Paper deep dive

AnyAttack: Towards Large-scale Self-supervised Generation of Targeted Adversarial Examples for Vision-Language Models

Jiaming Zhang, Junhong Ye, Xingjun Ma, Yige Li, Yunfan Yang, Jitao Sang, Dit-Yan Yeung

Year: 2024Venue: arXiv preprintArea: Multimodal SafetyType: EmpiricalEmbeddings: 52

Models: BLIP, BLIP2, Claude Sonnet, CLIP ViT-B/16, CLIP ViT-B/32, Gemini, InstructBLIP, Microsoft Copilot, MiniGPT-4

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 96%

Last extracted: 3/12/2026, 6:49:04 PM

Summary

AnyAttack is a novel self-supervised framework for generating targeted adversarial examples for Vision-Language Models (VLMs). By pre-training a noise generator on the large-scale LAION-400M dataset without label supervision, it enables the transformation of any image into an attack vector. The framework demonstrates high effectiveness across five open-source VLMs (CLIP, BLIP, BLIP2, InstructBLIP, MiniGPT-4) and transfers successfully to commercial systems like Google Gemini, Claude Sonnet, Microsoft Copilot, and OpenAI GPT.

Entities (7)

AnyAttack · framework · 100%LAION-400M · dataset · 100%Claude Sonnet · commercial-vlm · 95%CLIP · vlm · 95%Google Gemini · commercial-vlm · 95%Microsoft Copilot · commercial-vlm · 95%OpenAI GPT · commercial-vlm · 95%

Relation Signals (3)

AnyAttack → trainedon → LAION-400M

confidence 100% · pre-training a noise generator on the large-scale LAION-400M dataset

AnyAttack → attacks → CLIP

confidence 95% · extensive validation across five open-source VLMs (CLIP...)

AnyAttack → transfersto → Google Gemini

confidence 95% · AnyAttack seamlessly transfers to commercial systems including Google Gemini

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Due to their multimodal capabilities, Vision-Language Models (VLMs) have found numerous impactful applications in real-world scenarios. However, recent studies have revealed that VLMs are vulnerable to image-based adversarial attacks. Traditional targeted adversarial attacks require specific targets and labels, limiting their real-world this http URL present AnyAttack, a self-supervised framework that transcends the limitations of conventional attacks through a novel foundation model approach. By pre-training on the massive LAION-400M dataset without label supervision, AnyAttack achieves unprecedented flexibility - enabling any image to be transformed into an attack vector targeting any desired output across different this http URL approach fundamentally changes the threat landscape, making adversarial capabilities accessible at an unprecedented scale. Our extensive validation across five open-source VLMs (CLIP, BLIP, BLIP2, InstructBLIP, and MiniGPT-4) demonstrates AnyAttack's effectiveness across diverse multimodal tasks. Most concerning, AnyAttack seamlessly transfers to commercial systems including Google Gemini, Claude Sonnet, Microsoft Copilot and OpenAI GPT, revealing a systemic vulnerability requiring immediate attention.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

51,822 characters extracted from source content.

Expand or collapse full text

AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models Jiaming Zhang1 Junhong Ye2 Xingjun Ma3 Yige Li411footnotemark: 1 Yunfan Yang2 Yunhao Chen3 Jitao Sang2,5 Dit-Yan Yeung1 1Hong Kong University of Science and Technology 2Beijing Jiaotong University 3Fudan University 4Singapore Management University 5Peng Cheng Laboratory Project Page: https://jiamingzhang94.github.io/anyattack/ Corresponding authors Abstract Due to their multimodal capabilities, Vision-Language Models (VLMs) have found numerous impactful applications in real-world scenarios. However, recent studies have revealed that VLMs are vulnerable to image-based adversarial attacks. Traditional targeted adversarial attacks require specific targets and labels, limiting their real-world impact. We present AnyAttack, a self-supervised framework that transcends the limitations of conventional attacks through a novel foundation model approach. By pre-training on the massive LAION-400M dataset without label supervision, AnyAttack achieves unprecedented flexibility - enabling any image to be transformed into an attack vector targeting any desired output across different VLMs. This approach fundamentally changes the threat landscape, making adversarial capabilities accessible at an unprecedented scale. Our extensive validation across five open-source VLMs (CLIP, BLIP, BLIP2, InstructBLIP, and MiniGPT-4) demonstrates AnyAttack’s effectiveness across diverse multimodal tasks. Most concerning, AnyAttack seamlessly transfers to commercial systems including Google Gemini, Claude Sonnet, Microsoft Copilot and OpenAI GPT, revealing a systemic vulnerability requiring immediate attention. 1 Introduction Figure 1: Comparison of existing targeted adversarial attack strategies and the our proposed self-supervised method - AnyAttack. Vision-Language Models (VLMs) have exhibited remarkable performance across a diverse array of tasks, primarily attributed to the scale of training data and model size [16, 9, 35]. Despite their remarkable performance, these models, heavily reliant on visual inputs, remain vulnerable to image-based adversarial attacks111For simplicity, we will refer to image-based adversarial attacks as “adversarial attacks” in the remainder of this paper, distinguishing them from text-based adversarial attacks., which are carefully crafted input images designed to mislead the model into making incorrect predictions [20]. The evolution of adversarial attacks has progressed from general untargeted attacks (causing arbitrary errors) to more concerning targeted attacks, where adversaries can manipulate VLMs to produce specific, predetermined harmful outputs. For instance, a benign image such as a landscape could be subtly altered to elicit harmful text descriptions such as “violence” or “explicit content” from the model. Such manipulation could have severe implications for content moderation systems, potentially leading to the removal of legitimate content or the inappropriate distribution of harmful material. As VLMs become increasingly accessible to the public, facilitating the rapid proliferation of downstream applications, this vulnerability poses a significant threat to the reliability and security of VLMs in real-world scenarios. Therefore, exploring new targeted attack methods tailored to VLMs is crucial to address these vulnerabilities. However, existing targeted attack methods on VLMs present challenges due to the reliance on target labels for supervision, which limits the scalability of the training process. For example, it is impractical to expect a generator trained on ImageNet [17] to produce effective adversarial noise for VLMs. To overcome this limitation, we propose a novel self-supervised framework, AnyAttack, which leverages the original image itself as supervision, enabling any image to be transformed into an attack vector targeting any desired output across different VLMs. Our approach involves pre-training a generator on the large-scale LAION-400M dataset [18], enabling the pre-trained noise generator to learn comprehensive noise patterns from diverse image data. Through self-supervised adversarial noise pre-training, we can further fine-tune the pre-trained generator on downstream datasets for adapting downstream vision-language tasks. The large-scale pre-training establishes a foundation model, thereby enhancing the potential for developing more powerful adversarial attacks. Our framework, to the best of our knowledge, is the first to implement the “pre-training and fine-tuning” paradigm for targeted adversarial attacks at scale, breaking the barriers of traditional attack methods. Fig. 1 highlights the distinctions between our method and existing strategies. To demonstrate the effectiveness of our approach, we conduct extensive experiments on 5 target VLMs (CLIP [16], BLIP [8], BLIP2 [9], InstructBLIP [2], and MiniGPT-4 [35]), across 3 multimodal tasks (image-text retrieval, multimodal classification, and image captioning). We also evaluate our method on commercial VLMs, including Google Gemini, Claude Sonnet, Microsoft Copilot and OpenAI GPT. In summary, our main contributions are: • We propose AnyAttack, a self-supervised framework that utilizes the original image as supervision, allowing any image to be transformed into an attack vector targeting any desired output across different VLMs. • Our framework is the first to adopt the “pre-training and fine-tuning” paradigm for targeted adversarial attacks, pre-training a noise generator on the large-scale LAION-400M dataset and fine-tuning it for downstream vision-language tasks. • We demonstrate the effectiveness of our AnyAttack on five mainstream open-source VLMs across three multimodal tasks. Additionally, we successfully transfer our attack to four commercial VLMs. Figure 2: Overview of the proposed AnyAttack: a self-supervised framework consisting of pre-training and fine-tuning stages. 2 Related Work Targeted Adversarial Attacks. A number of works have been proposed to improve the effectiveness and transferability of targeted adversarial attacks against vision models. Input augmentation techniques such as image translation [4], cropping [24], mixup [23, 11], and resizing [27], have been employed to increase the diversity of adversarial input, thus improving their transferability across different target models. In addition, adversarial fine-tuning and model enhancement techniques have been explored to increase the attack capabilities of surrogate models [19, 32, 25]. These methods typically involve retraining the surrogate models with a mix of clean and adversarial examples to improve their robustness against future attacks. Furthermore, optimization techniques have evolved to stabilize the update processes during adversarial training. Methods such as adaptive learning rates and gradient clipping have been integrated to ensure more consistent updates and enhance the overall performance of the adversarial attacks [3, 22, 10]. These advancements collectively contribute to the development of more effective and transferable adversarial attacks in the realm of vision models. Jailbreak Attacks on VLMs. Multimodal jailbreaks primarily exploit cross-modal interaction vulnerabilities in VLMs. These attacks manipulate inputs of text [26], images [1, 7, 15, 14], or both simultaneously [30, 21], aiming to elicit harmful but non-predefined responses. In contrast, image-based adversarial attacks focus on manipulating the image encoder of VLMs. The objective is to induce adversary-specified, predetermined responses through precise visual manipulations. Adversarial Attacks on VLMs. Adversarial research on VLMs is relatively limited compared to the extensive studies on vision models, with the majority of existing attacks focusing primarily on untargeted attacks. Co-Attack [31] was among the first to perform white-box untargeted attacks on several VLMs. Following this, more approaches have been proposed to enhance adversarial transferability for black-box untargeted attacks [12, 34, 29, 28]. Cross-Prompt Attack [13] investigates a novel setup for adversarial transferability based on the prompts of LLMs. AttackVLM [33] is the most closely related work, using a combination of text inputs and popular text-to-image models to generate guided images for creating targeted adversarial images. Although their approach shares a similar objective with our work, our method distinguishes itself by being self-supervised and independent of any text-based guidance. 3 Proposed Attack In this section, we first present the preliminaries on targeted adversarial attacks and then introduce our proposed method. 3.1 Preliminaries and Adversary’s Settings Threat Model. This work focuses on transfer-based black-box attacks, where the adversary generates an adversarial image x′ using a fully accessible pre-trained surrogate model fssubscriptf_sfitalic_s. The adversary has no knowledge of the target VLMs ftsubscriptf_tfitalic_t, including its architecture and parameters, nor can they leverage the outputs of ftsubscriptf_tfitalic_t to reconstruct adversarial images. The adversary’s objective is to cause the target VLM ftsubscriptf_tfitalic_t to incorrectly match the adversarial image x′ with the target text description ytsubscripty_tyitalic_t. We begin by formulating the problem of targeted adversarial attacks. Let fssubscriptf_sfitalic_s represent a pre-trained surrogate model, and =(x,y)D=\(x,y)\D = ( x , y ) denote the image dataset, where x is the original image and y is the corresponding label (description). The attacker’s objective is to craft an adversarial example x′=x+δsuperscript′x =x+ ′ = x + δ that misleads the target model ftsubscriptf_tfitalic_t into predicting a predefined target label ytsubscripty_tyitalic_t. In the context of VLMs, this objective requires that x′ aligns with ytsubscripty_tyitalic_t as a valid image-text pair. The process of generating targeted adversarial images typically involves finding a perturbation δ using the surrogate model fssubscriptf_sfitalic_s. Tab. 1 highlights the key differences between our approach and current strategies, where xrsubscriptx_rxitalic_r denotes an irrelevant random image. Strategy Formulation Target label supervision min⁡ℒ⁢(fs⁢(x+δ),yt),s.t.⁢yt≠yℒsubscriptsubscripts.t.subscript (f_s(x+δ),y_t), .t.\ y_t≠ ymin L ( fitalic_s ( x + δ ) , yitalic_t ) , s.t. yitalic_t ≠ y Target image supervision min⁡ℒ⁢(fs⁢(x+δ),fs⁢(xt)),s.t.⁢xt≠xℒsubscriptsubscriptsubscripts.t.subscript (f_s(x+δ),f_s(x_t)), .t.\ x_t≠ xmin L ( fitalic_s ( x + δ ) , fitalic_s ( xitalic_t ) ) , s.t. xitalic_t ≠ x AnyAttack (ours) min⁡ℒ⁢(fs⁢(δ+xr),fs⁢(x))ℒsubscriptsubscriptsubscript (f_s(δ+x_r),f_s(x))min L ( fitalic_s ( δ + xitalic_r ) , fitalic_s ( x ) ) Table 1: The formulation of different attack strategies. The existing strategies rely on explicit target supervision, whereas our AnyAttack is unsupervised. 3.2 AnyAttack Framework Overview. Our proposed framework, AnyAttack, employs two phases: self-supervised adversarial noise pre-training and self-supervised adversarial noise fine-tuning. Fig. 2 provides the self-supervised framework overview including pre-training and fine-tuning. For self-supervised adversarial noise pre-training, we train a decoder F, to produce adversarial noise δ on large-scale datasets psubscriptD_pDitalic_p, using frozen encoder E as the surrogate model. Given a batch of images x, we extract their embeddings using a frozen image encoder E. These normalized embeddings zz are then fed into the decoder F, which generates adversarial noise δ corresponding to the images x. To enhance generalization and computational efficiency, we introduce a K-augmentation strategy that creates multiple shuffled versions of the original images within each mini-batch. During this process, adversarial noise is added to the shuffled original images (random images) to produce the adversarial images. For self-supervised adversarial noise fine-tuning, we adapt the pre-trained decoder F to a specific downstream dataset fsubscriptD_fDitalic_f. We use an unrelated random image xrsubscriptx_rxitalic_r from an external dataset esubscriptD_eDitalic_e as the clean image to synthesize the adversarial image xr+δsubscriptx_r+ _r + δ. Self-supervised Adversarial Noise Pre-training aims to train the generator on large-scale datasets, enabling it to handle a diverse array of input images as potential targets. Unlike existing methods, it does not require target labels or target images as supervision throughout the training process. Our objective can be formulated as follows: min⁡ℒ⁢(fs⁢(δ+xr),fs⁢(x)),s.t.⁢xr≠x,ℒsubscriptsubscriptsubscripts.t.subscript (f_s(δ+x_r),f_s(x)), .t.\ x_r≠ x,min L ( fitalic_s ( δ + xitalic_r ) , fitalic_s ( x ) ) , s.t. xitalic_r ≠ x , (1) where xrsubscriptx_rxitalic_r is a random image that is unrelated to x, while the adversarial noise δ is designed to align with the original image x within the surrogate model’s embedding space, and ℒLL denotes the similarity function. Given a batch of n images x∈ℝn×H×W×3superscriptℝ3x ^n× H× W× 3x ∈ blackboard_Rn × H × W × 3 from the large-scale training dataset psubscriptD_pDitalic_p, we employ the CLIP ViT-B/32 image encoder, which is frozen during training, as the encoder E, to obtain the normalized embeddings E⁢(x)=∈ℝn×dsuperscriptℝE(x)=z ^n× dE ( x ) = z ∈ blackboard_Rn × d corresponding to the original images x, where d represents the embedding dimension (i.e., 512 for CLIP ViT-B/32). Subsequently, we deploy an initialized decoder F, which maps the embeddings zz to adversarial noise D⁢()=δ∈ℝn×H×W×3superscriptℝ3D(z)=δ ^n× H× W× 3D ( z ) = δ ∈ blackboard_Rn × H × W × 3 corresponding to the original images x. We expect the generated noises δ to serve as adversarial noise representative of the original images x. Our goal is for the generated noises δ, when added to random images xrsubscriptx_rxitalic_r, to be interpreted by the encoder E as the original images x, i.e., E⁢(xr+δ)=E⁢(x)subscriptE(x_r+δ)=E(x)E ( xitalic_r + δ ) = E ( x ). To increase the number of random images within every batch, we present the K-augmentation strategy, which duplicates both adversarial noises δ and the original images x K times, forming K mini-batches. For each mini-batch, the order of the adversarial noises remains consistent, while the order of the original images is shuffled within the mini-batch, referred to as shuffled images. These shuffled images are then added to the corresponding adversarial noise, resulting in adversarial images x′. Next, the adversarial images are fed into F to produce adversarial embeddings (a⁢d⁢v)superscriptz^(adv)z( a d v ), which are then used for subsequent calculations against the original embeddings zz. Finally, we introduce the adversarial noise pre-training loss ℒPresubscriptℒPreL_PreLPre. It maximizes the cosine similarity between positive sample pairs, defined by the i-th elements of adversarial and original embeddings in each mini-batch, while minimizing the similarity between the negative pairs, which consist of all other elements. This setup creates n positive pairs and n⁢(n−1)1n(n-1)n ( n - 1 ) negative pairs in every mini-batch, with gradients accumulated to update F: ℒPre=−1n⁢∑i=1nlog⁡exp⁡(i⋅i(a⁢d⁢v)/τ⁢(t))∑j=1nexp⁡(i⋅j(a⁢d⁢v)/τ⁢(t)),subscriptℒPre1superscriptsubscript1⋅subscriptsuperscriptsubscriptsuperscriptsubscript1⋅subscriptsuperscriptsubscriptL_Pre=- 1n _i=1^n ( % z_i·z_i^(adv)/τ(t) ) _j=1^n (% z_i·z_j^(adv)/τ(t) ),LPre = - divide start_ARG 1 end_ARG start_ARG n end_ARG ∑i = 1n log divide start_ARG exp ( zitalic_i ⋅ zitalic_i( a d v ) / τ ( t ) ) end_ARG start_ARG ∑j = 1n exp ( zitalic_i ⋅ zitalic_j( a d v ) / τ ( t ) ) end_ARG , (2) where isubscriptz_izitalic_i and i(a⁢d⁢v)superscriptsubscriptz_i^(adv)zitalic_i( a d v ) are the ℓ2subscriptℓ2 _2ℓ2-normalized embeddings of the i-th sample from original images x and adversarial images x′. τ⁢(t)τ(t)τ ( t ) is the temperature at step t, enabling the model to dynamically adjust the hardness of negative samples during training. We set a relatively large initial temperature τ0subscript0 _0τ0 at the beginning of training and gradually decrease it, reaching the final temperature τfinalsubscriptfinal _finalτfinal after a certain number of steps T: τ⁢(t)=τ0⁢(τfinalτ0)tT=τ0⁢exp⁡(−λ⁢t).subscript0superscriptsubscriptfinalsubscript0subscript0τ(t)= _0 ( _final _0 ) tT% = _0 (-λ t ).τ ( t ) = τ0 ( divide start_ARG τfinal end_ARG start_ARG τ0 end_ARG )divide start_ARG t end_ARG start_ARG T end_ARG = τ0 exp ( - λ t ) . (3) Self-supervised Adversarial Noise Fine-tuning refines the pre-trained decoder F on downstream vision-language datasets using task-specific objective functions, facilitating its adaptation to particular domains and multimodal tasks. Given a batch of n images x∈ℝn×H×W×3superscriptℝ3x ^n× H× W× 3x ∈ blackboard_Rn × H × W × 3 from the downstream dataset fsubscriptD_fDitalic_f, the encoder E remains frozen and outputs the embeddings zz, which are then fed into the decoder F to generate the noise δ. Since the size of fsubscriptD_fDitalic_f is much smaller than that of psubscriptD_pDitalic_p, we randomly select images from an external dataset esubscriptD_eDitalic_e as random images xrsubscriptx_rxitalic_r, which are then added to the generated noise δ to create adversarial images. To improve transferability, we incorporate auxiliary models alongside the encoder E, forming an ensemble surrogate. Depending on the downstream tasks, self-supervised adversarial noise fine-tuning employs two different fine-tuning objectives. The first strategy is tailored for the image-text retrieval task, which imposes stricter requirements for distinguishing between similar samples. It demands robust retrieval performance in bi-directions: from (a⁢d⁢v)superscriptz^(adv)z( a d v ) to zz and from zz to (a⁢d⁢v)superscriptz^(adv)z( a d v ), denoted as ℒBisubscriptℒBiL_BiLBi. ℒBi=12⁢n∑i=1n( _Bi= 12n _i=1^n (LBi = divide start_ARG 1 end_ARG start_ARG 2 n end_ARG ∑i = 1n ( −log⁡exp⁡(i⋅i(a⁢d⁢v)/τ)∑j=1nexp⁡(i⋅j(a⁢d⁢v)/τ)⋅subscriptsuperscriptsubscriptsuperscriptsubscript1⋅subscriptsuperscriptsubscript - (z_i·z_i^(adv)/τ)% _j=1^n (z_i·z_j^(adv)/τ)- log divide start_ARG exp ( zitalic_i ⋅ zitalic_i( a d v ) / τ ) end_ARG start_ARG ∑j = 1n exp ( zitalic_i ⋅ zitalic_j( a d v ) / τ ) end_ARG (4) −logexp⁡(i(a⁢d⁢v)⋅i/τ)∑j=1nexp⁡(i(a⁢d⁢v)⋅j/τ)). - (z_i^(adv)·z_i/τ)% _j=1^n (z_i^(adv)·z_j/τ) ).- log divide start_ARG exp ( zitalic_i( a d v ) ⋅ zitalic_i / τ ) end_ARG start_ARG ∑j = 1n exp ( zitalic_i( a d v ) ⋅ zitalic_j / τ ) end_ARG ) . The second strategy is suited for general tasks, such as image captioning, multimodal classification, and other broad vision-language applications. It requires i(a⁢d⁢v)superscriptsubscriptz_i^(adv)zitalic_i( a d v ) to match isubscriptz_izitalic_i, so we employ cosine similarity to align i(a⁢d⁢v)superscriptsubscriptz_i^(adv)zitalic_i( a d v ) with isubscriptz_izitalic_i, denoting this objective as ℒCossubscriptℒCosL_CosLCos. 4 Experiments Model Attack Method MSCOCO TR@1 TR@5 TR@10 IR@1 IR@5 IR@10 R@Mean ViT-B/16 AttackVLM-i 0.4 1.0 1.4 0.24 1.08 2.16 1.05 AttackVLM-it 0.2 1.4 1.8 0.16 1.16 2.12 1.14 SASD-WS-Cos 6.0 17.0 24.8 9.08 24.39 34.55 19.30 SASD-WS-MSE 4.8 18.4 25.6 8.20 25.87 35.15 19.67 SU-Cos 6.8 20.4 27.8 11.11 25.70 33.34 20.86 SU-MSE 6.8 20.6 27.0 10.83 25.10 32.62 20.49 AnyAttack-Cos 8.6 21.2 29.6 10.80 27.59 37.50 22.55 AnyAttack-Bi 12.2 26.2 33.8 12.63 31.71 40.86 26.23 AnyAttack-Cos w/ Aux 8.4 24.8 33.0 11.59 32.10 44.98 25.81 AnyAttack-Bi w/ Aux 14.8 36.8 48.0 17.59 42.02 56.05 35.88 ViT-L/14 AttackVLM-i 0.2 1.0 1.6 0.24 0.60 1.32 0.83 AttackVLM-it 0.4 0.8 1.4 0.12 0.76 1.48 0.83 SASD-WS-Cos 3.8 11.6 18.8 7.20 18.43 26.35 14.36 SASD-WS-MSE 5.4 14.6 20.6 6.00 18.23 26.47 15.22 SU-Cos 3.0 10.4 13.2 6.19 14.99 20.07 11.31 SU-MSE 3.4 11.2 17.4 6.63 15.27 19.79 12.28 AnyAttack-Cos 3.8 14.0 22.8 7.36 20.71 27.55 16.04 AnyAttack-Bi 4.8 16.0 23.6 8.20 22.31 29.11 17.34 AnyAttack-Cos w/ Aux 9.4 24.6 37.0 11.51 32.62 48.18 27.22 AnyAttack-Bi w/ Aux 12.0 34.0 47.4 15.67 39.34 53.54 33.66 ViT-L/14 × 336 AttackVLM-i 0.2 0.6 1.6 0.16 1.12 2.04 0.95 AttackVLM-it 0.2 0.6 1.8 0.32 0.96 1.76 0.94 SASD-WS-Cos 2.8 10.8 16.4 6.52 18.31 26.19 13.50 SASD-WS-MSE 4.4 13.6 19.2 6.72 18.23 25.71 14.64 SU-Cos 2.4 8.0 11.2 4.88 13.79 18.39 9.78 SU-MSE 3.6 8.2 13.2 6.40 14.51 19.19 10.85 AnyAttack-Cos 4.6 11.0 16.6 5.96 17.67 24.23 13.34 AnyAttack-Bi 3.6 14.4 19.0 7.64 19.79 26.83 15.21 AnyAttack-Cos w/ Aux 9.0 23.2 37.2 11.68 34.03 47.62 27.12 AnyAttack-Bi w/ Aux 12.0 33.2 46.8 14.79 39.22 53.06 33.18 Table 2: The retrieval performances on the MSCOCO dataset under different attacks. TR@1, TR@5, and TR@10 measures text retrieval performance, while IR@1, IR@5, and IR@10 measures image retrieval performance. R@Mean is the average of all retrieval metrics. Our proposed methods are italicized, the best results are highlighted in bold, and the second-best results are underlined. Attack Method Accuracy AttackVLM-i 6.5 AttackVLM-it 6.3 SASD-WS-Cos 24.3 SASD-WS-MSE 24.8 SU-Cos 13.7 SU-MSE 13.6 AnyAttack-Cos 17.5 AnyAttack-Cos w/ Aux 44.8 Table 3: Attack performance comparison on the SNLI-VE dataset for multimodal classification. Model Attack Method SPICE BLEU-1 BLEU-4 METEOR ROUGE-L CIDEr InstructBLIP AttackVLM-i 1.4 38.9 5.4 8.7 28.6 3.4 AttackVLM-it 1.3 39.1 5.4 8.7 28.8 3.3 SASD-WS-Cos 3.4 43.9 7.2 10.5 32.2 10.9 SASD-WS-MSE 3.2 44.6 7.0 10.8 32.4 11.8 SU-Cos 1.9 40.7 6.0 9.3 29.9 5.3 SU-MSE 1.9 40.9 6.5 9.5 29.9 6.0 AnyAttack-Cos 2.3 41.5 5.9 9.5 30.2 7.0 AnyAttack-Cos w/ Aux 4.7 46.5 7.5 12.2 33.6 20.3 BLIP2 AttackVLM-i 1.2 39.6 5.3 8.7 29.0 3.6 AttackVLM-it 1.2 39.6 5.4 8.7 29.3 3.5 SASD-WS-Cos 2.6 43.0 6.3 10.2 32.0 9.3 SASD-WS-MSE 2.8 42.8 6.5 10.2 31.7 9.5 SU-Cos 1.6 40.9 5.6 9.2 30.1 4.7 SU-MSE 1.6 40.8 5.9 9.2 30.1 5.0 AnyAttack-Cos 1.8 41.3 5.2 9.6 30.9 5.6 AnyAttack-Cos w/ Aux 3.3 44.2 6.0 11.0 32.4 13.3 BLIP AttackVLM-i 1.3 39.8 5.0 8.8 29.9 3.4 AttackVLM-it 1.2 39.7 4.8 8.7 29.7 3.2 SASD-WS-Cos 3.3 43.8 6.9 10.7 32.3 11.9 SASD-WS-MSE 3.4 43.8 6.9 10.8 32.3 12.4 SU-Cos 2.6 43.0 6.5 10.1 31.8 8.7 SU-MSE 2.6 42.4 6.4 9.9 31.6 8.4 AnyAttack-Cos 2.2 41.6 6.0 9.5 31.1 6.1 AnyAttack-Cos w/ Aux 3.4 44.4 7.1 11.1 32.8 13.0 Mini-GPT4 AttackVLM-i 1.6 29.5 2.3 9.3 24.3 1.6 AttackVLM-it 1.5 29.2 2.3 9.4 24.5 1.5 SASD-WS-Cos 2.8 30.5 2.4 10.9 25.2 2.6 SASD-WS-MSE 3.1 30.5 2.9 10.9 25.7 2.8 SU-Cos 2.0 29.5 2.9 9.9 24.8 1.9 SU-MSE 2.2 30.3 2.9 9.9 25.1 2.2 AnyAttack-Cos 2.5 30.5 2.4 10.3 25.2 1.9 AnyAttack-Cos w/ Aux 4.6 32.5 4.0 12.4 27.3 5.3 Table 4: Attack performance comparison on the MSCOCO dataset for image captioning task. In this section, we evaluate the performance of our proposed attack across multiple datasets, tasks, and VLMs. We evaluate the effectiveness of targeted adversarial attacks first in image-text retrieval tasks, then multimodal classification tasks, and finally image captioning tasks. Additionally, we analyze the performance of targeted adversarial images on commercial VLMs. 4.1 Experimental Setup Baselines. We first employed state-of-the-art targeted adversarial attack on VLMs, AttackVLM [33]. This method includes two variations: AttackVLM-i and AttackVLM-it, which are based on different attack objectives. Both methods utilize the CLIP ViT-B/32 image encoder as the surrogate model, consistent with our approach. Additionally, we incorporated two targeted adversarial attacks designed for visual classification models: SU [24] and SASD-WS [25]. Since the original cross-entropy loss used in these methods is not suitable for vision-language tasks, we modified them to employ cosine loss and mean squared error (MSE) loss to match targeted images. These modified methods are denoted as SU-Cos/SASD-WS-Cos and SU-MSE/SASD-WS-MSE, respectively. For the SU attack, the surrogate model is CLIP ViT-B/32. For the SASD-WS attack, we utilized the officially released weights, as its surrogate model with the auxiliary model. We denote our proposed methods as AnyAttack-Cos, AnyAttack-Bi, AnyAttack-Cos w/ Aux, and AnyAttack-Bi w/ Aux. These represent AnyAttack fine-tuned with ℒCossubscriptℒCosL_CosLCos, fine-tuned with ℒBisubscriptℒBiL_BiLBi, fine-tuned with ℒCossubscriptℒCosL_CosLCos using auxiliary models, and fine-tuned with ℒBisubscriptℒBiL_BiLBi using auxiliary models, respectively. Datasets, Models, and Tasks. For the downstream datasets, we utilize the MSCOCO, Flickr30K, and SNLI-VE datasets. We employ a variety of target models, including CLIP, BLIP, BLIP2, InstructBLIP, and MiniGPT-4. The downstream tasks we focus on are image-text retrieval, multimodal classification, and image captioning. For each task, we selected the top 1,000 images. Additionally, following the methodology outlined in [33], we used the top 1,000 images from the ImageNet-1K validation set as clean (random) images to generate adversarial examples. Figure 3: Example responses from commercial VLMs to targeted attacks generated by our method. Metric. We use the attack success rate (ASR) as the primary evaluation metric to assess the performance of targeted adversarial attacks. The calculation of ASR varies slightly depending on the specific task. For instance, in image-text retrieval tasks, ASR represents the recall rate between adversarial images and their corresponding ground-truth text descriptions. In multimodal classification tasks, ASR refers to the accuracy of correctly classifying pairs of “adversarial image and ground-truth description.” Implementation Details. In this work, we study perturbations constrained by the ℓ∞subscriptℓ _∞ℓ∞ norm, ensuring that ‖δ‖∞≤ϵsubscriptnormitalic-ϵ\|δ\|_∞≤ε∥ δ ∥∞ ≤ ϵ, where ϵitalic-ϵεϵ represents the maximum allowable perturbation, set to 1625516255 16255divide start_ARG 16 end_ARG start_ARG 255 end_ARG. We pre-trained the decoder for 520,000 steps on the LAION-400M dataset [18], using a batch size of 600 per GPU on three NVIDIA A100 80GB GPUs. The optimizer used was AdamW, with an initial learning rate of 1×10−41superscript1041× 10^-41 × 10- 4, which was adjusted using cosine annealing. For the downstream datasets, we fine-tuned the decoder for 20 epochs using the same optimizer, initial learning rate, and cosine annealing schedule. We deployed two auxiliary models: the ViT-B/16 trained from scratch on ImageNet-1K and the ViT-L/14 EVA model [5, 6], both of which are trained on ImageNet-1K. The factor K was set to 5. In the pre-training stage, the initial temperature τ0subscript0 _0τ0 was set to 1, the final temperature τfinalsubscriptfinal _finalτfinal was set to 0.07, and the total steps T were set to 10,000. More details can be found in the Appendix. 4.2 Evaluation on Image-Text Retrieval In this subsection, we compare the performance of our method against baseline approaches on the image-text retrieval task. Tab. 2 presents the results on the MSCOCO dataset, while results on the Flickr30K dataset are detailed in Appendix. The following key observations can be made: • Performance of AnyAttack-Bi w/ Auxiliary: This variant achieves significantly superior performance compared to all baselines, surpassing the best-performing baseline by 15.02%, 18.44%, and 18.54% on ViT-B/16, ViT-B/32, and ViT-L/14, respectively. All AnyAttack methods consistently deliver competitive results, outperforming most baselines. This highlights the effectiveness of our proposed method. • Effectiveness of the Auxiliary Module: The Auxiliary module demonstrates its effectiveness, providing improvements of 6.455%, 13.75%, and 15.875% on ViT-B/16, ViT-B/32, and ViT-L/14, respectively, when comparing AnyAttack w/ Auxiliary to AnyAttack. • Advantages of Bidirectional Loss: The bidirectional contrastive loss ℒBisubscriptℒBiL_BiLBi shows clear advantages for retrieval tasks, with AnyAttack-Bi consistently outperforming AnyAttack-Cos. 4.3 Evaluation on Multimodal Classification Here, we compare the performance of our attack with the baselines on the multimodal classification task. Tab. 3 presents the results on the SNLI-VE dataset. Our method, AnyAttack-Cos w/ Auxiliary, achieves the highest performance, surpassing the strongest baseline, SASD-WS-MSE, by 20.0%. This underscores the effectiveness of our attack in multimodal classification tasks. 4.4 Evaluation on Image Captioning Here, we evaluate the performance of our attack on the image captioning task using the MSCOCO dataset. The VLMs take adversarial images as input and generate text descriptions, which are then assessed against the ground-truth captions using standard metrics. Tab. 4 presents the results across four VLMs: InstructBLIP, BLIP2, BLIP, and MiniGPT-4. Our proposed attack method, AnyAttack-Cos w/ Auxiliary, consistently demonstrates superior performance across all evaluation metrics, outperforming the baseline attacks on each VLM. Attack Method Google Gemini OpenAI GPT AttackVLM-i 0 2 AttackVLM-it 0 0 SASD-WS-Cos 5 28 SASD-WS-MSE 1 25 SU-Cos 0 11 SU-MSE 0 12 AnyAttack-Cos w/ Aux 31 38 Table 5: Quantitative performance comparison on commercial VLMs. The reported values represent the ASR. Figure 4: Performance comparison between different configurations of AnyAttack for the image-text retrieval task on MSCOCO. The plot shows the comparative performance of decoder initialized from scratch (Scratch), pre-trained (Pre), and fine-tuned (Cos and Bi), alongside the impact of auxiliary models (w/ Aux) and different fine-tuning objectives (Cos or Bi) on retrieval tasks. 4.5 Transfer to Commercial VLMs We evaluate the transferability of adversarial images generated by our method to commercial VLMs: Google Gemini, Claude Sonnet, OpenAI GPT, and Microsoft Copilot. Detailed setups are provided in Appendix. Quantitative Results. We selected 100 images from the MSCOCO dataset as target images and conducted a comparison between our method and baseline approaches. The experiments were conducted using Google Gemini (Gemini 1.5 Flash) and OpenAI GPT (GPT-4o mini) via their respective APIs. Using the prompt “Evaluate the relationship between the given image and text”, along with corresponding options “A) The text is highly relevant to the image. B) The text is partially relevant to the image. C) The text is not relevant to the image.” Tab. 5 reports the percentage of responses labeled as “highly and partially relevant” by these commercial VLMs. Our method consistently outperforms the baselines, achieving substantial improvements across all evaluated models. Qualitative Results. To further demonstrate the effectiveness of AnyAttack, we uploaded the adversarial images to the publicly available web interfaces of these commercial VLMs. Fig. 3 showcases representative examples, with additional instances provided in Appendix. The portions of the VLM responses highlighted in red correspond to the target images, clearly illustrating the impact of our attacks on these VLMs. 4.6 Further Analysis Figure 5: Comparison of memory usage and time consumption across different methods. Ablation Study. We perform an ablation study on the MSCOCO dataset for image-text retrieval task to evaluate the impact of three key components in our approach: 1) Training approach: Pre-trained, fine-tuned, or trained from scratch. 2) Auxiliary models: With or without auxiliary model integration. 3) Fine-tuning objective: Cosine similarity (ℒCossubscriptℒCosL_CosLCos) vs. bidirectional contrastive loss (ℒBisubscriptℒBiL_BiLBi). The results, summarized in Fig. 4, reveal the following: 1) Training approach: Fine-tuning a pre-trained model achieves the highest performance, while training from scratch yields significantly worse results, indicating that pre-training is critical for task adaptation. 2) Auxiliary models: The inclusion of auxiliary models consistently improves performance, highlighting their role in enhancing transferability. 3) Fine-tuning objective: The bidirectional contrastive loss (ℒBisubscriptℒBiL_BiLBi) consistently outperforms the cosine similarity loss (ℒCossubscriptℒCosL_CosLCos), demonstrating its effectiveness in improving the alignment of image and text embeddings. Efficiency Analysis. In this subsection, we compare the efficiency of our method with SU, SASD, and AttackVLM. Figure 5 presents the results for generating 1,000 adversarial images on a single NVIDIA A100 80GB GPU with a batch size of 250, showing both memory usage and time consumption. The results demonstrate that our approach significantly outperforms the baselines in both computational speed and memory efficiency. 5 Conclusion In this paper, we introduced AnyAttack, a novel self-supervised framework for generating targeted adversarial attacks on VLMs. Our approach overcomes the scalability limitations of previous methods by enabling the use of any image to serve as a target for attack target without label supervision. Through extensive experiments, we demonstrated the effectiveness of AnyAttack across multiple VLMs and vision-language tasks, revealing significant vulnerabilities in state-of-the-art models. Our method showed considerable transferability, even to commercial VLMs, highlighting the broad implications of our findings. These results underscore the urgent need for robust defense mechanisms in VLM systems. As VLMs become increasingly prevalent in real-world applications, our work opens new avenues for research in VLM security, particularly considering that this is the first time pre-training has been conducted on a large-scale dataset like LAION-400M. This emphasizes the critical importance of addressing these challenges. Future work should focus on developing resilient VLMs and exploring potential mitigation strategies against such targeted attacks. 6 Acknowledgements This work is supported by the National Key R&D Program of China (Grant No. 2023YFC3310700, 2022ZD0160103) and the National Natural Science Foundation of China (Grant No. 62276067). This research has been made possible by a Research Impact Fund project (RIF R6003-21) and a General Research Fund project (GRF 16203224) funded by the Research Grants Council (RGC) of the Hong Kong Government. References Carlini et al. [2024] Nicholas Carlini, Milad Nasr, Christopher A Choquette-Choo, Matthew Jagielski, Irena Gao, Pang Wei W Koh, Daphne Ippolito, Florian Tramer, and Ludwig Schmidt. Are aligned neural networks adversarially aligned? Advances in Neural Information Processing Systems, 36, 2024. Dai et al. [2023] Wenliang Dai, Junnan Li, Dongxu Li, Anthony Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. InstructBLIP: Towards general-purpose vision-language models with instruction tuning. In Thirty-seventh Conference on Neural Information Processing Systems, 2023. Dong et al. [2018] Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 9185–9193, 2018. Dong et al. [2019] Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 4312–4321, 2019. Fang et al. [2023] Yuxin Fang, Wen Wang, Binhui Xie, Quan Sun, Ledell Wu, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. Eva: Exploring the limits of masked visual representation learning at scale. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 19358–19369, 2023. Fang et al. [2024] Yuxin Fang, Quan Sun, Xinggang Wang, Tiejun Huang, Xinlong Wang, and Yue Cao. Eva-02: A visual representation for neon genesis. Image and Vision Computing, 149:105171, 2024. Gong et al. [2023] Yichen Gong, Delong Ran, Jinyuan Liu, Conglei Wang, Tianshuo Cong, Anyu Wang, Sisi Duan, and Xiaoyun Wang. Figstep: Jailbreaking large vision-language models via typographic visual prompts. arXiv preprint arXiv:2311.05608, 2023. Li et al. [2022] Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In International conference on machine learning, pages 12888–12900. PMLR, 2022. Li et al. [2023] Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In International conference on machine learning, pages 19730–19742. PMLR, 2023. Lin et al. [2023] Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In International Conference on Learning Representations, 2023. Liu and Lyu [2024] Junlin Liu and Xinchen Lyu. Boosting the transferability of adversarial examples via local mixup and adaptive step size. arXiv preprint arXiv:2401.13205, 2024. Lu et al. [2023] Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. Set-level guidance attack: Boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 102–111, 2023. Luo et al. [2024] Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image is worth 1000 lies: Transferability of adversarial images across prompts on vision-language models. In International Conference on Learning Representations, 2024. Niu et al. [2024] Zhenxing Niu, Haodong Ren, Xinbo Gao, Gang Hua, and Rong Jin. Jailbreaking attack against multimodal large language model. arXiv preprint arXiv:2402.02309, 2024. Qi et al. [2024] Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Peter Henderson, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak aligned large language models. In Proceedings of the AAAI Conference on Artificial Intelligence, pages 21527–21536, 2024. Radford et al. [2021] Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In International conference on machine learning, pages 8748–8763. PMLR, 2021. Russakovsky et al. [2015] Olga Russakovsky, Jia Deng, Hao Su, Jonathan Krause, Sanjeev Satheesh, Sean Ma, Zhiheng Huang, Andrej Karpathy, Aditya Khosla, Michael Bernstein, et al. Imagenet large scale visual recognition challenge. International journal of computer vision, 115(3):211–252, 2015. Schuhmann et al. [2021] Christoph Schuhmann, Richard Vencu, Romain Beaumont, Robert Kaczmarczyk, Clayton Mullis, Aarush Katta, Theo Coombes, Jenia Jitsev, and Aran Komatsuzaki. Laion-400m: Open dataset of clip-filtered 400 million image-text pairs. arXiv preprint arXiv:2111.02114, 2021. Springer et al. [2021] Jacob Springer, Melanie Mitchell, and Garrett Kenyon. A little robustness goes a long way: Leveraging robust features for targeted transfer attacks. Advances in Neural Information Processing Systems, 34:9759–9773, 2021. Szegedy et al. [2013] Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199, 2013. Wang et al. [2024] Ruofan Wang, Xingjun Ma, Hanxu Zhou, Chuanjun Ji, Guangnan Ye, and Yu-Gang Jiang. White-box multimodal jailbreaks against large vision-language models. arXiv preprint arXiv:2405.17894, 2024. Wang and He [2021] Xiaosen Wang and Kun He. Enhancing the transferability of adversarial attacks through variance tuning. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 1924–1933, 2021. Wang et al. [2021] Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: Enhancing the transferability of adversarial attacks. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 16158–16167, 2021. Wei et al. [2023] Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Enhancing the self-universality for transferable targeted attacks. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 12281–12290, 2023. Wu et al. [2024] Han Wu, Guanyan Ou, Weibin Wu, and Zibin Zheng. Improving transferable targeted adversarial attacks with model self-enhancement. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 24615–24624, 2024. Wu et al. [2023] Yuanwei Wu, Xiang Li, Yixin Liu, Pan Zhou, and Lichao Sun. Jailbreaking gpt-4v via self-adversarial attacks with system prompts. arXiv preprint arXiv:2311.09127, 2023. Xie et al. [2019] Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2730–2739, 2019. Xu et al. [2024] Wenzhuo Xu, Kai Chen, Ziyi Gao, Zhipeng Wei, Jingjing Chen, and Yu-Gang Jiang. Highly transferable diffusion-based unrestricted adversarial attack on pre-trained vision-language models. In ACM Multimedia, 2024. Yin et al. [2024] Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Vlattack: Multimodal adversarial attacks on vision-language tasks via pre-trained models. Advances in Neural Information Processing Systems, 36, 2024. Ying et al. [2024] Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. Jailbreak vision language models via bi-modal adversarial prompt. arXiv preprint arXiv:2406.04031, 2024. Zhang et al. [2022] Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pre-training models. In Proceedings of the 30th ACM International Conference on Multimedia, pages 5005–5013, 2022. Zhang et al. [2023] Jiaming Zhang, Qi Yi, Dongyuan Lu, and Jitao Sang. Low-mid adversarial perturbation against unauthorized face recognition system. Information Sciences, 648:119566, 2023. Zhao et al. [2024] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. Advances in Neural Information Processing Systems, 36, 2024. Zhou et al. [2023] Ziqi Zhou, Shengshan Hu, Minghui Li, Hangtao Zhang, Yechao Zhang, and Hai Jin. Advclip: Downstream-agnostic adversarial examples in multimodal contrastive learning. In Proceedings of the 31st ACM International Conference on Multimedia, pages 6311–6320, 2023. Zhu et al. [2024] Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. In The Twelfth International Conference on Learning Representations, 2024.

Instant research discovery