA. a novel approach that injects dynamic perturbations into the vision-language connector. Experimental results demonstrate that DynVLA effectively transfers adversarial examples across Q-Former models.

strengths:
1.	This paper studies the transferability of adversarial examples in attacking MLLMs, which is important and practical.
2.	This paper proposes a novel approach, DynVLA, which generates adversarial examples by targeting vision-language alignment rather than solely vision-specific perturbations.
3.	The experiments with both open- and closed-source models and different tasks (i.e., classification, captioning, VQA) provides a comprehensive evaluation of the method’s applicability.

weaknesses:
1.	The authors' main claim about the transferability of DynVLA is not well-supported. According to the experimental results, the adversarial examples are mainly effective for models with the Q-former architecture (i.e., BLIP2, InstructBLIP, and MiniGPT4), but show limited success with other architectures (i.e., LLaVA and Gemini). This undermines the paper's key contribution regarding the transferability of adversarial examples.
2.	This paper does not convincingly demonstrate that DynVLA primarily targets vision-language modality alignment. The adversarial examples produced by DynVLA also include perturbations on the original image, which could potentially attack the vision encoder rather than the vision-language alignment in MLLMs. The authors could conduct additional experiments to verify this. For instance, they could randomly generate noise with the same bit size as the noise created by DynVLA and compare the ASR of these two perturbations.
3.	The experiments do not compare with the latest and most advanced baselines. As mentioned in the paper, both [1] and [2] have explored transferring adversarial examples across different models. However, three of the four baselines in this study were published before 2020. Why did the authors select these older baselines while overlooking the latest methods in this field? They should include more empirical comparisons with these existing works.

Reference

[1] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36, 2024.

[2] Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models. arXiv preprint arXiv:2403.09766, 2024.

questions:
1.	There are 4 baselines in the experiments. What does “baseline” refer in Table 1,2 and 3?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730540541492

thread_type:
official_review

<thread_object>
creator: reviewer_sroa

<content>
summary:
This paper introduces a Dynamic Vision-Language Alignment Attack (DynVLA) to enhance the adversarial robustness of Multi-Modal Large Language Models (MLLMs) by addressing the interaction between visual and textual modalities. Existing baseline attack methods typically generate adversarial samples based on a single type of vision-language alignment, leading to low transferability across different models. DynVLA dynamically perturbs the attention mechanism applied to visual tokens to improve interactions between visual and textual information, resulting in more diverse adversarial samples. Specifically, it employs a Gaussian kernel to smoothly adjust the model's attention distribution, allowing for more precise perturbations of specific regions in the visual input. Experimental results demonstrate that DynVLA outperforms traditional methods across multiple benchmark datasets.

strengths:
(1) Introduces a novel attack method, DynVLA, which dynamically adjusts vision-language interactions, improving on traditional adversarial strategies.
(2) Well-founded methodology based on established adversarial techniques. And Gaussian smoothing adds refinement.
(3) Generally clear structure, though some mathematical sections could be improved with more detailed explanations.
(4 ) Addresses a critical gap in MLLM robustness, with potential implications for multi-modal AI security.

weaknesses:
(1) While DynVLA introduces a dynamic perturbation approach, the core methodology remains relatively straightforward and does not offer groundbreaking innovations compared to existing techniques.
Dependency on White-Box Models:
(2) The effectiveness of DynVLA hinges on having access to the internal structure of the model being attacked. The method's applicability diminishes significantly for black-box models or those where internal mechanisms are inaccessible. This limitation restricts the method's utility in real-world scenarios where such access is often unavailable.
(3) The decision to use "unknown" as the targeted output raises concerns regarding its relevance. This output is not representative of typical outputs from MLLMs, making it questionable whether the attack accurately simulates realistic adversarial conditions. A more grounded target could enhance the validity of the results and provide clearer insights into the method's practical effectiveness.
(4) The experiments primarily focus on specific datasets, which may not reflect the broader applicability of the method. Expanding the experimental framework to include diverse datasets and model architectures would strengthen the findings and validate the robustness of the approach.

questions:
See weakness.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730685457589

thread_type:
official_review

<thread_object>
creator: reviewer_1ytz

<content>
summary:
This paper proposes DynVLA, an adversarial attack method that adds Gaussian kernels to the attention map of vision-language connectors, and evaluates it on sufficient models.

strengths:
1. The paper was evaluated on many models, including BLIP-2, InstructBLIP, MiniGPT, and LLaVa.

2. The writing of the paper is clear.

weaknesses:
1. Line 102 says "DynVLA does not require any prior knowledge of the model", I think this sentence is overblown. In Tables 1, 2, and 3, the authors all perform transfer attacks on LVLMs with very similar structures, including BLIP-2, InstructBLIP, and MiniGPT. Their vision-language connectors are all Q-formers. this can hardly be claimed to be without any a priori knowledge of the model. If indeed no a priori knowledge of any model is required, the authors should use their method to attack structurally different models, such as GPT-4, etc., or at least LLaVA.

2. The results are poor. The authors perform transfer attacks in Tables 1, 2 and 3 only in a few LVLMs that use Q-former as a vision-language connector, including BLIP-2, InstructBLIP, and MiniGPT. There seems to be a large improvement from the table (which will be continued to the question in point 3), but once transfer attacks are performed on the other models, such as the LLaVA in Table 4, the performance improvement is only 1%, and even 0.1% on V1.6-LLaMA3 (the authors chose 1000 images as dataset, that is only 1 successful attack). 

3. The improvements in Tables 1-3 may be unfair. It is well known that adversarial attacks are very easy to overfit, leading to poorer transferability. The authors used a PGD attack with an extremely large T = 2000 steps (line 296). This leads to severe overfitting, which leads to poor attack transferability. In a way, the authors' approach is more like a regularisation that prevents overfitting, so why not compare it with some similar approaches, and some of the already existing methods for improving the transferability of adversarial attacks？Such as MI [1], DI [2], SGA [3], CroPA [4], etc. 

[1] Boosting adversarial attacks with momentum, CVPR 2018.
[2] Improving transferability of adversarial examples with input diversity, CVPR 2019.
[3] Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models, ICCV 2023.
[4] An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models, ICLR 2024.

4. Overstatement. line 458-460 says "We evaluate the adversarial examples generated by InstructBLIP models on Gemini, ......, these samples on closed-source models like Gemini have never been reported by other works." However, Attack-Bard [5] successfully attacked Google-Bard (a previous version of Gemini) by using a series of boosts to adversarial transferability on models such as InstructBLIP. It also works much better than the author's method.

[5] How Robust is Google’s Bard to Adversarial Image Attacks? NeurIPS 2023 Workshop on Robustness of Few-shot and Zero-shot Learning in Foundation Models

5. Lack of necessary ablation experiments. The authors should have at least demonstrated the adversarial transferability in a conventional PGD attack setup (not T=2000 steps) and compared it with classical adversarial attack methods. The existing ablation experiments are not sufficient.

questions:
See weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730686381728

thread_type:
official_review

<thread_object>
creator: reviewer_7vlz

<content>
summary:
This paper proposes a novel approach to inject dynamic perturbations into the vision-language connector to enhance vision-language alignment of different models. It adds a Gaussian Kernel to the attention map to force the model focus on a specific area. The experimental results indicate the effectiveness of the proposed attack.

strengths:
1.The paper is well written.

2. The paper provides comprehensive evaluation on different model architectures, such as BLIP2, MINIGPT4, InstructBLIP, LLaVA associated with different surrogate model.

weaknesses:
1. DynVLA adds a Gaussian kernel to the attention map, will it change the forward process? For example, in a standard forward process, there is no Gaussian kernel. In proposed attack, with the Gaussian kernel, it achieves good attack performance. However, if the users use the provided model, it would be easily observed due to the unusual forward pass. It will hurt the attack’s stealthies. 

2. Some analysis regarding the defense mechanism would be good. For example, will the attack resistant to the defense?
3. For the examples given in Figure4, it seems the attack makes the outputs contains word “unknown

questions:
Please check the weakness
</content>
</thread_object>

</thread>


Metareview: