Effective and Efficient Adversarial Detection for Vision-Language Models via A Single Vector

TL;DR

A novel and effective iN-time Embedding-based AdveRSarial Image DEtection (NEARSIDE) method, which exploits a single vector that distilled from the hidden states of VLMs, which is called the attacking direction, to achieve the detection of adversarial images against benign ones in the input.

Abstract

Visual Language Models (VLMs) are vulnerable to adversarial attacks, especially those from adversarial images, which is however under-explored in literature. To facilitate research on this critical safety problem, we first construct a new laRge-scale Adervsarial images dataset with Diverse hArmful Responses (RADAR), given that existing datasets are either small-scale or only contain limited types of harmful responses. With the new RADAR dataset, we further develop a novel and effective iN-time Embedding-based AdveRSarial Image DEtection (NEARSIDE) method, which exploits a single vector that distilled from the hidden states of VLMs, which we call the attacking direction, to achieve the detection of adversarial images against benign ones in the input. Extensive experiments with two victim VLMs, LLaVA and MiniGPT-4, well demonstrate the effectiveness, efficiency, and cross-model transferrability of our proposed method. Our code is available at https://github.com/mob-scu/RADAR-NEARSIDE

Figures (6)

• Figure 1: (a) Working mechanism of VLMs. VLMs map textual and visual inputs to the embedding space, and employ LLMs to fuse both embeddings to generate textual responses. (b) Adversarial images that jailbreak VLMs. The adversarial images that contain human-imperceptible noises can jailbreak VLMs to elicit harmful responses.
• Figure 2: An illustration of construction pipeline for our RADAR dataset.
• Figure 3: An illustration of proposed NEARSIDE. Our method learns the attacking direction on a set of tuples (benign input, adversarial input), and then classifies a test input as benign or adversarial according to the projection between the input's embedding and the attacking direction. If the projection is larger than a threshold, it is classified as an adversarial input, and otherwise as benign.
• Figure 4: Visualized projections of adversarial and benign samples to the attacking directions on Harm-Data with LLaVA as the victim.
• Figure 5: Throughput of four different detection methods. The number is the average examples can be detected per second (item/s).