Paper: Quantifying and Enhancing Multi-modal Robustness with Modality Preference (ICLR-2024)

Reviewer comment (Experiments):
"Robustness against multi-modal attacks" mentioned in Section 4.2, since multi-modal attacks are considered, the experimental results in Table 1 only consider single-mode attacks (#a, #v). Is the method proposed in this paper effective when co-attacks (both modality attacks) are existing? In [1,2], more effective multi-modal attack methods are proposed than uni-modal (such as #a and #v) attacks. Can the proposed method effectively resist these multi-modal attack methods? It is suggested that the relevant experiments should be added to Section 4.2, otherwise the conclusion of "Robustness against multi-modal attacks" is somewhat not convincing.

Author response:
Thank you for your comment. In fact, **the adversarial results in Table 1 is actually the multi-modal attack, where both of the modalities are perturbed**. This multi-modal attack will be more effective than each single-modality attack of the same size. Moreover, **we also report results about additional multi-modal attacks**.  First, we apply the Multi-modal Embedding Attack (MEA) method [1], where the co-attack is designed based on the alteration of the joint representation rather than the prediction. Second, we also apply two multi-modal attack methods, introducing Multi-modal Gaussian Noise (MGN) and randomly Multi-modal Pixel Missing (MPM).  These experiments indicate that except for existing multi-modal attacks (FGM, PGD-$\ell_2$), our method can also resist various types of multi-modal attacks. 

|                           |   JT   |    GB   |   OGM   |   PMR   |    AT   |   Mixup   |  MSEFM  | CRMT-JT (ours) | CRMT-Mix (ours)| CRMT-AT (ours) |
|:-------------------------:|:-------:|:-------:|:-------:|:-------:|:-------:|:-------:|:-------:|:-------:|:--------:|:-------:|
|     MGN     | 0.5254  | 0.4622  | 0.5269  | 0.4797  | 0.5240  | 0.5015  | 0.4775  | 0.5603  |  0.6337  | 0.6039  |
| MPM | 0.3154  | 0.3445  | 0.4462  | 0.3278  | 0.3699  | 0.4673  | 0.2980  | 0.5073  |  0.5698  | 0.5480  |
|            MEA            | 0.3401  | 0.4121  | 0.3626  | 0.4549  | 0.5879  | 0.4782  | 0.5000  | 0.5560  |  0.5654  | 0.6890  |

[1] J. Zhang, Q. Yi, and J. Sang, “Towards adversarial attack on vision- language pre-training models,” in *Proceedings of the 30th ACM International Conference on Multimedia*, 2022, pp. 5005–5013.

Reviewer comment (Reproducibility):
**Missing implementation details**: I may have missed something; however, I did not find any implementation details about the multi-modal encoders. What are the backbones used in the experiment? Can the proposed method apply to different backbones?

Author response:
Thank you for your comments. 

a. As shown in Section 4.1 in the manuscript, we present that we use the widely used backbone ResNet18 as the uni-modal encoder, for Audio, Vision, and Optical Flow modalities. Then, the uni-modal representation is concatenated to form the multi-modal joint representation. We have updated the experiment section to clarify this setting.

b. We conduct experiments on different backbones, including ResNet34 (Vision, V+Audio, A), and ResNet18 (Vision, V) + Transformer (Audio, A) on the Kinetic-Sounds dataset. These experiments show the improvement and the flexibility of our method across different backbones. 

|  ResNet34 (V)+ResNet34(A) |  Clean  | Missing #v | Missing #a |   FGM   |  PGD-$\ell_2$ |
|:--------:|:-------:|:---------:|:---------:|:-------:|:-------:|
| JT  | 0.6424  |  0.4528   |  0.2471   | 0.3132  | 0.2863  |
|  CRMT-JT (ours) | 0.7435  |  0.5269   |  0.5705   | 0.4978  | 0.4746  |

|  ResNet18(V)+Transformer(A)  |  Clean  | Missing #v | Missing #a |   FGM   |  PGD-$\ell_2$ |
|:--------:|:-------:|:---------:|:---------:|:-------:|:-------:|
| JT | 0.5538  |  0.3387   |  0.2703   | 0.2456  | 0.2100  |
|  CRMT-JT(ours) | 0.5807  |  0.3721   |  0.3539   | 0.3067  | 0.2711  |

Reviewer comment (Writing):
**Unclear model-specific weights/classifiers**: The exact role of introducing model-specific weights $a^{(m)}$ is somewhat unclear to me. How will it be used to guide the orthogonal classifier of each modality? Also, it remains unclear to me how the proposed eventually gets the prediction result upon different modalities's classifiers.

Author response:
Thank you for your comments. The modality-specific weights can help the model identify the importance of each modality. As shown in Equation 8:

\begin{equation}
\begin{aligned}
         \tilde{h}_k(\boldsymbol{x}) =  a_k^{(1)} \tilde{W} _{k\cdot}^{(1)} \phi^{(1)} (\boldsymbol{x}^{(1)}) +  a_k^{(2)}\tilde{W} _{k\cdot}^{(2)} \phi^{(2)} (\boldsymbol{x}^{(2)}) + \tilde{b}_k, 
\end{aligned}
\end{equation}
The $\tilde{h} _k(\boldsymbol{x})$ denote the logits score of $k$-th class. Since the valuable information between modalities is different, the weight $\boldsymbol{a}^{(m)}$ can lead the model to focus on the more reliable modalities. Integrating these weights can enhance the model's ability to effectively utilize the most valuable information from each modality. And the orthogonal $\tilde{W} _{k\cdot}^{(m)}$ for each modality, is approximated through the weight normalization method [1]. After we obtain the classifier, we can further get the logits score using the equation above and further obtain the prediction result. We have improved our presentation in Section 3.4 to explain the design more precisely. 

[1] L. Huang, X. Liu, B. Lang, A. Yu, Y. Wang, and B. Li, “Orthogonal weight normalization: Solution to optimization over multiple dependent stiefel manifolds in deep neural networks,” in *Proceedings of the AAAI Conference on Artificial Intelligence*, vol. 32, no. 1, 2018.

Reviewer comment (Experiments):
**Lacking empirical evidence**: One main motivation of the proposed approach is one modality may be more vulnerable than the others. While the adversarial accuracy (between uni-modal and multi-modal attacks) could support this observation empirically, it would be more convincing to provide more evidence that can be used to back-up the theoretical results, such as plotting the vulnerability indicator ($\eta$) values, visualizing the perturbation radius over modalities, etc.

Author response:
Thank you for your suggestions. As shown in Figure 3 in the manuscript, we demonstrate how the ratio of the vulnerability indicator ($\eta$) varies in our method. As shown in Figure 3(a), in AT method, there is also a large imbalance on vulnerable indicators, which is alleviated by our proposed CRMT method. Furthermore, to clearly explain this phenomenon, in revised Section B.4.1, we provide the heat map of the indicator $\eta$ to represent the robustness of each uni-modality, where the smaller indicator means the modality is more robust. Meanwhile, we also provide the uni-modal perturbation radius to further verify this modality preference, where we list the percentage of safe samples that can always resist this size of perturbation. It can be seen that in the Kinetic-Sounds dataset, the audio modality is definitely more vulnerable than the vision modality, thus explaining the phenomenon in Figure 1 in the manuscript.  

| Perturbation radius | 0.25    | 0.50     | 0.75    | 1.00       | 1.25    | 1.50     |
|---------------------|---------|---------|---------|---------|---------|---------|
|  Percentage of safe samples #v                 | 0.6366  | 0.6279  | 0.6214  | 0.6163  | 0.6068  | 0.6010  |
| Percentage of safe samples #a                  | 0.4172  | 0.2573  | 0.1584  | 0.0996  | 0.0596  | 0.0422  |

Reviewer comment (Experiments):
Can the proposed method apply to multiple modalities larger than 2?

Author response:
Thank you for your suggestion. We apply the experiments on UCF101 with three modalities (RGB, Optical Flow (OF), and RGB Frame Difference (FD)), with two training strategies, training from scratch and with ImageNet-pretrained ResNet18. The following results show that our method can be well extended to multiple modalities.  

|   UCF101 (RGB+OF+FD)    | JT (Scratch) | CRMT-JT (Scratch, ours) | JT (Pretrained) | CRMT-JT (Pretrained, ours) |
|:----------:|:--------------------------:|:-------------------------------:|:---------------:|:--------------------:|
|    Clean   |           0.4490           |             0.5640              |      0.8312     |        0.8506        |
|     FGM    |           0.4005           |             0.4567              |      0.2471     |        0.4138        |
|   PGD_$\ell_2$   |           0.3963           |             0.4312              |      0.0783     |        0.2623        |

Reviewer comment (Experiments):
What's the selection criterion in choosing datasets for the experiment?

Author response:
In this study, we analyze the robustness through the perturbation radius, where the perturbation inside this radius can be always defended. Hence, our methods have no special requirements for certain modalities. Following previous studies in multi-modal learning [1,2], we apply the universally used Kinetic-Sounds, UCF101, and VGG-Sounds datasets. Our method can also extend to more modalities like the text to enhance the robustness. 

[1] J. Chen and C. M. Ho, “Mm-vit: Multi-modal video transformer for compressed video action recognition,” in *Proceedings of the IEEE/CVF winter conference on applications of computer vision*, 2022, pp. 1910–1921.

[2] X. Peng, Y. Wei, A. Deng, D. Wang, and D. Hu, “Balanced multimodal learning via on-the-fly gradient modulation,” in *Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition*, 2022, pp. 8238–8247.

Reviewer comment (Theory):
Are the provided theoretical results applicable to vision-text data? Any empirical evidence?

Author response:
Thank you for your suggestion. We apply experiments on a vision-text dataset Food101, which inputs an image-text pair for classification. We employ a Vision Transformer (ViT) as our image encoder and BERT as our text encoder, subsequently concatenating their outputs to achieve a unified joint representation. To evaluate robustness, we apply multiple attacks including modality missing and descent-based attacks (FGM and PGD-$\ell_2$). It is important to note that attacks like the Fast Gradient Method (FGM) and Projected Gradient Descent with $\ell_2$ norm (PGD-$\ell_2$) are typically applied to continuous data. Given that text represents discontinuous data, we focus on implementing these attack methods on the image modality. Our results reveal that the text modality is more critical than the image modality, as its absence significantly impacts model performance. Concentrating on the $\ell_2$-norm, we achieve enhanced robustness under both FGM and PGD-$\ell_2$ attacks. Our method demonstrates a notable performance increase in scenarios where text is absent, though there is a slight decline in performance when the image modality is missing. This could be attributed to the huge performance difference among text and image. This is a very interesting and challenging issue in building a robust model for both modalities, which we will focus on in the upcoming work. Thanks again for such a valuable suggestion!


| Food101 |  Clean  | FGM on Image | PGD-$\ell_2$ on Image | Missing Text | Missing Image |
|:-------:|:-------:|:------------:|:---------------------:|:------------:|:-------------:|
|    JT   | 0.8218  |    0.7603    |        0.7281         |    0.0497    |    0.7831     |
| CRMT-JT | 0.8257  |    0.7656    |        0.7313         |    0.0759    |    0.7779     |

Reviewer comment (Experiments):
Could the proposed method be incorporated into the pre-trained multi-modal model (e.g., CLIP or BLIP)?

Author response:
CLIP and BLIP stand out as highly effective multi-modal models, with their robustness gaining considerable attention in recent studies. Notably, the CLIP models also prefer certain modalities, such as text [1]. Hence, it is expected to first analyze the potential influence of such preference within CLIP with our proposed approach. However, there is a slight difference in that CLIP (also BLIP) employs contrastive loss across modalities instead of discriminative learning over joint representation. In future work, we will attempt to theoretically analyze the potential influence of this, thanks again for the precious suggestion, which undoubtedly helps to improve the potential value of this work.

[1] Z. Liu, C. Xiong, Y. Lv, Z. Liu, and G. Yu, “Universal vision-language dense retrieval: Learning a unified representation space for multi-modal retrieval,” in *The Eleventh International Conference on Learning Representations*, 2022.