Research map / Adversarial robustness and security / Certified and empirical robustness
MMCert: Provable Defense against Adversarial Attacks to Multi-modal Models
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MMCert, the first certified defense for multi-modal models, using independent per-modality sub-sampling with a Neyman-Pearson-based ensemble to certify robustness against l0-like modification, addition, and deletion attacks.
Problem
Multi-modal models are vulnerable to adversarial perturbations across all modalities simultaneously, and existing certified defenses designed for unimodal inputs give suboptimal guarantees when extended to multi-modal inputs.
Approach
Independently sub-sample a fixed number of basic elements from each modality, build an ensemble of base multi-modal predictions, and derive a certified robustness bound per modality (with Holm-Bonferroni for segmentation), so the attacker's per-modality budgets are handled separately rather than as one l0 ball.
Key results
- On RAVDESS with r1=r2=8, MMCert certifies correct predictions for more than 40% of test samples while randomized ablation certifies 0%.
- MMCert consistently outperforms randomized ablation across all tested r1, r2 combinations on both RAVDESS and KITTI Road.
- Modification attacks are the strongest attack type; with r1=r2=10, modification drops certified accuracy to 0, while addition keeps it above 0.4 and deletion above 0.6.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| MMCert modality-independent sub-sampling instead of randomized ablation on merged modalities | multi-modal emotion recognition and road segmentation · RAVDESS and KITTI Road | certified accuracy / certified pixel accuracy, F-score, IoU: consistently outperforms randomized ablation for all r1, r2 combinations | Helped |
| choose larger k1/k2 ratio (sub-sample fewer elements from higher-attack modality) (ablation) | MMCert sub-sampling · KITTI Road | certified pixel accuracy/F-score/IoU: k2=9k1 outperforms k2=3k1 when r2>r1, gap grows with r2/r1 | Helped |
| ratio k1=k2 vs k1=3k2 vs k1=9k2 when r2=r1 (ablation) | MMCert sub-sampling · KITTI Road | certified pixel accuracy/F-score/IoU | No clear effect |
| attack type: modification vs addition vs deletion (ablation) | MMCert on RAVDESS · RAVDESS | certified accuracy: modification drops to 0 at r1=r2=10; addition >0.4; deletion >0.6 | Mixed |
Surprising findings
- Modification attack brings certified accuracy to 0 at r1=r2=10, while addition and deletion attacks retain substantially higher certified accuracy.
Limitations
- Only l0-like attacks on each modality are considered; other attack forms (e.g., lp-bounded) are left to future work.
- Randomized ablation baseline is the only compared method; the original paper's evaluation is limited to two datasets.
- Clean accuracy requires data augmentation with random ablation to match the sub-sampled test distribution.
Experimental setup
Datasets: RAVDESS KITTI Road
Benchmarks: RAVDESS KITTI Road
Metrics: certified accuracy certified pixel accuracy certified F-score certified IoU
Baselines: randomized ablation
Builds on: randomized ablation Fischer et al. certified segmentation Neyman-Pearson lemma Clopper-Pearson confidence bounds
Closest papers by meaning
- MMDT: Decoding the Trustworthiness and Safety of Multimodal Foundation Models (ICLR 2025 · similarity 0.84)
- Quantifying and Enhancing Multi-modal Robustness with Modality Preference (ICLR 2024 · similarity 0.84)
- Mutual-Modality Adversarial Attack with Semantic Perturbation (AAAI 2024 · similarity 0.84)
- Do We Really Need Curated Malicious Data for Safety Alignment in Multi-modal Large Language Models? (CVPR 2025 · similarity 0.84)
- COMMIT: Certifying Robustness of Multi-Sensor Fusion Systems Against Semantic Attacks (AAAI 2025 · similarity 0.83)
- PubDef: Defending Against Transfer Attacks From Public Models (ICLR 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.