Break the Visual Perception: Adversarial Attacks Targeting Encoded Visual Tokens of Large Vision-Language Models

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-03 09:31:10

Abstract: Large vision-language models (LVLMs) integrate visual information into large language models, showcasing remarkable multi-modal conversational capabilities. However, the visual modules introduces new challenges in terms of robustness for LVLMs, as attackers can craft adversarial images that are visually clean but may mislead the model to generate incorrect answers. In general, LVLMs rely on vision encoders to transform images into visual tokens, which are crucial for the language models to perceive image contents effectively. Therefore, we are curious about one question: Can LVLMs still generate correct responses when the encoded visual tokens are attacked and disrupting the visual information? To this end, we propose a non-targeted attack method referred to as VT-Attack (Visual Tokens Attack), which constructs adversarial examples from multiple perspectives, with the goal of comprehensively disrupting feature representations and inherent relationships as well as the semantic properties of visual tokens output by image encoders. Using only access to the image encoder in the proposed attack, the generated adversarial examples exhibit transferability across diverse LVLMs utilizing the same image encoder and generality across different tasks. Extensive experiments validate the superior attack performance of the VT-Attack over baseline methods, demonstrating its effectiveness in attacking LVLMs with image encoders, which in turn can provide guidance on the robustness of LVLMs, particularly in terms of the stability of the visual feature space.

Main paper: 
 related work 2.1 large vision-language models: 
 Research in large vision-language models (LVLMs) has been advancing rapidly, driven by the efforts of researchers who design novel model architectures and employ specific training strategies to propel their development [3, 9, 14, 18, 20, 21, 23, 37, 42] .The architecture of a large vision-language model typically comprises three components: a pre-trained image encoder, an intermediate module facilitating the transformation of visual tokens into the language space, and a large language model. Various approaches have been employed in designing the intermediate modules. For instance, LLaVA [23] utilizes linear layers to project visual features into the language space, while the BLIP-2 [21] series (MiniGPT-4 [42] , InstructBLIP [9] ) adopt Q-Former to extract the most relevant visual features to the text prompts for the language models.Different LVLMs may employ diverse intermediate modules for visual feature extraction, while utilizing a common pre-trained image encoder (e.g. OpenAI CLIP [29] or EVA CLIP [13] ) for feature encoding. These pre-trained image encoders have been trained with contrastive learning on large-scale image-text datasets, allowing them to capture universal visual features that are beneficial for various downstream tasks.Adversarial attacks have been extensively explored to assess model robustness. Early research primarily focused on image classification, while in recent years, it has expanded into other domains [1, 33, 39, 40] .In general, adversarial attacks can be categorized into whitebox attacks and black-box attacks, where white-box attacks allow attackers to have complete access to the model's architecture and parameters [12, 25] . In contrast, black-box attacks require attackers to launch attacks without any knowledge of the model's internal details [7, 27] , making them intuitively more challenging. Because our proposed method only has access to image encoders, it can be classified into gray-box attacks, which involve partial access to the model's architecture and parameters.Considerable research efforts have been devoted to developing novel algorithms for adversarial attacks [6, 15, 17, 25, 34] , aiming to enhance the efficiency and imperceptibility of the attacks. These studies have contributed to the gradual improvement and refinement of adversarial attack methods.With the expanding applications of adversarial attacks, researchers have initiated investigations into the adversarial robustness of LVLMs.LVLMs are capable of performing various multimodal tasks, including image-text dialogue, detailed image description, and content explanation, presenting heightened challenges for adversarial attacks. Recent works have investigated the robustness of LVLMs. using proxy models in [41] , and methods such as gradient estimation are employed to attack LVLMs in black box settings. Malicious triggers are injected into the visual feature space to compromise the model security in [32] . The work in [8] conducts a comprehensive analysis on the robustness of LVLMs and devises a context-augmented image classification scheme to improve robustness. Other approaches utilize end-to-end gradient-based optimization methods to generate adversarial perturbations [5, 28, 31] , typically with the cross-entropy loss as the objective to induce errors or achieve proximity between the output and a predefined target text. Different from these works, we focus on investigating the robustness of LVLMs against impaired visual information encoded in visual tokens. We construct adversarial perturbations that disrupt visual features output by the image encoder from different perspectives, resulting in more comprehensive corruption of visual tokens and enhanced attack performance. 
methodology: 
 In this section, we start with the problem formulation and then provide detailed explanations of our proposed method The framework of our method (VT-Attack) is shown in Figure 2 , where we first construct adversarial examples against image encoders and proceed to attack LVLMs.Let 𝐹 𝜃 (𝒙, 𝒒) ↦ → 𝒛 denote a large visual language model parameterized by 𝜃 , where 𝒙 is the input image and 𝒒 is the prompt input to the LVLM. Let 𝐼 𝜙 denote the image encoder of the LVLM parameterized by 𝜙, which encodes images into visual tokens 𝒗. Additionally, let 𝑀 𝜓 represent the intermediate module, parameterized by 𝜓 , that processes visual tokens output by 𝐼 𝜙 and transforms them into mapped visual tokens 𝒑:𝒗 = 𝐼 𝜙 (𝒙), 𝒑 = 𝑀 𝜓 (𝐼 𝜙 (𝒙))Given the input prompt 𝒒 and the image 𝒙, the answer 𝒛 generated by LVLM can be represented as𝒛 = 𝐹 𝜃 (𝑀 𝜓 (𝐼 𝜙 (𝒙)), 𝒒)Let 𝒙 adv = 𝒙 + 𝚫 adv denote the adversarial image being constructed, exhibiting subtle differences 𝚫 adv from the clean image 𝒙. Our focus is on non-targeted attacks, where the adversarial image 𝒙 adv leads the LVLM to generate any incorrect or unreasonable answers ŷ different from the original answer 𝒛 as follows.𝒛 ≠ ẑ = 𝐹 𝜃 (𝑀 𝜓 (𝐼 𝜙 (𝒙 + 𝚫 adv )), 𝒒)With only access to the parameters and gradients of the image encoder 𝐼 𝜙 , our method constructs adversarial images by setting optimization objectives based on the visual tokens 𝒗. During the generation process of 𝒙 adv , it is common to apply an 𝐿 𝑝 norm constraint on the perturbation size, written as ∥𝒙 -𝒙 adv ∥ 𝑝 = ∥Δ adv ∥ 𝑝 ≤ 𝜖. It should be noted that setting 𝜖 to a large value may compromise the stealthiness of the generated adversarial images. Large vision-language models commonly employ CLIP [29] as their image encoders which are typically based on the ViT architecture [11] . An input image is split into fixed-length patches, with each patch treated as a token and fed into the ViT. Subsequently, the ViT encodes the image and generates a series of visual tokens 𝒗 arranged in an 𝐿 × 𝐷 matrix, which can be regarded as the visual feature representation of the image. After further integration of these visual tokens by the intermediate module, the language model can naturally generate outputs leveraging the visual information.Hence, the features output by the image encoder provides crucial visual information to the entire model. Intuitively, if the visual features are disrupted and deviated from the original representation, subsequent modules will be unable to accurately interpret the image contents, leading to erroneous model outputs.Motivated by this, we apply a visual feature representation attack as illustrated in Figure 2 (a), aiming to maximize the loss between the feature representation in visual tokens of the adversarial image and the original representation:EQUATIONs.t. ∥𝒙 -𝒙 adv ∥ 𝑝 ≤ 𝜖where L measures the difference or distance, which can be calculated using KL divergence or MSE. We employ the PGD [25] optimization algorithm to update the adversarial perturbations.While the visual feature attack explicitly disrupts individual visual tokens, it may not fully consider the interdependencies among these tokens. Therefore, we introduce visual token relation attack.The self-attention [36] layers in the ViT image encoder are responsible for capturing the relationships and dependencies among image patches or tokens, corresponding to the relevance between different regions in the image [11] . These layers enable the model to weigh the importance of each token in relation to the others, allowing for a comprehensive understanding of the image's contexts.Therefore, within the visual tokens generated by the image encoder, each token tends to carry information of other tokens that have a higher degree of relationship with it. This enables the visual tokens to exhibit clustering properties, where tokens with higher correlation tend to be grouped together in the same cluster. As shown in Figure 3 , visual tokens belonging to the same region or entity tend to cluster together. This clustering effect arises because tokens that are related or depict similar aspects of the image receive stronger attention connections through the self-attention mechanism.Nevertheless, relying solely on the feature representation attack may not be sufficient to disrupt the clustering relationship among relevant visual tokens, as illustrated in Figure 4 (a). Although feature attack introduce deviations between visual tokens and their initial distribution, they may still exhibit proximity to the clustering centers.To effectively disrupt the clustering relationships, we introduce a novel visual token relation attack, as illustrated in Figure 2 (a) and Figure 4 (b) . Specifically, we initially apply the K-Means clustering [24] to the visual tokens generated by the image encoder, where the number of clusters 𝑘 is determined based on the silhouette coefficient [30] . Each visual token 𝒗 𝑖 is assigned a cluster label denoted as 𝑌 𝑖 ∈ Y, and 𝑘 cluster centers are identified and denoted as C:Y = {𝑌 1 , • • • , 𝑌 𝐿 }, C = {𝐶 1 , • • • , 𝐶 𝑘 } ⇐ Kmeans(𝐼 𝜙 (𝒙)) (2)Next, we maximize the discrepancy between the visual tokens of the adversarial image and their respective cluster centers of the clean image: EQUATION= 𝒙 + Clip(Δ GaussianNoise , -𝜖, 𝜖); 2: Y = {𝑌 1 , • • • , 𝑌 𝐿 }, C = {𝐶 1 , • • • , 𝐶 𝑘 } ⇐ Kmeans(𝐼 𝜙 (𝒙)); 3: for 𝑖 = 1 to 𝐾 do 4: L Feature = E[ 𝑖 L (𝐼 𝜙 (𝒙 adv ) 𝑖 , 𝐼 𝜙 (𝒙) 𝑖 )] 5: L Relation = E[ 𝑖 L (𝐼 𝜙 (𝒙 adv ) 𝑖 , 𝐶 𝑌 𝑖 )] 6:L Semantics = L (𝐼 𝜙 (𝒙 adv ) [CLS] ,𝑇 𝜂 (𝒕) [CLS] )7: L = L Feature + L Relation + L Semantics 8:Gradient descent:𝒙 adv = 𝒙 adv + 𝛼 • sign(∇ 𝒙 adv (L)) 9:Perturbation size constraint: 𝒙 adv = Clip 𝜖 (𝒙 adv ) 10:Grayscale constraint: 𝒙 adv = Clip(𝒙 adv , 0, 1) 11: end for 12: return 𝒙 adv ;The feature and relation attacks introduced above directly compromise the visual token sequence of length 𝐿 generated by the image encoder, resulting in disruptions at both the representation and relationship levels. While the combination of these two attacks can effectively disrupt the information of visual tokens, we are still interested in attacks that change the semantics of images.The information carried by the [CLS] token contains the most direct content of an image, unlike the visual tokens that encode specific visual features. We hypothesize that the disruptions of both local image details (feature and relation attacks) and global semantics are mutually reinforcing, contributing to a comprehensive destruction of visual tokens.Therefore, we incorporate the semantics attack as illustrated in Figure 2 , which reduces the semantic similarity between the visual and text semantic information of the [CLS] token encoded by the CLIP image/text encoder: max L (𝐼 𝜙 (𝒙 adv ) [CLS] ,𝑇 𝜂 (𝒕) [CLS] )s.t. ∥𝒙 -𝒙 adv ∥ 𝑝 ≤ 𝜖 where𝑇 𝜂 represents the CLIP text encoder corresponding to 𝐼 𝜙 and 𝒕 refers to the caption of an image. We utilize cosine similarity to preserve settings similar to contrastive learning [29] . We employ a variant of cosine similarity as the loss functionL (• , •) = 1 1 + cos_sim(• ,•)to align with the loss space of the previous two methods.By integrating the aforementioned three sub-attack methods, we introduce a unified attack approach named VT-Attack , as illustrated in Figure 2 (a). The proposed VT-Attack can comprehensively disrupt the embedded visual features, disturb the inherent relationships and weaken the semantic properties of visual tokens, by solving the following optimization problem:max L Feature + L Relation + L Semantics (5) s.t. ∥𝒙 -𝒙 adv ∥ 𝑝 ≤ 𝜖The generation process of the adversarial image is illustrated in Algorithm 1. After obtaining the adversarial image 𝒙 adv through 𝐼 𝜙 , we input it to various LVLMs that utilize 𝐼 𝜙 as the image encoder, as depicted in Figure 2 (b) . Due to the models' inability to perceive meaningful visual information, they tend to generate incorrect answers regardless of the types of questions concerning the image content. 
experiments: 
 In this section, we present the experimental results of VT-Attack to demonstrate the effectiveness of the proposed method. Additionally, we provide experimental analysis of our approach for further exploration.Victim models. We conduct experiments on a series of prominent baseline large vision-language models to validate the generality of our proposed method. The victim models include LLaVA [23] , Otter [18] , LLaMA-Adapter-v2 [14] , and OpenFlamingo [3] , which utilize OpenAI CLIP [29] as their image encoder, as well as BLIP-2 [21] , MiniGPT-4 [42] , and InstructBLIP [9] , which employ EVA CLIP [13] as their image encoder. We also involve models without employing the pre-trained CLIP such as mPLUG-Owl-2 [37] , utilizing a further trained ViT. We generate adversarial images using the ViT encoders and subsequently attack LVLMs that utilize the same image encoder. Dataset. We follow the typical dataset construction in [10, 26, 31] by randomly sampling 1000 images from the validation set of ILSVRC 2012 for conducting adversarial attacks and evaluating robustness. Evaluation metric. Following commonly used settings in [41] , we employ the CLIP score for evaluating attack performance, which measures the similarity or alignment between images and texts. Both clean images 𝒙 and adversarial images 𝒙 adv are fed into LVLMs to obtain clean and adversarial captions. Subsequently, we compute the CLIP scores between each image 𝒙 and the clean caption 𝒛 / the adversarial caption ẑ. The decrease in the CLIP score for the adversarial caption reflects the effectiveness of the attack. We also employ the attack success rate (ASR) used in [8] which represents the ratio of attacks that successfully mislead the model's output. Basic setup. We follow the common setups in [8, 41] , setting the maximum perturbation size 𝜖 to 8/255 and employing the infinity norm as the constraint [41] . Note that the images are normalized. For the feature attack and relation attack, we utilize the KL divergence or MSE to compute the losses L Feature and L Relation . The PGD algorithm [25] with 1000 iterations is employed for optimization. For the relation attack, we determine the optimal number of clusters 𝑘 within a predefined interval using the silhouette coefficient [30] .We conduct our evaluation primarily on the image captioning task [31, 41] , as it assesses the global comprehension ability of Table 1 : The results of VT-Attack on LVLMs. The evaluation metric is CLIP score(↓) which measures the similarity between images and clean captions or adversarial captions generated by LVLMs. The lower the score, the higher the degree of errors in the model's outputs, reflecting a better attack performance. "-" indicates that the attack cannot be executed due to the absence of a pre-trained text encoder. The gray background represents the attack results of the sub-methods. The best results are highlighted in bold. The best performance among the three sub-methods is highlighted in blue.OpenAI LVLMs towards images. We query the LVLMs using the prompt "Describe the image briefly in one sentence." with adversarial images. The results are presented in Table 1 . Note that "VT-Attack" refers to the combination of feature, relation and semantics attacks, while "VT-Attack (F+R)" refers to the combination of feature and relation attacks.Table 2 : The attack successful rate across different tasks (question types) by VT-Attack. Here we evaluate Otter [18] as an example. Each task is evaluated using 10 prompts (Details are provided in supplementary materials). The ASR(↑) refers to the ratio of successful attacks that mislead the model's output. The best results are highlighted in bold. As demonstrated in the results presented in Table 1 , our proposed VT-Attack achieves the best attack performance. This indicates that our method can more extensively disrupt visual features compared to baseline methods, leading to a diminished comprehension of images by language models. Among the three sub-methods, the feature attack or relation attack typically achieves the best performance among the sub-methods, particularly the relation attack.LVLMs exhibit stronger robustness against semantics attack compared to the other two methods. However, our analysis in Section 4.3 demonstrates the insensitivity of semantics attack to image complexity.One can also notice that, adversarial examples generated by our proposed method exhibits transferability across the LVLMs employing same image encoder, as shown in Table 1 . Regardless of the intermediate modules, the LVLMs exhibit vulnerability to visual tokens that lack original image information. Various intermediate modules fail to reconstruct the compromised visual content. To further validate the generality of our method across various tasks or prompts, we conduct experiments using three different tasks, each evaluated with 10 prompts. Examples of the general VQA and the detailed VQA can be "Is there a pen in the image?" and "Please provide a detailed description of the image". More prompts are provided in supplementary materials. We employ ASR for manual evaluation and the results are shown in Table 2 . Compared to baseline methods and sub-methods, VT-Attack achieves the highest ASR. We can observe that attacks against image encoders exhibit cross-task generality in contrast to end-to-end method [31] . This demonstrates the advantages of prompt-agnostic non-targeted attacks. Table 3 presents cases of attacks on LLaVA [23] . Compared to the baseline methods, our attacks result in larger discrepancies between the model's outputs and the golden captions. More cases are provided in supplementary materials. To compare the impact of VT-Attack with baseline methods on the encoded visual tokens, we employ two-dimensional t-SNE [35] for visualization, as shown in Figure 5 (a). t-SNE is a dimensionality reduction technique that visualizes data in a lower-dimensional space, while preserving the local structure between data points. In contrast to the baseline methods, the visual tokens perturbed by VT-Attack exhibit a significant deviation from the original distribution. Such visual tokens likely have lost their original visual information, causing the language models to generate incorrect responses based on the image content. This demonstrates that VT-Attack targeting visual tokens can more effectively break the visual perception of LVLMs.Visualization of visual tokens in three different sub-methods. In order to explore the degree of visual token disruption in each submethod, we employ t-SNE [35] for visualization, as illustrated in Figure 5 (b). The attacked visual tokens produced by the semantics attack exhibit a distribution that remains relatively close to the original visual tokens. Nevertheless, the attacked visual tokens in the feature attack or relation attack have essentially deviated completely from the original distribution. This observation further explains why the performance of the single semantics attack is slightly lower. Comparison of visual tokens in feature and relation attack.To identify the differences of attacked visual tokens between the feature attack and relation attack, we conduct case visualization of these two attacks in the same t-SNE space. An example is illustrated in Figure 6 . We can observe that the visual tokens affected by the feature attack may still remain close to the original cluster coverage. This indicates that the incorporation of the relation attack may enhance the efficacy of disrupting the relationships between visual tokens and the original cluster, thereby compensating for the limitations of feature attack. Semantics attack exhibit insensitivity to image complexity. The image complexity refers to the richness exhibited by objects, colors or entities within an image. Despite the obvious impact of the feature attack and relation attack on visual tokens, their performance is influenced by the image complexity, as we have observed in our experiments. This is because the increasing image complexity amplifies the intricacy of the information in visual tokens, leading to a decreased performance. We conduct a statistical analysis of the relationship between performance (ASR) and image complexity for the three sub-methods, as illustrated in Figure 8 (a) . In contrast to the other two attack, the semantics attack is not sensitive to image complexity. A possible reason is that there is no direct correlation between image semantics and complexity because an image can be described concisely even if it exhibits complexity. Therefore, the semantics attack that disrupts semantic properties is insensitive to image complexity. The results demonstrates the advantage of employing semantics attack in mitigating the limitations of feature and relation attacks. The results of same adversarial image attacking different LVLMs. We compare the answers generated by different LVLMs given the same clean and adversarial images, as shown in Figure 7 .For the same clean image, the models produce similar answers. However, the models generate completely unrelated answers for the same adversarial image. The results indicate that adversarial images lack valid visual information that can be perceived by LVLMs. This can be attributed to the complete destruction of visual tokens, The impact of perturbation size to the performance. As shown in Figure 8 (b), the performance of the attack improves as the perturbation size increases from 1/255 to 8/255. However, further enlarging the perturbation size does not necessarily lead to performance improvement.The impact of attacks on the perplexity of model outputs.We are curious about the self-confidence level of LVLMs in generating responses when the visual tokens are disrupted. Therefore, we compute the perplexity of the outputs from three models as shown in Table 4 . The perplexity of answers corresponding to adversarial images is consistently higher than that of clean images. This indicates that the models exhibit vulnerability to compromised visual information, resulting in uncertain outputs. 
conclusion: 
 In this paper, we focus on the robustness of LVLMs against nontargeted attacks. Existing methods often overlook the impact of compromised visual tokens on LVLMs. To this end, we propose a new adversarial attack method called VT-Attack, which disrupts the encoded visual tokens comprehensively from multiple perspectives. Experimental results have demonstrated the superiority of our approach over the baselines. This highlights the necessity for enhancing the adversarial defense capability of LVLMs. We hope our work can provide guidance for research on model defense, particularly in the defense of the visual token space.  
: 
 answering [4] and multimodal dialogue [9, 23, 42] . However, recent research [5, 28, 41] highlights their vulnerability to adversarial attacks, posing potential security concerns in practical domains such as biological/medical image understanding [19] and document information extraction [22] . This underscores the importance of investigating the robustness of LVLMs from an attacker's perspective.Adversarial attacks involve the deliberate manipulation of input data to induce incorrect or specific predictions. In general, adversarial attacks can be classified into targeted attacks, which aim to mislead the model into generating specific outputs, and nontargeted attacks, which lead to any incorrect or undesired outputs. Early research of adversarial attacks on visual models was primarily conducted to explore the security and robustness of image classification models [15, 25] . Attacking LVLMs is more challenging because of a much broader prediction space, where an image can correspond to multiple textual expressions while belonging to a specific class.Extensive investigations have been conducted to explore the robustness of LVLMs, including targeted attacks [5, 28, 31, 32, 41] and non-targeted attacks [8, 31] . Specifically, the non-targeted attacks on LVLMs aim to mislead models into generating any erroneous answers, which raise security concerns as these attacks can potentially lead to the breakdown of models in practical scenarios. Therefore, it is vital to design effective non-targeted attacks to investigate the robustness of multimodal systems.Existing non-targeted attacks commonly employ end-to-end [31] or CLIP-based [8] cross-modal optimization methods, aiming to deviate images from their original textual semantics. Nevertheless, these approaches overlook the impact of manipulated visual tokens on the model robustness.LVLMs typically employ ViTs [11] as image encoders to convert images into visual tokens, which encapsulate comprehensive image features/information, working as a bridge for subsequent modules (e.g. language modules) to perceive image contents. Essentially, disrupting visual tokens can impair the model's visual perception and ability to generate proper responses. Therefore, we suggest investigating the robustness of LVLMs by conducting adversarial attacks targeting the encoded visual tokens, providing assistance for relevant research in defense.In this paper, we propose a multi-angle attack approach called VT-Attack (Visual Tokens Attack) which is designed to target the image encoder of LVLMs. As shown in Figure 2 , our proposed approach consists of three sub-methods that systematically and comprehensively disrupt feature representations, inherent relationships, and global semantics of visual tokens output by the image encoder. This facilitates the exploration of the vulnerability of LVLMs to compromised visual information in the embedding space, simulating the operations of extreme adversaries in real-world scenarios.Notebly, our approach yields two benefits. Firstly, adversarial images crafted against the shared image encoder of LVLMs exhibit global effectiveness across different LVLMs [32] . Secondly, we find that the adversarial perturbations obtained through the image encoders of LVLMs are insensitive to specific prompts or tasks, as the generation process does not rely on the prompt/task information.Methodologically, our method is applicable to LVLMs employing ViTs [11] as image encoder. We conduct experiments on a variety of prominent baseline LVLMs including LLaVA [23] , MiniGPT-4 [42] , LLaMA-Adapter-v2 [14] , InstructBLIP [9] , Otter [18] , Open-Flamingo [3] , BLIP-2 [21] and mPLUG-Owl-2 [37] , with image encoders such as OpenAI CLIP [29] , EVA CLIP [13] and other furthertrained ViTs. An example of our attack is demonstrated in Figure 1 . Empirical results demonstrate the effectiveness of our VT-Attack, consistently outperforming baseline approaches and individual submethods. Furthermore, employing adversarial examples generated against image encoders to attack downstream LVLMs can successfully mislead the models into generating incorrect answers, even with different questions as prompts. We also conduct experimental analyses on the properties and functions of each sub-method to demonstrate their distinct roles in attacking from different perspectives.In summary, our contributions can be summarized as follows:• We propose VT-Attack, a joint method that constructs adversarial images by disrupting the visual tokens output by image encoders of LVLMs from multiple perspectives, in order to investigate the robustness of LVLMs against compromised visual information. • We conduct extensive experiments on various models to demonstrate the effectiveness of the proposed method. The results indicate that the adversarial images generated by our method exhibit cross-prompt generality and enhanced attack performance over baseline methods.• We explore the distinctive properties and contributions of each sub-method in our attack approach through experimental analysis, validating the effectiveness of the joint method. 
 
 Appendix:  


Decision: This paper received one 'Weak Reject', one 'Weak Accept', and two 'Borderline Accept' reviews. The rebuttal has addressed most of the concerns raised by all reviewers, except for two questions from Reviewer XkW7. Overall, I have checked the rebuttal and the original submission, we think this submission is a good candidate for ACM MM conference. We encourage the authors to include the new content and experiments mentioned in the rebuttal in the final version of the paper. Additionally, issues raised by reviewers XkW7 and ZwA9 in their final rating justifications need to be addressed and clarified in the final version.

Reviews: review: paper_summary: paper_summary: Considering that VLMs use vision encoders to transform images into visual tokens, this paper investigates the robustness of VLMs against compromised visual information. This paper proposed an adversarial attack method, VT-Attack, disrupting the encoded visual tokens comprehensively from multiple perspectives. Experimental results towards various victim models (LLaVA, Otter, LLaMA-Adapter-v2, OpenFlamingo, BLIP-2, MiniGPT-4, and InstructBLIP) can demonstrate the effectiveness of the proposed method compared with the baselines.
strength_weakness: strength_weakness: + The motivation is clear and the proposed method is interesting. 
+ The paper is well-written and easy to follow.
limitations: limitations: - It seems that the proposed method only focused on vision encoders of VLMs. If the paper aims to investigate the robustness of VLMs, why not consider both vision attacks and language attacks?
- It seems that the current method would highly rely on similar vision encoders, so the attack style is just like white-box attacks. In addition,  in the experiments, only CLIP and EVA-CLIP are used as source encoders...
- The missing details. For example, why the paper did not use the recent VLMs, the most recent model is mPLUG_Owl_2 (Nov, last year). We don't know the version (1.5?) and the scale (7B?) of Llava... It seems that the reproducibility of the paper cannot be guaranteed. 
- Lack of explanation. In Figure 5, it seems that the attacked tokens are separated into two parts. I was wondering why this happened and the connection to the proposed method.
paper_summary: paper_summary: The paper introduces VT-Attack, a novel method designed to assess the robustness of LVLMs to compromised visual information. By systematically disrupting visual feature representations, interdependencies among visual tokens, and semantic attributes, VT-Attack comprehensively evaluates the vulnerability of LVLMs. Through extensive experiments, the proposed approach demonstrates its effectiveness in generating adversarial examples to mislead LVLMs.
strength_weakness: strength_weakness: 1. The writing of the entire paper is very well done and easy to understand. The experiments are comprehensive.
2. The introduction of the relation attack is innovative, and the authors have conducted numerous ablation studies and visualizations to validate each type of attack proposed in the method.
3. The division of different aspects into "semantics, general features, and feature central relationships" proposed in this paper is reasonable.
limitations: limitations: questions:
1. It's interesting to see why Feature scored lower compared to relation in the experiment, it stands to reason that if you distance the token from the clustering center token it might be more effective than feature as a whole? In Figure 8, we can see that the average performance of relation attack is higher than the set of three sub-methods "VT-Attack", why?
2. For Table 1 using clip scores to calculate the success rate of attack I am more concerned about the different models of data length is not the same this will lead to different clip scores, the author can statistics on the average length of the response of the different methods?
3. It would be beneficial to set additional metrics to evaluate the reliability of the proposed method, considering that the method is a non-targeted attack. For instance, an attack could be deemed successful if the model fails to mention the objects in the image after the attack. Currently, metrics like CLIP score and perplexity might not be sufficiently accurate.
4. What would the visualization of the attacked image tokens look like according to Figure 3?
paper_summary: paper_summary: This paper propose a non-targeted attack method referred to as VT-Attack (Visual Tokens Attack), which constructs adversarial examples from multiple perspectives, with the goal of comprehensively disrupting feature representations and inherent relationships as well as the semantic properties of visual tokens output by image encoders.
strength_weakness: strength_weakness: 1. The article proposes an attack method for encoding visual tokens, which is a novel perspective in evaluating the resilience of LVLMs.
2. The article describes four different attack methods, including visual feature representation attack, visual token relationship attack, global semantic attack, and visual token attack (VT Attack), demonstrating the threats to different levels of the model.
3. Through non target attacks, researchers emphasized that these attacks may lead to model failure in practical applications, thus emphasizing the importance of studying the robustness of LVLMs.
limitations: limitations: 1. The article does not provide a detailed comparison with other known attack methods, which may limit readers' comprehensive understanding of the effectiveness of the new method.
2. Although the experimental setup was mentioned, the description of specific implementation details and parameter selection is not detailed enough, which may affect the reproducibility work of other researchers.
3. The article mainly focuses on attack methods, and there is relatively little discussion on how to enhance the resilience of LVLMs, namely defense strategies.
paper_summary: paper_summary: This paper proposes VT-Attack, a joint method that constructs adversarial images by disrupting the visual tokens output by image encoders of LVLMs from multiple perspectives, i.e., feature, relation, and semantic. Extensive experiments are conducted to evaluate the attack performance of the proposed method and it can improve the performance compared to the existing methods.
strength_weakness: strength_weakness: 1.The second sub-method visual token relation attack is interesting and innovative, which focuses on the inner relationship among visual tokens. 

2.The experiments are solid and the analysis are reasonable.
limitations: limitations: 1.What are the differences between visual tokens and feature embeddings?
The proposed visual tokens are the output of vision encoder, which seems similar to the image feature embeddings used in previous work [1]. What are the differences between visual tokens and feature embeddings? If they are the same, I think the proposed feature representation attack and global semantics attack are similar to the two attack strategies used in transfer-based attack in previous work [1]. 

2.From the experimental results, the visual token relation attack achieves the best attack performance. And it is a novel method to perform attack based on the clustering results of visual tokens. However, I have concerns about the optimization of equation 2 and 3. In my opinion, the process of equation 2 and 3 can change the clustering centers of visual tokens, but the visual tokens belonging to one cluster before the attack may lie in a new but same cluster, in this way, the relationship among similar visual tokens will not change. 

3.According to the paper, the authors perform non-targeted attack and the clean images are selected from the validation set of ILSVRC 2012. However, it is unclear how the original caption 𝑡 used in equation 4 is obtained. This clarification is important for judging the success of the attack and for calculating the CLIP Score.

4.Does the [CLS] token in equation 4 come from the output of the vision encoder? The use of the [CLS] token from the text encoder is misleading because there is also a [CLS] token when tokenizing a text sequence. This makes it confusing how to calculate the semantic similarity between the visual and textual semantic information of the [CLS] token.

5.How is attack success defined? As presented in Table 3, can the outputs by E2E and CLIP-based methods be regarded as successful attack cases?

6.What encoders are used when calculating the CLIP Score? According to previous work [1], the average CLIP Score is about 40 even when using a clean image with an unrelated caption, while in Table 1 it is only about 30.

[1]. Zhao Y, Pang T, Du C, Yang X, Li C, Cheung NM, Lin M. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems. 2024 Feb 13;36.