TUAP: Targeted Universal Adversarial Perturbations for CLIP

Authors: Hanxun Huang, Sarah Monazam Erfani, Yige Li, Xingjun Ma, James Bailey
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Adversarial, Universal, Perturbation, Vision Language Model, VLM, CLIP

Abstract:
As Contrastive Language-Image Pretraining (CLIP) models are increasingly adopted in a wide range of downstream tasks and large Vision-Language Models (VLMs), their vulnerability to adversarial attacks has attracted growing attention. In this work, we examine the susceptibility of CLIP models to Universal Adversarial Perturbations (UAPs). Unlike existing works that focus on untargeted attacks in a white-box setting, we investigate targeted UAPs (TUAPs) in a black-box setting, with a particular emphasis on transferability. In TUAP, the adversary can specify a targeted adversarial text description and generate a universal $L_{\infty}$-norm-bounded or $L_2$-norm perturbation or a small unrestricted patch, using an ensemble of surrogate CLIP encoders. When TUAP is applied to different test images, it can mislead the image encoder of unseen CLIP models into producing image embeddings that are consistently close to the adversarial target text embedding. We conduct comprehensive experiments to demonstrate the effectiveness and transferability of TUAPs. This universal transferability extends not only across different datasets and models but also to downstream models, such as large VLMs including OpenFlamingo, LLaVA, MiniGPT-4 and BLIP2. TUAP can mislead them into generating responses that contain text descriptions specified by the adversaries. Our findings reveal a universal vulnerability in CLIP models to targeted adversarial attacks, emphasizing the need for effective countermeasures.

Decision: reject
Reviewer scores: 3, 3, 3, 8

Reviews and discussion:
<thread>
creation date:
1730192543066

thread_type:
official_review

<thread_object>
creator: reviewer_qeu8

<content>
summary:
This paper introduces TUAP, a new method for crafting universal perturbations for specific outputs in the CLIP model in a black-box setting. TUAP aims to generate perturbations that, when universally applied to images, guide CLIP's image encoder to achieve predetermined adversarial text embeddings.

strengths:
1. The paper explores the targeted universal adversarial perturbation (TUAP) for the CLIP model in a black-box setting, and shows that TUAP can still achieve efficient attack effects in unseen models without gradient information. By combining multiple alternative models for perturbation generation, the transferability of the attack is improved.
2. Unrestricted adversarial patches, $L_{\infty}$ norm-constrained perturbations, and $L_{2}$ norm-constrained perturbations provide users with flexibility to choose appropriate perturbation forms in different scenarios. This diversity not only enhances the applicability of the method, but also demonstrates the performance of TUAP under various constraints, which is suitable for adversarial needs in various scenarios.
3. The paper experimentally verifies TUAP on 9 datasets and multiple downstream tasks, covering tasks such as image-text retrieval, zero-shot classification, and image description generation. Through diverse datasets (such as ImageNet, CIFAR, and Food101, etc.) and task tests, the paper demonstrates the applicability of TUAP in different tasks and its wide range of attack effects.

weaknesses:
1. The paper discusses the attack effects on a variety of target text descriptions, but the targeted support for the diversity of target texts and actual scenarios is relatively limited. The lack of in-depth analysis of target texts that may have complex semantics or contextual dependencies in reality limits the applicability of this method in practical applications.
2. The paper focuses on the success rate and transitivity of the attack, but ignores the visual perceptibility of adversarial perturbations. Especially under $L_{\infty}$ and $L_{2}$ constraints, perturbations may produce visible artifacts, affecting the concealment of practical applications. In real application scenarios, perceptible perturbations may be easily discovered by the detection system, thereby limiting the effectiveness of the attack.
3. There are some ablation experiments on different perturbation parameters in the paper, but the sensitivity analysis of key parameters such as perturbation intensity and perturbation position is not comprehensive enough. In particular, how the perturbation intensity of the $L_{\infty}$ constraint affects the concealment and transitivity of the attack, and the impact of the change in the position of the perturbation at the edge or main area of ​​the image on the success rate of the attack, has not been fully discussed.
4. The experiments are mainly conducted on more typical datasets such as ImageNet, which may not fully reflect the complexity of real application scenarios. For example, the feature representation of CLIP may be significantly different in images in specific fields such as outdoor scenes or medical images, and there is a lack of verification of the attack effect in these specific fields.

questions:
Please see weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730361274323

thread_type:
official_review

<thread_object>
creator: reviewer_mcuc

<content>
summary:
This paper introduces a universal adversarial perturbation method against CLIP and its variants. Unlike previous white-box untargeted attacks against CLIP. This paper focus on a black-box targeted setting based on the transferability of adversarial examples. Experiments across diverse datasets and settings are conducted.

strengths:
1. This paper is generally well organized.
2. The experiments are comprehensive. The authors have provided analyses across diverse scenarios.
3. The introduction of background knowledge is comprehensive.

weaknesses:
1. This idea is trivial and not so novel. Universal adversarial attacks have been well explored in the context of standard adversarial attacks for single-modal architectures. It seems that the authors do not make any specific designs to transfer it into the vision-language models. According to the pseudocode, the proposed method seems to be a general approach for all the architectures but not specific to CLIP models.

2. The authors should also explore some related works [a, b] that apply black-box attacks based on transferability for a more comprehensive comparison analysis.


[a] Set-level Guidance Attack: Boosting Adversarial Transferability of Vision-Language Pre-training Models
[b] Sa-attack: Improving adversarial transferability of vision-language pre-training models via self-augmentation

questions:
1. Can the authors provide some comparisons with query-based black-box attack approaches?
2. Can the novel designs for attacking CLIP models be shown?
3. In addition to adversarial images, is it possible to generate universal adversarial texts?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730365120019

thread_type:
official_review

<thread_object>
creator: reviewer_ypoi

<content>
summary:
This paper proposes the first targeted UAP attack against VLP models and conducts extensive experiments across various tasks and models. By specifying a targeted adversarial text description, TUAP is able to generate a universal L_{inf} norm-bounded or L_{2}-norm perturbation or a small unrestricted patch, exhibiting outstanding transferability.
Besides, the ensemble of surrogate CLIP encoders further enhances the attack effects.

strengths:
(1) The authors provide sufficient experiments on diverse downstream tasks and models, showing the efficacy of the proposed TUAP.
(2) The tables are in good format.
(3) The experimental analysis is reasonable and convincing.
(4) Visualization results are intuitive and reveal that TUAP successfully achieves the attack.

weaknesses:
(1) My major concern is that this paper provides no significant technical innovation. Specifically, the proposed method makes an intuitive attempt by simply combining existing techniques from former studies of adversarial attacks, lacking in-depth exploration and novel insights into vulnerabilities of VLP models against UAP.  
(2) The introduction section requires further reformulation to reduce the unnecessary space.
(3) Despite the extensive experiments, I do not see any insightful analysis regarding the underlying mechanism of the attack algorithm.  

While the authors have conducted sufficient experiments, no significant contributions are made compared with [1].
In summary, this paper is more like an experimental report rather than a top-tier conference paper, far from meeting the acceptance criteria for ICLR. 

[1] Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In ACM MM, 2023.

questions:
Did you train the universal perturbation with the whole training set of the surrogate model?
</content>
</thread_object>

</thread>
<thread>
creation date:
1730654300239

thread_type:
official_review

<thread_object>
creator: reviewer_tkjh

<content>
summary:
This work explores the vulnerability of CLIP models to targeted Universal Adversarial Perturbations (TUAPs) in a black-box setting, focusing on transferability. TUAPs enable adversaries to specify a targeted text description and generate universal perturbations that mislead unseen CLIP models into producing embeddings aligned with the adversarial text. Experiments demonstrate the effectiveness and transferability of TUAPs across various datasets and large Vision-Language Models (VLMs) like OpenFlamingo and MiniGPT-4. The findings highlight a significant vulnerability in CLIP models to targeted attacks, underscoring the need for effective countermeasures.

strengths:
Strengths.
1. The paper is clearly written and motivates the proposed approach well in a lucid manner.
2. The paper demonstrates universal transferability across different datasets and various Vision-Language Models (VLMs), consistently misleading image encoders.
3. The paper proposes a targeted Universal Adversarial Perturbations (TUAPs) method. The proposed TUAPs allow adversaries to specify precise text descriptions for targeted attacks while functioning effectively in a black-box setting.
4. The paper highlights significant vulnerabilities in CLIP models, underscoring the need for improved defenses against targeted adversarial attacks.

weaknesses:
Weaknesses

1. The novelty, in my opinion, is limited. This paper simply migrates the Universal Adversarial Perturbations generation method in image classification to the VLM task, and there is no technical innovation.


2.  Lack of comparison with Universal Adversarial Attack methods for VLM models[1][2]. They have proposed to adopt the image encoder to generate adversarial perturbations. 
[1] Zhao Y, Pang T, Du C, et al. On evaluating adversarial robustness of large vision-language models[J]. Advances in Neural Information Processing Systems, 2024, 36.
[2] Dong Y, Chen H, Chen J, et al. How Robust is Google's Bard to Adversarial Image Attacks?[J]. arXiv preprint arXiv:2309.11751, 2023.

3. How does the proposed method perform on closed-source models such as chatgpt4?


4. In Figure 1, there are apparent shark textures in the generated adversarial images, and I think there is no problem for VLM to identify them as sharks.

questions:
Refer to Weaknesses.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732094899351

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
General response

comment:
Our work introduces a previously unexplored adversarial threat that has not been effectively addressed by existing studies. We acknowledge that the lack of empirical comparisons to prior work in the initial submission may have made it difficult for reviewers to fully assess the novelty of our paper. These comparisons were initially omitted due to the fundamentally different threat model explored in our work.

To address this, we have incorporated both technical and empirical comparisons with all related works identified by the reviewers. The performance gap is substantial, often determining whether the attacker’s goal is achieved or not, underscoring the complexity and significance of the new adversarial threat identified in our study.

To enable these comparisons, we relaxed certain aspects of our threat model, including adjustments in **Black-box versus White-box access assumptions**, **Targeted versus Untargeted attack objectives**, and **Sample-specific versus Universal perturbations**. Despite these relaxations, our TUAP (Targeted Universal Adversarial Perturbation) consistently outperforms existing approaches. We have summarized the technical comparisons between our work and all the works mentioned by each reviewer in the table below. 

|       Method      | Threat model |    Attack objective   | Perturbation type | Cross-model transferability | Cross-dataset transferbility | Cross-task transferability |
|:-----------------:|:----------------:|:---------------------:|:---------------------:|:-------------------------------:|:-------------------------------:|:-----------------------------:|
|  Bard Attack [1]  |     Black-box    | Untargeted / targeted |    Sample-specific    |                ✓                |                ✗                |               ✗               |
| Attack on VLM [2] |     Black-box    | Untargeted / targeted |    Sample-specific    |                ✓                |                ✗                |               ✗               |
|      SGA [3]      |     Black-box    |       Untargeted      |    Sample-specific    |                ✓                |                ✗                |               ✓               |
|   SA-Attack [4]   |     Black-box    |       Untargeted      |    Sample-specific    |                ✓                |                ✗                |               ✓               |
|    AdvCLIP [5]    |    White-box*    |       Untargeted      |       Universal       |                ✗                |                ✓                |               ✓               |
|        Ours       |     Black-box    |        Targeted       |       Universal       |                ✓                |                ✓                |               ✓               |

---

To the best of our knowledge, the TUAP presented in this work is the only one that is capable of achieving cross-model, cross-dataset, and cross-task adversarial transferability simultaneously, and achieving challenging targeted attack objectives. The targeted attack objective is only successful if the output is the one specified by the attacker. The untargeted attack is successful as long as the output is incorrect. If the targeted attack is successful, then it also means it can achieve untargeted objectives (as long as the attacker does not use the ground truth as the target). 

We welcome constructive discussions with each reviewer.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732095146494

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Summary of changes in the revision

comment:
We have made the following revisions to address reviewers' concerns:

- Revised introduction as suggested by reviewer **Ypoi**.
- Added discussion in related work section for papers [3,4] referenced by reviewer **mcuc**.
- A comparison with the SGA attack [3] is added to Appendix B.7, Table 11 to address the concern by reviewer **mcuc**. Results show that even compared with sample-specific perturbations with an untargeted objective, our Targeted UAP still shows a significant advantage in cross-task transferability.
- A comparison with the Bard attack [1] to Appendix B.7, Tables 12 and 13 to address the concern by reviewer **Tkjh**. Our TUAP shows a significant advantage in cross-model transferability over the sample-specific perturbation used by [1].
- A comparison with AdvCLIP [5] has been added in Appendix B.8, Tables 14 and 15, to address the concern of reviewer **Ypoi**. The results reveal a substantial performance gap, which critically determines whether the attacker’s objectives are successfully achieved or not.
- An evaluation of applying TUAP on the medical datasets is added to Appendix B.9, Table 16 to address the concern of reviewer **QeU8**. Results show that TUAP is also effective in achieving the adversarial objective when applied to medical imaging datasets, further demonstrating cross-dataset transferability.

In summary, these newly added results further demonstrate our TUAP can achieve cross-model, cross-dataset, and cross-task adversarial transferability simultaneously. 

[1] Dong, Yinpeng, et al. "How Robust is Google's Bard to Adversarial Image Attacks?." arXiv preprint arXiv:2309.11751(2023).\
[2] Zhao, Yunqing, et al. "On evaluating adversarial robustness of large vision-language models." In NeurIPS 2023.\
[3] Lu, Dong, et al. "Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models." In ICCV 2023.\
[4] He, Bangyan, et al. "Sa-attack: Improving adversarial transferability of vision-language pre-training models via self-augmentation." arXiv preprint arXiv:2312.04913 (2023).\
[5] Zhou, Ziqi, et al. "Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning." In ACMMM 2023.
</content>
</thread_object>

</thread>


Metareview:
metareview:
This work investigates the vulnerability of CLIP models to Targeted Universal Adversarial Perturbations (TUAPs) in a black-box setting, demonstrating their effectiveness and transferability across datasets, models, and downstream Vision-Language Models (VLMs). However, most of the reviewers raise a concern regarding lack of significant technical novelty, as the core techniques, such as the optimization of cosine embeddings and model ensemble, are commonly used in prior studies on VLP models. The proposed method primarily extends the Universal Adversarial Perturbation (UAP) framework from single-modal architectures to CLIP. Transferring from untargeted to targeted universal attacks involves standard modifications to the objective function and does not provide substantial conceptual advancements. While the experiments are extensive and well-executed, the results fail to introduce new insights or transformative contributions. Despite the rebuttal, the key concerns about the lack of originality and technical contributions remain unresolved. Therefore, we decide not to accept this work based on its current state.