Research map / Adversarial robustness and security / Attacks on text and graphs
On the Robustness of Large Multimodal Models Against Image Adversarial Attacks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Systematically evaluates the robustness of LLaVA-1.5, BLIP2-T5 and InstructBLIP against gradient-based visual adversarial attacks (PGD, APGD, CW) generated on their image encoders across caption retrieval, classification and VQA, and proposes query decomposition with context to improve classification robustness.
Problem
Whether adversarial attacks crafted only against the visual encoder of large multimodal models (LMMs) compromise their end-to-end performance on tasks such as image classification, captioning/caption retrieval and VQA, which had not been systematically studied.
Approach
Attack only the image encoder (CLIP or EVA-CLIP) with task-specific objectives and measure downstream LMM accuracy; find LMMs are vulnerable when the query targets the attacked content but robust for off-target VQA questions and when textual context is added, and exploit this via query decomposition into per-class existence questions with context.
Key results
- Under PGD-N, LLaVA's image classification accuracy on COCO without context drops from 87.51% to 48.25%, while adding context plus query decomposition keeps it at 65.30% (PGD-N) for the decomposed variant.
- On ScienceQA-Image, LLaVA's VQA accuracy drops only 3% under PGD-N and 9% under PGD-S while the CLIP visual encoder accuracy falls ~98%.
- BLIP2-T5 caption retrieval top-1 recall falls from 32.34% to 1.4% under PGD-N, showing LMMs are not robust when the query targets the attacked content.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add a correct object description as context to the classification prompt | LLaVA classification · COCO 2014val | accuracy: 48.25 -> 73.62; 52.06 -> 72.61; 80.64 -> 91.76 | Helped |
| Add class-specific context and decompose classification into existence queries | LLaVA · COCO 2014val | accuracy: 48.25 -> 65.30; 52.06 -> 66.98; 80.64 -> 95.27 | Helped |
| Add class-specific context and decompose classification into existence queries | LLaVA · ImageNet 2012val | accuracy: 10.34 -> 58.52; 11.46 -> 57.26; 21.00 -> 87.72 | Helped |
| Apply PGD-N perturbations to the visual encoder input | LLaVA caption retrieval · COCO caption 2014val | LLM Answer-to-Text Recall @1: 36.58 -> 13.1(-64) | Hurt |
| Apply PGD-S perturbations to the visual encoder input | LLaVA caption retrieval · COCO caption 2014val | LLM Answer-to-Text Recall @1: 36.58 -> 3.76(-90) | Hurt |
| Apply PGD-N perturbations to the visual encoder input | LLaVA · ScienceQA(image) | VQA accuracy: 71.59 -> 68.77 (-3) | Hurt |
| Apply CW-N perturbations to the visual encoder input | LLaVA · ScienceQA(image) | VQA accuracy: 71.59 -> 71.69 (+0.1) | No clear effect |
| Apply PGD-N perturbations to the visual encoder input | LLaVA · VQA V2 | VQA accuracy: 78.43 -> 64.38 (-18) | Hurt |
| Query about visual content different from the attack target | LLaVA VQA · VQA V2 | accuracy | Helped |
| Increase attack strength from normal to strong PGD | LLaVA classification · COCO 2014val | accuracy: 48.25 -> 22.58 | Hurt |
Surprising findings
- LMMs are largely robust on VQA when questions concern content different from the attacked object, even when the visual encoder accuracy drops below 1%.
- Adding a short textual context about the correct class restores much of the post-attack classification accuracy, and for some BLIP2/InstructBLIP attacks post-attack accuracy exceeds pre-attack accuracy.
Limitations
- Attacks are generated only against the image encoder rather than end-to-end, so results may not generalize to full-model attacks.
- Query decomposition assumes a closed-world fixed class list and uses 20 randomly chosen classes per image, limiting real-world applicability.
- Ground-truth labels are missing for several VQA datasets, so synthetic LLaVA captions are used to generate adversaries.
Experimental setup
Datasets: COCO 2014 val ImageNet 2012 val ScienceQA-Image VQA V2 TextVQA POPE MME
Benchmarks: COCO 2014 val caption retrieval COCO 2014 val classification ImageNet 2012 val classification ScienceQA-Image VQA V2 TextVQA POPE MME
Metrics: top-1 accuracy recall@1 percent change from pre-attack accuracy
Baselines: CLIP EVA-CLIP BLIP2-T5 InstructBLIP
Builds on: PGD APGD Carlini-Wagner attack LLaVA InstructBLIP
Closest papers by meaning
- On Evaluating Adversarial Robustness of Large Vision-Language Models (NeurIPS 2023 · similarity 0.91)
- VQAttack: Transferable Adversarial Attacks on Visual Question Answering via Pre-trained Models (AAAI 2024 · similarity 0.89)
- Dissecting Adversarial Robustness of Multimodal LM Agents (ICLR 2025 · similarity 0.88)
- One Prompt Word is Enough to Boost Adversarial Robustness for Pre-trained Vision-Language Models (CVPR 2024 · similarity 0.87)
- Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.87)
- Ranked from Within: Ranking Large Multimodal Models Without Labels (ICML 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.