Improving Adversarial Robustness in Vision-Language Models with Architecture and Prompt Design (2024)

Abstract: Vision-Language Models (VLMs) have seen a significant increase in both research interest and real-world applications across various domains, including healthcare, autonomous systems, and security. However, their growing prevalence demands higher reliability and safety including robustness to adversarial attacks. We systematically examine the possibility of incorporating adversarial robustness through various model design choices. We explore the effects of different vision encoders, the resolutions of vision encoders, and the size and type of language models. Additionally, we introduce novel, cost-effective approaches to enhance robustness through prompt engineering. By simply suggesting the possibility of adversarial perturbations or rephrasing questions, we demonstrate substantial improvements in model robustness against strong image-based attacks such as Auto-PGD. Our findings provide important guidelines for developing more robust VLMs, particularly for deployment in safety-critical environments where reliability and security are paramount. These insights are crucial for advancing the field of VLMs, ensuring they can be safely and effectively utilized in a wide range of applications.

## introduction vlms have emerged as a cornerstone of artificial intelligence in recent years. by enabling seamless integration of visual and linguistic information, these models have the capacity to perform a wide range of tasks from image captioning, to visual question answering (vqa), and cross-modal retrieval @xcite @xcite . despite the impressive advances in vlms' performance through novel architectures and scaling network size, it has been shown that, like many other neural network models, vlms are also not immune to adversarial vulnerabilities -original provide a short caption for this image. ## experimental setup in this section, we outline the attack setups, the tasks, and the specific models examined in our model design choice experiments. ## discussion and conclusion our evaluation provides critical insights on how we can incorporate adversarial robustness in vlms through various design choices. first, we find that vision encoders trained across diverse data distributions are more robust against simpler attacks but lose the advantage against complex attacks. second, neither increasing the input resolution of vision encoders nor scaling up the language model enhances robustness. third, our findings show that the mistral base model exhibits the best robust accuracy across most tasks and attacks. fourth, using multiple vision encoders does not guarantee robustness; an adversary only needs knowledge of the weakest encoder to compromise the entire system. the combination of dinov2 and siglip yielded the highest robust accuracies, but the gains were not significant, highlighting the limited advantage of current ensemble methods. hence, our study points to the need for comprehensive analysis with more encoders to fully understand the efficacy of ensemble approaches in improving prompt type prompt original provide a short caption for this image.