One Perturbation is Enough: On Generating Universal Adversarial Perturbations against Vision-Language Pre-training Models

Authors: Hao Fang, Jiawei Kong, Wenbo Yu, Bin Chen, Jiawei Li, Hao Wu, Shu-Tao Xia, Ke Xu
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Universal Adversarial Attacks, Vision-Language Pretraining Models, Generative Attacks

Abstract:
Vision-Language Pre-training (VLP) models have exhibited unprecedented capability in many applications by taking full advantage of the multimodal alignment. However, previous studies have shown they are vulnerable to maliciously crafted adversarial samples. Despite recent success, these methods are generally instance-specific and require generating perturbations for each input sample. In this paper, we reveal that VLP models are also vulnerable to the instance-agnostic universal adversarial perturbation (UAP). Specifically, we design a novel Contrastive-training Perturbation Generator with Cross-modal conditions (C-PGC) to achieve the attack. In light that the pivotal multimodal alignment is achieved through the advanced contrastive learning technique, we devise to turn this powerful weapon against themselves, i.e., employ a malicious version of contrastive learning to train the C-PGC based on our carefully crafted positive and negative image-text pairs for essentially destroying the alignment relationship learned by VLP models. Besides, C-PGC fully utilizes the characteristics of Vision-and-Language (V+L) scenarios by incorporating both unimodal and cross-modal information as effective guidance. Extensive experiments show that C-PGC successfully forces adversarial samples to move away from their original area in the VLP model's feature space, thus essentially enhancing attacks across various victim models and V+L tasks.

Decision: reject
Reviewer scores: 3, 6, 5, 6

Reviews and discussion:
<thread>
creation date:
1729325842326

thread_type:
official_review

<thread_object>
creator: reviewer_4nrc

<content>
summary:
This paper introduces a universal adversarial attack method called C-PGC for VLP models. By leveraging contrastive learning mechanisms within VLP models, C-PGC generates UAP that can effectively attack across different tasks and models without requiring individual perturbations for each input. Experiments demonstrate that C-PGC disrupts image-text feature alignment efficiently in both white-box and black-box settings, outperforming existing attack methods.

strengths:
1.	The writing is clear. The formulas are correct.
2.	The experiment is abundant and multi-dimensional.
3.	The research topic is important for VLM.

weaknesses:
1. The generator-based UAP method is time-consuming due to its indirect optimization approach, as it does not directly update the UAP.
2. In multimodal contrastive loss, randomly selecting texts or images may not be ideal. Instead, selecting items related to the current image-text pair in the batch could improve the performance.
3. The method uses the default settings of SGA in the experiment (i.e., resizing the original images into five scales {0.5, 0.75, 1, 1.25, 1.5} and applying Gaussian noise with a mean of 0 and a standard deviation of 0.5). It would be beneficial to give an explanation of the effect of such augmentation, with the experiment result being better.

questions:
Please see weakness
</content>
</thread_object>

</thread>
<thread>
creation date:
1729519728100

thread_type:
official_review

<thread_object>
creator: reviewer_u4zg

<content>
summary:
The paper presents a novel framework, C-PGC, designed to generate Universal Adversarial Perturbations (UAPs) targeting Vision-Language Pretraining (VLP) models. The authors introduce a cross-modal conditional perturbation generator, which leverages both single-modal and cross-modal features to disrupt the learned alignment between visual and textual representations in VLP models.

strengths:
The writing style of the paper is commendably clear and concise, making it accessible to a broad audience within the machine learning and computer vision communities. The authors have taken care to present the technical details in a manner that is straightforward and easy to follow, even for readers who may not be deeply familiar with adversarial attacks or VLMs. The method’s components are explained in a way that balances technical rigor with simplicity. This makes the paper highly readable and ensures that a wide range of researchers and practitioners can engage with its contributions.

The experimental results demonstrate that the proposed C-PGC framework performs well across several benchmarks. The authors have conducted comprehensive experiments on multiple well-established datasets and across various VLP models. The results show consistent improvements in attack success rates (ASR) across both white-box and black-box settings.

weaknesses:
The paper, while strong overall, has several areas for improvement:

1. **Use of Contrastive Loss**  
   The inclusion of contrastive loss (\(\mathcal{L}_{CL}\)) feels somewhat forced. Since the goal is to perform untargeted attacks, it seems unnecessary to rely on contrastive loss, which is typically used to enforce alignment between representations. While the authors have shown its utility through ablation studies, the logical foundation of using contrastive loss in an untargeted setting remains unclear. The paper could be improved by either rethinking the rationale behind using \(\mathcal{L}_{CL}\) or exploring alternative loss functions better suited for untargeted attacks.

2. **Choice of Positive and Negative Samples for Contrastive Loss**  
   The current method of manually selecting the farthest sample as the positive or negative example feels arbitrary and unnecessarily complex. In the context of untargeted attacks, where the objective is not to make the adversarial sample resemble a specific class, it would make more sense to introduce a synthetic, "fictitious" sample that maximally deviates from the original, rather than relying on the farthest feature-distance sample. This approach could simplify the process and make the use of contrastive loss more coherent in the untargeted setting.

3. **Limited Comparison with State-of-the-Art**  
   The comparison of the proposed method only with GAP, a 2018 work, limits the scope of the evaluation. Given the rapid advancements in adversarial attack methods, comparing against more recent techniques would provide a clearer picture of the method’s competitiveness. For example, comparing with more contemporary adversarial generation methods would strengthen the experimental section and make the results more relevant to current research.

4. **Visual Design of the Framework Diagram**  
   The framework diagram could benefit from improved design and color harmony. While this is a minor issue, it affects the overall presentation quality. The authors could refer to well-designed diagrams from recent top-tier papers to make the visualizations clearer and more appealing.

These adjustments would enhance the logical foundation of the method and improve both the clarity and relevance of the experimental comparisons.

Post-Rebuttal:

The main issue lies in the fact that the authors' response fails to address my concerns regarding the use of Contrastive Loss in the paper. The goal of the paper is to construct untargeted adversarial attacks, yet the authors manually select negative samples to construct the Contrastive Loss, which is problematic. If we follow the authors' stated motivation that "destruction is easier than construction," the approach should involve maximizing the Contrastive Loss during normal training, rather than manually selecting negative samples to minimize it. For these reasons, I am inclined to maintain my current rating.

questions:
Please refer to the **Weaknesses** section. If the authors can address these issues, I would be willing to raise my score.

1. **Use of Contrastive Loss** 
Perhaps the authors could offer a more detailed explanation of their rationale for using contrastive loss in this context and discuss potential alternative loss functions they considered, as well as why contrastive loss was ultimately chosen despite its typical use in alignment tasks.

2.  **Choice of Positive and Negative Samples for Contrastive Loss**  
Introducing a synthetic, "fictitious" sample that maximally deviates from the original, is a more direct way. Perhaps the authors could discuss the trade-offs between their current approach and your suggested method.

3. **Limited Comparison with State-of-the-Art**  
The authors could select 2-3 recent and relevant adversarial attack methods from related work for comparison.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730432379103

thread_type:
official_review

<thread_object>
creator: reviewer_aoyq

<content>
summary:
This paper addresses the vulnerability of Vision-Language Pre-training (VLP) models to universal adversarial perturbations, which are instance-agnostic and do not require individual perturbations for each input. The authors introduce a novel attack method, the Contrastive-training Perturbation Generator with Cross-modal conditions (C-PGC), which leverages contrastive learning to disrupt the multimodal alignment in VLP models. Experiments are conducted across multiple VLP models and tasks.

strengths:
1. The proposed UAP framework addresses the inefficiencies of instance-specific attacks by incorporating cross-modal and unimodal guidance within a contrastive training setup, representing an advancement in universal adversarial attack methods.

2. The paper thoroughly evaluates C-PGC's effectiveness across multiple VLP models and downstream tasks, and additionally analyzes various defense strategies to mitigate the potential risks posed by C-PGC.

weaknesses:
The proposed method leverages image and text attacks alongside cross-modal contrastive learning to generate universal adversarial perturbations. While this approach shows promise, the novelty may not be fully evident. I recommend that the authors consider further highlighting and reorganizing the unique contributions of the paper to enhance its clarity and impact.

questions:
1. In the text modality attack, how do the authors maintain semantic similarity between original and adversarial texts? In the experiments, the authors should provide the similarity scores (e.g. bert_score) between original and adversarial texts to demonstrate that the modifications do not significantly alter the text's semantics.

2. The authors should explain how ASR is calculated in the main text.

3. As shown in Figure 4, the adversarial texts exhibit a clear semantic gap from the original texts. Thus, would using special characters (e.g. ##*) for the universal adversarial word be more effective?


4. The authors propose a contrastive training perturbation generator to produce universal adversarial perturbations for images and text. I am curious about how this generator differs from general UAP methods (e.g. Data-free Universal Adversarial Perturbation and Black-box Attack ), justifying its designation as a "generator."

I look forward to your detailed response.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730532050880

thread_type:
official_review

<thread_object>
creator: reviewer_jjkc

<content>
summary:
This paper proposes a method to learn universal perturbations that can transfer across different Vision-Language Pre-training (VLP) models and downstream tasks. The authors leverage contrastive loss to disrupt cross-model interactions and use a Euclidean distance-based loss to maximize the distance between adversarial data and the original data. Experimental results show that the proposed method achieves strong attack performance on various VLP models and downstream tasks.

strengths:
1. The paper focuses on an important task of evaluating robustness of VLP models.
2. Both adversarial images and texts are learned.

weaknesses:
Several concerns remain:
1. Motivation: 
- In the abstract, the authors claim to "fully utilize the characteristics of Vision-and-Language (V+L) scenarios by incorporating both unimodal and cross-modal information." However, the authors do not seem to fully exploit the characteristics of different V+L scenarios or tasks.
- In the introduction, Figure 1 compares two methods and claims that "the generator-based approach GAP consistently achieves superior ASR compared to UAP." Since UAP uses the DeepFool method to learn perturbations, its inferior performance compared to a generator-based approach does not necessarily demonstrate the superiority of the generator-based method over other approaches, e.g., PGD. More experiments including comparisons with other strong baselines like PGD, or a more comprehensive analysis of why generator-based methods are required to support this claim.
2. Algorithm: 
a: My biggest concerns are the definition of universal perturbation learning and adversarial text learning.
- The authors use generators to produce adversarial data based on cross-modal conditions. The main advantage of universal adversarial attacks is their ability to produce perturbations that are generalizable across all data without needing to generate sample-specific perturbations, thereby improving efficiency. In other words, universal perturbations should be independent of the test data and applicable to unseen data. However, relying on cross-modal conditions appears to conflict with this objective. If cross-modal conditions are required, why not generate sample-specific perturbations instead? The authors need to clarify how to maintain the universality of the perturbations without using cross-modal conditions.  Additionally, the authors should report results of universal attacks for more scenarios, e.g., using perturbations generated on the Flickr30k dataset to attack models on the MSCOCO dataset.
- Learning adversarial text perturbations requires ensuring that they do not compromise the quality of original texts. However, the authors did not address this, rendering the algorithm impractical. Further verifications are required, such as utilizing proposing metrics to evaluate the semantic consistency of perturbed texts or discussing potential methods to constrain the text perturbations to maintain readability and coherence.
b. In addition, the authors utilize contrastive learning to disrupt the cross-model relationships and use the Euclidean distance-based loss to enlarge the distance between adversarial data and their original counterpart. First, the authors utilize contrastive learning to enlarge the gap between multiple texts and minimize the distance with diverse target texts. However, I question whether setting different targets can truly maximize the distance between adversarial and original images. An ablation study is necessary to verify this, such as comparing the proposed approach with a baseline that doesn't use diverse target texts, or to analyze how different choices of target texts affect the effectiveness of the perturbations. Second, the authors use two distinct losses to maximize the distance between adversarial images and each modality in the original image-text pairs. It is unclear why two losses are needed, rather than using a unified loss for both modalities. Additional experiments comparing their two-loss approach with a unified loss approach, and analyze the impact on both cross-modal and intra-modal relationships should be conducted. 

c. Perturbation learning methods, including set-level augmentation, maximizing both intra- and inter-model differences, and leveraging contrastive learning, have already been explored by current approaches [1,2]. The specific contribution of this method remains unclear, aside from generating universal perturbations instead of sample-specific ones. Furthermore, the distinction between the generation of universal and sample-specific perturbations remains unclear.

5. Experiments:
-  Previous works on universal adversarial attacks for VLP models should be discussed and compared, such as [3]. Additional comparison with relevant methods should be provided.
- The authors apply data augmentation to improve the method's effectiveness, but additional comparisons with other augmentation techniques should be conducted to better demonstrate the proposed method's superiority. Examples include ScMix [3] and Admix [4].
 [1] Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. 2023. Set-level guidance attack: boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE International Conference on Computer Vision. 102–111.
[2] Kim M, Tack J, Hwang S J. Adversarial self-supervised contrastive learning[J]. Advances in neural information processing systems, 2020, 33: 2983-2994.
[3] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. 2021. Admix: enhancing the transferability of adversarial attacks. In Proceedings of the IEEE International Conference on Computer Vision. 16158–16167.
[4] Zhang, Peng-Fei, Zi Huang, and Guangdong Bai. "Universal Adversarial Perturbations for Vision-Language Pre-trained Models." Proceedings of the 47th International ACM SIGIR Conference on Research and Development in Information Retrieval. 2024.

questions:
Please refer to Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732116349840

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Common Concerns (Part I)

comment:
We sincerely appreciate all the reviewers for dedicating their valuable time and effort to review our paper and provide insightful comments and suggestions. 
Encouragingly, reviewers praise C-PGC’s design (`R#U4zG`, `R#AoYQ`), effectiveness (`R#AoYQ`, `R#U4zG`), scalability and versatility (`R#AoYQ`,`R#U4zG`) and appreciate the writing (`R#U4zG`, `R#4NRc`) and experiments (`R#AoYQ`, `R#U4zG`, `R#4NRc`) of our work. Below, we uniformly address several concerns shared by different reviewers.

> `[Q1]` **R#jJKC**, **R#AoYQ**: Semantic Similarity between Clean and Adversarial Texts.

Thanks for the insightful question. Yes! The basic objective of untargeted adversarial attacks is to fool the victim model to output incorrect predictions [1, 2], while the attacker is supposed to preserve semantic similarity between the original and the adversarial sample to **ensure attack imperceptibility**. 
In our implementation, we follow the rigorous setup in prior works [3,4,5] that modify only one single word to preserve semantic similarity and attack stealthiness. 
To further quantitatively evaluate C-PGC, we follow the suggestion of **R#AoYQ** and **calculate BERT scores [6], including P (precision), R (recall), and F1 (F1 score) as metrics** for the semantic distance between 5,000 clean and adversarial sentences in Table A. To more comprehensively evaluate, we also compute BLEU metrics when surrogated on ALBEF in Table B.  

Table A. Comparison of our C-PGC with the two widely acknowledged Co-Attack [3] and SGA [4] regarding the semantic similarity between clean and adversarial texts. 
| Source model$\Rightarrow$   | ALBEF  |   ALBEF     |   ALBEF     | TCL    |  TCL      |   TCL     | CLIP_VIT |   CLIP_VIT     |  CLIP_VIT      | CLIP_CNN |   CLIP_CNN     |  CLIP_CNN      |
|-----------|--------|--------|--------|--------|--------|--------|----------|--------|--------|----------|--------|--------|
|     Method$\Downarrow$      | P$\uparrow$    | R$\uparrow$        | F1$\uparrow$       | P  $\uparrow$        | R $\uparrow$         | F1$\uparrow$         | P$\uparrow$            | R$\uparrow$          | F1$\uparrow$         | P$\uparrow$            | R$\uparrow$          | F1$\uparrow$         |
| Co-Attack [3] | 0.8328 | 0.8589 | 0.8455 | 0.8325 | 0.8588 | 0.8453 | 0.8269   | 0.8526 | 0.8394 | 0.8271   | 0.853  | 0.8397 |
| SGA [4]      | 0.8389 | **0.8654** | 0.8518 | 0.8376 | 0.8646 | 0.8509 | 0.8416   | **0.8697** | 0.8553 | 0.8378   | 0.865  | 0.8511 |
| Ours      | **0.8891** | 0.8613 | **0.8748** | **0.8924** | **0.8687** | **0.8802** | **0.8746**   | 0.8684 | **0.8713** | **0.8948**  | **0.8842** | **0.8893** |

Table B. Comparison of BLEU metrics regarding our C-PGC with Co-Attack and SGA. 
| Method $\Downarrow$    | B@4   | METEOR | ROUBE_L | CIDEr | SPICE |
|-----------|-------|--------|---------|-------|-------|
| Co-Attack [1] | 0.79  | 0.52   | 0.895   | 7.03  | 0.661 |
| SGA [2]      | 0.798 | 0.527  | 0.898   | 7.159 | 0.668 |
| Ours      | **0.889** | **0.552**  | **0.905**   | **8.036** | **0.671** |

Note that we provide previous sample-specific algorithms `Co-Attack`[3] and `SGA`[4] as references. 
Notably, our method  **achieves better similarity scores to these wide-acknowledged sample-specific methods** across different surrogate VLP models, demonstrating the outstanding attack stealthiness of our C-PGC.

To better understand its influence on attack performance under more practical scenarios, we evaluate C-PGC against a widely used language correction tool, *i.e*., the **LangugeTool** (LT) which has been applied to adversarial text correction [5]. As shown in **Table 2 of the main body**, the minor ASR drop from NRP to NRP+LT indicates that C-PGC exhibits excellent attack imperceptibility and can effectively bypass the automated evaluation tool, which again underscores the generalizability of the generated UAP, presenting a practical and effective textual perturbation strategy.

We will supplement these analyses in the Appendix and encourage more related future works. Thanks again for your insightful advice!
</content>
</thread_object>

</thread>
<thread>
creation date:
1732118175906

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Revision Uploaded

comment:
We would like to express our sincere gratitude once more for your invaluable time and efforts in evaluating our work! 

`A revision of our paper` that fully incorporates your precious suggestions along with the details concerning the revised content **has been uploaded**.
We have highlighted all modified content in the paper with blue color. Specifically, we have added/updated the following contents in the paper。
> **Reviewer jJKC**
1. We clarify the claim of *"Fully utilize the characteristics of V+L scenario"* and encourage future studies to investigate task-level characteristics in **Appendix I**. 
2. We add the comparison with PGD-based UAP to **Figure 1** and cite the support literature in the **Introduction section**. 
3. We highlight that our Appendix includes the cross-domain experiments in the **introduction part of Section 4**. 
4. We provide the analysis regarding semantic similarity between adversarial text and its original text in **Appendix D**.
5. We conduct ablation studies of diverse target texts in **Appendix E**.
6. We supplement further discussions of unified losses in **Appendix B**.
7. We compare our C-PGC with the suggested baseline in **Appendix C**.
8. We compare different data augmentations in **Appendix E**.

> **Reviewer AoYQ**
1. We provide the analysis regarding semantic similarity between adversarial text and its original text in **Appendix D**.
2. We provide the way to calculate ASR in **Section 4.2**.
3. We discuss the employment of special characters in **Appendix J**.
4. We reorganize and highlight the innovations and contributions in the **contributions of Introduction**.

>  **Reviewer U4zG**
1. We provide the detailed motivation and rationale behind the contrastive loss in **Appendix B**.
2. We discuss the trade-offs between C-PGC and the suggested method in  **Appendix I**.
3. We compare our C-PGC with a recent SOTA baseline in **Appendix C**.
4. We improve the color schemes and visual materials of the framework diagram in  **Figure 3 of the Method**.

>  **Reviewer 4NRc**
1. We highlight the positive sample selection strategy in the **multimodal contrastive loss part of Method section**.
2. We discuss the effect of set-level augmentation in **Table 11 of Appendix E**.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This work reveals that Vision-Language Pre-training (VLP) models are vulnerable to instance-agnostic Universal Adversarial Perturbations (UAPs). It introduces a Contrastive-training Perturbation Generator with Cross-modal conditions (C-PGC) that leverages malicious contrastive learning to disrupt the multimodal alignment in VLP models, achieving effective and transferable attacks across various models and vision-language tasks. The authors provided additional experiments and explanations during the rebuttal phase to address the reviewers' concerns; however, some issues remain unresolved. The primary weaknesses of this work lie in the inefficiency and ineffectiveness of the proposed universal adversarial text generation approach. The method's reliance on identifying critical words before applying universal perturbations contradicts the principle of universal attacks, which should function on all unseen data without additional computation. The quality of the generated perturbations is questionable, as merely replacing words does not ensure imperceptibility, making the modified texts easily identifiable. Additionally, the high semantic similarity between the original and adversarial texts suggests the attack has minimal impact, undermining its effectiveness. The use of large language models to validate imperceptibility is also unconvincing. Furthermore, the performance improvement primarily stems from the underlying perturbation technique (e.g., DeepFool) rather than the novel strategy proposed in this work, as highlighted in the rebuttal. Therefore, we decide not to accept this work based on its current state.