Paper deep dive

Adversarial Hubness in Multi-Modal Retrieval

Tingwei Zhang, Fnu Suya, Rishi Jha, Collin Zhang, Vitaly Shmatikov

Year: 2024Venue: arXiv preprintArea: Adversarial RobustnessType: EmpiricalEmbeddings: 88

Models: AudioCLIP, CLIP, ImageBind

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 94%

Last extracted: 3/12/2026, 6:36:48 PM

Summary

The paper investigates 'Adversarial Hubness' in multi-modal retrieval systems, where attackers exploit the high-dimensional embedding space to create adversarial hubs. These hubs, generated via gradient-based optimization, can be retrieved as top results for thousands of unrelated or concept-specific queries, posing significant security risks like spam propagation and denial-of-service. The authors demonstrate that these attacks are effective across modalities (text, image, audio) and remain robust against existing natural hubness mitigation techniques.

Entities (6)

Adversarial Hubness · phenomenon · 95%AudioCLIP · model · 95%ImageBind · model · 95%Multi-modal retrieval systems · system · 95%Pinecone · database · 95%Projected Gradient Descent · algorithm · 95%

Relation Signals (3)

Adversarial Hubness → affects → Multi-modal retrieval systems

confidence 95% · investigate how attackers can exploit hubness to turn any image or audio input in a multi-modal retrieval system into an adversarial hub

Projected Gradient Descent → generates → Adversarial hubs

confidence 95% · Equation (3) is optimized via Projected Gradient Descent (PGD), which enforces the perturbation constraint

ImageBind → usedin → Multi-modal retrieval systems

confidence 90% · Modern retrieval systems leverage pretrained multi-modal encoders, such as ImageBind

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Hubness is a phenomenon in high-dimensional vector spaces where a point from the natural distribution is unusually close to many other points. This is a well-known problem in information retrieval that causes some items to accidentally (and incorrectly) appear relevant to many queries. In this paper, we investigate how attackers can exploit hubness to turn any image or audio input in a multi-modal retrieval system into an adversarial hub. Adversarial hubs can be used to inject universal adversarial content (e.g., spam) that will be retrieved in response to thousands of different queries, and also for targeted attacks on queries related to specific, attacker-chosen concepts. We present a method for creating adversarial hubs and evaluate the resulting hubs on benchmark multi-modal retrieval datasets and an image-to-image retrieval system implemented by Pinecone, a popular vector database. For example, in text-caption-to-image retrieval, a single adversarial hub, generated using 100 random queries, is retrieved as the top-1 most relevant image for more than 21,000 out of 25,000 test queries (by contrast, the most common natural hub is the top-1 response to only 102 queries), demonstrating the strong generalization capabilities of adversarial hubs. We also investigate whether techniques for mitigating natural hubness can also mitigate adversarial hubs, and show that they are not effective against hubs that target queries related to specific concepts.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

87,447 characters extracted from source content.

Expand or collapse full text

Adversarial Hubness in Multi-Modal Retrieval Tingwei Zhang† Suya Fnu§ Rishi Jha† Collin Zhang† Vitaly Shmatikov† † Tech § of Tennessee tingwei, collinzhang, jxm3@cs.cornell.edu suya@utk.edu shmat@cs.cornell.edu Abstract Hubness is a phenomenon in high-dimensional vector spaces where a point from the natural distribution is unusually close to many other points. This is a well-known problem in information retrieval that causes some items to accidentally (and incorrectly) appear relevant to many queries. In this paper, we investigate how attackers can exploit hubness to turn any image or audio input in a multi-modal retrieval system into an adversarial hub. Adversarial hubs can be used to inject universal adversarial content (e.g., spam) that will be retrieved in response to thousands of different queries, and also for targeted attacks on queries related to specific, attacker-chosen concepts. We present a method for creating adversarial hubs and evaluate the resulting hubs on benchmark multi-modal retrieval datasets and an image-to-image retrieval system implemented by Pinecone, a popular vector database. For example, in text-caption-to-image retrieval, a single adversarial hub, generated using 100 random queries, is retrieved as the top-1 most relevant image for more than 21,000 out of 25,000 test queries (by contrast, the most common natural hub is the top-1 response to only 102 queries), demonstrating the strong generalization capabilities of adversarial hubs. We also investigate whether techniques for mitigating natural hubness can also mitigate adversarial hubs, and show that they are not effective against hubs that target queries related to specific concepts. 1 Introduction AI systems are becoming multi-modal. This includes large language models [52, 23, 2], as well as cross-modal and multi-modal retrieval systems that enable flexible and accurate information retrieval across different modalities, e.g., text-to-image, image-to-image, and text-to-audio [77, 75, 76]. Modern retrieval systems leverage pretrained multi-modal encoders, such as ImageBind [24] and AudioCLIP [28], which encode inputs from different modalities (e.g., images and text) into the same embedding space. In this shared space, semantically related inputs are clustered together (see Section˜2), allowing queries to be effectively matched to items regardless of modality, based only on embedding similarity [59]. Embedding-based retrieval is more scalable and accurate than traditional techniques based on metadata or keywords [4, 35]. Figure 1: A cross-modal adversarial hub. High-dimensional embedding spaces are prone to hubness, a well-known manifestation of the curse of dimensionality in information retrieval [57, 46, 57]. This is a phenomenon where a point (a “natural hub”) appears in the neighborhood of many points to which it is not semantically related. Many methods have been proposed for mitigating natural hubness [34, 85, 60, 60, 31, 71], including specifically for multi-modal retrieval [5, 78, 14] which is especially vulnerable to hubness [42]. We investigate whether hubness can be exploited to intentionally create images and audio inputs that act as “adversarial hubs.” Adversarial hubs (1) carry adversarial content, e.g., spam or misinformation, and (2) are very close in the embedding space to many queries in the same or different modality, causing them to be retrieved in response to these queries. For example, Figure 1 shows that a mild perturbation makes an audio clip of a barking dog appear relevant to many unrelated text captions, including “A classical concert”, “Soothing jazz tunes”, and “Funky disco beats,” and causes it to be retrieved whenever users search for any of these terms. Figures 2, 3 and 4 illustrate concrete examples of adversarial hubs for different cross-modal retrieval scenarios. Figure 2: An adversarial hub in text-to-image retrieval. Figure 3: An adversarial hub in image-to-image retrieval. Our Contributions. We show that hubness, a natural phenomenon in high-dimensional spaces, can be adversarially exploited. By applying a small perturbation, an attacker can transform any image or audio input with adversary-chosen semantics (e.g., an advertisement, product promotion, song, etc.) into a hub. We demonstrate that a single adversarial hub affects significantly (two orders of magnitude) more queries than natural hubs. Moreover, these attacks can target specific concepts, so the hub is retrieved only for certain query topics. Generated via standard gradient-based optimization on a limited number of queries, our adversarial perturbations generalize to tens of thousands of unseen user queries. The low cost makes the attack accessible to many adversaries and presents a security threat to production retrieval systems. Our cross-modal adversarial hubs are qualitatively and quantitatively more powerful than uni-modal music hubs [31] and text-only poisoning attacks on retrieval systems [11, 91]. First, our attack exploits the shared embedding space to compromise retrieval in all modalities (text, images, and audio) simultaneously. Second, our attack transfers across modalities in a way uni-modal hubs can’t: an adversary can exploit a modality with continuous input space (e.g., images) to stealthily attack a modality with discrete input space (e.g., text) that would be otherwise difficult to compromise because adversarial changes to inputs are easily detectable [8, 86]. We evaluate adversarial hubness attacks on the same benchmarks as prior work [5, 78, 14] and on a realistic image-to-image retrieval system from Pinecone [54]. We further evaluate known techniques for mitigating natural hubness and show that they fail to mitigate concept-specific adversarial hubs even if hub generation is oblivious of the defense. We then investigate transferability of adversarial hubs across different embeddings, and feasibility of generating them without knowledge of the target embedding or query distribution. While prior work focused on adversarial inputs with downstream, task-specific objectives (e.g., misclassification or jailbreaking LLM generation), we focus on embeddings. Ours is the first cross-modal attack on modern, embedding-based retrieval that can convert any data of attacker’s choice into an adversarial hub and affect a many generic or concept-specific queries. Our results highlight a new risk to multi-modal retrieval systems, and we hope that they will motivate research on adversarially robust multi-modal embeddings. Figure 4: An adversarial hub in text-to-audio retrieval. 2 Multi-Modal Retrieval Traditional retrieval systems relied on hand-crafted features and metadata. Features such as SIFT and color histograms for images [47] and TF-IDF for text [58] provided basic representations that captured low-level information. Metadata, such as tags, labels, or captions, helped bridge different modalities by aligning co-occurring information, as in early image annotation systems [4, 35]. With the rise of deep learning, the field shifted toward models such as CLIP [56], pretrained on massive datasets to produce embeddings, which are dense vector representations of inputs. Embeddings map semantically related inputs from the same or different modalities (e.g., images and texts) into a shared latent space, greatly improving accuracy for both single-modal and cross-modal retrieval tasks. Typically, encoders into the embedding space are trained to minimize cosine similarity between related inputs, which helps ensure that their embeddings are neighbors [61]. Multi-Modal Embeddings. A multi-modal encoder θmθ^m transforms inputs from modality m∈ℳm into a common embedding space. We focus on systems with two modalities, but extending to more modalities is straightforward: generate bi-modal input pairs for modality combinations and train as below. Given a bi-modal dataset D=(X,Y)∈m1×m2D=(X,Y)∈ m_1× m_2, where (x,y)(x,y) are semantically aligned (for instance, an image of a car and the text caption “Cars”), contrastive learning [50] is used to train the encoders by bringing embeddings of aligned pairs closer while pushing embeddings of unaligned inputs apart. Cross-Modal Retrieval. Consider an image retrieval system, consisting of (1) a vector database with embeddings of images, aka “Gallery”, and (2) “Queries” submitted by users in order to retrieve relevant images from the gallery. Queries can be in the same or different modality as the gallery. In text-to-image retrieval, queries are text captions, whereas in image-to-image retrieval queries are images. We use m1m_1 to denote the modality of queries and m2m_2 to denote the modality of the gallery data. Let Q=qii=1NQ=\q_i\_i=1^N denote the queries and G=gii=1SG=\g_i\_i=1^S the vectors corresponding to the gallery. Let θm1(⋅)θ^m_1(·) be the encoder for queries, θm2(⋅)θ^m_2(·) for the gallery. The retrieval system encodes the query and measures the cosine similarity of the resulting embedding with each data point in the gallery gj∈Gg_j∈ G as sim(qi,gj)=cos(θm1(qi),θm2(gj)),sim(q_i,g_j)=cos (θ^m_1(q_i),θ^m_2(g_j) ), then ranks all gallery data points from high to low based on their similarity to qiq_i, (sim(qi,g1),…,sim(qi,gS)) sort (sim(q_i,g_1),...,sim(q_i,g_S) ), and finally returns the top k most relevant gallery data points. 3 Threat Model and Attack Methods We describe the attacker’s goals in Section˜3.1, then their knowledge and capabilities in Section˜3.2, and then present the adversarial hubness attack in Section˜3.3. 3.1 Attacker’s Goals Figure˜5 shows our threat model. The attacker aims to inject a malicious input gag_a into the gallery that functions as an adversarial hub: its embedding should appear among the top results for many user queries, regardless of modality or semantic relevance. Adversarial hubs are especially feasible in galleries with user-generated data, e.g., in systems that retrieve online posts, social media, or product listings [7, 94]. Types of Adversarial Hubs. We distinguish between rational hubs—semantically meaningful content such as product ads or misinformation, motivated by economic or strategic incentives—and reckless hubs, which lack meaning and serve only to degrade retrieval (denial-of-service). We focus on rational hubs, though our techniques apply to both. While we study single-hub attacks, adversaries may inject multiple hubs. Figure 5: Attacking retrieval system with an adversarial hub. Objectives. We consider two attack objectives: Indiscriminate. The goal is to make the hub appear close to as many queries as possible regardless of their semantics. For example, an adversarial image hub may be retrieved for queries such as “cars,” “food,” or “houses.” Such hubs resemble natural hubs but appear much more frequently (Figure˜6). Figure 6: Natural hubs and adversarial hubs. Concept-specific. The goal is to target only queries related to a chosen concept while avoiding irrelevant ones. For text-to-image retrieval, we define concepts in two ways: (1) queries containing attacker-chosen keywords (e.g., “cars” or specific car models), and (2) clusters in the embedding space that capture high-level semantics (e.g., “outdoor adventure,” covering queries like “mountain hiking” and “camping”). The cluster definition naturally extends to other modalities. Concept-specific attacks differ from retrieval-augmented generation (RAG) poisoning [11]. RAG attacks are currently limited to text-to-text retrieval and require poisoned documents to contain semantics-free gibberish whose embedding is close to the trigger. By contrast, our attack preserves the original semantics of the adversary’s content. Security Consequences. Adversarial hubs can be used to spread spam, or simply to degrade performance of retrieval systems thus causing denial of service. For example, in the music industry [21, 31] platforms like Spotify [67] are constantly battling malicious actors who attempt to promote their content and manipulate platforms into streaming it for many users. In online retail, hubness attacks could manipulate product search. In social media, they could propagate misinformation and amplify misleading content. These examples show that adversaries have an economic incentive to exploit hubness. 3.2 Attacker Knowledge and Capabilities White-box. The attacker knows the embedding models θm1,θm2θ^m_1,θ^m_2, including their architecture and parameters. They do not need knowledge of benign gallery data or exact queries, since hubs are independent from the existing gallery data points and effective across diverse queries. White-box settings are realistic because many systems use public models (e.g., CLIP), models can be extracted, and breaches may expose parameters. The white-box setting follows Kerckhoffs’ principle [37]: security should not rely on the secrecy of the system but rather on its inherent robustness. This approach is standard in adversarial machine learning literature [48, 72]. Black-box. We consider two scenarios [1, 44]: (1) Transfer attacks, where hubs generated on a surrogate transfer to the target model; and (2) Query attacks, where the adversary iteratively queries the system’s API (e.g., Google Vertex AI embeddings used by Wayfair [15]) to refine hubs. Knowledge of Query Distribution. Generation of adversarial hubs requires some knowledge of the user queries. Even if the adversary does not know the true query distribution, they may still have meta-information (e.g., the system accepts text queries to retrieve images, or even a few representative queries from the system demo). Therefore, we consider two levels of attacker knowledge: (1) Exact Knowledge of the true query distribution, and (2) Proxy Knowledge of a related but different query distribution. Proxy queries can be obtained from public benchmarks (e.g., text descriptions from MS COCO to approximate queries for a text-to-image retrieval task) and adjusted based on the available meta-information or example queries. For indiscriminate attacks, we consider both a small portion (0.4%) of exact knowledge queries in Section 5.1 and proxy knowledge in Section 7.3. For concept-specific attacks, the attacker selects the concept and constructs the corresponding queries (e.g., natural-language descriptions), thus he knows the query distribution he is targeting. 3.3 Generating Adversarial Hubs We consider a cross-modal retrieval task where queries QtQ_t have modality m1m_1 and gallery data G have modality m2m_2. The adversary’s goal is to generate an adversarial hub gag_a in modality m2m_2 that is close to QtQ_t in the embedding space. For the indiscriminate attack, QtQ_t contains 100 random samples from the query distribution. When this distribution is not known, QtQ_t is sampled from a proxy distribution. For the concept-specific attack, QtQ_t contains queries related to the (attacker-chosen) concept. The attacker generates adversarial hubs by selecting an arbitrary initial input gcg_c in the same modality as the gallery G. This input gcg_c carries arbitrary semantic content (e.g., spam or product promotions) and is independent from existing gallery items and target queries QtQ_t. The attacker then introduces a bounded perturbation δ to produce an adversarial hub: ga=gc+δ,with constraint‖δ‖∞≤ϵ.g_a=g_c+δ, constraint \|δ\|_∞≤ε. (1) The norm constraint on δ serves two primary purposes: (1) it ensures the adversarial input retains the attacker’s desired human-perceived semantics, preserving the integrity of visual, textual, or audio information (rational hub), and (2) it minimizes detectability by manual inspections or by end users, reducing the likelihood of the input appearing abnormal or suspicious [62]. If the attacker’s goal is simply to degrade the retrieval system’s performance (i.e., a “reckless” hub attack), this norm constraint can be removed entirely, resulting in a stronger, though potentially more noticeable, attack. Simultaneously optimizing the adversarial hub against multiple query embeddings is computationally expensive when |Qt||Q_t| is large. Instead, we compute a single representative centroid embedding tc_t of the target queries QtQ_t, which is the average of their cosine similarities. Formally, given the target set of query embeddings θm1(q):q∈Qt\θ^m_1(q):q∈ Q_t\, tc_t is defined as: t=1|Qt|∑q∈Qtθm1(q)‖θm1(q)‖.c_t= 1|Q_t| _q∈ Q_t θ^m_1(q)\|θ^m_1(q)\|. (2) The attacker then solves the following constrained optimization problem to generate the adversarial hub embedding close to tc_t. arg⁡minδ⁡ℒ(ga,t;θ)=−cos⁡(θm2(gc+δ),t),s.t.‖δ‖∞≤ϵ. _δ~~L(g_a,c_t;θ)=- (θ^m_2(g_c+δ),c_t ),~~s.t.~~\|δ\|_∞≤ε. (3) Equation (3) is optimized via Projected Gradient Descent (PGD), which enforces the perturbation constraint through projection after each iteration [48]. In black-box settings where the target’s gradients are not available, we use the following two techniques. Transfer Attack. We perform the white-box attack on a surrogate model θm1θ^m_1 and use the resulting adversarial hub against the black-box system. The surrogate can be a single model or an ensemble of multiple, diverse models for better transferability [44, 68]. We consider an ensemble of K surrogates, denoted as Θ=θii=1K =\ _i\_i=1^K (we omit modality m1m_1 for clarity in presentation). For each surrogate θi _i, we compute its corresponding centroid embedding t,ic_t,i from the same QtQ_t, resulting in a set of centroids Ct=t,ii=1KC_t=\c_t,i\_i=1^K. The importance of individual surrogates in the ensemble is quantified via weights λ=λ1,λ2,…,λKλ=\ _1, _2,…, _K\. The adversarial hub gag_a is then generated by minimizing the following ensemble loss: ℒT(ga,Ct,Θ)=∑i=1Kλi⋅ℒ(ga,ct,i;θi).L_T(g_a,C_t, )= _i=1^K _i·L(g_a,c_t,i; _i). For simplicity, we give equal weights for each model (λi=1K _i= 1K) for experiments in Section˜7.1. Query-Based Attack. In scenarios where the adversary does not have a surrogate but can continuously query the embedding model of the retrieval system, we adapt Square Attack [1], a state-of-the-art, query-efficient score-based black-box attack for generating adversarial examples. In the original Square Attack, the attacker’s objective is to maximize the likelihood of misclassification. We redefine it to maximize cosine similarity to the target embedding tc_t, as shown in Eq. (3). This objective is optimized using an iterative, hierarchical random search process to improve query efficiency. 4 Experimental Setup Datasets. Following prior work on cross-modal retrieval [5], we evaluate on 44 benchmarks, one per specific retrieval task. MS COCO [12] (text-to-image): 5,000 test images are the gallery, 25,000 associated captions (5 per image) are queries. CUB-200-2011 [74] (image-to-image): one test image per class (200 total) are the gallery, the remaining 5,724 test images are queries. AudioCaps [38] (text-to-audio): 816 audio clips are the gallery, their text captions are queries. MSR-VTT [81] (video-to-text, proxy): 10,000 clips with ∼ 20 captions each. To evaluate query-distribution generalization, we use the 1,000 test captions as a proxy query distribution to generate adversarial hubs and evaluate them against the target MS COCO queries. Unless otherwise specified, the adversarial query set QtQ_t contains 100 randomly selected queries for indiscriminate attacks and more than 20 for concept-specific attacks (depending on the concept). Each hub generation is repeated 100 times, and we report both mean and standard deviation. Models. We use popular open-source encoders: ImageBind [24] (6 modalities), AudioCLIP [28] (3 modalities), and CLIP (2 modalities) [56]. For tasks involving images, we use a partially trained checkpoint of AudioCLIP, as it achieves better performance [28]. Our evaluations on CLIP are done on two architectures (ViT and ResNet-50) using the implementations provided by OpenCLIP [13]. Pinecone. Beyond simulated retrieval systems [5, 78], we evaluate a realistic image-to-image retrieval application from Pinecone,111https://github.com/pinecone-io/image-search-example which internally uses a proprietary CLIP variant. We assume the adversary only has access to public CLIP implementations (not the exact model) and can only upload gallery items but not alter system configurations. Experiments are run on CUB-200-2011 with the same settings. Attack Setup. To generate an adversarial hub, we randomly select a clean gallery point gc∈Gg_c∈ G, optimize the perturbation δ based on Equation (3), and run PGD for T=1,000T=1,000 iterations to obtain ga=gc+δg_a=g_c+δ. We set ϵ=16/255ε=16/255 for images and ϵ=0.05ε=0.05 for audio, following [88]. For query-based attacks, we allow up to 100,000 queries, following the original paper [1]. Evaluation Metrics. We use two standard retrieval metrics, Recall@k (R@kR@k) and Median Rank (MdR). Given a query qi∈Q=qii=1Nq_i∈ Q=\q_i\_i=1^N, we calculate the number of relevant documents in the gallery, RiR_i, and the number of relevant documents retrieved in the top-k list, RikR^k_i. Then R@kR@k is defined as 1N∑i=1NRikRi×100%. 1N _i=1^N R_i^kR_i× 100\%. Higher values indicate better retrieval performance. We report the results for different k. For the attack to be successful, the adversarial hub should appear in the top k retrieval results (not necessarily as #1). Let rir_i be the rank of the first retrieved datum in the ranked list of all gallery items. Define MdR as median(r1,r2,…,rN).median(\r_1,r_2,...,r_N\). Lower values indicate better retrieval performance. For each evaluation experiment, we first measure the retrieval performance of user queries on the original clean gallery (clean retrieval performance). Next, we generate 100 adversarial hubs for images and audio and inject each hub into the gallery to create a poisoned gallery, then measure performance of both the injected hub and original, clean documents using the same set of queries. An effective adversarial hub should achieve high R@kR@k and low MdR. We report the mean and standard deviation for both metrics. Table 1: Result for text-to-image retrieval (MS COCO). “Clean” denotes the original gallery, “Poisoned” denotes the gallery with an adversarial hub. “Relevant Doc.” is the documents relevant to the query, “Adv. Hub.” is the adversarial hub. Attack performance is shaded. Results show mean and standard deviation across 100 independently generated adversarial hubs. See Section 4 for detailed description of metrics and evaluation methodology. Model Gallery Retrieved R@1 (%)↑ R@5 (%)↑ R@10 (%)↑ MdR↓ ImageBind Clean Relevant Doc. 48.448.4 ±0.00 72.772.7 ±0.00 81.081.0 ±0.00 2.02.0 ±0.0 Poisoned Relevant Doc. 10.9±2.0010.9_± 2.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 69.6±0.0069.6_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 79.8±0.0079.8_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 2.9±0.12.9_± 0.1 Poisoned Adv. Hub 85.1±3.1085.1_± 3.1 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 98.1±0.7098.1_± 0.7 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 99.0±0.4099.0_± 0.4 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 1.0±0.01.0_± 0.0 AudioCLIP Clean Relevant Doc. 18.818.8 ±0.00 39.539.5 ±0.00 50.750.7 ±0.00 10.010.0 ±0.0 Poisoned Relevant Doc. 8.8±3.508.8_± 3.5 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 36.9±0.4036.9_± 0.4 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 49.3±0.2049.3_± 0.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 11.0±0.011.0_± 0.0 Poisoned Adv. Hub 62.0±18.762.0_± 18.7 81.4±13.381.4_± 13.3 87.5±10.487.5_± 10.4 1.6±1.41.6_± 1.4 OpenCLIP-ViT Clean Relevant Doc. 48.548.5 ±0.00 72.872.8 ±0.00 81.181.1 ±0.00 2.02.0 ±0.0 Poisoned Relevant Doc. 11.3±2.2011.3_± 2.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 69.8±0.0069.8_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 79.9±0.0079.9_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 3.0±0.13.0_± 0.1 Poisoned Adv. Hub 84.4±3.5084.4_± 3.5 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 97.9±0.8097.9_± 0.8 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 98.9±0.5098.9_± 0.5 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 1.0±1.01.0_± 1.0 OpenCLIP-RN50 Clean Relevant Doc. 28.328.3 ±0.00 53.053.0 ±0.00 64.164.1 ±0.00 5.05.0 ±0.0 Poisoned Relevant Doc. 1.4±0.801.4_± 0.8 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 49.8±0.0049.8_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 62.2±0.0062.2_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 6.0±0.06.0_± 0.0 Poisoned Adv. Hub 97.6±1.6097.6_± 1.6 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 99.5±0.5099.5_± 0.5 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 99.7±0.3099.7_± 0.3 [rgb]0.9,0.9,0.9 [named]pgfstrokecolorrgb0.9,0.9,0.9 @color@gray@stroke0.9 @color@gray@fill0.90 1.0±0.01.0_± 0.0 5 Evaluation Without Defenses We first evaluate universal adversarial hubs in Section˜5.1, thrn compare with natural hubs in Section˜5.2, then evaluate stealthy concept-specific hubs in Section˜5.3. 5.1 Universal Adversarial Hubs Text-to-Image Retrieval. Table˜1 shows results on MS COCO across ImageBind, AudioCLIP, and OpenCLIP. The performance of clean gallery ranges from R@10=81.1%R@10=81.1\% and MdR=2MdR=2 (OpenCLIP-ViT) to R@10=50.7%R@10=50.7\% and MdR=10MdR=10 (AudioCLIP). With an adversarial hub, all models retrieve the hub for many irrelevant queries. OpenCLIP-RN50 is most vulnerable (R@1=97.6%R@1=97.6\%), while AudioCLIP is more robust (R@1=62.0%R@1=62.0\%) but already performs poorly on the clean gallery (R@1=18.8%R@1=18.8\%), makes it unusable in practice. For most models the adversarial hub achieves MdR=1MdR=1, i.e., it is ranked above semantically relevant content. Impact on clean items is modest: ImageBind drops only slightly from R@10=81.0%R@10=81.0\% to 79.8%79.8\% when a hub is added. This is expected: adversarial hubs are single point that dominate the top ranks while leaving most of the gallery intact. Our adversarial hubs exhibit good generalization. They are optimized on only 100 random text queries from MS COCO, yet achieve high recall rates on the full test set of 25,000 captions. This indicates the adversarial hubs exploit inherent vulnerabilities in the embedding space (rather than overfitting to specific queries) and broadly effective against any user queries from the same distribution. Table 2: Text-to-audio retrieval (AudioCaps). Model Gallery Retrieved R@1(%)↑ R@5(%)↑ R@10(%)↑ MdR↓ ImageBind Clean Relevant Doc. 10.6±0.010.6_± 0.0 30.7±0.030.7_± 0.0 43.7±0.043.7_± 0.0 13.0±0.013.0_± 0.0 Poisoned Relevant Doc. 7.3±0.67.3_± 0.6 27.4±0.327.4_± 0.3 40.5±0.140.5_± 0.1 16.0±0.016.0_± 0.0 Poisoned Adv. Hub 52.2±6.752.2_± 6.7 71.2±5.671.2_± 5.6 81.3±4.881.3_± 4.8 1.5±0.71.5_± 0.7 AudioCLIP Clean Relevant Doc. 6.2±0.006.2_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 20.7±0.0020.7_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 31.8±0.031.8_± 0.0 27.0±0.027.0_± 0.0 Poisoned Relevant Doc. 2.5±0.802.5_± 0.8 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 18.8±0.3018.8_± 0.3 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 30.6±0.230.6_± 0.2 28.0±0.028.0_± 0.0 Poisoned Adv. Hub 58.0±13.758.0_± 13.7 77.6±10.577.6_± 10.5 85.8±7.985.8_± 7.9 1.5±0.91.5_± 0.9 Table 3: Image-to-image retrieval (CUB-200-2011). Model Gallery Retrieved R@1(%)↑ R@3(%)↑ R@5(%)↑ R@10(%)↑ MdR↓ ImageBind Clean Relevant Doc. 59.2±0.059.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 77.7±0.077.7 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 84.9±0.084.9 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 92.3±0.092.3 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 1.0±0.01.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 Poisoned Relevant Doc. 55.7±0.255.7_± 0.2 75.5±0.175.5_± 0.1 83.2±0.183.2_± 0.1 91.0±0.091.0_± 0.0 1.0±0.01.0_± 0.0 Poisoned Adv. Hub 5.5±0.75.5_± 0.7 39.5±2.639.5_± 2.6 62.2±2.562.2_± 2.5 87.7±2.087.7_± 2.0 4.2±0.44.2_± 0.4 AudioCLIP Clean Relevant Doc. 12.1±0.012.1 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 22.2±0.0022.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.00 28.3±0.0028.3 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.00 38.9±0.0038.9 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.00 19.0±0.019.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 Poisoned Relevant Doc. 11.0±0.511.0_± 0.5 21.6±0.5021.6_± 0.5 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 27.9±0.4027.9_± 0.4 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 39.2±0.2039.2_± 0.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 18.0±0.018.0_± 0.0 Poisoned Adv. Hub 13.3±6.113.3_± 6.1 31.6±11.131.6_± 11.1 44.8±12.944.8_± 12.9 66.7±13.166.7_± 13.1 6.8±3.16.8_± 3.1 OpenCLIP-ViT Clean Relevant Doc. 59.5±0.059.5 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 79.5±0.079.5 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 86.2±0.086.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 93.0±0.093.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 1.0±0.01.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 Poisoned Relevant Doc. 56.6±0.256.6_± 0.2 77.2±0.277.2_± 0.2 84.4±0.184.4_± 0.1 92.6±0.192.6_± 0.1 1.0±0.01.0_± 0.0 Poisoned Adv. Hub 4.1±0.64.1_± 0.6 34.6±2.734.6_± 2.7 61.0±3.161.0_± 3.1 90.7±2.690.7_± 2.6 4.7±0.54.7_± 0.5 OpenCLIP-RN50 Clean Relevant Doc. 22.0±0.022.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 38.7±0.038.7 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 48.0±0.048.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 62.1±0.062.1 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 6.0±0.06.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 Poisoned Relevant Doc. 20.5±0.420.5_± 0.4 36.6±0.336.6_± 0.3 46.4±0.146.4_± 0.1 60.8±0.160.8_± 0.1 6.6±0.56.6_± 0.5 Poisoned Adv. Hub 20.0±2.820.0_± 2.8 45.7±4.045.7_± 4.0 59.4±3.759.4_± 3.7 77.7±2.977.7_± 2.9 4.1±0.64.1_± 0.6 Text-to-Audio Retrieval. Table˜2 presents text-to-audio retrieval results on the AudioCaps dataset. Our adversarial hubs achieve R@1R@1 over 50% and R@10R@10 as high as 81.3% for ImageBind and 85.8% for AudioCLIP. The median rank for adversarial hubs is approximately 1.5, indicating their high “relevance” as it appears to users. These results show that a single adversarial audio can align with a broad range of captions. While somewhat more robust than text-to-image, text-to-audio is highly vulnerable. This suggests that hubness is intrinsic to multi-modal embedding spaces as it extends beyond the (well-studied) image domain to audio. Image-to-Image Retrieval. Our primary focus is cross-modal retrieval, but our attack also potentially affects embedding-based “search by image” systems. Table˜3 presents image-to-image retrieval results on the CUB-200-2011 dataset, using the same models as above. In Section˜7.1, we apply the attack to a black-box system from a Pinecone tutorial. Image-to-image retrieval is more robust than text-to-image but adversarial hubs are still retrieved among the top results for multiple queries. For OpenCLIP-ViT, R@1=4.1%R@1=4.1\% but R@10=90.7%R@10=90.7\%. Similarly, for ImageBind, R@1=5.5%R@1=5.5\% but R@10=87.7%R@10=87.7\%. We conjecture that image-to-image retrieval resists adversarial hubs better than cross-modal retrieval because embeddings cluster based on modality. Retrieval is based on relative similarity. In ImageBind, cosine similarity between a random text and all other texts is 0.2190.219; for images, average similarity is 0.2920.292, indicating similar concentration within each modality. But average similarity between a random image and all texts is only 0.0140.014. Therefore, the same absolute level of similarity that is sufficient to make a hub most relevant for queries from another modality may not be sufficient to make it most relevant for queries from the same modality. Furthermore, in ImageBind the center of all text query embeddings has an average cosine similarity of 0.4540.454 with the individual queries. By contrast, average similarity between images and their ground-truth text captions is 0.3110.311. Aligning an image with this center achieves average cosine similarity of 0.3920.392 with text queries and thus turns it into a hub because, on average, it is closer to the queries than clean images are to their correct captions. Overall, adversarial hubs exploit modality gaps: cross-modal retrieval is far more vulnerable than unimodal retrieval, echoing observations on natural hubness [42]. Single-modality representations tend to be more compact potentially reducing vulnerability to both natural and adversarial hubs. Figure 7: Retrieval frequency of adversarial and natural hubs. Adversarial hubs (red dots) are retrieved significantly more frequently than natural hubs. Plot width indicates retrieval frequency (log scale), with results averaged over 100 trials. 5.2 Comparing Adversarial and Natural Hubs Figure˜7 shows the number of gallery points retrieved as the most relevant for different numbers of queries (y-axis) across text-to-image, image-to-image, and text-to-audio retrieval tasks. For a given y, width indicates the number of points retrieved y times. Adversarial hubs (red) are retrieved orders of magnitude more often than natural hubs. On MS COCO with ImageBind, our adversarial hub is ranked as the top 21,13621,136 times vs. 102102 for the strongest natural hub (×207× 207 gap). Even in the most robust case (CUB-200-2011, OpenCLIP-ViT), the gap remains ×1.9× 1.9. The correct metric for a natural hub is the number of irrelevant queries for which it is retrieved. In CUB-200-2011 using OpenCLIP-ViT (where the gap between natural and adversarial hubs is the smallest), a natural hub is, on average, relevant to 28 user queries. Even though some clean gallery points are classified as natural hubs because they are retrieved by up to 100 queries, the actual number of irrelevant retrievals is only 100−28=72100-28=72. By contrast, adversarial hubs are irrelevant by construction, turning hubness from a statistical phenomenon to a potent and exploitable attack vector. 5.3 Concept-Specific Adversarial Hubs Generation. We build two types of concept-specific hubs on ImageBind embeddings and MS COCO dataset. Word-based: We extracted 100 distinctive words representing visual concepts from the MS COCO test set using ChatGPT [51], excluding common function words (e.g., “be”, “of”, “in”) and non-visual terms (e.g., “play”, “shape”). For each word, QtQ_t includes all queries containing it. Cluster-based: We partitioned 25,000 queries into 1,000 clusters via K-means, following prior work on subpopulation poisoning [69, 33]. Clusters reflect semantic concepts (e.g., outdoor adventures) even if queries are not lexically related (e.g., “mountain climbing” or “camping under the stars”). Generation of both word-based and cluster-based concept-specific adversarial hubs follows the optimization procedure from Equation (2), differing only in the choice of the target query set QtQ_t. We evaluate attack effectiveness using (1) retrieval performance on the intended concept-specific queries (higher is better), and (2) collateral damage, defined as retrieval performance on unrelated queries (lower is better). This setup simulates a realistic scenario where an adversary wants their hub to be frequently retrieved for queries related to the target concept while remaining largely invisible (and thus stealthy) to unrelated queries. Effectiveness and Stealthiness. Table˜4 presents the results for word-based and cluster-based concept-specific adversarial hubs. Word-based hubs achieve R@1=28.6%R@1=28.6\% and R@10=61.7%R@10=61.7\%. These metrics are almost 100% for cluster-based hubs, demonstrating that the attack is more effective when target queries share high-level semantics. To assess stealthiness, we measure the effect of concept-specific hubs on unrelated queries (the vast majority of the 25,000 test queries). Word-based hubs are almost never retrieved (R@10≤0.7%R@10≤ 0.7\%). Retrieval rates for unrelated queries are slightly higher for cluster-based hubs, 8.6%8.6\% at R@1R@1 and 18.4%18.4\% at R@10R@10, indicating a modest trade-off between effectiveness and stealthiness. Future hub generation methods may better balance effectiveness and stealthiness. In Section˜6, we show that defenses for natural hubs are much less effective against concept-based adversarial hubs. Table 4: Concept-specific adversarial hubs on MS COCO with and without QB-Norm defense. Performance is reported on poisoned galleries using Original and Targeted query sets. Standard deviations omitted for concept-specific hubs due to evaluation on heterogeneous query subsets. QB-Norm Retrieved Query R@1 (%) R@5 (%) R@10 (%) MdR No Relevant Doc. Original 10.9±2.010.9_± 2.0 69.6±0.069.6_± 0.0 79.8±0.079.8_± 0.0 2.9±0.12.9_± 0.1 Universal Hub Original 85.1±3.185.1_± 3.1 98.1±0.798.1_± 0.7 99.0±0.499.0_± 0.4 1.0±0.01.0_± 0.0 Word-based Concept-specific Hub Original 0.20.2 0.40.4 0.70.7 912.1912.1 Word-based Concept-specific Hub Targeted 28.628.6 53.553.5 61.761.7 50.850.8 Cluster-based Concept-specific Hub Original 8.68.6 15.015.0 18.418.4 24.124.1 Cluster-based Concept-specific Hub Targeted 100.0100.0 100.0100.0 100.0100.0 1.01.0 Yes Relevant Doc. Original 49.7±0.049.7_± 0.0 74.1±0.174.1_± 0.1 82.6±0.182.6_± 0.1 2.0±0.002.0_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 Universal Hub Original 0.0±0.00.0_± 0.0 11.5±2.411.5_± 2.4 12.2±2.712.2_± 2.7 699.9±72.8699.9_± 72.8 Word-based Concept-specific Hub Original 0.00.0 0.20.2 0.30.3 1379.21379.2 Word-based Concept-specific Hub Targeted 22.922.9 44.644.6 53.653.6 55.555.5 Cluster-based Concept-specific Hub Original 0.10.1 5.15.1 7.67.6 4015.74015.7 Cluster-based Concept-specific Hub Targeted 95.395.3 98.398.3 99.099.0 1.01.0 6 Evaluation of Defenses In Section˜6.1, we outline a representative defense against natural hubs [5], then evaluate its effectiveness against adversarial hubs in Section˜6.2. In Section˜6.3, we discuss potential adaptations of defenses against adversarial examples to mitigate adversarial hubs. 6.1 Querybank Normalization (QB-Norm) Defense Mechanism. This defense [5] normalizes abnormally high similarity scores in cross-modal retrieval. It employs a query bank QbQ_b of typical user queries and creates an activation set with the indices of gallery points that appear at least once in the top-k results for the queries in QbQ_b: =j:j∈argmaxgj∈Gsim(qi,gj),qi∈QbA=\j:j∈ kargmax_g_j∈ G\,sim(q_i,g_j),q_i∈ Q_b\ For each gallery point gjg_j, a precomputed probe vector pj∈ℝKp_j ^K consists of similarities with K most relevant queries from QbQ_b. When processing a user query q, if the index of the most relevant gallery point is in A, its similarity score ηq(j) _q(j) is normalized: ηq(j)=exp⁡(β⋅simj)Texp([β⋅pj)]if arg⁡maxgj∈G⁡simj∈simjotherwise _q(j)= cases (β·sim_j) 1^T ([β· p_j)]&if _g_j∈ Gsim_j \\ sim_j&otherwise cases (4) where β is a temperature parameter controlling normalization strength. We focus on this defense because it (a) scales to modern retrieval systems, and (b) was shown to reduce natural hubness with minimal impact on clean retrieval. Subsequent approaches [78, 14] are similar, with minor variations in the query bank construction. At a high level, these defenses leverage a curated set of potential queries to identify gallery items that frequently appear as hubs, then normalize their retrieval scores to reduce their dominance while preserving overall system performance. For our evaluation, we use the default hyperparameters from the original paper [5]. Lazy vs. Diligent Defense Implementation. Querybank normalization is very expensive for large-scale retrieval systems with continuously updated galleries because activation sets and probe vectors must be re-computed for every gallery update. We call this the diligent defense. An alternative is the lazy defense which does these computations periodically, not every time a new point is added. Lazy defense has a vulnerability window: if an adversary adds an adversarial hub, the system will not be defended against this hub until the next update because the hub will not be in the activation set A and its probe vector pjp_j will be zero. In our evaluation, we consider the stronger, diligent defense, even though it is computationally prohibitive in real-world deployments. 6.2 Effectiveness of QB-Norm Universal Hubs. We evaluate the effectiveness of the QB-Norm defense on MS COCO with ImageBind embedding. Without adversarial hubs, it slightly improves retrieval performance by mitigating (rare) natural hubs: R@1R@1 increases from 48.4% to 49.9%. Table˜4 shows that QB-Norm is effective against universal adversarial hubs, reducing their R@1R@1 of adversarial hubs drops from 85.1% to 0% and increasing median rank from 1 to 700. Retrieval accuracy for relevant documents in the presence of adversarial hubs increases 10.9% to 49.7%, and median rank increases from 2.9 to 2.0. In practice, the key challenge for this defense is its cost. It must maintain a comprehensive query bank QbQ_b that is representative of potential user queries, which potentially requires millions or billions of queries. Furthermore, activation sets and probe vectors must be frequently re-computed for the entire gallery. Using a small subset, such as the k-nearest neighbors of gallery data points in QbQ_b [14], increases the speed of this defense by over 100x, but introduces exploitable gaps due to the inherent asymmetry between the top-k samples in QbQ_b and the actual target queries QtQ_t (which corresponds to Q in our indiscriminate attack setting). To illustrate this, we evaluate the same universal hubs against the compute-efficient variant [14] and observe a R@1=3.3%R@1=3.3\% and R@10=45.2%R@10=45.2\%, in contrast to R@1=0%R@1=0\% and R@10=12.2%R@10=12.2\% achieved against the naive QB-norm defense. These results show a clear trade-off between computational efficiency and effectiveness of this defense even when adversarial hubs are universal and non-adaptive. We expect that an adaptive attacker could achieve even higher R@kR@k performance, but leave it for future work. Concept-Specific Hubs. Table˜4 shows that R@1R@1 of word-specific hubs by their targeted queries decreases only marginally (by 5.7%) in the presence of QB-Norm. Cluster-specific hubs remain highly effective, too, achieving 95.3% R@1R@1 and a median rank of 1 for their corresponding queries. Collateral damage (i.e., retrieval by unrelated queries) is minimal for both types of concept-specific hubs. Concept-specific hubs successfully evade the defense because their target query distribution QtQ_t differs significantly from the typical queries QbQ_b used by QB-Norm for normalization. In summary, universal adversarial hubs are useful for benchmarking adversarial robustness of retrieval systems but they are more likely to be detected than concept-specific hubs. Table 5: Black-box attack performance in text-to-image retrieval (MS COCO). Results show effectiveness of transfer-based and query-based attacks across different models. Target Model Attack Method R@1(%)↑ R@5(%)↑ R@10(%)↑ MdR↓ ImageBind Transfer 76.9±5.276.9_± 5.2 96.6±1.396.6_± 1.3 98.2±0.8098.2_± 0.8 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 1.0±0.0001.0_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill100 Query-based 0.7±1.10.7_± 1.1 8.1±9.78.1_± 9.7 15.2±16.115.2_± 16.1 120.5±129.2120.5_± 129.2 AudioCLIP Transfer 0.2±0.20.2_± 0.2 0.6±0.50.6_± 0.5 1.1±0.901.1_± 0.9 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 596.6±266.1596.6_± 266.1 Query-based 4.6±3.74.6_± 3.7 14.9±8.714.9_± 8.7 22.9±11.522.9_± 11.5 60.5±59.7060.5_± 59.7 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 OpenCLIP-ViT Transfer 76.2±6.576.2_± 6.5 96.4±0.896.4_± 0.8 98.1±0.1098.1_± 0.1 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 1.0±0.0001.0_± 0.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill100 Query-based 0.7±1.10.7_± 1.1 8.4±1.08.4_± 1.0 15.7±16.315.7_± 16.3 115.4±137.3115.4_± 137.3 OpenCLIP-RN50 Transfer 0.1±0.20.1_± 0.2 0.4±0.40.4_± 0.4 0.7±0.70.7_± 0.7 764.3±459.8764.3_± 459.8 Query-based 5.0±3.95.0_± 3.9 15.6±8.115.6_± 8.1 23.4±9.923.4_± 9.9 42.2±25.2042.2_± 25.2 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 6.3 Adapting Adversarial Examples Defenses Some defenses are based on input processing, such as JPEG compression [27], feature distillation [45] and feature squeezing [82]. These defenses have a significant negative impact on clean performance, not only for classification tasks [82, 27] but also for retrieval. For example, in our text-to-image retrieval on MS COCO, common input transformations (JPEG compression, Gaussian blur, random affine transformations, color jitter, random horizontal flips, and perspective changes) reduce the R@1R@1 across all embedding models by an average of 14.1%. By contrast, query normalization tends to improve clean performance. Furthermore, these defenses fail against adaptive attacks [3, 65, 30]. A detailed exploration of these defenses and the arms race with adaptive attacks is beyond the scope of this paper and left for future work. Another line of defense focuses on improving robustness through adversarial training [48, 87] or certified methods [16, 79, 26]. These approaches face serious challenges in modern retrieval systems due to limited scalability and poor performance on realistic models. Whereas robustness to adversarial examples was mostly demonstrated on toy datasets like CIFAR-10 [40], retrieval tasks involve high-resolution natural images and much larger models. Furthermore, retrieval inherently involves a robustness–invariance tradeoff [73]: models must be sensitive to small input changes (to distinguish different clean inputs), but the same sensitivity can be exploited by attackers to generate adversarial hubs. It is thus difficult to specify which inputs should or should not be aligned in the embedding space during robust training. 7 Relaxing Attack Assumptions Although our main goal is to benchmark adversarial robustness of cross-modal retrieval systems in white-box settings, which is consistent with prior adversarial examples literature [9, 3], in practical applications attackers may not always have access to the target system’s embedding model or query distribution. We now show that our adversarial hubs remain effective even when attackers only have limited knowledge about the target embedding model (Section 7.1) and the target query distribution (Section 7.2). 7.1 Black-Box Universal Adversarial Hubs In this section, we investigate how to generate adversarial hubs with a limited knowledge of the target embedding model. Transfer Attack. We first use available open-source embedding models as surrogates to create adversarial hubs that transfer to the black-box target system without additional queries to the latter. From our four models (ImageBind, AudioCLIP, OpenCLIP-ViT, OpenCLIP-ResNet-50), we select three as the local model ensemble and treat the remaining one as the black-box target (we omit the results using individual models as surrogates because ensembles work better). Table 5 shows that this attack achieves varying degrees of success. It is highly effective against ImageBind and OpenCLIP-ViT, achieving an average top-1 recall of R@1=76.5%R@1=76.5\% and median rank of MdR=1.0MdR=1.0. Since ImageBind extends OpenCLIP-ViT’s architecture with additional modalities while preserving the core visual encoder, including OpenCLIP-ViT in the surrogate ensemble enhances transferability to ImageBind, and vice versa. Transferability to OpenCLIP-RN50 and AudioCLIP is limited, with R@1=0.15%R@1=0.15\% and MdR=680.4MdR=680.4, which is still better than random (R@1=0.02%R@1=0.02\%, MdR=2500MdR=2500). Our transfer technique does push the embedding of the adversarial hub close to the centroid of queries in the embedding space of the target model but this proximity is insufficient for the hub to become the nearest neighbor of many unrelated queries contributing to the centroid. These results indicate that architectural similarity between the surrogates and targets is a critical factor in transfer attack success. However, there are only a few popular visual and audio encoders, making it possible for an adversary to make educated guesses about the architecture of the target system and include similar models in their surrogate ensemble. Developing transfer techniques with better cross-architecture generalizability remains an open challenge for future research. Table 6: Pinecone image-to-image retrieval (CUB-200-2011). Gallery Retrieved R@1(%)↑ R@3(%)↑ R@5(%)↑ Clean Relevant Doc. 25.4±0.025.4 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 43.0±0.043.0 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 52.7±0.052.7 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill1_± 0.0 Poisoned Relevant Doc. 24.5±0.224.5_± 0.2 41.9±0.641.9_± 0.6 51.8±0.751.8_± 0.7 Poisoned Adv. Hub 7.5±1.57.5_± 1.5 21.4±3.521.4_± 3.5 31.7±4.531.7_± 4.5 Pinecone. In addition to academic benchmarks, we evaluate our black-box attack on a image-to-image retrieval system implemented by Pinecone, a commercial vector database. We use the OpenCLIP-ViT embedding as the local surrogate and target image-to-image retrieval, reporting the results for k≤5k≤ 5 per this system’s default setup. Table˜6 shows that our attack achieves R@1=7.5%R@1=7.5\% and R@5=31.7R@5=31.7, comparable to the simulated settings in Section˜5.1. Query-Based Attack. We also evaluate attacks where adversaries submit multiple API queries to the black-box embedding models used in the target retrieval system and iteratively refine adversarial hubs. For these attacks, we run our adapted Square Attack with 100,000100,000 queries. Although less effective than the white-box or the most successful transfer attacks, this approach works across all tested models without requiring knowledge of the target’s model architecture. It performs best against OpenCLIP-RN50, achieving 23.4%23.4\% top-10 recall and median rank of 42.2. Future work could explore reducing the query budget, developing more effective black-box optimization techniques, and hybrid strategies that combine this approach with with transfer attacks [68]. Table 7: Effectiveness of adversarial hubs across different query distributions. Results show attack performance when using queries from alternative datasets (rows) to generate hubs that target MS COCO. Target Dataset R@1(%)↑ R@5(%)↑ R@10(%)↑ MdR↓ CUB-200 4.8±1.84.8_± 1.8 15.1±3.915.1_± 3.9 23.0±5.223.0_± 5.2 42.4±12.542.4_± 12.5 AudioCaps 10.6±2.810.6_± 2.8 30.8±5.830.8_± 5.8 41.9±6.741.9_± 6.7 17.0±6.3017.0_± 6.3 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 MSR-VTT 35.8±6.435.8_± 6.4 66.4±8.266.4_± 8.2 76.8±7.676.8_± 7.6 2.7±1.302.7_± 1.3 [rgb]1,1,1 [named]pgfstrokecolorrgb1,1,1 @color@gray@stroke1 @color@gray@fill10 7.2 Different Query Distributions We evaluate generalizability of our adversarial hubs across different query distributions by using text queries from other datasets (CUB-200, AudioCaps, MSR-VTT) to generate hubs for the text queries from MS COCO. Table˜7 shows that the attack remains effective. MSR-VTT yields the strongest transfer performance (R@1=35.8%,R@10=76.8%R@1=35.8\%,R@10=76.8\%), likely because its visual-linguistic properties are similar to MS COCO and the attack only needs to approximate common visual concepts (e.g., objects and scenes) rather than match the exact query distribution. Hubs optimized for CUB-200 exhibit the weakest transfer performance (R@1=4.8%R@1=4.8\%), which is expected given this dataset focuses on fine-grained object categories rather than descriptive captions. AudioCaps results are in the middle (R@1=10.6%R@1=10.6\%), demonstrating our attack’s ability to exploit cross-modal semantic relationships despite significant modality differences. These findings indicate that our approach is robust to differences and shifts in query distributions. 7.3 Ablation Studies We conduct additional ablation studies to assess the impact of the target query distribution size (|Qt||Q_t|) and the perturbation budget (ϵε) on adversarial hub performance in text-to-image retrieval tasks on the MS COCO dataset. Different Sizes of Target Query Set QtQ_t. The x-axis in Figure˜8 denotes different sizes of the target query set QtQ_t. The default size of QtQ_t used in our main experiments (Section˜5–Section˜7) is 100. The left y-axis shows the top-1 retrieval rate of adversarial hubs, each generated using a different QtQ_t, evaluated against the 25,000 test queries. The right y-axis shows the average cosine similarity between the embeddings of test queries and the corresponding adversarial hubs. The solid lines in the figure represent the performance of our optimized attack based on Equation˜3 across varying |Qt||Q_t|. The dotted lines indicate the performance of a “hypothetical” optimal attack, where the adversarial hub embedding exactly matches the centroid tc_t of QtQ_t. This serves as an upper bound on both top-1 recall and average cosine similarity, since actual attacks may not perfectly align with tc_t. From the figure, we observe that for both metrics, the solid and dotted lines increase with larger |Qt||Q_t|. However, the top-1 recall saturates around 85.1% when QtQ_t contains just 100 samples. Further increasing |Qt||Q_t| yields only marginal gains. This suggests that adversarial hubs can be effectively generated using a relatively small set of queries (e.g., 0.4% of the 25,000 total queries), while still closely approximating the embedding distribution of a much larger set. The diminishing returns beyond this saturation point are likely due to the compactness of the query embedding space, allowing 100 samples to provide a strong approximation, which our optimization method (Equation˜3) effectively exploits. Table 8: Impact of perturbation bound ϵε on attack performance. Results show how different perturbation magnitudes affect the retrieval metrics for adversarial hubs generated with ImageBind on MS COCO dataset. ϵε R@1(%)↑ R@5(%)↑ R@10(%)↑ MdR↓ 8/2558/255 62.8±10.7 92.9±4.4 96.4±2.4 1.1±0.4 16/25516/255 85.1±3.10 98.1±0.7 99.0±0.4 1.0±0.0 32/25532/255 90.5±1.40 98.8±0.3 99.4±0.2 1.0±0.0 64/25564/255 91.5±1.10 99.0±0.3 99.5±0.2 1.0±0.0 Figure 8: Performance vs. sample size. Attack success rate (ASR) and cosine similarity between adversarial hub and query embeddings improve with larger target sample sizes, converging at around 100 samples. Different Perturbation Bound. Table˜8 shows how the perturbation bound ϵε influences attack performance under the optimization in Equation˜3. Even small perturbations (ϵ=8/255ε=8/255) are effective, with 62.8% R@1R@1. Our default setting (ϵ=16/255ε=16/255), commonly used for generating adversarial examples, achieves 85.1% R@1R@1 with MdR = 1.0, striking a strong balance between attack success and imperceptibility. Larger bounds (ϵ=32/255ε=32/255, 64/25564/255) yield only marginal gains (90.5% and 91.5% R@1R@1, respectively), indicating diminishing returns. This suggests that increasing the perturbation magnitude primarily raises detection risk without meaningful performance improvement, validating our chosen ϵε as an effective trade-off between effectiveness and stealthiness. 8 Related Work Adversarial Alignment and Adversarial Examples. The most relevant related work investigates adversarial alignment of inputs in multi-modal embedding spaces [88, 20]. These attacks incrementally adjust an input to align with a single target embedding in an arbitrary modality. By contrast, adversarial hubs achieve the much harder goal of aligning a single input to a large number of target embeddings in arbitrary modalities. Our work builds on the broader literature on untargeted and targeted adversarial examples. Untargeted attacks cause outputs that are incorrect but not controlled by the adversary [25], while targeted attacks induce a specific, adversary-chosen, incorrect output [10]. By contrast, our approach generates adversarial inputs that work for multiple targets at once (dozens of thousands of queries in the case of multi-modal retrieval). In multi-modal settings, the most closely related papers are adversarial cross-modal examples [80, 90, 19, 53, 22, 64]. As well as being task-specific, these techniques only attack single targets while we demonstrate generalization to entire target distributions (queries related to a semantic concept). In other recent work [8, 55, 89], untargeted adversarial perturbations are used for jailbreaking and prompt injection in multi-modal chatbots. These problem settings are different from ours. Hoedt et al. [31] generate uni-modal audio adversarial hubs. Their attack has two key limitations: it is (1) incompatible with modern retrieval systems based on neural encoders, and (2) unrealistically assumes the attacker has prior access to natural hubs. By contrast, our attack converts any data of the attacker’s choice (in the same or different modality) into a hub using only a few random user queries and is naturally compatible with neural encoders. Furthermore, our adversarial hubs impact a much larger number of queries, demonstrating a more scalable and realistic threat. Other related work includes uni-modal adversarial examples against specific downstream tasks: toxicity classification [32], reading comprehension [36], and chatbots [93]. Untargeted adversarial perturbations against contrastively-trained encoders are demonstrated in [84, 39, 92]. Importantly, unlike multi-target attacks that cause different incorrect outputs for the same input across multiple models [41], and universal adversarial perturbations [49] that generalize across inputs (not targets), our method works against a single model but generalizes across embedding targets. Poisoning Retrieval-Augmented Generation. Our work is also closely related to retrieval-augmented generation (RAG) poisoning, which involves an adversary who injects adversarial documents into a RAG system’s corpus. In this setting, adversaries create documents that have two goals: (1) they are frequently retrieved (retrieval poisoning) and (2) they result in unsafe generations when retrieved (generation poisoning). Chaudhari et al. [11] study trigger-based retrieval poisoning: they create adversarial documents that are retrieved for any query containing a specific trigger word. Others [91, 83] study triggerless retrieval poisoning attacks by clustering clean documents and generating an adversarial document for each cluster. Zhang et al. [88] propose a method to produce natural-looking text that works for both trigger-based and triggerless attacks. After they are retrieved, adversarial documents cause generative models to produce harmful content or suppress correct answers [11, 63]. Unlike our work, these approaches work with pure text-to-text retrieval systems. While our work is more closely related to retrieval poisoning, an adversary could also target generation in any modality by including malicious generation targets in their query set QtQ_t. We leave this for future work. Mitigation of Natural Hubness. Since hubs occur organically, without adversarial manipulation, in high-dimensional distributions, prior work focused on mitigating natural hubness. There are train-time [43] and post-processing methods [5, 60, 70, 78] for mitigating natural hubs. Train-time methods rely on hubness-aware loss functions [43] which downweigh points that are close to multiple neighbors. While effective, these methods are costly for large models and have been mostly supplanted by post-processing methods, which rescale abnormally high similarities between points. Early methods included combinations of local scaling [34, 85, 60], global scaling [60, 31], and centroid-scaling [70, 71, 29], but these are inefficient for large models. More scalable methods leverage a query bank to normalize abnormal retrieval similarities [5, 18, 66, 17, 78, 14]. Some are explicitly designed for cross-modal retrieval [5, 78, 14]. We evaluate their effectiveness in Section˜6. 9 Conclusion and Future Work This paper investigated how the well-known phenomenon of hubness, where a data point in a high-dimensional space becomes a neighbor to many semantically unrelated points, can be adversarially exploited. We focused this investigation on multi-modal, embedding-based retrieval methods that are at the heart of modern retrieval systems. We introduced two types of adversarial hubs: (1) universal hubs that are close to, and thus retrieved by, many irrelevant user queries, and (2) concept-specific hubs that are only retrieved by queries related to adversary-chosen semantic concepts. Through empirical evaluation, we showed that adversarial hubs can be crafted to appear relevant to many more queries than natural hubs. Adversarial hubs could thus be (ab)used for spam and product promotion attacks on modern multi-modal retrieval systems that rely on pretrained embeddings. Furthermore, we showed that defenses designed to mitigate natural hubness are ineffective against concept-based adversarial hubs, motivating research on new defenses. There are several promising directions for future exploration. On the attack side, one could apply localized perturbations, akin to adversarial patches [6], to generate adversarial hubs, and extend their construction to modalities beyond images and audio, which are the focus of this paper. Another direction is to study adversarial hubs in the context of multi-modal RAG systems. On the defense side, mitigating adversarial hubness is a challenge, as demonstrated in this work. Future research may focus on designing efficient detection mechanisms against adaptive attacks and investigating tradeoffs between robustness and retrieval performance in multi-modal embedding models. Ethical Considerations While our work investigates the vulnerability of multi-modal retrieval systems to adversarial hubs, our primary goal is to raise awareness of these threats and to inspire the development of effective defenses against adversarial hubs. Open Science To facilitate research on the security of multi-modal embeddings, we released our code and models.222https://github.com/Tingwei-Zhang/adv_hub Acknowledgments Supported in part by the NSF grant 2311521 and the Google Cyber NYC Institutional Research Program. References [1] Maksym Andriushchenko, Francesco Croce, Nicolas Flammarion, and Matthias Hein. Square Attack: a query-efficient black-box adversarial attack via random search. In European Conference on Computer Vision (ECCV), 2020. [2] Anthropic. Introducing the next generation of Claude. https://w.anthropic.com/news/claude-3-family, March 2024. Accessed: August 24, 2025. [3] Anish Athalye, Nicholas Carlini, and David Wagner. Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. In International Conference on Machine Learning (ICML), pages 274–283. PMLR, 2018. [4] Kobus Barnard, Pinar Duygulu, David Forsyth, Nando De Freitas, David M Blei, and Michael I Jordan. Matching words and pictures. The Journal of Machine Learning Research, 3:1107–1135, 2003. [5] Simion-Vlad Bogolin, Ioana Croitoru, Hailin Jin, Yang Liu, and Samuel Albanie. Cross modal retrieval with Querybank normalisation. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2022. [6] Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer. Adversarial patch. arXiv:1712.09665, 2017. [7] Nicholas Carlini, Matthew Jagielski, Christopher A Choquette-Choo, Daniel Paleka, Will Pearce, Hyrum Anderson, Andreas Terzis, Kurt Thomas, and Florian Tramèr. Poisoning web-scale training datasets is practical. In IEEE Symposium on Security and Privacy (S&P), pages 407–425, 2024. [8] Nicholas Carlini, Milad Nasr, Christopher A. Choquette-Choo, Matthew Jagielski, Irena Gao, Anas Awadalla, Pang Wei Koh, Daphne Ippolito, Katherine Lee, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? arXiv:2306.15447, 2023. [9] Nicholas Carlini and David Wagner. Towards evaluating the robustness of neural networks. In IEEE Symposium on Security and Privacy (S&P), pages 39–57, 2017. [10] Nicholas Carlini and David Wagner. Audio adversarial examples: Targeted attacks on speech-to-text. In IEEE Symposium on Security and Privacy Workshops, 2018. [11] Harsh Chaudhari, Giorgio Severi, John Abascal, Matthew Jagielski, Christopher A Choquette-Choo, Milad Nasr, Cristina Nita-Rotaru, and Alina Oprea. Phantom: General trigger attacks on retrieval augmented language generation. arXiv:2405.20485, 2024. [12] Xinlei Chen, Hao Fang, Tsung-Yi Lin, Ramakrishna Vedantam, Saurabh Gupta, Piotr Dollár, and C Lawrence Zitnick. Microsoft COCO captions: Data collection and evaluation server. arXiv:1504.00325, 2015. [13] Mehdi Cherti, Romain Beaumont, Ross Wightman, Mitchell Wortsman, Gabriel Ilharco, Cade Gordon, Christoph Schuhmann, Ludwig Schmidt, and Jenia Jitsev. Reproducible scaling laws for contrastive language-image learning. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. [14] Neil Chowdhury, Franklin Wang, Sumedh Shenoy, Douwe Kiela, Sarah Schwettmann, and Tristan Thrush. Nearest neighbor normalization improves multimodal retrieval. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2024. [15] Google Cloud. Embeddings apis overview. https://cloud.google.com/vertex-ai/generative-ai/docs/embeddings, 2025. Accessed: 2025-04-09. [16] Jeremy Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. In International Conference on Machine Learning (ICML), pages 1310–1320. PMLR, 2019. [17] Alexis Conneau, Guillaume Lample, Marc’Aurelio Ranzato, Ludovic Denoyer, and Hervé Jégou. Word translation without parallel data. In International Conference on Learning Representations (ICLR), 2018. [18] Georgiana Dinu, Angeliki Lazaridou, and Marco Baroni. Improving zero-shot learning by mitigating the hubness problem. arXiv:1412.6568, 2014. [19] Yinpeng Dong, Huanran Chen, Jiawei Chen, Zhengwei Fang, Xiao Yang, Yichi Zhang, Yu Tian, Hang Su, and Jun Zhu. How robust is Google’s Bard to adversarial image attacks? arXiv:2309.11751, 2023. [20] Zhihao Dou, Xin Hu, Haibo Yang, Zhuqing Liu, and Minghong Fang. Adversarial attacks to multi-modal models. arXiv:2409.06793, 2024. [21] Arthur Flexer, Monika Dörfler, Jan Schlüter, and Thomas Grill. Hubness as a case of technical algorithmic bias in music recommendation. In IEEE International Conference on Data Mining Workshops (ICDMW), 2018. [22] Kuofeng Gao, Yang Bai, Jiawang Bai, Yong Yang, and Shu-Tao Xia. Adversarial robustness for visual grounding of multimodal large language models. In ICLR Workshop on Reliable and Responsible Foundation Models, 2024. [23] Gemini Team, Google. Gemini: A family of highly capable multimodal models. arXiv preprint arXiv:2312.11805, 2023. [24] Rohit Girdhar, Alaaeldin El-Nouby, Zhuang Liu, Mannat Singh, Kalyan Vasudev Alwala, Armand Joulin, and Ishan Misra. ImageBind: One embedding space to bind them all. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2023. [25] Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations (ICLR), 2015. [26] Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Uesato, Relja Arandjelovic, Timothy A Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv:1810.12715, 2018. [27] C Guo, M Rana, M Cisse, and L Van Der Maaten. Countering adversarial images using input transformations. arXiv:1711.00117, 2021. [28] Andrey Guzhov, Federico Raue, Jörn Hees, and Andreas Dengel. AudioCLIP: Extending CLIP to image, text and audio. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2022. [29] Kazuo Hara, Ikumi Suzuki, Masashi Shimbo, Kei Kobayashi, Kenji Fukumizu, and Miloš Radovanović. Localized centering: Reducing hubness in large-sample data. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), 2015. [30] Warren He, James Wei, Xinyun Chen, Nicholas Carlini, and Dawn Song. Adversarial example defense: Ensembles of weak defenses are not strong. In 11th USENIX workshop on offensive technologies (WOOT), 2017. [31] Katharina Hoedt, Arthur Flexer, and Gerhard Widmer. Defending a music recommender against hubness-based adversarial attacks. In Proceedings of the 19th Sound and Music Computing Conference (SMC), 2022. [32] Hossein Hosseini, Sreeram Kannan, Baosen Zhang, and Radha Poovendran. Deceiving Google’s perspective API built for detecting toxic comments. arXiv:1702.08138, 2017. [33] Matthew Jagielski, Giorgio Severi, Niklas Pousette Harger, and Alina Oprea. Subpopulation data poisoning attacks. In ACM SIGSAC Conference on Computer and Communications Security (CCS), pages 3104–3122, 2021. [34] Herve Jegou, Hedi Harzallah, and Cordelia Schmid. A contextual dissimilarity measure for accurate and efficient image search. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2007. [35] Jiwoon Jeon, Victor Lavrenko, and Raghavan Manmatha. Automatic image annotation and retrieval using cross-media relevance models. In 26th Annual International ACM SIGIR Conference on Research and Development in Information Retrieval (SIGIR), 2003. [36] Robin Jia and Percy Liang. Adversarial examples for evaluating reading comprehension systems. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2017. [37] Auguste Kerckhoffs. La cryptographie militaire. BoD–Books on Demand, 2023. [38] Chris Dongjoo Kim, Byeongchang Kim, Hyunmin Lee, and Gunhee Kim. AudioCaps: Generating captions for audios in the wild. In Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Technologies (NAACL), 2019. [39] Minseon Kim, Jihoon Tack, and Sung Ju Hwang. Adversarial self-supervised contrastive learning. In Annual Conference on Neural Information Processing Systems (NeurIPS), 2020. [40] Alex Krizhevsky. Learning multiple layers of features from tiny images. Technical report, University of Toronto, 2009. [41] Hyun Kwon, Yongchul Kim, Ki-Woong Park, Hyunsoo Yoon, and Daeseon Choi. Multi-targeted adversarial example in evasion attack on deep neural network. IEEE Access, 6:46084–46096, 2018. [42] Angeliki Lazaridou, Georgiana Dinu, and Marco Baroni. Hubness and pollution: Delving into cross-space mapping for zero-shot learning. In 53rd Annual Meeting of the Association for Computational Linguistics (ACL), 2015. [43] Fangyu Liu, Rongtian Ye, Xun Wang, and Shuaipeng Li. HAL: Improved text-image matching by mitigating visual semantic hubs. In AAAI Conference on Artificial Intelligence (AAAI), 2020. [44] Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In International Conference on Learning Representations (ICLR), 2017. [45] Zihao Liu, Qi Liu, Tao Liu, Nuo Xu, Xue Lin, Yanzhi Wang, and Wujie Wen. Feature distillation: Dnn-oriented jpeg compression against adversarial examples. In IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), 2019. [46] Thomas Low, Christian Borgelt, Sebastian Stober, and Andreas Nürnberger. The hubness phenomenon: Fact or artifact? Towards Advanced Data Analysis by Combining Soft Computing and Statistics, pages 267–278, 2013. [47] David G Lowe. Distinctive image features from scale-invariant keypoints. International Journal of Computer Vision, 60:91–110, 2004. [48] Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations (ICLR), 2018. [49] Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), July 2017. [50] Aaron van den Oord, Yazhe Li, and Oriol Vinyals. Representation learning with contrastive predictive coding. arXiv:1807.03748, 2018. [51] OpenAI. Gpt-4 technical report. https://openai.com/research/gpt-4, 2023. Accessed: 2025-04-09. [52] OpenAI. Hello GPT-4o. https://openai.com/index/hello-gpt-4o/, May 2024. Accessed: August 24, 2025. [53] Raghuveer Peri, Sai Muralidhar Jayanthi, Srikanth Ronanki, Anshu Bhatia, Karel Mundnich, Saket Dingliwal, Nilaksh Das, Zejiang Hou, Goeric Huybrechts, Srikanth Vishnubhotla, et al. SpeechGuard: Exploring the adversarial robustness of multimodal large language models. arXiv:2405.08317, 2024. [54] Pinecone. Pinecone - vector database for machine learning. https://w.pinecone.io, 2024. Accessed: 2024-11-12. [55] Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. In International Conference on Machine Learning (ICML) Workshop on New Frontiers in Adversarial Machine Learning, 2023. [56] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International Conference on Machine Learning (ICML), 2021. [57] Milos Radovanovic, Alexandros Nanopoulos, and Mirjana Ivanovic. Hubs in space: Popular nearest neighbors in high-dimensional data. Journal of Machine Learning Research (JMLR), 11(9):2487–2531, 2010. [58] Gerard Salton and Christopher Buckley. Term-weighting approaches in automatic text retrieval. Information Processing & Management, 24(5):513–523, 1988. [59] Amaia Salvador, Nicholas Hynes, Yusuf Aytar, Javier Marin, Ferda Ofli, Ingmar Weber, and Antonio Torralba. Learning cross-modal embeddings for cooking recipes and food images. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2017. [60] Dominik Schnitzer, Arthur Flexer, Markus Schedl, and Gerhard Widmer. Local and global scaling reduce hubs in space. Journal of Machine Learning Research (JMLR), 13:2871–2902, 2012. [61] Florian Schroff, Dmitry Kalenichenko, and James Philbin. FaceNet: A unified embedding for face recognition and clustering. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2015. [62] Ali Shafahi, W Ronny Huang, Mahyar Najibi, Octavian Suciu, Christoph Studer, Tudor Dumitras, and Tom Goldstein. Poison frogs! Targeted clean-label poisoning attacks on neural networks. In Advances in Neural Information Processing Systems (NIPS), 2018. [63] Avital Shafran, Roei Schuster, and Vitaly Shmatikov. Machine against the RAG: Jamming retrieval-augmented generation with blocker documents. In USENIX Security Symposium, 2024. [64] Erfan Shayegani, Yue Dong, and Nael Abu-Ghazaleh. Plug and Pray: Exploiting off-the-shelf components of multi-modal models. arXiv:2307.14539, 2023. [65] Richard Shin and Dawn Song. JPEG-resistant adversarial images. In NIPS 2017 Workshop on Machine Learning and Computer Security, 2017. [66] Samuel L Smith, David HP Turban, Steven Hamblin, and Nils Y Hammerla. Offline bilingual word vectors, orthogonal transformations and the inverted softmax. In International Conference on Learning Representations (ICLR), 2017. [67] Spotify for Artists. Artificial streaming, 2023. Accessed: 2024-11-13. [68] Fnu Suya, Jianfeng Chi, David Evans, and Yuan Tian. Hybrid batch attacks: Finding black-box adversarial examples with limited queries. In USENIX Security Symposium, pages 1327–1344, 2020. [69] Fnu Suya, Saeed Mahloujifar, Anshuman Suri, David Evans, and Yuan Tian. Model-targeted poisoning attacks with provable convergence. In International Conference on Machine Learning (ICML), pages 10000–10010. PMLR, 2021. [70] Ikumi Suzuki, Kazuo Hara, Masashi Shimbo, Yuji Matsumoto, and Marco Saerens. Investigating the effectiveness of laplacian-based kernels in hub reduction. In AAAI Conference on Artificial Intelligence (AAAI), 2012. [71] Ikumi Suzuki, Kazuo Hara, Masashi Shimbo, Marco Saerens, and Kenji Fukumizu. Centering similarity measures to reduce hubs. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2013. [72] C Szegedy. Intriguing properties of neural networks. In International Conference on Learning Representations (ICLR), 2014. [73] Florian Tramer and Dan Boneh. Adversarial training and robustness for multiple perturbations. Advances in Neural Information Processing Systems (NIPS), 2019. [74] Catherine Wah, Steve Branson, Peter Welinder, Pietro Perona, and Serge Belongie. Caltech-UCSD Birds-200-2011 dataset. 2011. [75] Bokun Wang, Yang Yang, Xing Xu, Alan Hanjalic, and Heng Tao Shen. Adversarial cross-modal retrieval. In 25th ACM International Conference on Multimedia (ACM M), 2017. [76] Kaiye Wang, Qiyue Yin, Wei Wang, Shu Wu, and Liang Wang. A comprehensive survey on cross-modal retrieval. arXiv:1607.06215, 2016. [77] Tianshi Wang, Fengling Li, Lei Zhu, Jingjing Li, Zheng Zhang, and Heng Tao Shen. Cross-modal retrieval: a systematic review of methods and future directions. Proceedings of the IEEE, 112(11):1716–1754, 2024. [78] Yimu Wang, Xiangru Jian, and Bo Xue. Balance Act: Mitigating hubness in cross-modal retrieval with query and gallery banks. In Conference on Empirical Methods in Natural Language Processing (EMNLP), 2023. [79] Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. In International Conference on Machine Learning (ICML), pages 5286–5295. PMLR, 2018. [80] Chen Henry Wu, Jing Yu Koh, Ruslan Salakhutdinov, Daniel Fried, and Aditi Raghunathan. Adversarial attacks on multimodal agents. arXiv:2406.12814, 2024. [81] Jun Xu, Tao Mei, Ting Yao, and Yong Rui. MSR-VTT: A large video description dataset for bridging video and language. In IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 5288–5296, 2016. [82] Weilin Xu, David Evans, and Yanjun Qi. Feature squeezing: Detecting adversarial examples in deep neural networks. arXiv:1704.01155, 2017. [83] Jiaqi Xue, Mengxin Zheng, Yebowen Hu, Fei Liu, Xun Chen, and Qian Lou. BadRAG: Identifying vulnerabilities in retrieval augmented generation of large language models. arXiv:2406.00083, 2024. [84] Qiying Yu, Jieming Lou, Xianyuan Zhan, Qizhang Li, Wangmeng Zuo, Yang Liu, and Jingjing Liu. Adversarial contrastive learning via asymmetric InfoNCE. In European Conference on Computer Vision (ECCV), 2022. [85] Lihi Zelnik-Manor and Pietro Perona. Self-tuning spectral clustering. In Advances in Neural Information Processing Systems (NIPS), 2004. [86] Collin Zhang, Tingwei Zhang, and Vitaly Shmatikov. Adversarial decoding: Generating readable documents for adversarial objectives. arXiv:2410.02163, 2025. [87] Hongyang Zhang, Yaodong Yu, Jiantao Jiao, Eric Xing, Laurent El Ghaoui, and Michael Jordan. Theoretically principled trade-off between robustness and accuracy. In International Conference on Machine Learning (ICML), pages 7472–7482. PMLR, 2019. [88] Tingwei Zhang, Rishi Jha, Eugene Bagdasaryan, and Vitaly Shmatikov. Adversarial illusions in multi-modal embeddings. In USENIX Security Symposium, 2024. [89] Tingwei Zhang, Collin Zhang, John X Morris, Eugene Bagdasarian, and Vitaly Shmatikov. Self-interpreting adversarial images. In USENIX Security Symposium, 2025. [90] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. In Annual Conference on Neural Information Processing Systems (NeurIPS), 2023. [91] Zexuan Zhong, Ziqing Huang, Alexander Wettig, and Danqi Chen. Poisoning retrieval corpora by injecting adversarial passages. In Conference on Empirical Methods in Natural Language Processing (EMNLP), pages 13764–13775, 2023. [92] Ziqi Zhou, Shengshan Hu, Ruizhi Zhao, Qian Wang, Leo Yu Zhang, Junhui Hou, and Hai Jin. Downstream-agnostic adversarial examples. In IEEE International Conference on Computer Vision (ICCV), 2023. [93] Andy Zou, Zifan Wang, J Zico Kolter, and Matt Fredrikson. Universal and transferable adversarial attacks on aligned language models. arXiv:2307.15043, 2023. [94] Wei Zou, Runpeng Geng, Binghui Wang, and Jinyuan Jia. PoisonedRAG: Knowledge corruption attacks to retrieval-augmented generation of large language models. arXiv:2402.07867, 2024.

Instant research discovery