A Unified Understanding of Adversarial Vulnerability Regarding Unimodal Models and Vision-Language Pre-training Models

Authors: haonan  zheng
wen  jiang
Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-07 05:46:51

Abstract: With Vision-Language Pre-training (VLP) models demonstrating powerful multimodal interaction capabilities, the application scenarios of neural networks is no longer confined to unimodal domains such as CV and NLP, but has expanded to more complex multimodal V+L downstream tasks. The security vulnerabilities of unimodal models have been extensively examined, whereas those of VLP models remain challenges. We note that in CV models, the understanding of images comes from annotated information, while VLP models is designed to learn image representations directly from raw text. Motivated by this discrepancy, we developed the Feature Guidance Attack (FGA), a novel method that uses text representations to direct the perturbation of clean images, resulting in the generation of adversarial images. FGA is orthogonal to many advanced attack strategies in the unimodal domain, facilitating the direct application of rich research findings from the unimodal to multimodal scenario. By appropriately introducing text attack into FGA, we construct Feature Guidance with Text Attack (FGA-T). Through the interaction of attacking two modalities, FGA-T achieves superior attack effects against VLP models. Moreover, incorporating data augmentation and momentum mechanisms significantly improves black-box transferability of FGA-T. Our method demonstrates stable and effective attack capabilities across various datasets, downstream tasks, and both black-box and white-box settings, offering a unified baseline for exploring the robustness of VLP models.

Main paper: 
 introduction: 
 ViT provides an effective Transformer-based encoder for the visual modality [11] , ensuring the feature extraction of multimodal input through a unified encoding manner, significantly advancing the Vision-and-Language tasks [13, 1, 40, 45] . Various VLP models [20, 44, 38, 35] continually improve performance in V+L downstream tasks through diverse pre-training tasks and architectural designs [2, 38, 17, 24, 25] . However, the previous research in unimodal fields such as Computer Vision (CV) and Natural Language Processing (NLP) highlights the vulnerability of neural networks to adversarial attacks [12, 21] . Although adversarial robustness, particularly in CV, has been extensively explored in terms of attack strategies [4, 31] , defence mechanisms [30] , and transferability [9, 39] , the study of adversarial robustness in VLP models remains challenges [23, 47, 48, 29] . Our study aims to develop a unified architecture to explore commonalities between multimodal and unimodal tasks from the perspective of adversarial attacks. In other words, we seek to bridge the gap, allowing rich findings in unimodal adversarial robustness to be directly applied to the multimodal scenario.The first question we consider is "Which modality should be paid more attention?" We primarily focus on perturbations in the image modality, with perturbations in the text modality serving as orthogonal (1) Semantic consistency: Visual adversarial examples maintain semantic consistency, i.e., noise addition within reasonable limits doesn't change human comprehension. Conversely, text adversarial examples risk semantic distortion, potentially introducing spelling errors. (2) Differentiability: Image inputs are continuous and differentiable, unlike text tokens which are discrete and non-differentiable making text-only attacks less effective.(3) Accessibility: In real-world scenarios, text often serves as the "beautiful building" "the word of bus" "traffic light""Correct Localization " "Incorrect Localization"Figure 1 : ALBEF computes Grad-CAM [36] visualizations on the self-attention maps. Before FGA, ALBEF can accurately localize image content based on textual cues. After FGA, AL-BEF's understanding of the image becomes confused.primary means of interaction between users and AI models, with limited opportunities for attackers to modify user-generated text. In contrast, models can automatically acquire image data, simplifying the process for attackers to introduce perturbations. In fact, [29] also primarily focuses on enhancing attack strategies in the visual modality to improve adversarial transferability and [48] does not involve text attacks. The second question is "How to unify multimodal and unimodal scenarios in exploring adversarial robustness?" We conceptualize image adversarial attacks as a feature-guided process. For unimodal models which primarily learn to understand images through detailed annotation information (such as category labels), attacking an image involves steering its embedding away from the feature vector linked to its correct annotation [12] . This deviation induces a biased comprehension of the image within the network. Alternatively, the image embedding can be guided closer to the feature vector associated with an incorrect annotation, thereby leading the network to make a predetermined error [22] . In the multimodal scenario, models are encouraged to understand images from raw text, providing a broader and more accessible source of supervision [35] . This also offers more flexible guiding information for the adversarial attack. By guiding the image embedding away from the correct text description, we induce the VLP model to develop an incorrect understanding of the image itself. Similarly, directing the embedding towards an incorrect text description intentionally misleads the model into adopting a specific erroneous interpretation. This strategy is termed Feature Guidance Attack (FGA). Expanding upon FGA, we employ adversarial texts from text attacks as guiding information to generate adversarial images, thus obtaining a novel multimodal attack. This approach exacerbates the model's misinterpretation called Feature Guidance with Text Attack (FGA-T). Furthermore, we introduce additional orthogonal mechanisms to enhance the adversarial transferability of FGA-T in the black-box scenario. Code: https://github.com/LibertazZ/FGA Our contributions can be summarized as follows:• We provide FGA, using original text as the supervision source for the adversarial attack on VLP models, inducing the network to misinterpret adversarial images. • We introduce cross-modal interaction through adversarial text, forming a novel multimodal adversarial attack that enhances white-box attack strength, and improves black-box transferability through additional mechanisms. • Our approach is theoretically orthogonal to any unimodal attack enhancement mechanism. Empirical evidence based on multiple datasets and VLP models demonstrates the broad applicability of our method to various V+L multimodal tasks, providing a unified baseline for the exploration of multimodal robustness. 
related work 2.1 unimodal adversarial attack: 
 From an access perspective to the model, unimodal attacks can be divided into white-box and black-box attacks. In the black-box scenario, due to the target network's opaque weights, attackers typically conduct white-box attacks on an accessible source network, then transfer the adversarial examples to the target network. Therefore, the attack's transferability is also crucial. White-box Attack. Based on how to constrain perturbation, adversarial attacks on the visual modality can generally be divided into two categories. (1) Global attacks typically involve perturbing all pixels of an image, usually constraining the distance between adversarial and original images based on ℓ ∞ , ℓ 2 , or ℓ 1 norms. Representative methods include FGSM [12] , PGD [30] , APGD [7] , CW [4] , etc. (2) Patch attacks, which confine the perturbation to a small area, such as 2% of the image, and allow unrestricted modification of image pixels within that area. Representative methods include LaVAN [16] and Depatch [6] . Since patch attacks are more practical, physical world attacks are usually based on this form. In the text domain, due to the discrete nature of text data, such attacks typically involve subtle modifications to the original text, such as replacing synonyms, inserting additional words, or adjusting sentence structure, without significantly altering the meaning of the text. A representative method is BertAttack [21] .Boosting Transferability. Enhancing the transferability of adversarial attacks is essentially a generalization problem. The two main approaches to solving the generalization issue are data augmentation and improving the optimization algorithm, thus dividing transfer attack methods into two categories. (1) Typical methods that boost transferability through data augmentation, such as DI [42] (Diverse Inputs), TI [10] (Translation Invariant) and SI [26] (Scale Invariant). ( 2) Typical schemes that improve optimization algorithm, such as MI [9] (Momentum Iterative), NI [26] (Nesterov Iterative), VMI [39] (Varied Momentum Iterative), VNI [39] (Varied Nesterov Iterative).This subsection discusses relevant VLP models and multimodal adversarial attack methods.VLP Models. VLP models based on different combinations of pre-training tasks can be roughly divided into three categories.(1) Aligned models: CLIP [35] contains two unimodal encoders to align multimodal embeddings based on Image-Text Contrastive (ITC) loss. (2) Fused models by matching: ViLT [17] introduces both Image-Text Matching (ITM) and Masked Language Modeling (MLM) pre-training for V+L tasks. Models like ALBEF [20] , TCL [44] , BLIP [19] , and VLMo [3] build on it, first aligning multimodal features using ITC loss, then fusing cross-modal features using ITM and MLM losses. (3) Fused models by Masked Data Modeling (MDM): BEiT [2] and BEiTV2 [33] propose and improve Masked Image Modeling (MIM) loss. BEiT3, based on it, first aligns multimodal features using ITC loss, then fuses cross-modal features using MIM, MLM, and Masked Language-Vision Modeling (MLVM) losses.Multimodal Attack. Attacking VLP models is a novel topic. Existing work has provided valuable insights. Co-Attack [47] designs general optimization objectives based on different embeddings (unimodal or multimodal) and experimentally demonstrates that using text attacks or image attacks alone is not as effective as using both in combination, providing a general baseline for subsequent works. SGA [29] points out that improving the diversity of multimodal interaction can enhance the transferability of multimodal adversarial examples. AdvCLIP [48] provides a framework to learn a universal adversarial patch on pre-trained models for transfer attacks on downstream fine-tuned models. These works are limited to VLP models and ignore the connection between unimodal and multimodal scenarios, which is our main motivation. 
methodology 3.1 feature guidance: 
 An image feature extractor 𝐸 (e.g., an image contrastive representation encoder [15, 5, 14] or a VLP model's visual encoder) projects the image into a feature vector for various visual tasks like image classification and object detection. Without regarding the subsequent usage, the most intuitive approach to generate an adversarial example 𝑥 ′ for an image 𝑥 is to encourage the feature vectors 𝐸 (𝑥 ′ ) and 𝐸 (𝑥) to be as distant as possible [47] . This universal strategy is termed "Feature Deviation Attack" (FDA), which involves maximizing the loss function:𝐿 𝑑𝑒𝑣 = -𝐸 (𝑥 ′ ) • 𝐸 (𝑥).(EQUATIONwhere • represents the dot product of vectors, 𝐸 (𝑥) ∈ R 𝑑 . Assuming that in the embedding space, there exists a set of guiding vectors 𝑊 = {𝜔 𝑖 } 𝑚 𝑖=1 , 𝜔 ∈ R 𝑑 , and there is a set of guiding labels 𝑌 = {𝑦 𝑖 } 𝑛 𝑖=1 , 𝑦 ∈ {1, 2, . . . , 𝑚} specifying that 𝐸 (𝑥 ′ ) should be distant from the guiding vectors {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 ∈ 𝑊 . We refer to this strategy as "Feature Guidance Attack" (FGA). To realize the above concept, we need to maximize the loss function:𝐿 𝑔𝑢𝑖 = - 1 𝑛 𝑛 ∑︁ 𝑖=1 𝑙𝑛 exp(𝐸 (𝑥 ′ ) • 𝜔 𝑦 𝑖 ) 𝑚 𝑗=1 exp(𝐸 (𝑥 ′ ) • 𝜔 𝑗 ) (2)where 𝑒𝑥𝑝 (•) represents the exponential function with Euler's number 𝑒 as the base, and 𝑙𝑛(•) stands for the logarithm to the base 𝑒.Based on 𝐿 𝑔𝑢𝑖 or 𝐿 𝑑𝑒𝑣 , we can apply the PGD process [30] , gradually pushing the clean example 𝑥 along the gradient direction to maximize the loss function, ultimately obtaining the adversarial example 𝑥 ′ . By the chain rule of gradients, The reported value is classification accuracy.𝜕𝐿 𝜕𝑥 ′ = 𝜕𝐿 𝜕𝐸 (𝑥 ′ ) • 𝜕𝐸 (𝑥 ′ ) 𝜕𝑥 ′ .𝜕𝐿 𝜕𝑥 ′ represents the direction of perturbation added to the input example. While we focus on 𝜕𝐿 𝜕𝐸 (𝑥 ′ ) which represents the movement direction of the feature vector:EQUATION𝜕𝐿 𝑔𝑢𝑖 𝜕𝐸 (𝑥 ′ ) = 𝑛 ∑︁ 𝑖=1 - 1 𝑛 • 𝜔 𝑦 𝑖 + 𝑚 ∑︁ 𝑘=1 𝑒𝑥𝑝 (𝐸 (𝑥 ′ ) • 𝜔 𝑘 ) 𝑚 𝑗=1 𝑒𝑥𝑝 (𝐸 (𝑥 ′ ) • 𝜔 𝑗 ) • 𝜔 𝑘 (4)It can be observed that feature deviation loss promotes the movement of 𝐸 (𝑥 ′ ) towards -𝐸 (𝑥), which means moving away from 𝐸 (𝑥). While, Regarding the first term of 𝜕𝐿 𝑔𝑢𝑖 /𝜕𝐸 (𝑥 ′ ), it encourages 𝐸 (𝑥 ′ ) to move away from the guiding vectors {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 , and assigning equal weight 1/𝑛 to each of them. The second term encourages 𝐸 (𝑥 ′ ) to approach the guiding vector 𝜔 𝑘 ∈ 𝑊 , with a weight of exp(𝐸 (𝑥 ′ ) • 𝜔 𝑘 )/ 𝑚 𝑗=1 exp(𝐸 (𝑥 ′ ) • 𝜔 𝑗 ), which means the closer 𝐸 (𝑥 ′ ) is to a guiding vector, the greater the weight assigned to it. Due to the presence of the first term, 𝐸 (𝑥 ′ ) is far from {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 , resulting in the weight of 𝜔 𝑦 𝑖 being almost zero in the second term. Consequently, the second term effectively facilitates 𝐸 (𝑥 ′ ) in selecting a nearby guiding vector that does not belong to the set {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 and moving closer to it.We conduct a simple attack experiment using the SimCLR image encoder [5] and the CIFAR-10 dataset [18] , where image feature vectors are used for image classification through a KNN-200 classifier. During the feature guidance attack, we first use the encoder to extract features for all training data. Then, by averaging the features belonging to the same category, we obtain ten guiding vectors {𝜔 1 , 𝜔 2 , . . . , 𝜔 10 }. The label 𝑦 ∈ {1, 2, . . . , 10} of the image 𝑥 serves as the guiding label, encouraging 𝐸 (𝑥 ′ ) to move away from the guiding vector 𝜔 𝑦 . From Table 2 , it is not difficult to observe that the intensity of the feature guidance attack is greater than the feature deviation attack.Most existing VLP models typically consist of two unimodal encoders, a text encoder 𝐸 𝑡 and a visual encoder 𝐸 𝑣 , along with a multimodal feature fusion encoder 𝐸 𝑚 . For a single image-text paired example (𝑣, 𝑡), it is first mapped to a shared feature space separately by 𝐸 𝑡 and 𝐸 𝑣 for aligning image and text features. Subsequently, cross-modal feature fusion is conducted through 𝐸 𝑚 . Therefore, VLP models focus on three key embeddings:𝐸 𝑣 (𝑣), 𝐸 𝑡 (𝑡), and 𝐸 𝑚 (𝐸 𝑣 (𝑣), 𝐸 𝑡 (𝑡)), all corresponding to the [CLS] vector. We will focus on finding guiding vectors in the embedding space and constructing guiding labels to execute FGA on VLP models.In this scenario, we focus on the fused embedding 𝐸 𝑚 (𝐸 𝑣 (𝑣), 𝐸 𝑡 (𝑡)).For different V+L downstream tasks, it needs to be fed into different subsequent models which can be uniformly understood as comprising a projector 𝑃 and a linear classification head ℎ. 𝑃 projects the fused embedding into a task-specific downstream embedding space, followed by ℎ performing classification on this embedding. We can rewrite 𝑃 (𝐸 𝑚 (𝐸 𝑣 (𝑣), 𝐸 𝑡 (𝑡))) as 𝐸 (𝑣 |𝑡), obtaining an image encoder conditioned on the textual modality. The weight of the linear classification head, 𝑊 = {𝜔 𝑖 } 𝑐 𝑖=1 ∈ R 𝑑 ×𝑐 (𝑐 is the number of categories), serve as guiding vectors. Using label information as guiding labels 𝑌 , we thus have all the necessary components to implement the Feature Guidance Attack. See Appendix A for more details and explanations about Visual Question Answering (VQA), Visual Reasoning (VR), etc.FGA is primarily used to generate image adversarial examples. However, for VLP models, attacking both modalities simultaneously is a more effective strategy [47, 29] . The main challenge in generating adversarial texts involves solving the following optimization problem:EQUATIONwhere BertAttack [21] is a well-suited choice for addressing this problem.In fact, FGA and BertAttack are completely orthogonal strategies. This means we first generate an adversarial text example 𝑡 ′ and then use 𝐸 (𝑣 |𝑡 ′ ) as the image encoder to perform FGA, obtaining 𝑣 ′ . Thus, we acquire the adversarial pair (𝑣 ′ , 𝑡 ′ ).In this scenario, only two unimodal encoders are used: 𝐸 𝑣 , and 𝐸 𝑡 . The primary intention of VLP models is to learn directly from raw text descriptions of images, utilizing a broader source of supervision [35] . This implies that in CV models, image understanding comes from pre-provided labels, such as image categories, pixel categories, or annotated bounding boxes. In contrast, in VLP models, the understanding of images originates from raw text. Consequently, using text as supervisory information to generate image adversarial examples becomes a natural approach. To implement this approach, we first acquire a text set 𝑇 = {𝑡 𝑖 } 𝑚 𝑖=1 . Then, We use the text encoder to obtain a set of guiding vectors {𝜔 𝑖 } 𝑚 𝑖=1 = {𝐸 𝑡 (𝑡 𝑖 )} 𝑚 𝑖=1 . To obtain this text set 𝑇 , all texts are gathered from the dataset. Here, by utilizing the dataset's annotations, we can identify which texts in the text set match with the image 𝑣, thereby obtaining the guiding labels 𝑌 . By this point, all elements necessary for executing FGA have been acquired: the image encoder 𝐸 𝑣 , the set of guiding vectors {𝐸 𝑡 (𝑡 𝑖 )} 𝑚 𝑖=1 , and the guiding labels 𝑌 . By maximizing 𝐿 𝑔𝑢𝑖 , the feature vector 𝐸 𝑣 (𝑣 ′ ) will diverge from the text representations {𝐸 𝑡 (𝑡 𝑦 )} 𝑦 ∈𝑌 that match 𝑣, thereby generating adversarial images 𝑣 ′ . For more details on executing iterations of FGA and how it can be combined with typical attack strategies in the unimodal domain, refer to Appendix B.SGA [29] points out that multimodal adversarial examples have better transferability than unimodal adversarial examples. Therefore, we need to introduce text attack into FGA before fuse. We consider an image minibatch 𝑉 = {𝑣 𝑖 } 𝑛 𝑖=1 and the text set 𝑇 𝑖 represents all texts that match with the image 𝑣 𝑖 . Firstly, for each text 𝑡 ∈ 𝑇 𝑖 , we handle the following optimization problem to generate adversarial text 𝑡 ′ :EQUATIONwhere ∥•∥ 2 denotes the Euclidean distance.At this point, we obtain the adversarial text set 𝑇 ′ 𝑖 , and we denote𝑇 = 𝑇 1 ∪𝑇 2 . . . ∪𝑇 𝑛 ∪𝑇 ′ 1 ∪𝑇 ′ 2 . . . ∪𝑇 ′ 𝑛 .Secondly, for 𝑣 𝑖 ∈ 𝑉 , where 𝑇 𝑖 is its matching texts and 𝑇 ′ 𝑖 is the adversarial texts, to generate adversarial example 𝑣 ′ 𝑖 , we use the feature guidance loss to encourage 𝐸 𝑣 (𝑣 ′ 𝑖 ) to simultaneously move away from both 𝐸 𝑡 (𝑇 𝑖 ) and 𝐸 𝑡 (𝑇 ′ 𝑖 ):EQUATION𝑙𝑒𝑛 𝑖 represents the length of text set 𝑇 𝑖 ∪ 𝑇 ′ 𝑖 . Building on this foundation, we further introduce two strategies to enhance transferability: (1) Following SGA [29] , we preset a set of resize parameters 𝑆 = {𝑠 1 , 𝑠 2 , . . . , 𝑠 𝑚 }, where ℎ(𝑣, 𝑠 𝑘 ) denotes the resizing function that takes the image 𝑣 and the scale coefficient 𝑠 𝑘 as inputs. After data augmentation, the objective function we aim to maximize is no longer 𝐿 𝑔𝑢𝑖 (𝑣 ′ 𝑖 ) but rather 𝑚 𝑘=1 𝐿 𝑔𝑢𝑖 (ℎ(𝑣 ′ 𝑖 , 𝑠 𝑘 )), where ℎ(𝑣 ′ 𝑖 , 𝑠 𝑘 ) represents the augmented image. (2) Following MI-FGSM [9] , we introduce the momentum mechanism, where the current perturbation direction is determined by both the current gradient and the historical gradients from previous iterations. See Appendix B.2 for more details. 
experiments 4.1 experimental setting: 
 4.1.1 VLP Models. Our experimental section involves four typical VLP models: CLIP, ALBEF, TCL and BEiT3. CLIP is a typical aligned model, consisting solely of two unimodal encoders. The latter three are fused models, containing two unimodal encoders and a multimodal encoder. ALBEF and TCL share the same architecture with some differences in the details of ITC loss. Besides, ALBEF and BEiT3 have two main differences: (1) Different Pre-training Tasks: ALBEF is based on three pre-training tasks: ITC, ITM and MLM. In contrast, BEiT3 is based on three MDM tasks: MLM, MIM, and MVLM. (2) Different Model Structures: In ALBEF, the three encoders are independent of each other. BEiT3, however, uses the Multiway Transformer to split the feed-forward layer into three parallel paths, thereby obtaining three encoders.4.1.2 V+L Downstream Tasks. In this part, we will introduce each downstream task involved in the experiments, along with the models and datasets used to perform these tasks.Visual Entailment (VE) is a fine-grained visual reasoning task, where given a pair of (𝑣, 𝑡), the model needs to determine whether the text is supported by the image (entailment), whether the text is unrelated to the image (neutral), or whether the text contradicts the content of the image (contradictory). This task will be conducted based on the ALBEF model and the SNLI-VE [43] dataset.Visual Question Answering (VQA) requires the model to predict a correct answer given an image and a question [13, 32] . It can be viewed as a multi-answer classification problem, or as an answer generation problem. We use the VQAv2 [13] dataset and the ALBEF model, which performs the VQA task through text generation.Visual Grounding (VG) requires the model to find parts of the image that match the given textual description. We perform this task based on the RefCOCO+ [46] dataset and the ALBEF model.Visual Reasoning (VR) requires the model to predict if a given text describes a pair of images. This task necessitates that the model not only understands the content of individual images but also compares and reasons about the relationship between two images. Therefore, the input consists of a pair of images and a piece of text. We use the BEiT3 model and the NLVR2 [37] dataset to perform this task.Zero-Shot Classification (ZC) requires using predefined category descriptions (such as "a cat," "a car," etc.) as text inputs and mapping these descriptions to the embedding space by text encoder. Then, for a given image, the similarity between the image embedding and each category description embedding is calculated, and the image is classified into the category with the highest similarity. Due to the CLIP model's strong zero-shot capacity, we use it along with three datasets: CIFAR-10 [18] , CIFAR-100 [18] , and ImageNet [8] , to perform this task.Image-Text Retrieval (ITR) involves retrieving relevant images from an image database given a text query, and vice versa [45, 28, 41] . We perform this task based on the CLIP, ALBEF and TCL models, and the Flickr30k [34] and MS COCO [27] datasets.This subsection explores the effectiveness of attacks on the fused feature vector. Since VE, VQA, VG, and VR rely on this vector, we choose to evaluate these four tasks. As Table 1 illustrates, the evaluation follows the baseline set by [47] , TA represents alone text attack using BertAttack. IA represents image attack based on feature deviation loss. SA stands for separate unimodal attack, indicating that TA and IA are executed separately without modal interaction, and CA denotes the multimodal white-box attack Co-Attack [47] which introduces cross-modal interaction. For fairness, we set the ℓ ∞ perturbation constraint for the image modality in FGA and FGA-T to 𝜖 = 2/255 with 10 iterations, consistent with IA, SA, and CA. Additionally, we explore the attack effectiveness when the number of iterations is 1, i.e., single-step attack, namely FGA 1 and FGA-T 1 . We also investigate the effectiveness under the ℓ 1 constraint, namely FGAl ℓ 1 , with 𝜖 ℓ 1 = 255 and 20 iterations. (See Appendix B.1 for more details.) Besides, we perform FGA in patch form, namely FGA 𝑝𝑎𝑡 , with 100 iterations, a single-step ℓ ∞ constraint of 𝛼 = 8/255, and a patch area of 2% of the total image area, with a random location. (See Appendix B.3 for more details.) Furthermore, when involving text attack, BertAttack is used with a restriction of 1 perturbable token, following [47, 29] .We can observe from Table 1 : (1) Under all tasks, FGA-T consistently achieves the best white-box attack performance, validating the effectiveness of the feature guidance approach and its orthogonality with text attack. (2) Even with only a single step, the feature guidance method is sufficient to produce effective adversarial examples, performing on par with or even better than the baseline. This provides a faster and more convenient attack strategy. (3) The feature guidance approach exhibits good orthogonality with other attack strategies in Computer Vision. When combined with ℓ 1 attack or patch attack, it demonstrates strong performance.In this subsection, we explore the effectiveness of attacks on two unimodal encoders. The tasks of ZC and ITR primarily rely on two unimodal embeddings. We first conduct attacks on the ZC task.Since the text input in the ZC task is predefined and cannot be altered, we only use attacks involving the visual modality. When conducting FGA, we construct the text "A photo of a {object}. " using the categorys' name to obtain the text set 𝑇 = {𝑡 𝑖 } 𝑐 𝑖=1 , where 𝑐 represents the number of categories, following [35] . We extract features through 𝐸 𝑡 to construct the guiding vectors {𝐸 𝑡 (𝑡 𝑖 )} 𝑐 𝑖=1 , and the true category of the image serves as the guiding label 𝑦 ∈ {1, 2, . . . , 𝑐}. The attack results are presented in the Table 2 . We observe that even FGA 1 outperforms IA which is an iterative feature deviation attack.When executing the ITR task on the CLIP model with ViT image encoder, to construct guiding vectors for FGA, we use not only all the texts in the dataset to construct the text set ("Test Texts" in Table 3 ), but also follow the approach of the ZC task: using the 1000 category names from the ImageNet dataset ("ImageNet Categories" in Table 3 ) or the 80 category names from the MS COCO dataset's object detection task ("MS COCO Categories" in Table 3 ) to construct texts "There is a {object} in this photo. " to form the text set 𝑇 = {𝑡 𝑖 } 𝑐 𝑖=1 . Since in the Flickr30k and MS COCO datasets, an image may contain multiple objects, it is possible that the image matches multiple texts in {𝑡 𝑖 } 𝑐 𝑖=1 . In fact, we do not have annotation information indicating which objects are in the image. Therefore, we compare the cosine similarity between 𝐸 𝑣 (𝑣) and {𝐸 𝑡 (𝑡 𝑖 )} 𝑐 𝑖=1 to find the top 5 texts with the highest cosine similarity to 𝑣. When performing FGA, we encourage 𝐸 𝑣 (𝑣 ′ ) to move away from the feature vectors of these five texts. From Table 3 , we can summarize:(1) When using all texts to construct the feature guidance vectors, FGA achieves the best attack effect, which is intuitive. Moreover, we find that without the text attack, CLIP is already incapacitated on the ITR task. (2) ImageNet includes more categories and therefore contains richer guiding information, resulting in better attack effects compared to using categories from COCO.Since the CLIP model only contains two unimodal encoders, attacking before fuse actually utilizes the entire CLIP model. However, the ALBEF model additionally includes a multimodal encoder, so attacking before fuse ignores the multimodal encoder. Therefore, it is necessary to validate the effectiveness of FGA before fusion on the ALBEF model. As shown in Table 4 , we conduct this experiment based on the ALBEF model and the ITR task and observe phenomena consistent with Table 3 .In this subsection, we transition the attack from the white-box setting to the black-box setting, which is a more common scenario. We use four VLP models: ALBEF, TCL, CLIP 𝑉 𝑖𝑇 , and CLIP 𝐶𝑁 𝑁 . The TCL model is identical to ALBEF except for differences in the design of the Image-Text Contrastive (ITC) loss during training, resulting in different final network weights. The two CLIP models use ViT and CNN as visual encoders, respectively. The degree of difference between these four models varies, which will inevitably affect the transferability of adversarial examples. We will observe this phenomenon in the experiments. Our experimental setup is as follows: (1) Task and Dataset: We conduct black-box adversarial example transfer attacks based on the Image-Text Retrieval (ITR) task and the Flickr30k dataset. (2) Source Model and Target Model: The source model is the model for which we generate adversarial examples through white-box attacks, and then use them to attack the target model. Each model will serve as both source and target models. (3) Attack Methods: The methods we use involve attacking both image and text. SA and CA, which do not focus on transferability, serve as baselines. SGA is the state-of-the-art (SOTA) transfer attack and serves as the comparative method. FGA-T 𝑎𝑢𝑔 is based on FGA-T with additional data augmentation using a set of resize parameters 𝑆, following SGA. The differences between SGA and FGA-T 𝑎𝑢𝑔 are in the loss function used for generating adversarial images and the attack process (the former's attack order is "text, image, text", while the latter's attack order is "text, image"). MFGA-T 𝑎𝑢𝑔 additionally introduces the momentum mechanism. (4) Hyperparameters: All texts are allowed to modify only one word, all image perturbations are limited to 2/255 (ℓ ∞ norm), and the number of iterations is 10, following [47] . The resize parameters 𝑆 = {0.5, 0.75, 1.25, 1.5}, following SGA.The experimental results are shown in Table 5 . We observe the following phenomena: (1) SA, CA, and SGA attack the visual modality based on feature deviation. SGA designs a more advanced setlevel feature deviation and introduces data augmentation, improving both white-box and black-box attack effects on the baseline. ( 2) FGA-T 𝑎𝑢𝑔 based on feature guidance, improves SGA further, simultaneously enhancing both white-box and black-box attack effects again. (3) MFGA-T 𝑎𝑢𝑔 slightly reduces the white-box attack effect but further improves adversarial transferability, which is consistent with the observations in [9] . (4) Attacks based on ALBEF transfer better to TCL than to CLIP because ALBEF and TCL only have differences in parameters, while ALBEF and CLIP are completely different models. The same logic applies to attacks based on TCL.(5) Attacks based on CLIP 𝑉 𝑖𝑇 transfer better to CLIP 𝐶𝑁 𝑁 than to ALBEF or TCL because the model difference between CLIP 𝑉 𝑖𝑇 and CLIP 𝐶𝑁 𝑁 is obviously smaller than the difference with ALBEF or TCL. The same logic applies to attacks based on CLIP 𝐶𝑁 𝑁 .FGA pushes 𝐸 𝑣 (𝑣 ′ ) away from matching text embeddings. Conversely, we can also push 𝐸 𝑣 (𝑣 ′ ) closer to a specified text embedding to produce a predetermined error. In unimodal scenarios, this form of attack is called the targeted attack. For example, we have a text set {𝑡 } 𝑛 𝑖=1 and want to push 𝐸 (𝑣 ′ ) closer to a specified text 𝑡 𝑘 . In this case, we need to maximize the following function:EQUATIONWe add perturbation to the clean image 𝑣 in patch form, maximizing 𝐿 𝑡𝑎𝑟𝑔𝑒𝑡 𝑔𝑢𝑖 to obtain the adversarial patch image 𝑣 ′ . We execute FGA 𝑡𝑎𝑟𝑔𝑒𝑡 𝑝𝑎𝑡𝑐ℎ on the ALBEF model and compute Grad-CAM visualizations on the self-attention maps. As shown in Figure 4 , by guiding Table 3 : Comparison results on image-text retrieval before fuse on CLIP. For text-retrieval (TR) and image-retrieval (IR), R@1, R@5 and R@10 are reported respectively. Lower is better.Flickr30k(1K test set) MSCOCO(5K test set) TR IR TR IR R@1 R@5 R@10 R@1 R@5 R@10 R@1 R@5 R@10 R@1 R@5 R@10 4 : Comparison results on image-text retrieval before fuse on ALBEF. For text-retrieval (TR) and image-retrieval (IR), R@1, R@5 and R@10 are reported respectively. Lower is better.Flickr30k(1K test set) MSCOCO(5K test set) TR IR TR IR R@1 R@5 R@10 R@1 R@5 R@10 R@1 R@5 R@10 R@1 R@5 R@10 In subection 3.1, it is mentioned that 𝜕𝐿 𝑔𝑢𝑖 𝜕𝐸 (𝑣 ′ ) not only "guides 𝐸 (𝑣 ′ ) away from {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 ", but also "selects a nearby guiding vector that does not belong to the set {𝜔 𝑦 𝑖 } 𝑛 𝑖=1 and moves closer to it". The performance decline of VLP models on various V+L downstream tasks in previous experiments sufficiently demonstrates the former. We further prove the latter based on the ZC task and the CLIP model. In the ZC task, we collect the text set 𝑇 = {𝑡 𝑖 } 𝑐 𝑖=1 and use it to construct the guiding vectors {𝐸 𝑡 (𝑡 𝑖 )} 𝑐 𝑖=1 . FGA encourages 𝐸 𝑣 (𝑣 ′ ) to move away from 𝐸 𝑡 (𝑡 𝑦 ), where 𝑦 is the true category, and simultaneously encourages 𝐸 𝑣 (𝑣 ′ ) to move closer to the nearest vector from {𝐸 𝑡 (𝑡 𝑖 )} 𝑐 𝑖=1,𝑖≠𝑦 , meaning that in an ideal situation:EQUATIONIn simpler terms, the category predicted for the clean image 𝑣, excluding the true category 𝑦, will be the category predicted for the adversarial image 𝑣 ′ . Based on the CIFAR-10 dataset, we present the statistical results in Figure 5 . In an ideal situation, all positions except the main diagonal should be zero. We observe that the actual situation is close to the ideal. This indicates that the FGA attack indeed tends to guide "𝐸 (𝑣 ′ ) to move closer to the nearest vector from {𝐸 𝑡 (𝑡 𝑖 )} 𝑐 𝑖=1,𝑖≠𝑦 ". In fact, this principle of proximity promotes 𝑣 ′ to automatically choose the nearest decision boundary to cross, which is also one of the reasons for the success of FGA.Table 5 : Compare the transferability with SOTA methods based on the Flickr30k dataset. The reported value is the attack success rate. Higher is better. R@1 value after the attack is reported in parentheses for SGA, FGA-T 𝑎𝑢𝑔 , and MFGA-T 𝑎𝑢𝑔 . Lower is better.Attack ALBEF TCL CLIP 𝑉 𝑖𝑇 CLIP 𝐶𝑁 𝑁 TR R@1 IR R@1 TR R@1 IR R@1 TR R@1 IR R@1 TR R@1 IR R@1  
conclusion: 
 In this paper, we attempt to construct a unified understanding of adversarial vulnerability regarding unimodal models and VLP models. We abstract visual modality attack into a feature guidance form and combine it with text attack and other enhancement mechanisms to establish a general baseline for exploring the security of the VLP domain. In fact, our approach is theoretically orthogonal to many other attack schemes in the unimodal domain, which facilitates further exploration of the vulnerabilities of VLP models and the design of defence algorithms in subsequent work. We hope our code can be beneficial to the community. 
 
 Appendix: '24, October 28-November 1, 2024, Melbourne, VIC, Australia 


Decision: The authors introduced a novel method to generate adversarial images for vision-language pre-trained (VLP) models. It utilizes labels from the dataset to enhance the attack. Although it is a while-box method, the transferability is well-studied. 

All reviewers agree that the paper is a solid contribution and the rebuttal addressed the concerns by providing detailed experiments and analysis.

I recommend acceptance.

Reviews: review: paper_summary: paper_summary: This paper guides the perturbation of image features through textual features and classifies image content to conduct category-based guided attacks. Building on this, the paper implements further feature-guided attacks by adding textual attacks, achieving stronger attack effects in a white-box environment. By incorporating data augmentation and a momentum mechanism, the black-box transferability of the attacks is further enhanced.
strength_weakness: strength_weakness: 1. This paper creates new features for attacking samples by utilizing the categories of image content, significantly increasing the perturbation level of the encoded entities within the images, rather than simply optimizing perturbations based on global textual information in comparison with global image information.
2. This method not only performs well after multiple iterations but also achieves relatively good attack effects with just one iteration.
3. The method enhances the effectiveness of black-box transfer attacks through data augmentation and momentum mechanisms.
limitations: limitations: 1. The paper mentions that adding textual attacks can further enhance the attack effects, which is indeed shown in Tables 1, 2, and 5. However, in Tables 3 and 4, although the text states that CLIP loses its capability in the ITR task even without textual attacks, it does not provide the performance data when textual attacks are added.
2. The paper states that using momentum and data augmentation can improve the performance of black-box transfer attacks, but it does not provide a detailed description to explain the principles and reasons behind this performance improvement.
3.  There is a typo in the last paragraph of Section 2.1, "Boosing Transferability."
paper_summary: paper_summary: This paper proposes Feature Guidance Attack (FGA), a novel method using text representations to direct the generation of adversarial images, to bridge the gap between unimodal and multimodal tasks from the perspectives of adversarial robustness. Extensive experiments across various datasets, downstream tasks, and both black-box and white-box settings, demonstrate that the effectiveness of the proposed methods.
strength_weakness: strength_weakness: 1.This paper introduces FGA, which encourages the feature vectors of adversarial examples to diverge from the guiding vectors. By doing so, text modality features can be integrated when constructing the guiding vectors.

2.The method incorporates text attack into FGA, achieving superior attack effects through the interaction of attacking two modalities.

3.The experiments are solid and the analysis are reasonable.
limitations: limitations: 1.What is the motivation behind moving the feature vectors of adversarial examples closer to the guiding vectors? It seems more logical to move the feature vectors of adversarial examples as far away as possible.

2.Although introducing text attack into FGA is effective, this method lacks stealth and may be impractical for attackers, especially in scenarios where the text inputs are user-generated.

3.In the VQA task, what is the text 𝑡 in Equation 5? If it represents the answer to a multiple-choice question like “C”, how do you ensure that the generated adversarial text is also a choice like “A”, “B”, or “D”?

4.The indicative information in Figure 3 is insufficient, making the figure difficult to understand. More descriptive information should be added to the figure or its caption.

5.In Table 1, the performance of FGA in visual reasoning tasks is significantly superior compared to baseline methods. Additional explanation may be required to demonstrate the advantages of FGA in visual reasoning tasks.
paper_summary: paper_summary: The authors introduced a novel method to generate adversarial images for vision-language pre-trained (VLP) models. The method utilizes labels from the dataset to construct guiding vectors, which guide adversarial images away from the original label and towards other labels. The method requires a white-box model to construct adversarial images, but the transferability of the method is better than pre-existing methods.
strength_weakness: strength_weakness: - The method proposed by the authors is novel and intuitive; furthermore, the experimental results indicate that the method is transferable and effective on different kinds of VLP models.
- Informative constraints, such as the FGA$^1$ and FGA$_{l_1}$, highlights the effectiveness of the method.
- Extensive discussion about why the proposed method is more effective compared to previous "more naive" methods.
limitations: limitations: - The structure of the Methodology section can be changed for better understanding. More specifically, first introducing the guiding vectors and the rational behind the loss might be more useful in conveying the method.
- On a minor note, are there any reasons that the models will focus on the top-right corner of the adversarial images in Figure 4? The same phenomenon is not observed in Figure 1, but the context of both figures should be the same. Is this specific to some subset of images?
paper_summary: paper_summary: The paper "A Unified Understanding of Adversarial Vulnerability Regarding Unimodal Models and Vision-Language Pre-training Models" explores the adversarial vulnerabilities of both unimodal and Vision-Language Pre-training (VLP) models. It introduces a novel adversarial attack method, the Feature Guidance Attack (FGA), which utilizes text representations to manipulate image data, creating adversarial images that effectively compromise VLP models. By integrating text attacks into FGA, named Feature Guidance with Text Attack (FGA-T), the method enhances its efficacy across various datasets and settings, showcasing significant improvements in attack transferability and effectiveness. This research aims to bridge the gap in adversarial robustness between unimodal and multimodal scenarios, providing a unified framework for future robustness explorations in complex multimodal tasks.
strength_weakness: strength_weakness: 1. The FGA-T method, which incorporates text attacks into the FGA framework, has been shown to achieve superior attack effects against VLP models.
2. One of the critical contributions of this research is demonstrating the robust transferability of the FGA-T attacks. The method performs consistently across various datasets, downstream tasks, and both black-box and white-box scenarios.
limitations: limitations: 1. While the proposed methods are intriguing, the paper would benefit from a more robust comparative analysis with existing state-of-the-art adversarial attack techniques, especially those known for their effectiveness against VLP models.
2. Include a discussion on the ethical implications of your findings. Offer guidelines or considerations for responsible use and dissemination of knowledge related to adversarial attacks.
3. The paper effectively identifies and exploits vulnerabilities in VLP models but does not discuss potential defensive mechanisms. Including such information could make the research more comprehensive and practically valuable.