Leveraging One-To-Many Relationships in Multimodal Adversarial Defense for Robust Image-Text Retrieval

Authors: Futa Kai Waseda, Antonio Tejero-de-Pablos, Isao Echizen
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Image-Text Retrieval, Adversarial Defense, Vision-Language Model

Abstract:
Large pre-trained vision-language models (e.g., CLIP) are vulnerable to adversarial attacks in image-text retrieval (ITR). Existing works primarily focus on defense for image classification, overlooking two key aspects of ITR: multimodal manipulation by attackers, and the one-to-many relationship in ITR, where a single image can have multiple textual descriptions and vice versa (1:N and N:1). 
This is the first work that explores defense strategies for robust ITR. 
We demonstrate that our proposed multimodal adversarial training, which accounts for multimodal perturbations, significantly improves robustness against multimodal attacks; however, it suffers from overfitting to deterministic one-to-one (1:1) image-text pairs in the training data.
To address this, we conduct a conprehensive study on leveraging one-to-many relationships to enhances robustness, investigating diverse augmentation techniques.
Our findings reveal that diversity and alignment of image-text pairs are crucial for effective defense.
Specifically, text augmentations outperform image augmentations, which tend to create either insufficient diversity or excessive distribution shifts. 
Additionally, we find that cross-modal augmentations (e.g., $image \rightarrow text$) can outperform intra-modal augmentations (e.g., $text \rightarrow text$) due to generating well-aligned image-text pairs.
In summary, this work pioneers defense strategies for robust ITR, identifying critical aspects overlooked by prior research, and offers a promising direction for future studies.

Decision: reject
Reviewer scores: 5, 3, 5, 5

Reviews and discussion:
<thread>
creation date:
1730429242364

thread_type:
official_review

<thread_object>
creator: reviewer_5dw5

<content>
summary:
This paper proposes a new defense framework, Multimodal Augmented Adversarial Training (MA2T), designed to enhance robustness in image-text retrieval tasks within vision-language models. MA2T is tailored for the CLIP model, leveraging one-to-many (1:N) image-text pairing and data augmentation to reduce the impact of multimodal adversarial attacks. This approach significantly improves model robustness on datasets such as Flickr30k and COCO.

strengths:
1.	The authors are the first to propose a multimodal adversarial training method for ITR tasks, filling the research gap left by image-only defenses.
2.	Through an in-depth exploration of one-to-many relationships, the authors validate the effectiveness of various augmentation strategies, including text and image augmentation as well as cross-modal and unimodal augmentations.
3.	The experiments of the work show the operations make sense, and proposing data augmentation methods suitable for different tasks.
4.	The proposed framework can adapt to various real-world scenarios, providing a reference for AI security research.

weaknesses:
1.	The experiments rely primarily on the Flickr30k and COCO datasets, lacking tests on other, more diverse real-world datasets.
2.	The framework is only tested on the CLIP model, without validation on other vision-language models, such as BLIP, to assess generalizability.
3.	There is a typo in the tenth line of the abstract; it seems the authors likely meant to write “comprehensive” rather than “conprehensive.”
4.	The paper lacks a clear framework diagram or visual results that would make the contributions of this work immediately understandable.

questions:
1.	This paper lack a framework diagram, which limits its readability.
2.	In Table 3, the focus is mainly on comparing different augmentation strategies,  comparisons with other existing multimodal adversarial training methods are require.
3.	Why select Flickr30k and COCO datasets, it seems that the scenes in these two datasets are relatively limited?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730450518487

thread_type:
official_review

<thread_object>
creator: reviewer_ghv4

<content>
summary:
This paper introduces Multimodal Augmented Adversarial Training (MA2T) to improve adversarial robustness in image-text retrieval (ITR). Extending beyond unimodal defenses, MA2T combines image and text perturbations and incorporates one-to-many and many-to-one augmentations to counteract overfitting and enhance multimodal resilience. Experiments on Flickr30k and COCO validate that MA2T improves robustness, especially with cross-modal augmentations.

strengths:
The paper addresses adversarial robustness in image-text retrieval (ITR) by employing multimodal adversarial training alongside one-to-many and many-to-one augmentations. This approach leverages the multimodal characteristics of ITR data to enhance defenses against attacks. The experimental methodology is robust, featuring well-structured evaluations on Flickr30k and COCO, which illustrate the advantages of cross-modal augmentations. Overall, the work is clearly articulated, providing sufficient context and explanations, and is relevant for advancing robust vision-language models in the expanding field of multimodal research.

weaknesses:
A substantive assessment of the weaknesses of the paper. Focus on constructive and actionable insights on how the work could improve towards its stated goals. Be specific, avoid generic remarks. For example, if you believe the contribution lacks novelty, provide references and an explanation as evidence; if you believe experiments are insufficient, explain why and exactly what is missing, etc.

While the paper proposes a promising approach, several areas need improvement to strengthen claims of broader applicability and robustness. First, the experiments are limited to CLIP as the only vision-language model, which restricts conclusions about model generalizability. Evaluating the framework on additional models, such as BLIP or ALBEF, would provide a more thorough understanding of its robustness across various architectures. Additionally, the current augmentation strategy for image perturbations may introduce distribution shifts that could negatively affect performance. Finally, although the paper discusses the limitations of unimodal defenses in a multimodal context, a more comprehensive theoretical analysis of why cross-modal augmentations specifically enhance ITR robustness is warranted.

questions:
Since the framework is tested solely on CLIP, do the authors foresee challenges in adapting MA2T to other vision-language models, such as BLIP or ALBEF?

The paper notes that image augmentations may introduce distribution shifts that could affect performance. Have the authors investigated alternative augmentation techniques or constraints to mitigate this impact?

Minor issue:
Some Grammatical mistakes are there – like “conprehensive” instead of “comprehensive” [line 021]. “mutlimodal” instead of “multimodal” [line 225]. A thorough proofreading will be helpful.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730498401849

thread_type:
official_review

<thread_object>
creator: reviewer_oubz

<content>
summary:
This paper explored adversarial attack and defense for image-text retrieval (ITR) using vision-language models. It proposed Multimodal Augmented Adversarial Training (MA2T), using one-to-many relationships in image-text pairs to improve model robustness. The authors claimed improvements in adversarial robustness, especially when using text augmentations over image perturbations.

strengths:
- An interesting problem of multimodal adversarial defense, particularly for ITR.
- The paper proposed a new defense strategy, MA2T, to improve robustness by incorporating multimodal adversarial training and augmentation.
- The paper conducted many experiments across multiple attack types, with detailed augmentation analysis.

weaknesses:
- It seems unclear why one-to-many augmentations should directly improve adversarial robustness in ITR, it would be good to add some theoretical explanations if possible. 
- Following the above, the selection choice, including the multimodal training setup, appears empirically driven without a theoretical basis.
- The paper used CLIP-ViT-B/16 as the base model and reported improvements in robustness metrics (e.g., 1.7%–8.7%). The authors should have realized that CLIP-ViT-B/16 is quite a small model, and the performance improvement on this may not be generalized to a larger model, which is said, the large model may already show much better adversarial robustness than the small model. So it is recommended to conduct a study on larger models to see the performance and the improvement gain compared with small models, 
- The paper only used a base model. Though many attacks have been studied, it seems unclear whether the proposed method only works on the models with architectures like CLIP or can be generalized to other model architectures. It is recommended that other model architectures be investigated as well. 
- Evaluations are limited to Flickr30k and COCO datasets. Existing studies have shown that Flickr is quite a simple dataset, so it is recommended that other, more complex datasets be explored.
- Some evaluations show selective use of augmented pairs, while others apply them inconsistently across attack types and scenarios. This inconsistency may lead to ambiguity around the robustness gains attributable to MA2T.

questions:
Please see the comments above.
</content>
</thread_object>

</thread>
<thread>
creation date:
1731921642807

thread_type:
official_review

<thread_object>
creator: reviewer_norj

<content>
summary:
This research introduces novel defense strategies for Image-Text Retrieval (ITR) by addressing the limitations of existing methods tailored for image classification. A pioneering approach is demonstrated, emphasizing the significance of multimodal adversarial training in enhancing the robustness of ITR systems against diverse attacks. Furthermore, a comprehensive analysis of leveraging one-to-many relationships is conducted, revealing the efficacy of diverse augmentations across image and text modalities for bolstering the resilience of ITR models.

strengths:
1.This research pioneers a new direction in defense strategies for ITR, highlighting the inadequacies of conventional image classification defense methods.
2.The introduction of multimodal adversarial training significantly improves the robustness of ITR systems.
3.This study offers an in-depth analysis of leveraging one-to-many relationships
4.Well-written and easy to read.

weaknesses:
1. Both the selection of datasets and the methodological exposition in this work are relatively weak and lack persuasiveness. It is suggested that the authors should not confine themselves to COCO and Flickr datasets but also test on more diverse datasets, such as remote sensing scenes, to thoroughly validate the generalizability of the proposed method. Furthermore, the introduced method lacks sufficient theoretical justification.
2. The ablation experiments are too simplistic; at the very least, different visual-language foundation models should be subjected to ablation analysis.

questions:
1. Can the proposed method be extended to tasks at a finer granularity, such as VL segmentation and detection?
2. Since text augmentation is superior to image augmentation, is there a similar conclusion for the audio modality as well?
3. Since the author mentioned a one-to-many strategy, what about many-to-many strategies, such as [1]?

[1]. Leveraging Many-To-Many Relationships for Defending Against Visual-Language Adversarial Attacks, arXiv 2024
</content>
</thread_object>

</thread>
<thread>
creation date:
1732468026563

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General Response by Authors

comment:
We appreciate all the reviewers for taking the time to review our paper and for their thoughtful efforts.

Thank you for considering our work a pioneer [NoRj, 5DW5], interesting [oUBz], well-written [NoRj, ghV4], with an experimental setting that is robust [ghV4, 5DW5], well-structured [ghV4] and in-depth [NoRj, oUBz, 5DW5]. We appreciate the feedback and will clarify all points in the camera-ready version.

First, we would like to clarify our contributions:
- We propose **a new defense paradigm** for adversarial robustness in the multimodal task of image-text retrieval.
- **For the first time, we explore the benefits of standard image and text augmentation techniques** for adversarial robustness in various combinations.
- We analyze the effectiveness of different augmentations and, for the first time, **provide empirical evidence revealing the importance of diversity and alignment of augmentations for robustness**.

However, the final scores do not reflect these strengths and mostly focus on requiring additional experiments that, in our humble opinion, do not seem essential. **Our method has been validated following the standard settings of the related work regarding datasets and models**, and we humbly request the reviewers reconsider their scores.

Key points of disagreement (discussed more in-depth for each author):

- *Additional datasets:* **Flickr and COCO are the standard datasets** evaluating adversarial robustness in the related works, providing diverse general scenes.
- *Additional models:* **Our primary focus was to thoroughly study** the impact of diverse augmentation techniques on adversarial robustness, and dedicated computational resources to exploring data variations. The defense method, TeCoA [A], also focuses exclusively on CLIP-B/32 for detailed analysis since adversarial training is computationally expensive. Moreover, since the other models mentioned (i.e., ALBEF, BLIP) are based on the same multimodal contrastive learning as CLIP,  evaluating ALBEF and BLIP may not provide any critical insight regarding the effectiveness of multimodal augmentations, apart from a boost in CLIP’s base performance. Instead, we focused on thoroughly evaluating various attack methods and augmentations.
- *Lack of theoretical background:* Our work is **based on a well-established theory for data augmentation in adversarial robustness [B]**. We demonstrate that unimodal methods behind this theory underperform in cross-modal retrieval, and demonstrated that their alignment and diversity are the key factors.

While we also believe that adding more experiments would be nice, in our humble opinion, none of them are essential points that debunk our contributions in a way that the paper deserves to be rejected. We focused our efforts on evaluating a variety of augmentations and attack methods. **Increasing the number of models and datasets in this study would exponentially increase the number of required combinations unreasonably, given that training adversarial defense methods are computationally expensive.**

**We also ask reviewers to specify the name of the suggested datasets or models and the specific reason why they are essential**, as it is hard to provide an answer otherwise.

We apologize for any unclear points and will address them in the camera-ready version. We kindly ask for a reassessment of our work.

---
[A] Mao, Chengzhi, et al. "Understanding zero-shot adversarial robustness for large-scale models." ICLR 2023.

[B] Rebuffi, S. A., Gowal, S., Calian, D. A., Stimberg, F., Wiles, O., & Mann, T. A. "Data augmentation can improve robustness." NeurIPS 2021.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This paper investigates adversarial attack and defense for image-text retrieval (ITR) tasks. To tackle this problem, this paper introduces Multimodal Augmented Adversarial Training (MA2T) awaring of one-to-many image-text correspondences and using diverse augmentation techniques. Experimental results show that the proposed method can enhance adversarial robustness of ITR models, especially when using cross-modal augmentation.

This paper has four negative initial reviews, while only one reviewer responded to the authors despite the reminder by the authors and the AC. I made my decision not solely based on the initial scores, but based on the diverse perspectives, including the authors' response.
The reviewers have three shared concerns:

- [NoRj, oUBz, 5DW5] The evaluation dataset is only limited to COCO and Flickr30k which are known to be simple datasets.
- [NoRj, oUBz, ghV4] There is no theoretical justification of why one-to-many augmentation can help adversarial robustness (it is different from the theoretical justification of minimax optimization, which is widely known theory in adversarial robustness of classification tasks). There could be a potential risk of this augmentation strategy, but there is no related discussion or theory.
- [NoRj, oUBz, ghV4, 5DW5] The study is only based on a single model, CLIP ViT-B/16. We may need more diverse backbones, such as BLIP, ALBEF, or larger backbones, such as CLIP ViT-L/14.

I agree with the reviewers' point. Although the authors mentioned that they followed the previous work, testing more backbones will be important for this submission. For example, [A] showed that different VLMs behave in different ways even under the same evaluation scenario (some models are good at recall, some models are good at precision). Similar findings could be observed in this scenario. I personally recommend adding more backbones, such as [1] different CLIP backbones [2] BLIP backbone [3] image-text cross-modal retrieval models based on triplet loss, e.g., VSE infinity [B]

- [A] Chun, Sanghyuk, et al. "Eccv caption: Correcting false negatives by collecting machine-and-human-verified image-caption associations for ms-coco." European Conference on Computer Vision. Cham: Springer Nature Switzerland, 2022.
- [B] Chen, Jiacheng, et al. "Learning the best pooling strategy for visual semantic embedding." Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021.

I partially agree with the authors on evaluation datasets. There are not many evaluation datasets for image-text cross-modal retrieval. One possible alternative is ECCV Caption [A] or CxC [C], which are the extended versions of COCO Caption with many-to-many correspondences.

- [C] Parekh, Zarana, et al. "Crisscrossed captions: Extended intramodal and intermodal semantic similarity judgments for MS-COCO." arXiv preprint arXiv:2004.15020 (2020).

Finally, the most significant issue of this paper is the lack of understanding of why and how the proposed one-to-many augmentation enhances adversarial robustness. Although the authors mentioned general theories for adversarial robustness and adversarial training, they cannot directly tackle the one-to-many augmentation.

Overall, I think this paper needs more empirical analyses (more backbones, more benchmarks) and more theoretical or high-level insights (how the proposed augmentation works for adversarial robustness).