LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models

TL;DR

LAMP presents a black-box approach to learning universal adversarial perturbations for multi-image MLLMs by leveraging an attention-centric objective that degrades cross-image information fusion. It introduces five loss terms, including a contagious objective that propagates perturbation effects to clean tokens and an index-attention suppression loss to achieve position-invariant attacks, while keeping the victim model frozen. Evaluations across multiple multi-image benchmarks and a range of open-source MLLMs show that LAMP significantly outperforms state-of-the-art baselines, achieving large gains in attack success rate while maintaining imperceptibility. The work demonstrates practical risks for real-world multi-image VLP systems and offers a transferable, model-agnostic attack framework with potential implications for robustness and defense research in multimodal AI. The perturbation learning relies on a surrogate pretrained model and a constrained budget, enabling robust transfer to unseen architectures and tasks in black-box settings.

Abstract

Multimodal Large Language Models (MLLMs) have achieved remarkable performance across vision-language tasks. Recent advancements allow these models to process multiple images as inputs. However, the vulnerabilities of multi-image MLLMs remain unexplored. Existing adversarial attacks focus on single-image settings and often assume a white-box threat model, which is impractical in many real-world scenarios. This paper introduces LAMP, a black-box method for learning Universal Adversarial Perturbations (UAPs) targeting multi-image MLLMs. LAMP applies an attention-based constraint that prevents the model from effectively aggregating information across images. LAMP also introduces a novel cross-image contagious constraint that forces perturbed tokens to influence clean tokens, spreading adversarial effects without requiring all inputs to be modified. Additionally, an index-attention suppression loss enables a robust position-invariant attack. Experimental results show that LAMP outperforms SOTA baselines and achieves the highest attack success rates across multiple vision-language tasks and models.

Figures (12)

• Figure 1: An overview of our approach showing superior effectiveness over traditional methods. Conventional methods fail when the perturbation is not applied to every image, an unrealistic setting when the attacker does not have access to the later inference stage. Our method succeeds even if a subset of downstream samples includes perturbed samples since it can affect "green" samples even though they are not attacked, unlike traditional methods.
• Figure 2: An overview of our proposed attack methodology. The input sample shown in the left blue-shaded box is what a normal user might query an MLLM, while the pink box shows our attack setting, where the attacker adds learned universal perturbations to two images of the input. The universal perturbations are learned using: a) Adversarial language modeling loss $\mathcal{L}_{adv}^{lm}$: reduces likelihood of correct tokens (Option: D), and increases probability of wrong tokens (Options: A, B, C). b) Adversarial hidden states loss $\mathcal{L}_{adv}^{dec}$: encourages divergence between $z_{l,h}^{\text{adv}}$ and $z_{l,h}^{\text{clean}}$, representing the hidden states of the $h$-th attention head in the $l$-th decoder layer for adversarial and clean inputs. c) Adversarial attention weights loss $\mathcal{L}_{adv}^{h}$: maximizes distance between $\bar{A}^{\text{clean}}_{\ell}$ and $\bar{A}^{\text{adv}}_{\ell}$, representing head-averaged attention weights in $l$-th decoder layer for adversarial and clean inputs. d) Adversarial contagious loss $\mathcal{L}_{adv}^{ctg}$: encourages clean tokens to place greater attention to noisy image tokens $\tilde{x'_1}$ and $\tilde{x'_2}$ for each $A^{(l)}_{:,h}$, attention weights for head $h$ at layer $l$ (Here $\{x_t\}$ represents all image tokens of image $x_t$ for brevity). And e) Adversarial Index-Attention Suppression loss $\mathcal{L}_{adv}^{ias}$: suppresses attention from image tokens $x_1, x_2$ to text tokens corresponding to image index $t_{2_{idx}}$, to encourage image position invariance (Here the input token sequence for multi-image setting is shown as 'Image 1: < Image> < image></Image>').
• Figure 3: Perturbation budget vs ASR
• Figure 4: # of perturbation vs ASR
• Figure 5: Image count vs ASR