On the Robustness of Large Multimodal Models Against Image Adversarial Attacks

TL;DR

This work systematically evaluates the robustness of state-of-the-art Large Multimodal Models (LMMs) to image-based adversarial attacks across image classification, caption retrieval, and VQA. It demonstrates that LMMs are generally vulnerable to visual perturbations when no extra textual context is provided, but that contextual prompts and query decomposition can substantially mitigate attack effects, with notable resilience observed on ScienceQA. The authors formalize a gradient-based white-box threat model, compare multiple attacks on three representative LMMs, and introduce context-augmented prompting as a practical defense strategy for real-world applications. The findings highlight a nuanced robustness landscape, where attack effectiveness depends on the query and content, and provide a concrete pathway—contextual prompts and existence-query decomposition—to bolster multimodal systems against adversarial environments.

Abstract

Recent advances in instruction tuning have led to the development of State-of-the-Art Large Multimodal Models (LMMs). Given the novelty of these models, the impact of visual adversarial attacks on LMMs has not been thoroughly examined. We conduct a comprehensive study of the robustness of various LMMs against different adversarial attacks, evaluated across tasks including image classification, image captioning, and Visual Question Answer (VQA). We find that in general LMMs are not robust to visual adversarial inputs. However, our findings suggest that context provided to the model via prompts, such as questions in a QA pair helps to mitigate the effects of visual adversarial inputs. Notably, the LMMs evaluated demonstrated remarkable resilience to such attacks on the ScienceQA task with only an 8.10% drop in performance compared to their visual counterparts which dropped 99.73%. We also propose a new approach to real-world image classification which we term query decomposition. By incorporating existence queries into our input prompt we observe diminished attack effectiveness and improvements in image classification accuracy. This research highlights a previously under-explored facet of LMM robustness and sets the stage for future work aimed at strengthening the resilience of multimodal systems in adversarial environments.

Figures (9)

• Figure 1: QA pairs for LLaVA liu2023visual given an adversarial image. "LLaVA" and "LLaVA(adv)" refer to LLaVA's response to the user query with clean and adversarial image, respectively. For the readers, there are two sheep in the scene, and the adversarial attack was based on maximizing the distance between the image and the text "a photo of a sheep". In the first two QA pairs, we can see that LLaVA(adv)'s answer is completely wrong. However, it can still answer the following questions correctly, because they are not pertinent to the object being attacked (sheep). Also note the contrast between the second and last QA pairs. LLaVA(adv) answers the question correctly after additional context has been provided. These observations help drove some of the findings in this paper. Source: COCO lin2014microsoftcoco
• Figure 2: A sample CLIP's adversarial image, generated by PGD, APGD and CW, under Normal and Strong attack parameter settings. Image source: COCO 2014val. Note that under strong attack, the adversarial perturbations become very obvious under PGD and APGD, and are expected to cause a higher degree of performance degradation.
• Figure 3: Overview of our procedure for attack generation and evaluation over image classification, caption retrieval, and VGA. Top: overview of attack generation for the three tasks; bottom: evaluation procedure for LMM on the three tasks.
• Figure 4: Two sample adversarial images from COCO 2014val, generated under APGD $\text{Post}_\text{S}$. "LLaVA" and "LLaVA(adv)" refer to LLaVA's responses using the clean Pre-attack and post-attack image, respectively. Above the dotted line in each cell, we query LLaVA for the general description; below the dotted line are questions taken from VQA V2 dataset.
• Figure 5: LLaVA's VQA accuracy drop after APGD attack under the normal attack setting. Y-axis represents question types, and X-axis represents accuracy dropped (%).