Light-weight Fine-tuning Method for Defending Adversarial Noise in Pre-trained Medical Vision-Language Models (2024)

Abstract: Fine-tuning pre-trained Vision-Language Models (VLMs) has shown remarkable capabilities in medical image and textual depiction synergy. Nevertheless, many pre-training datasets are restricted by patient privacy concerns, potentially containing noise that can adversely affect downstream performance. Moreover, the growing reliance on multi-modal generation exacerbates this issue because of its susceptibility to adversarial attacks. To investigate how VLMs trained on adversarial noisy data perform on downstream medical tasks, we first craft noisy upstream datasets using multi-modal adversarial attacks. Through our comprehensive analysis, we unveil that moderate noise enhances model robustness and transferability, but increasing noise levels negatively impact downstream task performance. To mitigate this issue, we propose rectify adversarial noise (RAN) framework, a recipe designed to effectively defend adversarial attacks and rectify the influence of upstream noise during fine-tuning.

## introduction with the success of multi-modal learning @xcite @xcite , the availability of large medical vision-language models (vlms) has surged. despite their potential, these models introduce considerable safety concerns. the pretraining datasets used on these vlms are often inaccessible; maintaining data integrity becomes significantly challenging when scaling up. this issue is particularly pronounced in the healthcare domain, where data sensitivity and patient confidentiality limit its access. consequently, they may contain imperceptible noise, which can adversely affect the model's generalization and transferability in downstream applications @xcite , posing serious risks in medical contexts. additionally, as vlms achieve remarkable success in generation tasks, there is a growing reliance on synthetic data @xcite . examples include synthetic health reports @xcite , medical instructions @xcite , and medical images @xcite . this dependence on multi-modal generation exacerbates safety concerns, since models trained on such data are more susceptible to adversarial attacks @xcite . adversaries can potentially compromise the entire system by subtly manipulating the most vulnerable modality. to remedy this issue, recent work has pivoted to understanding and mitigating noise introduced during pre-training @xcite . nonetheless, the robustness of vlms pre-trained on perturbed adversarial samples remains unclear. this is particularly crucial in the healthcare context, where tasks like medical visual question answering (vqa) directly influence professionals' decisions regarding patient care. in this paper, we focus on the following research: can we design a light-weight fine-tuning technique to alleviate the adverse effects introduced by adversarial noise in pre-trained medical vlms? our main contributions can be summarized as follows: ## methods in this section, we first introduce our novel multimodal adversarial attack strategies designed to create noisy medical image-caption datasets, which will be used to train clip models. then, we introduce ran fine-tuning to alleviate the effect of such pre-trained noisy medical models on downstream classification tasks. ## conclusion despite the success development of medical vlms, most such models are vulnerable to adversarial attack and still lag behind in transferring to downstream tasks robustly. in this work, we discuss how upstream adversarial noise affects various medical downstream tasks by crafting adversarial multimodal medical samples. through extensive experiments, we found that even minor adversarial noise in pre-training datasets can enhance id performance while degrading ood generalization. to this end, we introduce a light-weight fine-tuning recipe, ran, effectively mitigating noise effects by refining the feature space and enforcing robust margins to defend adversarial noise.