Text-Guided Attention is All You Need for Zero-Shot Robustness in Vision-Language Models

Authors: lu  yu
haiyang  zhang
changsheng  xu
Venue: NeurIPS_cc_2024_Conference
Published: 2024-05-13 02:54:49

Abstract: Due to the impressive zero-shot capabilities, pre-trained vision-language models (e.g. CLIP), have attracted widespread attention and adoption across various domains. Nonetheless, CLIP has been observed to be susceptible to adversarial examples. Through experimental analysis, we have observed a phenomenon wherein adversarial perturbations induce shifts in text-guided attention. Building upon this observation, we propose a simple yet effective strategy: Text-Guided Attention for Zero-Shot Robustness (TGA-ZSR). This framework incorporates two components: the Attention Refinement module and the Attention-based Model Constraint module. Our goal is to maintain the generalization of the CLIP model and enhance its adversarial robustness: The Attention Refinement module aligns the text-guided attention obtained from the target model via adversarial examples with the text-guided attention acquired from the original model via clean examples. This alignment enhances the model’s robustness. Additionally, the Attention-based Model Constraint module acquires text-guided attention from both the target and original models using clean examples. Its objective is to maintain model performance on clean samples while enhancing overall robustness. The experiments validate that our method yields a 9.58% enhancement in zero-shot robust accuracy over the current state-of-the-art techniques across 16 datasets. Our code is available at https://github.com/zhyblue424/TGA-ZSR.

Main paper: 
 introduction: 
 Large-scale pre-trained vision-language models (VLMs) have showcased remarkable success in artificial intelligence by seamlessly integrating visual and textual data to understand complex multimodal information, such as CLIP [48] . Leveraging vast datasets and powerful architectures such as BERT [10] and its variants [8, 33] , these models adeptly capture semantic relationships between images and texts, offering significant advantages across numerous applications. From image classification [14, 67, 55] and semantic segmentation [50] to image captioning [39] and vision question answering [44] , pre-trained VLMs revolutionize how machines perceive and interact with multimodal information. Their importance lies in their ability to learn rich representations from varied data streams, enabling zero-shot learning and transfer learning across domains and tasks. Thus ensuring the reliability of large-scale models is crucial. However, these models are vulnerable to adversarial attacks as many other networks as demonstrated by recent studies [38, 59] , even slight perturbations to input data can result in misclassification or altered outputs. Such attacks pose a significant challenge, particularly in critical applications like autonomous vehicles [60] , medical diagnosis [32] , and maritime navigation [29] , where the consequences of erroneous decisions can be severe. As these large-scale models become increasingly prevalent in real-world applications, understanding and 
related work: 
 Pre-trained Vision-language Models. In recent years, advancements in computer vision [12, 17, 34] have primarily relied on training models with image-label pairs to recognize predefined object categories. However, these approaches often overlook the inherent semantic connections between textual descriptions and visual content. Motivated by the remarkable progress witnessed in natural language processing (NLP), exemplified by breakthroughs like Transformer [56] , BERT [10] , and GPT-3 [3] , researchers are increasingly drawn to the prospect of using textual data to enhance the capabilities of DNNs. These methodologies are referred to as VLMs [21, 48, 49, 64] and one prominent approach is to directly learn the semantic similarity between images and corresponding textual descriptions through image-text pairs. By aligning the embeddings of these two modalities, models like CLIP [48] , ALIGN [21] , BLIP [25] , Visual-BERT [47] , and ALBEF [26] aim to achieve superior performance across various tasks. CLIP [48] leverages a vast dataset of 400 million imagetext pairs sourced from the internet and employs contrastive loss to effectively align the embeddings of both modalities, thereby enhancing the model's capabilities. Experimental results underscore the significant performance gains achieved by incorporating textual information into the model, with zero-shot performance surpassing that of earlier deep neural network architectures. However, despite its impressive zero-shot accuracy, experiments [38, 59] reveal vulnerabilities to adversarial examples, resulting in a notable decline in robustness.Adversarial Robustness. Deep neural networks have been found to be vulnerable to adversarial examples [54, 36, 40, 66] , which can fool DNNs to produce false outputs, rendering trained models unreliable. To bolster robustness against such adversarial attacks, various advanced methods have been proposed, including data augmentation [28, 58, 27, 65] , adversarial training [69, 53, 61, 68] , progressive self-distillation [1] , randomization strategy [11, 35] , and adversarial purification [41, 24, 62] . While these strategies aim to improve DNNs' adversarial robustness, they often come with increased complexity or limited generalizability. Adversarial training [69, 53, 61, 68] stands out as one of the most widely used and effective approaches, fine-tuning DNNs by generating adversarial examples during training. After the emergence of CLIP [48] , many subsequent works [45, 16, 63] have utilized CLIP as a backbone, yet little attention has been given to studying its adversarial robustness. CLIP is shown to be susceptible to adversarial examples [38] as well, posing a significant threat to downstream tasks utilizing CLIP as a backbone. Hence, investigating the adversarial robustness of CLIP is crucial.Zero-shot Adversarial Robustness for VLMs. The visual-language model, trained on both image and text data, serves as a foundational model for various tasks. However, it has shown vulnerability to adversarial examples [38, 59] , and training from scratch is time-intensive. TeCoA [38] was the first to explore zero-shot adversarial robustness for VLMs, aiming to enhance CLIP's adversarial robustness by minimizing the cross-entropy loss between image logits and targets. While TeCoA solely utilizes cross-entropy loss, yielding only marginal performance improvements, PMG-AFT [59] extends this approach by minimizing the distance between features of adversarial examples and those of the pre-trained model. FARE [51] primarily focuses on maintaining high clean accuracy while improving model robustness, achieving this by constraining the distance between the original and target model embeddings. Our experiments reveal significant differences in attention maps between original examples and adversarial examples. Leveraging this insight, we enhance model robustness by constraining it with text-guided attention.Question: Does the paper discuss the limitations of the work performed by the authors? Answer: [Yes] Justification: Our approach entails certain limitations, which we acknowledge in Section 5 and commit to addressing through subsequent research.Guidelines:• The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper. • The authors are encouraged to create a separate "Limitations" section in their paper.• The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be. • The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated. • The authors should reflect on the factors that influence the performance of the approach.For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon. • The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size. • If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness. • While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations. 
preliminaries and problem setup: 
 Following the previous works [38, 59] , we choose CLIP model as the pre-trained VLMs for image classification task. Given an image-text pair (x, t), where x represents an image and t represents a textual prompt, CLIP learns to encode both the image and the text into fixed-dimensional embeddings. Let f (x) denote the embedding of the image x and g(t) denote the embedding of the text prompt t, y is the one-hot vector label. For training or fine-tuning on the downstream tasks, we use the cross-entropy loss, denoted as L(x, t, y).EQUATIONwhere we set y ij = 1 if the image-text pair is positive, otherwise, y ij = 0. τ is the temperature parameter and cos indicates calculating the cosine similarity of the two embeddings.Adversarial Attacks. Adversarial attacks are a concerning phenomenon where small, often imperceptible perturbations are intentionally applied to input data with the aim of deceiving a model into producing incorrect outputs. These perturbations are crafted with the goal of causing the model to misclassify or generate erroneous predictions while appearing indistinguishable to human observers. The Projected Gradient Descent (PGD) [36] method is an iterative approach for crafting adversarial examples. It starts with the original input data and then iteratively adjusts the data in the direction that maximizes the model's loss function while ensuring the perturbed data remains within a specified perturbation budget. Mathematically, the PGD attack can be expressed as follows:EQUATIONHere, L represents the loss function, x denotes the original input data, ε controls the magnitude of perturbation, and ▽ x L represents the gradient of the loss function with respect to the input data. x a which can be formulated as:EQUATIONAdversarial training is a technique to generate adversarial examples from the original training data and then use these examples to train the model, forcing it to learn to resist adversarial perturbations.To adapt the model to the downstream tasks, we apply adversarial fine-tuning on one target model towards robustness with the following loss:EQUATIONWhere J represents the total loss function used for training the model.Zero-Shot Adversarial Robustness. In this paper, we investigate the zero-shot adversarial robustness of CLIP model, which refers to the ability of these models to maintain performance and reliability even when encountering unseen adversarial samples during inference, with only adversarial fine-tuning the original CLIP model on one target dataset, such as Tiny-ImageNet.Text-Guided Attention. Attention mechanisms [30, 16, 31] play a crucial role in enhancing vision model performance across various tasks. At its core, attention enables models to focus on relevant parts of the input data while suppressing irrelevant information. Similarly, in VLMs, by incorporating textual guidance, the models can effectively focus on relevant visual features while processing language, thus facilitating more accurate and coherent multimodal understanding. Additionally, text-guided attention enhances interpretability by providing insights into the model's decision-making process, fostering trust and understanding in complex multimodal systems. Thus, we investigate the impact of text-guided attention on enhancing and interpreting zero-shot adversarial robustness in VLMs in this paper. We define the text-guided attention as following:EQUATIONWhere f g (x) represents the global image feature before the pooling operation of f (x), and P denotes the dimension of the attention embeddings. We reshape A to R √ P × √ P to obtain the attention map, which is then resized to A ∈ R H×W . Finally, we apply a normalization operation (norm) on A to obtain the final text-guided attention map.Interpretation of Adversarial Attacks. The previous research has predominantly focused on bolstering the zero-shot robustness of Vision-Language Models (VLMs), yet the reasons leading to mis-classifications induced by adversarial attacks remain unclear. This paper aims to shed light on interpreting the impact of adversarial attacks on VLMs. By employing Eq. 5, we compute the text-guided attention for both the original image (Ori. image) and its corresponding adversarial counterpart (Adv. image), as depicted in Fig. 1 . Remarkably, despite the subtle discrepancies imperceptible to the human eye between the adversarial example and the original image, the former is mis-classified (labels in red). However, a significant difference emerges in the respective text-guided attention maps. Specifically, we observe a notable shift in the text-guided attention of the adversarial example, characterized by instances of displacement towards other objects, backgrounds, or even disappearance. For instance, while the original images in the first, second, and fourth columns pay attention to their subjects' heads, in their adversarial counterparts, attention diverges elsewhere. In the third column, the attention shift leads from the correct object to an incorrect one, resulting in mis-classification. In the fifth and seventh columns, the attention in their adversarial counterparts is redirected towards the background.The semantic information embedded within text representations are preserved through a frozen text encoder, offering invaluable guidance when adversarial perturbations disrupt relevant visual features, which has not been explored for zero-shot robustness of vision-language models. We introduce the Attention Refinement Module, designed to effectively filter out irrelevant information, thereby mitigating the impact of adversarial attacks seeking to exploit vulnerabilities in the model's decision-making process. Moreover, to maintain model's ability to generalize effectively on clean images, we introduce the Attention-based Model Constraint Module. This module ensures consistent performance on clean data while enhancing the model against adversarial disruptions. Additionally, employing text-guided attention enhances interpretability, offering crucial insights into how the model integrates and processes information across modalities. This interpretability not only instills trust in the model's predictions but also facilitates the detection and mitigation of adversarial attacks. Our approach (i.e. TGA-ZSR) presents a comprehensive framework (as shown in Fig. 2 ) for enhancing model robustness to adversarial perturbations while concurrently improving interpretability. We will introduce the details as follows.Attention Refinement Module. Based on the insights gained in Section 3.2, we propose an attention refinement module aimed at enhancing the robustness of the model. This module is designed to rectify the text-guided attention of adversarial samples, which often leads to altered predictions. Our approach aligns the adversarial attention map with that of the clean samples, known for their high-accuracy attention distribution. This simple yet effective strategy serves to mitigate the impact of adversarial perturbations on the model's predictions.We take the generated adversarial sample x a to the target model f tar g (•) and the clean sample x to the original model f ori g (•) and obtain the adversarial attention map A(x i a ) tar and the clean attention map A(x i ) ori respectively. The attention refinement loss L AR is thus defined as:EQUATIONwhere A(x a ) tar = f tar g (x a ) • g(t) T and A(x) ori = f ori g (x) • g(t) T1 , ∥∥ 2 denotes the L 2 distance computation between two attention maps.Attention-based Model Constraint Module. The Attention Refinement module serves to enhance the robustness of the models, consequently improving the accuracy of adversarial samples. However, this enhancement comes with a trade-off: it may marginally sacrifice the accuracy on clean samples due to shifts in model parameters. To preserve the generalization capability of pre-trained VLMs, we introduce an Attention-based Model Constraint module. This module aims to mitigate performance drops on clean images, thereby ensuring the overall effectiveness and reliability of the model. Specifically, we input the clean sample x into the target model f tar g (•), adversarially fine-tuned on the Tiny-ImageNet dataset, to acquire the text-guided attention map A(x) tar . Concurrently, the original text-guided attention map outputted from the original CLIP model f ori g (•) is denoted as A(x) ori . To ensure the preservation of importance parameters for clean images, we enforce an L 2 distance constraint between these two attention maps. The attention-based model constraint loss L AM C is formulated as:EQUATIONThus the final loss function can be represented as:L total = L CE + α • L AR + β • L AM C (8)4 ExperimentsQuestion: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?• The method for calculating the bars should be explained (closed form formula, call to a library function, bootstrap, etc.) • The assumptions made should be given (e.g., Normally distributed errors). • It should be clear whether the error bar is the standard deviation or the standard error of the mean. Justification: We discuss both potential positive societal impacts and negative societal impacts of the work performed in Section 5. Guidelines:• The answer NA means that there is no societal impact of the work performed.• If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations. • The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster. • The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology. • If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML). 
experimental setup: 
 Datasets. Our experiments begin with training the pre-trained CLIP model on the Tiny-ImageNet [9] .Then we evaluate the model's zero-shot adversarial robustness across 15 subsequent datasets, fol-Table 1 : Zero-shot robust accuracy on images attacked with 100 steps of PGD [36] . We performed several different methods on Tiny-ImageNet and evaluated across 16 datasets. The optimal accuracy is highlighted in bold, while the second-best accuracy is underlined. The values in parentheses represent the standard deviation. lowed by previous studies, such as TeCoA [38] and PMG-AFT [59] . These datasets include several commonly used classfication datasets, including CIFAR-10 [23], CIFAR-100 [23] , STL-10 [6], Ima-geNet [9] , Caltech-101 [13] , and Caltech-256 [15] . Additionally, fine-grained image classification datasets such as StanfordCars [22] , Flowers102 [42] , Food101 [2] , FGVCAircraft [37] , and Oxford-Pets [46] are included. Furthermore, the scene recognition dataset SUN397 [43] , the medical image dataset PCAM [57] , and the satellite image classifacation dataset EuroSAT [18] and the texture recognition dataset DTD [5] are incorporated for comprehensive evaluation. We also conduct experiments on four additional datastes (i.e. ImageNet_subset, ImageNet-A, ImageNet-O and ImageNet-R) as shown in Supp. Mat. A.1.Implementation Details. Following the protocol of previous works [59] , we fine-tuned the CLIP model on the adversarial samples of Tiny-ImageNet [9] as 'adversarial fine-tuning' and subsequently evaluated its performance across 15 datasets and Tiny-ImageNet itself. We employ ViT-B/32 as the backbone in CLIP and utilize the SGD optimizer to minimize loss. During adversarial fine-tuning, we update all parameters of the image encoder with a learning rate of 1e-4, weight decay of 0, momentum of 0.9, and a batch size of 128. We utilize l ∞ norm PGD-2 [36] To validate the effectiveness of our approach, we conduct comparisons with several state-of-theart methods such as TeCoA [38], PMG-AFT [59] , and FARE [51] . Additionally, we extend the comparison to include CLIP (the original pre-trained CLIP model), FT-Adv. (adversarial fine-tuning using the contrastive loss of the original CLIP) and FT-Clean (fine-tuning on clean examples with the contrastive loss of the original CLIP) for a comprehensive evaluation. Adversarial Zero-shot Robust Accuracy. Table 1 shows that the average accuracy of our TGA-ZSR outperforms the original CLIP model by 37.19%. Compared to current stat-of-the-art method, PMG-AFT, the proposed method achieve an average improvement of 9.58%. In general, our method is superior than all the other methods on most datasets except a comparable result on PCAM dataset. In addition, we obtain the best result on Tiny-ImageNet, which is not a strict zero-shot test. It indicates that our method is robust on the adversarial attack on both seen and unseen datasets.Zero-shot Clean Accuracy. 3 . We can see that the original CLIP model experienced a significant performance decline, decreasing to 0.09% on the adversarial example. Our TGA-ZSR also demonstrates a decline but still achieves superior results compared to other methods, validating its effectiveness against stronger attacks.Results against CW Attack. CW attack [4] is an optimization-based approach designed to generate small perturbations to input data, causing the model to make incorrect predictions while keeping the perturbed input visually similar to the original. We further evaluate the robustness of our approach against this challenging attack, using a perturbation bound of ε = 1/255. The results, shown in Table 4 , demonstrate that our method significantly outperforms the state-of-the-art method PMG-AFT on both adversarial and clean samples. This substantial margin indicates the adversarial robustness of our proposed method.Different Types of Attentions. To validate the important role of text-guided attention in our method, we conducted experiments by replacing it with vision-based attention. We employ Grad-CAM [52] , a widely adopted method, for generating attention maps based on vision. Table 5 demonstrates that replacing the text-guided attention with vision-based attention yields results that are still comparable to the state-of-the-art method PMG-AFT in terms of both zero-shot robust accuracy and clean accuracy. This finding validates the effectiveness of our method's pipeline. Furthermore, our text-guided attention significantly improves the average accuracy, demonstrating the advantage of incorporating textual guidance.Effect of Attack Strength. We further assess the robustness of the pre-trained model by different levels of PGD-2 attacks. Specifically, we set ε to values of 1/255, 2/255 and 4/255, progressively amplifying the magnitude of the adversarial perturbation. This allows us to investigate whether a model trained on weak adversarial examples exhibits robustness against stronger adversarial perturbations. In Table 6 , we present the average results for three distinct levels of attack strength. Despite a general decline in the robustness of all methods, our approach still achieves superior results, outperforming PMG-AFT by 1.18%, and FARE by 11.91%.Effect of Each Component. We conducted several experiments to thoroughly evaluate the effectiveness of each component of our method, as summarized in Table 7 . Using L CE alone significantly enhances the model's robustness through standard adversarial training, but it also results in a notable decrease in clean accuracy compared to the original CLIP model. Applying our Attention Refinement module further improves the average zero-shot accuracy on both adversarial and clean samples. Finally, the Attention-based Model Constraint module dramatically boosts performance, increasing robustness by 10.25% and clean accuracy by 6.52%.Trade-off between Robust and Clean Accuracy. Achieving the balance between robustness and clean accuracy is crucial in adversarial training. Overfitting in models tends to yield high robustness but low clean accuracy, whereas underfitting typically results in the opposite scenario. As shown in Fig. 3 , methods positioned close to the dotted line excel in either adversarial accuracy or clean accuracy, yet they often struggle to strike a balance between robustness and clean accuracy. In contrast, our method demonstrates not only an enhancement in the model's robustness but also the maintenance of clean accuracy, resulting in an overall superior performance.More comprehensive and detailed ablation studies, including hyperparameter selection, the effect of distance metrics on the loss function, and the effect of learning rate, can be found in Supp. Mat. A.2.We have evaluated our method against others in terms of memory usage, training time, and test time, and the results are summarized in Table 8 . Our method increases memory consumption by approxi-  
conclusion and limitations: 
 In this paper, we discovered that adversarial attacks lead shift of text-guided attention. Building on this observation, we introduce a text-guided approach, TGA-ZSR, which incorporates two key components to preform adversarial fine-tuning and constrain the model. This strategy prevents model drift while enhancing model robustness. Extensive experiments validate the performance of TGA-ZSR, which not only improves CLIP's zero-shot adversarial robustness but also maintains zero-shot clean accuracy on clean examples, gaining a favorable balance.Limitations. We use a simple text-guided attention mechanism by multiplying the text embedding and vision embedding which is effective against most attack types. However, for more challenging attacks such as AutoAttack, the improvement remains limited. This indicates that while our approach shows promise, it may require further refinement to enhance robustness under stronger adversarial scenarios.Border Impact. Large-scale pre-trained vision-language models (VLMs) like CLIP [48] integrate visual and textual data, revolutionizing applications such as image classification, semantic segmentation, and vision question answering. While these models excel in zero-shot learning and transfer learning, they are vulnerable to adversarial attacks, posing risks in critical applications like autonomous vehicles and medical diagnosis. Adversarial training improves robustness but has practical challenges, including increased computational overhead and potential overfitting. Exploring zero-shot adversarial robustness is essential to ensure reliability.Table 9 : Zero-shot robust accuracy on images attacked with 100 steps of PGD [36] . We performed several different methods on ImageNet_subset and evaluated across 16 datasets. The optimal accuracy is highlighted in bold, while the second-best accuracy is underlined. Results on Diverse Datasets. In addition to validate the method on 16 datasets following the evaluation protocol of previous works, we also conduct evaluations on three additional datasets: ImageNet-A (natural adversarial examples) [20] , ImageNet-O (out-of-distribution data) [20] , and ImageNet-R (multiform art form) [19] . In Table 11 and Table 12 , the clean accuracy on ImageNet-A is notably lower compared to ImageNet-O and ImageNet-R . In general, other methods enhance robust accuracy by around 2%, they also incur a steep 20% drop in clean accuracy. In contrast, our approach achieves a notable 5% improvement in zero-shot robust accuracy, although with a 16% decrease in clean accuracy, outperforming other methods. Although our method doesn't excel in zero-shot clean accuracy for ImageNet-O and ImageNet-R, it excels in optimizing zero-shot robust accuracy. Overall, our method yields the best results across these three datasets, as demonstrated by the Average.Table 11 : Zero-shot robust accuracy on images attacked with 100 steps of PGD [36] . We performed different several methods on Tiny-ImageNet and evaluated in the following three additional datasets. The optimal accuracy is highlighted in bold, while the second-best accuracy is underlined.  
safeguards: 
 Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?Answer: [NA] Justification: The model and dataset employed in our study are widely recognized and do not exhibit any inherent issues.Guidelines:• The answer NA means that the paper poses no such risks.• Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters. • Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images. • We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.12. Licenses for existing assets Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?Answer: [Yes] Justification: The models, methodologies, datasets, and other elements used are appropriately aligned and referenced throughout the paper.Guidelines:• The answer NA means that the paper does not use existing assets.• The authors should cite the original paper that produced the code package or dataset.• The authors should state which version of the asset is used and, if possible, include a URL. • The name of the license (e.g., CC-BY 4.0) should be included for each asset.• For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.• If assets are released, the copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset. • For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided. • If this information is not available online, the authors are encouraged to reach out to the asset's creators. 
new assets: 
 Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?Answer: [NA]Justification: The paper does not release new assets.Guidelines:• The answer NA means that the paper does not release new assets.• Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc. • The paper should discuss whether and how consent was obtained from people whose asset is used. • At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file. 
crowdsourcing and research with human subjects: 
 Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?Answer: [NA]Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper. • According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector. 
institutional review board (irb) approvals or equivalent for research with human subjects: 
 Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?Answer: [NA]Justification: The paper does not involve crowdsourcing nor research with human subjects.Guidelines:• The answer NA means that the paper does not involve crowdsourcing nor research with human subjects. • Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution. • For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review. 
 
 Appendix: Trade-off between α and β. Following the protocol of previous works (TeCoA [38] , PMG-AFT [59] , FARE [51] ), we fine-tuned the CLIP model on adversarial samples from a single dataset (Tiny-ImageNet in our case) for 'adversarial fine-tuning' and subsequently evaluated its performance across 15 datasets, including Tiny-ImageNet itself. Thus we only need to tune hyperparameters on just the training dataset. We randomly selected 80% of the training set for training and the remaining 20% for validation to choose the hyperparameters. The validation set results are shown in Table 13 .The final results on the test set were obtained by training on the entire training set using the optimal hyperparameters (α=0.08, β=0.05) identified from the validation set. After choosing the optimal hyper-parameter on the validation set of the Tiny-ImageNet dataset, we proceeded to analyze the sensitivity of these hyper-parameters on the overall performance across 16 datasets, including the Tiny-ImageNet and 15 additional datasets. This step was crucial for evaluating the robustness and generalizability of the model under different hyper-parameter settings. Table 14 and Table 15 demonstrate the results of different hyper-parameter of α and β in Eq. 8.Table 14 : Zero-shot robust accuracy on images attacked with 100 steps of PGD [36] . We compared the results of different hyper-parameters on Tiny-ImageNet and evaluated across 16 datasets. The optimal accuracy is highlighted in bold, while the second-best accuracy is underlined. Effect of Each Component. Due to space constraints, a detailed experiment on the effect of each component was not provided in Table 7 . Therefore, we present here a comprehensive experiment detailing the effect of each component. To explore the impact of each component on the final model performance, we conducted a series of ablation experiments to evaluate the effectiveness of each component. From the experimental results Table 16 and Table 17 , it's clear that the inclusion of our text-guided attention components enhances CLIP's zero-shot robust accuracy and maintains its zero-shot clean accuracy. Effect of Distance Metrics on Loss Function. Except l 2 , cosine and l 1 are also frequently utilized distance metrics. We compared the performance of our method using these distance metrics. The results from Table 18 and Table 19 demonstrate that cosine and l 1 exhibit similar performance but are inferior to l 2 , except for the zero-shot clear accuracy on PCAM. l 2 outperforms the other two distance measures by enhancing zero-shot adversarial robustness and zero-shot clean accuracy by approximately 12% and 11%, respectively. Thus we choose l 2 distance to measure in our loss function.Effect of Learning Rate. Learning rate stands as a significant hyper-parameter in model training.Here we validate the effect of the learning rate for the experiment in Table 20 and Table 21 . When the learning rate is set to 0.001, we observe the lowest values for both zero-shot robust accuracy and zeroshot clean accuracy. And, when we reduce the learning rate to 0.00001, we note that CLIP's zero-shot clean accuracy remains relatively stable, demonstrating the highest performance in this experiment. However, it affects CLIP's zero-shot robust accuracy, resulting in a less favorable balance. Selecting a learning rate of 0.0001 achieved a well-balanced improvement, with the average of zero-shot robust accuracy and zero-shot clean accuracy increasing by 18.48% and 6.41%, respectively, compared to the learning rates of 0.001 and 0.00001.Table 18 : Zero-shot robust accuracy on attacked with 100 steps of PGD [36] . We compared the results of different distance metrics on Tiny-ImageNet and evaluated across 16 datasets. The optimal accuracy is highlighted in bold. Justification: In the abstract and introduction, we provide a clear explanation of the motivation behind our approach. At the conclusion of the introduction, we enumerate the contributions of this paper, etc. We provide details in Abstract and Introduction.Guidelines:• The answer NA means that the abstract and introduction do not include the claims made in the paper. • The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers. • The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings. • It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.We only compute the attention map for the image corresponding to the text prompt of the ground-truth label. 


Decision: The paper introduces a method to improve the robustness of visual language pretrained models. Building on insights from text-guided attention, the authors propose two modules—the Attention Refinement module and the Attention-based Model Constraint module—to enhance model robustness. While the reviewers raised concerns about additional comparisons, complexities, and unclear wording, the AC found that the rebuttal effectively addressed all these issues. In light of this, the AC recommends acceptance. The authors are encouraged to incorporate all changes and additional experimental results into the final camera-ready version of the paper.

Reviews: review: paper_summary: paper_summary: The paper proposes a framework, Text-Guided Attention for Zero-Shot Robustness (TGA-ZSR), to enhance the robustness of vision-language models (VLMs) against adversarial attacks. The proposed method incorporates two modules: the Attention Refinement module and the Attention-based Model Constraint module. The Attention Refinement module aligns the text-guided attention of adversarial examples with clean examples, while the Attention-based Model Constraint module maintains the model’s performance on clean samples.
strength_weakness: strength_weakness: 1. The incorporation of text-guided attention mechanisms and multiple modules may increase the complexity of implementation and computational overhead.
2. Although the authors claim zero-shot robustness in Vision-Language Models, the experiments and methods only target the CLIP model.
3. Missing limitation in Section 5.
questions: questions: 1. What is the additional computational overhead introduced by the Attention Refinement and Attention-based Model Constraint modules? How does this impact training and inference times compared to baseline methods?
2. How well does the proposed method generalize to other types of vision-language tasks beyond image classification, such as image captioning or visual question answering?
3. Why is the proposed method fine-tuned on Tiny-ImageNet rather than ImageNet? Both TeCoA [1] and FARE [2] are trained on ImageNet. 

[1] Mao, C., Geng, S., Yang, J., Wang, X., & Vondrick, C. (2022). Understanding zero-shot adversarial robustness for large-scale models. 

[2] Schlarmann, C., Singh, N. D., Croce, F., & Hein, M. (2024). Robust clip: Unsupervised adversarial fine-tuning of vision embeddings for robust large vision-language models.
limitations: limitations: N/A
paper_summary: paper_summary: This paper proposes an approach to improve the adversarial robustness of vision-language models while maintaining performance on clean images. The key idea is to aligns the attention maps of adversarial examples with clean examples. Extensive experiments demonstrate the effectiveness of the proposed method in zero-shot adversarial robustness across multiple datasets while maintaining high clean accuracy.
strength_weakness: strength_weakness: 1. The method is only demonstrated on CLIP, raising questions about its applicability to other vision-language models or architectures.

2. The method introduces additional hyperparameters without a clear strategy for tuning them across different datasets or tasks. 

3. No error bars or statistical significance tests reported for the experimental results.
questions: questions: 1. How sensitive is the method to the choice of hyperparameters? Is there a principled way to select these across different datasets or tasks? 

2. Are there any scenarios or types of adversarial attacks where this method performs poorly? What are the limitations of this approach?
limitations: limitations: The authors did not explicitly address the limitations such as the types of adversarial attacks where this method performs poorly.
paper_summary: paper_summary: This work studies the robustness to adversarial samples for CLIP. Inspired by an observation that adversarial perturbations induce shifts in text-guided attention, the work proposes a simple yet effective approach to improve the zero-shot robostness, i.e., align the text-guided attention of clean samples and adversarial samples. The state-of-the-art performance across 16 datasets demonstrate the effectiveness of the proposed method.
strength_weakness: strength_weakness: I would like to see more comparison with other types of attention, e.g., vision-only self-attention. Does the proposed method works because of the attention mechanism or the text guidance?
questions: questions: 1. How do you utilize the class token in the ViT backbone of CLIP? 
2. In Tables 13 and 14, why the losses L1 and L2 have very different performance?
limitations: limitations: The paper has discussed the limitations and potential impacts of the work.
paper_summary: paper_summary: The paper focuses on enhancing the robustness of CLIP models against adversarial perturbations. The approach utilizes saliency maps generated by the inner products between image and text embeddings. Two regularization terms are introduced: the first aims to align the saliency maps of the original and its adversarial examples, while the second seeks to match the saliency maps of the original example between the pre-trained CLIP model and the target model. Experimental results indicate that fine-tuning CLIP with these two regularization terms improves its robustness to attacks.
strength_weakness: strength_weakness: 1.	The abstract claims that the goal is to enhance both the generalization and robustness of the CLIP model; however, the experimental results do not fully support this assertion. Specifically, regarding generalization, Table 2 shows a significant decrease in clean accuracy compared to the original pre-trained CLIP model. I kindly ask the authors to use the terms "generalizability" and "adversarial robustness" more carefully within the paper. Typically, the generalizability of CLIP models refers to their zero-shot classification performance across different datasets. It may be argued that the proposed method improves the adversarial robustness of CLIP models while maintaining relatively good generalizability compared to previous adversarial training methods. However, the authors must acknowledge the decrease in generalizability compared to original CLIP model as clearly evidenced by the results in Table 2.

2. Since the training uses adversarial examples produced by PGD, it is not surprising that the proposed method results in a model with good robustness to PGD attacks, as shown in Table 1. However, when the evaluation comes to AutoAttack, the advantage of the TGA-ZSR over the previously best method is marginal as shown in Table 3. Could the authors provide explanations for this point, and could they demonstrate the robustness of the resulting models to more attacks?
questions: questions: See weaknesses.
limitations: limitations: The primary limitation of the paper is that the experimental results presented do not sufficiently support its claims. I recommend that the authors either revise the claims to align more closely with the data presented or extend the experimental section to provide additional evidence supporting their assertions.

Comments: comment: Thanks for the authors' response and their valuable insights. My concerns have been addressed. I wil increase my rating to Weak Accept.
Thanks for your question. We will incorporate these discussions into the final version.

We compute the **text-guided attention** $A(x)$ by simply multiplying the text embedding $g(t)$ with the vision embedding $f_{g}(x)$. Specifically, this is expressed as $A(x)=f_{g}(x) \cdot g(t)^ \mathsf{T} $, where  $f_{g}(x)$ represents the global image features before the pooling operation of the class token $f(x)$ (as described in Equation 5 and in Lines 162-166 of the paper). Text-guided attention incorporates textual context, potentially offering more precise and context-aware localization of relevant image features.

For comparison, the **vision-only attention** is obtained using the widely adopted visualization technique in deep learning, Grad-CAM [49]. The Grad-CAM heatmap $L_{\text{Grad-CAM}}^c $ for class $c$ is defined as $L_{\text{Grad-CAM}}^c = \text{ReLU} \left( \sum_k \alpha_k^c A^k \right)$, where $\alpha_k^c = \frac{1}{Z} \sum_i \sum_j \frac{\partial y^c}{\partial A_{ij}^k}$. Here, $y^c$ denotes the class score, $i,j$ are the spatial dimensions within the activation map of the $k$-th convolutional layer $A^k$, and $Z$ represents the total number of spatial locations $i \times j$ in the feature map. The Grad-CAM method highlights regions of the image that are most relevant to the class prediction by calculating the gradients of the class score with respect to the activation map.

Figure 1 demonstrates the results of our text-guided attention. We first convert a grayscale attention map into a color map using the ‘cv2.applyColorMap’ function. This colorized attention map is then overlaid onto the original image through a weighted sum: $ image \times 0.4 + attention × 0.6$ (these weights can be adjusted to achieve the desired visual emphasis), as similarly demonstrated in references [e] and [f]. The resulting image, shown in Figure 1, effectively highlights the areas of focus for the model, providing a clear visualization of its attention.


[49] Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and456
Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In457
Proceedings of the IEEE international conference on computer vision, pages 618–626, 2017.

[e] Song, Y., Jang, S., Katabi, D., & Son, J. (2023). Unsupervised Object Localization with Representer Point Selection. 2023 IEEE/CVF International Conference on Computer Vision (ICCV), 6511-6521.

[f] Li, Y., Wang, H., Duan, Y., & Li, X. (2023). CLIP Surgery for Better Explainability with Enhancement in Open-Vocabulary Tasks. ArXiv, abs/2304.05653.
I thank the authors for their responses. All my concerns have been addressed. I will increase my rating from 4 to 5.
Thanks for the authors' response. I would like to confirm with you the details of your experiment settings. Specifically, I wonder how do you calculate the attention map when using text-guided attention and vision-only attention in this experiment (and how in Fig. 1).
Thank you for taking the time to review our response and for your support. We are glad to hear that the response addressed your concerns.
Thank you for taking the time to review our response and for recognizing the insights and interest in our work. We are pleased to hear that our previous response addressed your concerns.

Regarding your new question, we believe that the significant improvement in robustness with text guidance can be attributed to two key aspects:

(1) **Selective Focus on Relevant Features**: Text-guided attention allows the model to selectively focus on the most relevant parts of the image based on the text input. For instance, if the text describes "a photo of an apple," the attention mechanism guides the model to focus on the apple in the image, while ignoring irrelevant details. This selective focus enables the model to extract the most pertinent information, thus enhancing robustness by minimizing distractions from non-essential features.

To illustrate the advantage of text-guided attention over vision-only attention, we calculated the mean Intersection over Union (mIoU) of the attention maps generated by both methods on the validation set of the ImageNet-S-50 dataset [d], which includes ground truth masks for semantic segmentation tasks. The results below demonstrate that the mIoU of text-guided attention is significantly higher than that of vision-only attention, indicating the superior effectiveness of our approach.

Table 8: mIoU Comparison of Text-Guided and Vision-Only Attention on ImageNet-S-50 Dataset.
| Method | mIoU |
|----------| -------| 
|     Text-guided    | **0.485** |
|   Vision-only  | 0.400 |

(2) **Consistency Across Modalities**: By integrating text-guided attention, the model maintains consistency between the visual and textual modalities. The attention mechanism aligns visual features with corresponding textual descriptions, reinforcing the semantic connections between the two. This alignment reduces the risk of the model making inconsistent or erroneous predictions based on a single modality, thereby enhancing overall robustness.

To further support this point, we conducted an experiment measuring the difference (L2 distance) in attention maps before and after an adversarial attack using both the text-guided attention-based model and the vision-only model on the TinyImageNet validation set. The results below show that the text-guided attention model maintains better consistency after the attack compared to the vision-only model.

Table 9: L2 Distance Comparison Before and After Attack on TinyImageNet.
| Method | L2 distance|
|----------| -------| 
|     Text-guided    | **29.886** |
|   Vision-only  | 52.918 |

Based on these findings, we believe that the introduction of text guidance significantly enhances the robustness of the model.

We hope this response addresses your concerns.

[d] Shanghua Gao, Zhong-Yu Li, Ming-Hsuan Yang, Ming-Ming Cheng, Junwei Han, and Philip Torr. Large-scale unsupervised semantic segmentation. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2022.
Thank you for your detailed response. I will be maintaining my initial score.
Thanks for the authors' response. My concerns have been addressed. 

Additionally, I have one more question about the proposed model: Why introducing the text guidance can significantly improve the robustness? I think this work is insightful and the proposed model is interesting, and thus I would like to see more analysis or more insights. 

If the authors can address this, I am willing to increasing my rating.
Thank you for taking the time to read our response and increasing your score! We are glad to hear that the response addressed your concerns.
The author have addressed my concern, and I will change my score from 4 to 5.