This work proposes a white-box spectral-subspace-guided attack (SSGRA) that aligns intermediate representations with the subspace spanned by the bottom right singular vectors, offering a spectral interpretation of adversarial vulnerability in VLMs, providing insights for improving their robustness.
Abstract
Adversarial vulnerability in deep neural networks (DNNs) has been studied from the perspectives of decision-boundary geometry, feature robustness, input-output Jacobians, and the instability of inverse problems. Here, we focus on the spectral structure of intermediate linear transformations that propagate information through modern DNNs, an unexplored mechanism of adversarial vulnerability. Specifically, we investigate transformer-based vision-language models, whose linear layers admit interpretable spectral decompositions and whose widespread adoption makes understanding their robustness increasingly important. We propose a white-box spectral-subspace-guided attack (SSGRA) that aligns intermediate representations with the subspace spanned by the bottom right singular vectors. Our experiments show improved attack effectiveness over existing baselines. In addition, SSGRA offers a spectral interpretation of adversarial vulnerability in VLMs, providing insights for improving their robustness.
While Large Vision-Language Models (LVLMs), represented by LLaVA and GPT-4V, have demonstrated remarkable capabilities, their visual inputs remain vulnerable to adversarial attacks, posing significant security risks. Existing defense methods predominantly target single-task scenarios (e.g., zero-shot classification) and consequently lack generalizability across various multimodal tasks. To address this limitation, we propose a dual adversarial fine-tuning framework that jointly optimizes visual and semantic supervision signals from two modalities, enhancing model robustness while generalizing across multiple downstream tasks. The proposed framework comprises two core components, i.e., $\textbf{Visual}$ supervision branch and $\textbf{Semantic}$ supervision branch. The former branch leverages features from clean images, extracted via a frozen original vision encoder, to guide adversarial robustness while the latter incorporates caption-image alignment as a contextual signal to preserve semantic coherence under attack. Moreover, our method achieves cross-task robustness by simply replacing the CLIP vision encoder in the original model, with no need of separate task-specific retraining or architecture modifications.Extensive experiments demonstrate that our approach outperforms the state-of-the-art method in adversarial robustness evaluation across zero-shot classification, image captioning, and visual question answering (VQA) tasks.
Sibo Wang, Jie Zhang, Shiguang Shan et al.· 0 citations
A method to analyze ANNs designed for image classification from an adversarial robustness perspective and implemented an ablation and fine-tuning strategy that successfully boosted the robustness of the ANNs against a variant of the Auto-PGD attack under different threat models.
This work establishes a high-probability generalization bound for ViTs in classification tasks under adversarial settings, and elucidates the roles of several factors in mitigating perturbation effects, norm regularization of weight matrices and depth-wise propagation constraints on layer-wise norms.
Ziwen Jiang, Chang Cao, Han Li et al.· 0 citations
The recent progress in the vision-language model (VLM) research made it one of the key aspects of artificial intelligence due to joint vision and language processing capabilities required for such tasks as image retrieval, visual question answering, autonomous systems and medical image analysis. However, despite the excellent results obtained with such systems, they still appear to be extremely vulnerable to adversarial perturbations which result in a significant decline in prediction accuracy and reliability due to even subtle input transformations. The purpose of this paper is to provide a systematic method for analyzing the adversarial robustness of vision-language models under both clean and perturbed conditions. The suggested framework is based on Semantic Counterfactual Augmentation (SCA) and Curriculum Contrastive Adversarial Training (CCAT) and aims to maintain semantic consistency and increase the robustness of the model respectively. The framework is tested using a CLIP-based vision-language model on the subset of Flickr8k dataset with Fast Gradient Sign Method (FGSM) and Projected Gradient Descent (PGD) attacks. As a result of the experiment, the performance gap is identified between the clean and perturbed images which confirms the vulnerabilities of the conventional VLM while indicating better robustness consistency with the suggested framework.
Kumari Anjali, Karnatakam Veda Sahithi, Sakinala Jyotsna· 2026 4th International Confe...· 0 citations
Focusing on zero-shot classification, this study demonstrates that 3D vision-language models exhibit heightened sensitivity to small coordinate perturbations, highlighting the need for a more rigorous security evaluation of 3D vision-language models.
Xuanxiang Lin, Yan Huang, Longkun Zou et al.· IEEE Access· 0 citations
This paper reveals that samples generated by a well-trained generative model are close to clean ones but far from adversarial ones, and proposes Consistency Model-based Adversarial Purification (CMAP), which optimizes vectors within the latent space of a pre-trained consistency model to generate samples for restoring clean data.
Shuhai Zhang, Jiahao Yang, Hui Luo et al.· IEEE Transactions on Pattern...· 0 citations