Paper deep dive

Energy-Latency Manipulation of Multi-modal Large Language Models via Verbose Samples

Kuofeng Gao, Jindong Gu, Yang Bai, Shu-Tao Xia, Philip Torr, Wei Liu, Zhifeng Li

Year: 2024Venue: arXiv preprintArea: Adversarial RobustnessType: EmpiricalEmbeddings: 98

Models: BLIP, BLIP-2, InstructBLIP, MiniGPT-4, VideoChat-2, Video-LLaMA, Video-Vicuna

Intelligence

Status: succeeded | Model: google/gemini-3.1-flash-lite-preview | Prompt: intel-v1 | Confidence: 95%

Last extracted: 3/12/2026, 6:17:53 PM

Summary

The paper introduces 'verbose samples' as a method to manipulate Multi-modal Large Language Models (MLLMs) into generating excessively long sequences, thereby inducing high energy consumption and latency. The authors propose modality-specific and non-specific loss functions—including delayed EOS, uncertainty, token diversity, and frame feature diversity—to craft imperceptible adversarial perturbations that increase inference costs.

Entities (5)

Multi-modal Large Language Models · technology · 100%Verbose Samples · methodology · 98%Delayed EOS Loss · loss-function · 95%Frame Feature Diversity Loss · loss-function · 95%Token Diversity Loss · loss-function · 95%

Relation Signals (4)

Verbose Samples → targets → Multi-modal Large Language Models

confidence 100% · we propose verbose samples... to induce high energy-latency cost for MLLMs

Token Diversity Loss → optimizes → Verbose Images

confidence 95% · For verbose images, a token diversity loss is proposed to promote diverse hidden states.

Frame Feature Diversity Loss → optimizes → Verbose Videos

confidence 95% · For verbose videos, a frame feature diversity loss is proposed to increase the feature diversity among frames.

Verbose Samples → inducedby → Delayed EOS Loss

confidence 90% · For both verbose images and videos, two modality non-specific loss objectives are designed... (1) Delayed EOS loss

Cypher Suggestions (0)

No Cypher suggestions yet.

Abstract

Abstract:Despite the exceptional performance of multi-modal large language models (MLLMs), their deployment requires substantial computational resources. Once malicious users induce high energy consumption and latency time (energy-latency cost), it will exhaust computational resources and harm availability of service. In this paper, we investigate this vulnerability for MLLMs, particularly image-based and video-based ones, and aim to induce high energy-latency cost during inference by crafting an imperceptible perturbation. We find that high energy-latency cost can be manipulated by maximizing the length of generated sequences, which motivates us to propose verbose samples, including verbose images and videos. Concretely, two modality non-specific losses are proposed, including a loss to delay end-of-sequence (EOS) token and an uncertainty loss to increase the uncertainty over each generated token. In addition, improving diversity is important to encourage longer responses by increasing the complexity, which inspires the following modality specific loss. For verbose images, a token diversity loss is proposed to promote diverse hidden states. For verbose videos, a frame feature diversity loss is proposed to increase the feature diversity among frames. To balance these losses, we propose a temporal weight adjustment algorithm. Experiments demonstrate that our verbose samples can largely extend the length of generated sequences.

PDF

Open source PDF →Open local PDF →

Trouble viewing inline? Open PDF directly →

Full Text

97,677 characters extracted from source content.

Expand or collapse full text

Energy-Latency Manipulation of Multi-modal Large Language Models via Verbose Samples Kuofeng Gao*, Jindong Gu*, Yang Bai, Shu-Tao Xia† †, Philip Torr, Senior Member, IEEE, Wei Liu, Fellow, IEEE, Zhifeng Li† †, Senior Member, IEEE * Equal contribution. Kuofeng Gao and Shu-Tao Xia are with Tsinghua Shenzhen International Graduate School, Tsinghua University, Shenzhen, Guangdong, China and Shu-Tao Xia is also with the Peng Cheng Laboratory, Shenzhen, Guangdong, China. (E-mail: gkf21@mails.tsinghua.edu.cn, xiast@sz.tsinghua.edu.cn). Jindong Gu and Philip Torr are with Torr Vision Group, University of Oxford. (E-mail: jindong.gu@eng.ox.ac.uk, philip.torr@eng.ox.ac.uk) Yang Bai is with Tencent Technology (Beijing) Co.Ltd, Beijing, China. (E-mail: mavisbai@tencent.com) Wei Liu and Zhifeng Li are with Tencent Data Platform, ShenZhen, China. (E-mail: wl2223@columbia.edu, michaelzfli@tencent.com) † †Corresponding authors: Shu-Tao Xia (E-mail: xiast@sz.tsinghua.edu.cn) and Zhifeng Li (E-mail: michaelzfli@tencent.com). Abstract Despite the exceptional performance of multi-modal large language models (MLLMs), their deployment requires substantial computational resources. Once malicious users induce high energy consumption and latency time (energy-latency cost), it will exhaust computational resources and harm availability of service. In this paper, we investigate this vulnerability for MLLMs, particularly image-based and video-based ones, and aim to induce high energy-latency cost during inference by crafting an imperceptible perturbation. We find that high energy-latency cost can be manipulated by maximizing the length of generated sequences, which motivates us to propose verbose samples, including verbose images and videos. Concretely, two modality non-specific losses are proposed, including a loss to delay end-of-sequence (EOS) token and an uncertainty loss to increase the uncertainty over each generated token. In addition, improving diversity is important to encourage longer responses by increasing the complexity, which inspires the following modality specific loss. For verbose images, a token diversity loss is proposed to promote diverse hidden states. For verbose videos, a frame feature diversity loss is proposed to increase the feature diversity among frames. To balance these losses, we propose a temporal weight adjustment algorithm. Experiments demonstrate that our verbose samples can largely extend the length of generated sequences. Index Terms: Energy-latency manipulation, multi-modal large language models, verbose samples. 1 Introduction Multi-modal large language models (MLLMs) [1, 2, 3, 4, 5, 6], including image-based LLMs [7, 8, 9, 10] and video-based LLMs [11, 12, 13], have achieved remarkable performance across various multi-modal tasks in both image and video modality, including image and video captioning, question answering, and comprehension. However, these MLLMs [6, 14, 15, 11, 16] often consist of billions of parameters, which require significant computational resources for deployment [17]. The larger scale of these models can lead to increased energy consumption and longer latency time during the inference process. Both NVIDIA and Amazon Web Services [18] have stated that the deployment for the inference process accounts for over 90% of machine learning demand. This high demand for computational resources not only poses challenges in terms of cost but also raises concerns about the potential security risks. Once attackers maliciously induce high energy consumption and latency time (energy-latency cost) during the inference stage, it can exhaust computational resources and reduce the availability of MLLMs. The energy consumption is the amount of energy used on hardware during an inference, while the latency time represents the response time taken for the inference. Previous studies have discussed how to manipulate high energy-latency cost in other architectures and specifically proposed sponge samples [19] for LLMs, and NICGSlowdown [20] for smaller-scale models. However, when these methods are directly applied to MLLMs, there remains room for improvement, which will be further discussed in Section 2. Different from LLMs and smaller-scale models, MLLMs integrate the image and video modality into impressive LLMs [21, 22] to enable powerful visual interaction with images and videos. This integration introduces vulnerabilities from the manipulation of visual inputs [23], requiring specific methods to induce high energy-latency cost. In this paper, we first conduct a comprehensive investigation on energy consumption, latency time, and the length of generated sequences by MLLMs during the inference stage. As observed in Fig. 1, both energy consumption and latency time exhibit an approximately positive linear relationship with the length of generated sequences. Hence, the high energy-latency cost of MLLMs can be maximized by increasing the length of their generated sequences. Consequently, we propose verbose samples, including verbose images and verbose videos, to craft an imperceptible perturbation, which can induce image-based LLMs and video-based LLMs to generate long sentences during the inference, respectively. (a) Energy of MiniGPT-4 (b) Latency of MiniGPT-4 (c) Energy of VideoChat-2 (d) Latency of VideoChat-2 Figure 1: The approximately positive linear relationship between energy consumption, latency time, and the length of generated sequences in image-based LLMs and video-based LLMs. Following [19], energy consumption is estimated by NVIDIA Management Library (NVML), and latency time is the response time of an inference. For both verbose images and videos, two modality non-specific loss objectives are designed as follows. (1) Delayed EOS loss: The end-of-sequence (EOS) token is a signal to stop generating further tokens. By delaying the placement of the EOS token, MLLMs are encouraged to generate more tokens and extend the length of generated sequences. Besides, to accelerate the process of delaying EOS tokens, we propose to break output dependency, following [20]. With the guide of the Delayed EOS loss and diverging from the original output dependency, the generated sequence can be deviated towards the direction of a longer sequence. (2) Uncertainty Loss: By introducing more uncertainty over each generated token, it can break the original output dependency at the token level and encourage MLLMs to produce more varied outputs and generate longer sequences. Additionally, to encourage longer generated sequences, we propose to improve diversity during inference, which can increase the complexity of the output. Based on different input modalities, the modality-specific loss objective for each modality is designed as follows. For verbose images, we propose a Token Diversity Loss that encourages token diversity among all tokens of the whole generated sequence. As a result, it can break the original output dependency at the sequence level and enable image-based LLMs to generate a diverse range of tokens in the output sequence, contributing to longer and more complex sequences. For verbose videos, we propose a Frame Feature Diversity Loss tailored for video-based LLMs. Typically, a video consists of a series of consecutive frames representing a scene, with adjacent frames often sharing similar semantics. Leveraging this consistent semantic relationship, video-based LLMs can aggregate different frames within a video into features to produce a coherent sequence. Hence, to promote a longer generated sequence, we propose to increase the diversity of frame features, which can induce different frames away from each other and introduce inconsistent semantics. Consequently, it can confuse video-based LLMs, making it hard to consistently comprehend the content in videos. Both verbose images and videos introduce three loss objectives. To balance them, we propose a temporal weight adjustment algorithm for the optimization of verbose images and videos. Extensive experiments demonstrate that our verbose images can increase the length of generated sequences of image-based LLMs by 7.87× and 8.56× compared to original images on MS-COCO and ImageNet datasets. Our verbose videos can increase the length of generated sequences of video-based LLMs by 4.04× and 4.14× compared to original videos on MSVD and TGIF datasets. In summary, a preliminary version of this work has been presented as the ICLR 2024 conference [24] and contributions in the conference version can be outlined as follows: • We conduct a comprehensive investigation and observe that energy consumption and latency time are approximately positively linearly correlated with the length of generated sequences for image-based LLMs. • We propose verbose images to craft an imperceptible perturbation to induce high energy-latency cost for image-based LLMs, which is achieved by delaying the EOS token, enhancing output uncertainty, improving token diversity, and employing a temporal weight adjustment algorithm during the optimization process. • Experiments show that our verbose images can increase the maximum length of generated sequences on MS-COCO and ImageNet across four image-based LLMs. Additionally, our verbose images can generate complex sequences containing hallucinated contents and produce dispersed attention on visual input. In the current work, we incorporate the following additional contributions: • For energy-latency manipulation of MLLMs, including both image-based LLMs and video-based LLMs, we find a general observation that energy consumption and latency time are approximately positively linearly correlated with the length of generated sequences. • To induce high energy-latency cost for MLLMs, we propose verbose samples, including verbose images and videos, which both adopt delaying the EOS token and enhancing output uncertainty. Besides, we propose to improve token diversity for verbose images and improve frame feature diversity for verbose videos. Furthermore, a temporal weight adjustment algorithm is proposed to balance these losses. • Experiments demonstrate that our verbose samples can generate the longest sequences. Besides, to highlight the necessity of verbose videos tailored for video-based LLMs, we compare and discuss the differences between verbose images and videos. Furthermore, we unify an interpretation framework for energy-latency manipulation in both image and video modality from hallucination and visual attention. • We supplement all discussions about the effect of both verbose images and videos, including different perturbation magnitudes, different adversary knowledge, and different multi-modal tasks. 2 Related Work 2.1 Multi-modal large language models (MLLMs) Recently, the advanced MLLMs, including image-based LLMs and video-based LLMs, have achieved an enhanced zero-shot performance in various multi-modal tasks [25, 26, 27]. The integration of the image or video modality into MLLMs enables visual context-aware interaction, surpassing the capabilities of existing LLMs. However, this integration also introduces vulnerabilities arising from the manipulation of visual inputs, such as adversarial misdirection [28, 29, 30, 31, 32, 33, 34] and visual jailbreak [35, 36, 37]. With the increasing size of LLM parameters and the inclusion of vision encoders, MLLMs consist of larger parameters, which results in higher energy-latency cost during the inference stage. In our paper, we aim to uncover this security threat in energy-latency manipulation of MLLMs during deployment. To this end, we propose to generate verbose samples to induce high energy-latency cost of MLLMs. 2.2 Energy-latency manipulation The energy-latency manipulation [38, 39, 40, 41] aims to slow down the models by increasing their energy computation and response time during the inference stage, a threat analogous to the denial-of-service (DoS) attacks [42] from the Internet. Concretely, sponge samples [19] first observe that a larger representation dimension calculation can introduce more energy-latency cost in LLMs. Hence, they propose to craft sponge samples to maximize the ℒ2subscriptℒ2L_2L2 norm of activation values across all layers, thereby introducing more representation calculation and energy-latency cost. NICGSlowDown [20] proposes to increase the number of decoder calls, i.e., the length of the generated sequence, to increase the energy-latency of smaller-scale captioning models. They minimize the logits of both EOS token and output tokens to generate long sentences. However, there is still room for improvement if these previous methods are directly applied to MLLMs for two main reasons. On one hand, they primarily focus on LLMs or smaller-scale models. Sponge samples are designed for LLMs for translations [43] and NICGSlowdown targets for RNNs or LSTMs combined with CNNs for image captioning [44]. Differently, our verbose samples are tailored for MLLMs in multi-modal tasks. On the other hand, the objective of NICGSlowdown involves logits of specific output tokens. Nevertheless, current MLLMs generate random output sequences for the same input sample, due to advanced sampling policies [45], which makes it challenging to optimize objectives with specific output tokens. Therefore, it highlights the need for methods specifically designed for MLLMs to induce high energy-latency cost. 3 Methodology 3.1 Threat model Goals and capabilities. The goal of our proposed verbose samples is to craft an imperceptible perturbation and induce the MLLMs to generate a sequence as long as possible, thereby increasing the energy consumption and prolonging latency during the victim model’s deployment. Specifically, the involved perturbation is restricted within a predefined magnitude in lpsubscriptl_plitalic_p norm, ensuring that it is imperceptible and difficult to detect. Knowledge and background. We consider the target MLLMs which generate sequences using an auto-regressive process. As suggested in [46, 35], we assume that the victim MLLMs can be accessed in full knowledge, including architectures and parameters, in our main experiments. Additionally, we consider a more challenging scenario where the victim MLLMs are inaccessible in discussions. In such cases, the verbose samples can only be generated on surrogate MLLMs and subsequently transferred to the victim MLLMs. 3.2 Problem formulation Consider an input image xitalic_x for image-based LLMs and an input video with M frames =1,…,Msubscript1…subscript X=\ X_1,..., X_M\italic_X = italic_X1 , … , italic_Xitalic_M for video-based LLMs. They are accordingly with an input text insubscriptin c_initalic_cin and a sequence of generated output tokens =y1,y2,…,yNsubscript1subscript2…subscript y=\y_1,y_2,...,y_N\italic_y = y1 , y2 , … , yitalic_N , where yisubscripty_iyitalic_i represents the i-th generated token, N is the length of the output sequence and insubscriptin c_initalic_cin is a placeholder ∅ ∅ in image and video captioning or a question in image and video question answering. Based on the probability distribution over generated tokens, MLLMs generate one token at one time in an auto-regressive manner. The probability distribution after the Softmax⁡(⋅)Softmax⋅Softmax(·)Softmax ( ⋅ ) layer over the i-th generated token can be denoted as fi⁢(y1,⋯,yi−1;;in)subscriptsubscript1⋯subscript1subscriptinf_i (y_1,·s,y_i-1;\ x;\ c_in )fitalic_i ( y1 , ⋯ , yitalic_i - 1 ; italic_x ; italic_cin ) for image-based LLMs and Fi⁢(y1,⋯,yi−1;;in)subscriptsubscript1⋯subscript1subscriptinF_i (y_1,·s,y_i-1;\ X;\ c_in )Fitalic_i ( y1 , ⋯ , yitalic_i - 1 ; italic_X ; italic_cin ) for video-based LLMs. Since we mainly focus on visual inputs of MLLMs in this paper, we abbreviate it as fi⁢()subscriptf_i ( x )fitalic_i ( italic_x ) and Fi⁢()subscriptF_i ( X )Fitalic_i ( italic_X ), where fi⁢()∈ℝVsubscriptsuperscriptℝVf_i ( x ) ^Vfitalic_i ( italic_x ) ∈ blackboard_RV, Fi⁢()∈ℝVsubscriptsuperscriptℝVF_i ( X ) ^VFitalic_i ( italic_X ) ∈ blackboard_RV, and VVV is the vocabulary size. Meanwhile, the hidden states across all the layers over the i-th generated token are recorded as gi⁢(y1,⋯,yi−1;;in)subscriptsubscript1⋯subscript1subscripting_i (y_1,·s,y_i-1;\ x;\ c_in )gitalic_i ( y1 , ⋯ , yitalic_i - 1 ; italic_x ; italic_cin ), abbreviated as gi⁢()subscriptg_i ( x )gitalic_i ( italic_x ), where gi⁢()∈ℝCsubscriptsuperscriptℝCg_i ( x ) ^Cgitalic_i ( italic_x ) ∈ blackboard_RC and CCC is the dimension size of hidden states for image-based LLMs. In addition, the frame feature over the j-th frame can be extracted by hj⁢()subscriptℎh_j ( X )hitalic_j ( italic_X ) for video-based LLMs, where hj⁢()∈ℝDsubscriptℎsuperscriptℝDh_j ( X ) ^Dhitalic_j ( italic_X ) ∈ blackboard_RD and DDD is the dimension size of frame features. As discussed in Section 1, the energy consumption and latency time of an inference are approximately positively linearly related to the length of the generated sequence. Hence, inducing high energy-latency cost can be formulated as maximizing the length N of the output tokens of MLLMs by crafting verbose images ′superscript′ x italic_x′ and verbose videos ′superscript′ X italic_X′. To ensure the imperceptibility, we impose an lpsubscriptl_plitalic_p restriction on the imperceptible perturbations, where the perturbation magnitude is denoted as ϵitalic-ϵεϵ, such that ‖′−‖p≤ϵsubscriptnormsuperscript′italic-ϵ|| x - x||_p≤ε| | italic_x′ - italic_x | |p ≤ ϵ and 1M⁢∑j=1M‖j′−j‖p≤ϵ1superscriptsubscript1subscriptnormsuperscriptsubscript′subscriptitalic-ϵ 1M _j=1^M|| X_j - X_j||_p≤ start_ARG 1 end_ARG start_ARG M end_ARG ∑j = 1M | | italic_Xitalic_j′ - italic_Xitalic_j | |p ≤ ϵ. Figure 2: An overview of verbose samples against MLLMs to increase the length of generated sequences, thereby inducing higher energy-latency cost. Two modality non-specific losses are designed to delay EOS occurrence and enhance output uncertainty. Besides, a modality specific loss is proposed for each modality. For verbose images, the goal is to improve token diversity, while for verbose videos, is to improve frame feature diversity. Moreover, a temporal weight adjustment algorithm is proposed to better utilize the three objectives. 3.3 Overview To increase the length of generated sequences, we propose two modality non-specific loss objectives for both verbose images and videos and the modality specific loss objective for each modality to optimize imperceptible perturbations. Two modality non-specific loss objectives are designed as follows. Firstly and straightforwardly, we propose a delayed EOS loss to hinder the occurrence of EOS token and thus force the sentence to continue. However, the auto-regressive textual generation in MLLMs establishes an output dependency, which means that the current token is generated based on all previously generated tokens. Hence, when previously generated tokens remain unchanged, it is also hard to generate a longer sequence even though the probability of the EOS token has been minimized. To this end, we propose to break this output dependency as suggested in [20]. Concretely, we propose an uncertainty loss to enhance output uncertainty over each generated token. Subsequently, the modality specific loss objective for each modality is designed as follows. We find that it can lead to the longer generated sequences by improving diversity, which can increase the complexity of the output. For verbose images, we propose a token diversity loss, which improves the diversity among all tokens of the whole generated sequence. For verbose videos, we propose a frame feature diversity loss to increase the diversity of frame features within an input video. Moreover, to balance three loss objectives during the optimization, a temporal weight adjustment algorithm is introduced in Section 3.5. Fig. 2 shows an overview of our samples. 3.4 Loss design 3.4.1 Delaying EOS occurrence For both MLLMs, the auto-regressive generation process continues until an end-of-sequence (EOS) token is generated or a predefined maximum token length is reached. To increase the length of generated sequences, one straightforward approach is to prevent the occurrence of the EOS token during the prediction process. However, considering that the auto-regressive prediction is a non-deterministic random process, it is challenging to directly determine the exact location of the EOS token occurrence. Therefore, we propose to minimize the probability of the EOS token at all positions. This can be achieved through the delayed EOS loss, formulated as follows for verbose images: ℒ1⁢(′)=1N⁢∑i=1NfiEOS⁢(′),subscriptℒ1superscript′1superscriptsubscript1superscriptsubscriptEOSsuperscript′ _1( x )= 1N _i=1^Nf_i^% EOS ( x ),L1 ( italic_x′ ) = divide start_ARG 1 end_ARG start_ARG N end_ARG ∑i = 1N fitalic_iroman_EOS ( italic_x′ ) , (1) and formulated as follows for verbose videos: ℒ1⁢(′)=1N⁢∑i=1NFiEOS⁢(′),subscriptℒ1superscript′1superscriptsubscript1superscriptsubscriptEOSsuperscript′ _1( X )= 1N _i=1^NF_i^% EOS ( X ),L1 ( italic_X′ ) = divide start_ARG 1 end_ARG start_ARG N end_ARG ∑i = 1N Fitalic_iroman_EOS ( italic_X′ ) , (2) where fiEOS⁢(⋅)superscriptsubscriptEOS⋅f_i^EOS(·)fitalic_iroman_EOS ( ⋅ ) and FiEOS⁢(⋅)superscriptsubscriptEOS⋅F_i^EOS(·)Fitalic_iroman_EOS ( ⋅ ) are the EOS token probability of the probability distribution after the Softmax⁡(⋅)Softmax⋅Softmax(·)Softmax ( ⋅ ) layer over the i-th generated token in image-based LLMs and video-based LLMs, respectively. When reducing the likelihood of every EOS token occurring by minimizing ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), MLLMs are encouraged to generate more and more tokens before reaching the EOS token. 3.4.2 Enhancing output uncertainty To generate a longer sequence, we propose to break output dependency. This is because guided by the delay of the EOS token, the generated sequence can deviate towards a longer generated sequence, diverging from the original auto-regressive output dependency. Then, the problem can be formulated as how to induce the generated sequence away from the original sequence. Typically, MLLMs generate each token with the highest probability, forming a generated sequence. The probability of the generated sequence can be calculated as a product of conditional probabilities of each generated token [47], formulated as follows for verbose images: P⁢(y1⁢…⁢yN;;cin)=∏i=1NP⁢(yi|y1,…,yi−1;;cin),subscript1…subscriptsubscriptinsuperscriptsubscriptproduct1conditionalsubscriptsubscript1…subscript1subscriptin P(y_1...y_N; x;c_in)=Π _i=1^NP(y_% i|y_1,...,y_i-1; x;c_in),P ( y1 … yitalic_N ; italic_x ; cin ) = ∏i = 1N P ( yitalic_i | y1 , … , yitalic_i - 1 ; italic_x ; cin ) , (3) and formulated as follows for verbose videos: P⁢(y1⁢…⁢yN;;cin)=∏i=1NP⁢(yi|y1,…,yi−1;;cin).subscript1…subscriptsubscriptinsuperscriptsubscriptproduct1conditionalsubscriptsubscript1…subscript1subscriptin P(y_1...y_N; X;c_in)=Π _i=1^NP(y_% i|y_1,...,y_i-1; X;c_in).P ( y1 … yitalic_N ; italic_X ; cin ) = ∏i = 1N P ( yitalic_i | y1 , … , yitalic_i - 1 ; italic_X ; cin ) . (4) Consequently, the probability of the original generated sequence is also the highest probability. To deviate from the original generated sequence, we can reduce the probability of the generated sequence, which can be achieved by lowering the probability of each generated token. To this end, we propose to enhance output uncertainty over each generated token to facilitate longer and more complex output sequences. This objective can be implemented by maximizing the entropy of the output probability distribution for each generated token. Based on [48], it can be converted to minimize the Kullback–Leibler (KLKLKLKL) divergence DKL⁢(⋅,⋅)subscriptKL⋅D_KL(·,·)Droman_KL ( ⋅ , ⋅ ) [49] between the output probability distribution and a uniform distribution UU. Therefore, the uncertainty loss can be formulated as follows for verbose images: ℒ2⁢(′)=∑i=1NDKL⁢(fi⁢(′),),subscriptℒ2superscript′subscript1subscriptKLsubscriptsuperscript′ _2( x )= _i=1^ND_KL% (f_i ( x ),U ),L2 ( italic_x′ ) = ∑i = 1N Droman_KL ( fitalic_i ( italic_x′ ) , U ) , (5) and formulated as follows for verbose videos: ℒ2⁢(′)=∑i=1NDKL⁢(fi⁢(′),),subscriptℒ2superscript′subscript1subscriptKLsubscriptsuperscript′ _2( X )= _i=1^ND_KL% (f_i ( X ),U ),L2 ( italic_X′ ) = ∑i = 1N Droman_KL ( fitalic_i ( italic_X′ ) , U ) , (6) where fi⁢(⋅)subscript⋅f_i(·)fitalic_i ( ⋅ ) and Fi⁢(⋅)subscript⋅F_i(·)Fitalic_i ( ⋅ ) are the probability distribution after the Softmax⁡(⋅)Softmax⋅Softmax(·)Softmax ( ⋅ ) layer over the i-th generated token in image-based LLMs and video-based LLMs, respectively. The uncertainty loss can introduce more uncertainty in the prediction for each generated token, effectively breaking the original output dependency. Consequently, when the original output dependency is disrupted, MLLMs can generate more complex sentences and longer generated sequences, guided by the delay of the EOS token. 3.4.3 Improving diversity for each modality For verbose images, to increase the complexity of the output, we propose to improve the diversity of hidden states among all generated tokens, which explores a wider range of possible outputs. Specifically, the hidden state of a token is the vector representation of a word or subword in image-based LLMs. Definition 1. Let Rank⁡(⋅)Rank⋅Rank(·)Rank ( ⋅ ) indicates the rank of a matrix and [g1⁢(′);g2⁢(′);⋯;gN⁢(′)]subscript1superscript′subscript2superscript′⋯subscriptsuperscript′[g_1( x );g_2( x );·s;g_N( x )][ g1 ( italic_x′ ) ; g2 ( italic_x′ ) ; ⋯ ; gitalic_N ( italic_x′ ) ] denotes the concatenated matrix of hidden states among all generated tokens. To induce high energy-latency cost of image-based LLMs, the token diversity is defined as the rank of hidden states among all generated tokens, i.e., Rank⁡([g1⁢(′);g2⁢(′);⋯;gN⁢(′)])Ranksubscript1superscript′subscript2superscript′⋯subscriptsuperscript′Rank([g_1( x );g_2( x );·s;g_N% ( x )])Rank ( [ g1 ( italic_x′ ) ; g2 ( italic_x′ ) ; ⋯ ; gitalic_N ( italic_x′ ) ] ). Given by Definition 1, increasing the rank of the concatenated matrix of hidden states among all generated tokens yields a more diverse set of hidden states of the tokens. However, based on [50], the optimization of the matrix rank is an NP-hard non-convex problem. To address this issue, we calculate the nuclear norm of a matrix to approximately measure its rank, as stated in Proposition 1. Consequently, by denoting the nuclear norm of a matrix as ||⋅||∗||·||_*| | ⋅ | |∗, we can formulate the token diversity loss as follows for verbose images: ℒ3⁢(′)=−‖[g1⁢(′);g2⁢(′);⋯;gN⁢(′)]‖∗.subscriptℒ3superscript′subscriptnormsubscript1superscript′subscript2superscript′⋯subscriptsuperscript′ _3( x )=-||[g_1( x );g_2% ( x );·s;g_N( x )]||_*.L3 ( italic_x′ ) = - | | [ g1 ( italic_x′ ) ; g2 ( italic_x′ ) ; ⋯ ; gitalic_N ( italic_x′ ) ] | |∗ . (7) This token diversity loss can lead to more diverse and complex sequences, making it hard for image-based LLMs to converge to a coherent output. Proposition 1. [50] For a rank minimization or maximization problem, the rank of a matrix can be heuristically measured using the nuclear norm of the matrix. For verbose videos, we propose a frame feature diversity loss tailored for video-based LLMs. Video-based LLMs extract spatial and temporal features from video data, where different frames maintain a consistent semantic relationship over time. The consistent semantic over time in multiple frames within a video induces the sequence generation to converge to a limited number of tokens. To facilitate a longer generated sequence, we propose to increase the diversity of frame features, thereby introducing inconsistent semantics into the video data. As video-based LLMs grapple with accommodating these diverse or disrupted frame features, it is compelled to explore alternative output interpretations, resulting in a longer generated sequence. Definition 2. Let Rank⁡(⋅)Rank⋅Rank(·)Rank ( ⋅ ) indicates the rank of a matrix and [h1⁢(′);h2⁢(′);⋯;hM⁢(′)]subscriptℎ1superscript′subscriptℎ2superscript′⋯subscriptℎsuperscript′[h_1( X );h_2( X );·s;h_M( X )][ h1 ( italic_X′ ) ; h2 ( italic_X′ ) ; ⋯ ; hitalic_M ( italic_X′ ) ] denotes the concatenated matrix of features among all frames. To induce high energy-latency cost of video-based LLMs, the diversity of frame features is defined as the rank of features among all frames, i.e., Rank⁡([h1⁢(′);h2⁢(′);⋯;hM⁢(′)])Ranksubscriptℎ1superscript′subscriptℎ2superscript′⋯subscriptℎsuperscript′Rank([h_1( X );h_2( X );·s;h_M% ( X )])Rank ( [ h1 ( italic_X′ ) ; h2 ( italic_X′ ) ; ⋯ ; hitalic_M ( italic_X′ ) ] ). Given by Definition 2, increasing the concatenated matrix of features among all frames can boost the diversity of frame features. Combined with Proposition 1, we can formulate the frame feature diversity loss as follows for verbose videos: ℒ3⁢(′)=−‖[h1⁢(′);h2⁢(′);⋯;hM⁢(′)]‖∗,subscriptℒ3superscript′subscriptnormsubscriptℎ1superscript′subscriptℎ2superscript′⋯subscriptℎsuperscript′ _3( X )=-||[h_1( X );h_2% ( X );·s;h_M( X )]||_*,L3 ( italic_X′ ) = - | | [ h1 ( italic_X′ ) ; h2 ( italic_X′ ) ; ⋯ ; hitalic_M ( italic_X′ ) ] | |∗ , (8) where ||⋅||∗||·||_*| | ⋅ | |∗ is the nuclear norm of a matrix. This loss can maximize the semantic distance among different frames within a video, which mislead video-based LLMs to generate a longer sequence. In summary, due to the reduced probability of EOS occurrence by ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), the disruption of the original output dependency introduced by ℒ2⁢(⋅)subscriptℒ2⋅L_2(·)L2 ( ⋅ ), and complexity diversity introduced by ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ), our verbose samples can facilitate a more effective manipulation on the worst-case energy-latency cost of MLLMs. 3.5 Optimization To combine the three loss functions of verbose samples, ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), ℒ2⁢(⋅)subscriptℒ2⋅L_2(·)L2 ( ⋅ ), and ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ) into an overall objective function, we propose to assign three weights λ1subscript1 _1λ1, λ2subscript2 _2λ2, and λ3subscript3 _3λ3 to the ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), ℒ2⁢(⋅)subscriptℒ2⋅L_2(·)L2 ( ⋅ ), and ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ) and sum them up to obtain the overall objective function of verbose images as follows: min′⁡λ1×ℒ1⁢(′)+λ2×ℒ2⁢(′)+λ3×ℒ3⁢(′),subscriptsuperscript′subscript1subscriptℒ1superscript′subscript2subscriptℒ2superscript′subscript3subscriptℒ3superscript′ _ x \ _1×L_1( x^% )+ _2×L_2( x )+ _3×% L_3( x ),minbold_italic_x′ λ1 × L1 ( italic_x′ ) + λ2 × L2 ( italic_x′ ) + λ3 × L3 ( italic_x′ ) , (9) and overall objective function of verbose videos as follows: min′⁡λ1×ℒ1⁢(′)+λ2×ℒ2⁢(′)+λ3×ℒ3⁢(′).subscriptsuperscript′subscript1subscriptℒ1superscript′subscript2subscriptℒ2superscript′subscript3subscriptℒ3superscript′ _ X \ _1×L_1( X^% )+ _2×L_2( X )+ _3×% L_3( X ).minbold_italic_X′ λ1 × L1 ( italic_X′ ) + λ2 × L2 ( italic_X′ ) + λ3 × L3 ( italic_X′ ) . (10) To optimize this objective, we adopt the projected gradient descent (PGD) algorithm, as proposed by [51]. PGD algorithm is an iterative optimization technique that updates the solution by taking steps in the direction of the negative gradient while projecting the result back onto the feasible set. We denote verbose images at the t-th step as t′subscriptsuperscript′ x _titalic_x′italic_t, verbose videos at the t-th step as t′subscriptsuperscript′ X _titalic_X′italic_t, and the gradient descent step of verbose images is as follows: t′=t−1′subscriptsuperscript′subscriptsuperscript′1 x _t= x _t-1italic_x′italic_t = italic_x′italic_t - 1 −α×sign(∇t−1′(λ1×ℒ1(t−1′) -α×sign( _ x _t-1(% _1×L_1( x _t-1)- α × sign ( ∇italic_x′ start_POSTSUBSCRIPT t - 1 end_POSTSUBSCRIPT ( λ1 × L1 ( italic_x′italic_t - 1 ) (11) +λ2×ℒ2(t−1′)+λ3×ℒ3(t−1′))), + _2×L_2( x _t-1)+ _% 3×L_3( x _t-1))),+ λ2 × L2 ( italic_x′italic_t - 1 ) + λ3 × L3 ( italic_x′italic_t - 1 ) ) ) , s.t.‖t′−‖p≤ϵ,formulae-sequencesubscriptnormsubscriptsuperscript′italic-ϵ s.t.\ || x _t- x||_p≤ε,s . t . | | italic_x′italic_t - italic_x | |p ≤ ϵ , and the gradient descent step of verbose videos is as follows: t′=t−1′subscriptsuperscript′subscriptsuperscript′1 X _t= X _t-1italic_X′italic_t = italic_X′italic_t - 1 −α×sign(∇t−1′(λ1×ℒ1(t−1′) -α×sign( _ X _t-1(% _1×L_1( X _t-1)- α × sign ( ∇italic_X′ start_POSTSUBSCRIPT t - 1 end_POSTSUBSCRIPT ( λ1 × L1 ( italic_X′italic_t - 1 ) (12) +λ2×ℒ2(t−1′)+λ3×ℒ3(t−1′))), + _2×L_2( X _t-1)+ _% 3×L_3( X _t-1))),+ λ2 × L2 ( italic_X′italic_t - 1 ) + λ3 × L3 ( italic_X′italic_t - 1 ) ) ) , s.t.1M⁢∑j=1M‖t⁢j′−j‖p≤ϵ,formulae-sequence1superscriptsubscript1subscriptnormsuperscriptsubscript′subscriptitalic-ϵ s.t.\ 1M _j=1^M|| X_tj - X_j% ||_p≤ε,s . t . divide start_ARG 1 end_ARG start_ARG M end_ARG ∑j = 1M | | italic_Xitalic_t j′ - italic_Xitalic_j | |p ≤ ϵ , where α is the step size and ϵitalic-ϵεϵ is the perturbation magnitude to ensure the imperceptibility. Since different loss functions have different convergence rates during the iterative optimization process, we propose a temporal weight adjustment algorithm to achieve a better balance among these three loss objectives. Specifically, we incorporate normalization scaling and temporal decay functions, 1⁢(t)subscript1T_1(t)T1 ( t ), 2⁢(t)subscript2T_2(t)T2 ( t ), and 3⁢(t)subscript3T_3(t)T3 ( t ), into the optimization weights λ1⁢(t)subscript1 _1(t)λ1 ( t ), λ2⁢(t)subscript2 _2(t)λ2 ( t ), and λ3⁢(t)subscript3 _3(t)λ3 ( t ) of ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), ℒ2⁢(⋅)subscriptℒ2⋅L_2(·)L2 ( ⋅ ), and ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ). Therefore, it can be formulated for verbose images as follows: λk⁢(t)=‖ℒ2⁢(t−1′)‖1/‖ℒk⁢(t−1′)‖1/k⁢(t),subscriptsubscriptnormsubscriptℒ2subscriptsuperscript′11subscriptnormsubscriptℒsubscriptsuperscript′11subscript _k(t)=||L_2( x _t-1)||_1\ /% \ ||L_k( x _t-1)||_1\ /\ T_k(t),λitalic_k ( t ) = | | L2 ( italic_x′italic_t - 1 ) | |1 / | | Litalic_k ( italic_x′italic_t - 1 ) | |1 / Titalic_k ( t ) , (13) and for verbose videos as follows: λk⁢(t)=‖ℒ2⁢(t−1′)‖1/‖ℒk⁢(t−1′)‖1/k⁢(t),subscriptsubscriptnormsubscriptℒ2subscriptsuperscript′11subscriptnormsubscriptℒsubscriptsuperscript′11subscript _k(t)=||L_2( X _t-1)||_1\ /% \ ||L_k( X _t-1)||_1\ /\ T_k(t),λitalic_k ( t ) = | | L2 ( italic_X′italic_t - 1 ) | |1 / | | Litalic_k ( italic_X′italic_t - 1 ) | |1 / Titalic_k ( t ) , (14) where k=1,2,3123k=1,2,3k = 1 , 2 , 3 and the temporal decay functions are set as follows: k⁢(t)=ak×ln⁡(t)+bk.subscriptsubscriptlnsubscript _k(t)=a_k×ln(t)+b_k.Titalic_k ( t ) = aitalic_k × ln ( t ) + bitalic_k . (15) Besides, a momentum value m is introduced into the update process of weights. This involves taking into account not only current weights but also previous weights when updating losses, which helps smooth out the weight updates during the optimization process. 4 Experiments 4.1 Experimental setups Models and datasets. For verbose images, we consider four open-source and advanced large image-language models as our evaluation benchmark, including BLIP [7], BLIP-2 [5], InstructBLIP [8], and MiniGPT-4 [9]. Concretely, we adopt the BLIP with the basic multi-modal mixture of encoder-decoder model in 224M version, BLIP-2 with an OPT-2.7B LM [52], InstructBLIP and MiniGPT-4 with a Vicuna-7B LM [53]. These models perform the captioning task for the image under their prompt templates in default and also evaluate question answering task in discussions. We randomly choose the 1,000 images from MS-COCO [54] and ImageNet [55] dataset, respectively, as our evaluation dataset. For verbose videos, we evaluate three benchmark video-based LLMs, including VideoChat-2 [11], Video-Vicuna [12], and Video-LLaMA [12]. Specifically, we employ VideoChat-2 with a Vicuna-7B LM [53], Video-Vicuna with a Vicuna-7B LM [53], and Video-LLaMA a LLaMA-2-7B LM [56]. These models perform video captioning tasks using their standard prompt templates in default and also evaluate question answering task in discussions. For the evaluation purposes, we randomly select 500 videos from the MSVD [57] and TGIF [58] datasets, respectively. Baselines and setups. For the evaluation, we consider original samples, samples with random noise, sponge samples, and NICGSlowDown as baselines. For sponge samples, NICGSlowDown, and our verbose samples, we perform the projected gradient descent (PGD) [51] algorithm in T=1,0001000T=1,000T = 1 , 000 iterations. Besides, in order to ensure the imperceptibility, the perturbation magnitude is set as ϵ=8italic-ϵ8ε=8ϵ = 8 within l∞subscriptl_∞l∞ restriction, following [59], and the step size is set as α=11α=1α = 1. The default maximum length of generated sequences of MLLMs is set as 512512512512 and the sampling policy is configured to use nucleus sampling [45]. For verbose images, the parameters of loss weights are a1=10subscript110a_1=10a1 = 10, b1=−20subscript120b_1=-20b1 = - 20, a2=0subscript20a_2=0a2 = 0, b2=0subscript20b_2=0b2 = 0, a3=0.5subscript30.5a_3=0.5a3 = 0.5, and b3=1subscript31b_3=1b3 = 1 and the momentum of our optimization is m=0.90.9m=0.9m = 0.9. For verbose videos, the parameters of loss weights are a1=10,000subscript110000a_1=10,000a1 = 10 , 000, b1=100,000subscript1100000b_1=100,000b1 = 100 , 000, a2=0subscript20a_2=0a2 = 0, b2=0subscript20b_2=0b2 = 0, a3=5subscript35a_3=5a3 = 5, and b3=500subscript3500b_3=500b3 = 500 and the momentum of our optimization is m=0.90.9m=0.9m = 0.9. Besides, a video consists of eight frames to input the video-based LLMs. Evaluation metrics. We calculate the energy consumption (J) and the latency time (s) during inference on one single GPU. Following [19], the energy consumption and latency time are measured by the NVIDIA Management Library (NVML) and the response time cost of an inference, respectively. Besides, the length of generated sequences is also regarded as a metric. Considering the randomness of sampling modes in MLLMs, we report the average evaluation results run over three times. TABLE I: The length of generated sequences, energy consumption (J), and latency time (s) of five categories of visual images against four image-based LLMs, including BLIP, BLIP-2, InstructBLIP, and MiniGPT-4, on two datasets, namely MS-COCO and ImageNet. Best results are marked in bold. Image-based LLMs Method MS-COCO ImageNet Length Latency Energy Length Latency Energy BLIP Original 10.03 0.21 9.51 10.17 0.22 9.10 Noise 9.98 0.17 8.57 9.87 0.18 8.29 Sponge samples 65.83 1.10 73.57 76.67 1.26 86.00 NICGSlowDown 179.42 2.84 220.73 193.68 2.98 243.84 Verbose images (Ours) 318.66 5.13 406.65 268.25 4.31 344.91 BLIP-2 Original 8.82 0.39 16.08 8.11 0.37 15.39 Noise 9.55 0.43 17.53 8.37 0.44 19.39 Sponge samples 22.53 0.73 30.20 43.59 1.51 63.27 NICGSlowDown 103.54 3.78 156.61 129.68 4.34 180.06 Verbose images (Ours) 226.72 7.97 321.59 250.72 10.26 398.58 InstructBLIP Original 63.79 2.97 151.80 54.40 2.60 128.03 Noise 62.76 2.91 148.64 53.01 2.50 125.42 Sponge samples 92.69 4.10 209.81 80.26 3.55 175.17 NICGSlowDown 93.70 4.08 200.51 81.64 3.56 174.44 Verbose images (Ours) 140.35 6.15 316.06 131.79 6.05 300.43 MiniGPT-4 Original 45.29 10.39 329.50 40.93 9.11 294.68 Noise 45.15 10.35 327.04 47.78 10.98 348.66 Sponge samples 220.30 43.84 1390.73 228.70 47.74 1528.58 NICGSlowDown 232.80 46.39 1478.74 245.51 51.22 1624.06 Verbose images (Ours) 321.35 67.14 2113.29 321.24 64.31 2024.62 TABLE I: The length of generated sequences, energy consumption (J), and latency time (s) of five categories of visual videos against three video-based LLMs, including VideoChat-2, Video-Vicuna, and Video-LLaMA, on two datasets, namely MSVD and TGIF. Best results are marked in bold. Video-based LLMs Method MSVD TGIF Length Latency Energy Length Latency Energy VideoChat-2 Original 13.97 4.79 153.08 14.47 5.16 163.22 Noise 14.49 4.84 156.84 14.38 4.76 148.98 Sponge samples 28.84 6.99 222.83 25.02 6.46 202.93 NICGSlowDown 29.99 7.02 224.11 24.98 6.35 197.22 Verbose videos (Ours) 165.77 35.88 1323.42 198.43 46.07 1741.97 Video-Vicuna Original 77.18 13.05 429.36 83.67 13.88 441.52 Noise 80.21 13.45 444.16 85.82 14.51 472.84 Sponge samples 225.91 39.05 1285.56 231.25 39.37 1315.16 NICGSlowDown 230.63 41.03 1310.19 235.22 42.59 1380.44 Verbose videos (Ours) 262.97 45.52 1488.95 277.56 47.88 1513.22 Video-LLaMA Original 59.51 12.01 441.58 60.07 13.02 495.73 Noise 63.52 14.03 578.78 61.82 13.62 525.28 Sponge samples 145.92 30.08 1193.59 136.91 28.69 1061.85 NICGSlowDown 172.92 37.56 1408.79 171.28 38.36 1616.52 Verbose videos (Ours) 180.01 41.15 1815.22 179.24 39.83 1726.57 (a) BLIP (b) BLIP-2 (c) InstructBLIP (d) MiniGPT-4 Figure 3: The length distribution of four image-based LLMs: (a) BLIP. (b) BLIP-2. (c) InstructBLIP. (d) MiniGPT-4. The peak of length distribution of our verbose images shifts towards longer sequences. (a) VideoChat-2 (b) Video-Vicuna (c) Video-LLaMA Figure 4: The length distribution of three video-based LLMs: (a) VideoChat-2. (b) Video-Vicuna. (c) Video-LLaMA. The peak of length distribution of our verbose videos shifts towards longer sequences. TABLE I: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 of verbose images on MS-COCO and ImageNet, and against VideoChat-2 of verbose videos on MSVD and TGIF in different combinations of three loss objectives. The total of three losses can induce MLLMs to generate the longest sequences. ℒ1subscriptℒ1L_1L1 ℒ2subscriptℒ2L_2L2 ℒ3subscriptℒ3L_3L3 MS-COCO ImageNet MSVD TGIF Length Latency Energy Length Latency Energy Length Latency Energy Length Latency Energy ✓ 119.46 3.96 162.40 147.87 4.52 185.64 27.66 6.84 227.12 24.87 6.41 203.18 ✓ 139.54 4.65 194.17 161.46 5.69 240.25 119.94 23.68 773.09 132.84 25.48 848.63 ✓ 104.03 3.29 135.75 129.02 3.90 161.87 91.97 18.62 588.26 111.13 23.35 765.24 ✓ ✓ 177.95 6.47 267.01 217.78 7.47 306.09 127.02 25.64 859.44 165.25 36.16 1244.91 ✓ ✓ 150.79 4.51 182.16 151.57 4.71 194.40 102.17 20.28 695.03 141.74 32.84 1148.93 ✓ ✓ 176.53 6.05 254.30 206.43 7.50 304.06 133.17 25.22 892.05 184.21 39.09 1316.51 ✓ ✓ ✓ 226.72 7.97 321.59 250.72 10.26 398.58 165.77 35.88 1323.42 198.43 46.07 1741.97 TABLE IV: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 of verbose images on MS-COCO and ImageNet, and against VideoChat-2 of verbose videos on MSVD and TGIF in different combinations of two optimization modules. The total of two modules can induce MLLMs to generate the longest sequences. ⁢(t)T(t)T ( t ) m MS-COCO ImageNet MSVD TGIF Length Latency Energy Length Latency Energy Length Latency Energy Length Latency Energy 152.49 4.70 205.09 144.90 5.31 231.83 128.55 24.25 853.35 151.83 35.51 1282.74 ✓ 199.92 7.02 292.55 231.03 7.88 318.34 144.51 33.19 1163.06 187.69 39.29 1390.18 ✓ 187.32 6.89 274.67 214.92 7.49 308.11 130.22 25.83 911.61 162.51 34.74 1204.18 ✓ ✓ 226.72 7.97 321.59 250.72 10.26 398.58 165.77 35.88 1323.42 198.43 46.07 1741.97 4.2 Main results Table I and Table I compare the length of generated sequences, energy consumption, and latency time of original samples, samples with random noise, sponge samples, NICGSlowdown, and our proposed verbose samples. The original samples serve as a baseline, providing reference values for comparison. When random noise is added to the samples, the generated sequences exhibit a similar length to those of the original ones. It illustrates that it is necessary to optimize a handcrafted perturbation to induce high energy-latency cost of MLLMs. The sponge samples and NICGSlowdown can generate longer sequences compared to original ones. However, the increase in length is still smaller than that of our verbose samples. This can be attributed to the reason that the additional computational cost brought by sponge samples is tailored for LLMs and the objective for longer sequences introduced by NICGSlowdown is particularly suited for smaller-scale captioning models. There is still potential improvement to induce high energy-latency cost specifically for MLLMs. Our verbose samples can increase the maximum length of generated sequences and introduce the highest energy-latency cost among all these methods. Specifically, our verbose images can increase the average length of generated sequences by 7.87× and 8.56× relative to original images on the MS-COCO and ImageNet datasets, respectively. Our verbose videos can increase the average length of generated sequences by 4.04× and 4.14× compared to original videos on MSVD and TGIF datasets. These results demonstrate the superiority of our verbose samples for MLLMs. In addition, we visualize the length distribution of output sequences generated by four image-based LLMs on original images and our verbose images in Fig. 4 and that by three video-based LLMs on original videos and our verbose videos in Fig. 4. Compared to original samples, the distribution peak for sequences generated using our verbose samples exhibits a shift towards the direction of the longer length, confirming the effectiveness of our methods in generating longer sequences. We conjecture that the different shift magnitudes are due to different architectures, different training policies, and different parameter quantities in these MLLMs. TABLE V: The length of generated sequences, energy consumption (J), and latency time (s) of different attacking methods, which compares differences between verbose images and videos when inducing high energy-latency cost of video-based LLMs. Attacking method MSVD TGIF Length Latency Energy Length Latency Energy L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ) 48.20 10.16 329.61 58.45 12.04 407.86 L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) 91.97 18.62 588.26 111.13 23.35 765.24 Verbose videos using L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ) 133.93 27.99 1194.35 176.15 39.72 1582.74 Verbose images 71.35 14.08 448.07 63.73 12.52 407.95 Multiple verbose images 104.72 21.52 638.28 127.37 27.22 852.51 Verbose videos (Ours) 165.77 35.88 1323.42 198.43 46.07 1741.97 TABLE VI: The CHAIRisubscriptCHAIRCHAIR_iCHAIRi (%) and CHAIRssubscriptCHAIRCHAIR_sCHAIRs (%) of the original images and our verbose images against four image-based LLMs. Our verbose images achieve a higher both CHAIRisubscriptCHAIRCHAIR_iCHAIRi and CHAIRssubscriptCHAIRCHAIR_sCHAIRs, meaning more hallucinated objects. Image-based LLMs CHAIRisubscriptCHAIRCHAIR_iCHAIRi (%) CHAIRssubscriptCHAIRCHAIR_sCHAIRs (%) MS-COCO ImageNet MS-COCO ImageNet Original Ours Original Ours Original Ours Original Ours BLIP 11.41 79.93 22.29 89.80 12.77 84.22 13.77 90.33 BLIP-2 12.03 52.30 25.30 69.83 10.99 35.02 11.77 46.11 InstructBLIP 23.66 55.56 40.11 69.27 38.04 75.46 34.55 64.55 MiniGPT-4 19.42 46.65 29.20 65.50 19.61 52.01 16.57 54.37 TABLE VII: The CHAIRisubscriptCHAIRCHAIR_iCHAIRi (%) and CHAIRssubscriptCHAIRCHAIR_sCHAIRs (%) of the original videos and our verbose videos against three video-based LLMs. Our verbose videos achieve a higher both CHAIRisubscriptCHAIRCHAIR_iCHAIRi and CHAIRssubscriptCHAIRCHAIR_sCHAIRs, meaning more hallucinated objects. Video-based LLMs CHAIRisubscriptCHAIRCHAIR_iCHAIRi (%) CHAIRssubscriptCHAIRCHAIR_sCHAIRs (%) MSVD TGIF MSVD TGIF Original Ours Original Ours Original Ours Original Ours VideoChat-2 27.53 37.37 19.81 37.22 6.58 12.4 7.91 15.41 Video-Vicuna 40.33 53.64 42.51 47.96 55.45 63.54 48.52 56.07 Video-LLaMA 45.86 64.43 51.67 58.26 55.25 74.42 52.57 59.89 4.3 Ablation studies We explore the effect of the proposed three loss objectives and the effect of the temporal weight adjustment algorithm with momentum for verbose samples. Effect of loss objectives. Our verbose samples consist of three loss objectives: ℒ1⁢(⋅)subscriptℒ1⋅L_1(·)L1 ( ⋅ ), ℒ2⁢(⋅)subscriptℒ2⋅L_2(·)L2 ( ⋅ ) and ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ), respectively. Note that ℒ3⁢(⋅)subscriptℒ3⋅L_3(·)L3 ( ⋅ ) is different and modality specific for verbose images and videos. To identify the individual contributions of each loss function and their combined effects on the overall performance, we evaluate various combinations of the proposed loss functions, as presented in Table IV. It can be observed that optimizing each loss function individually can generate longer sequences, and the combination of all three loss functions achieves the best results in terms of sequence length. This ablation study suggests that the three loss functions in verbose images, which delay EOS occurrence, enhance output uncertainty, and improve token diversity, play a complementary role in extending the length of generated sequences. Similarly, the three loss functions in verbose videos, which delay EOS occurrence, enhance output uncertainty, and improve frame feature diversity, collaboratively contribute to extending the length of generated sequences. Effect of temporal weight adjustment. During the optimization, we introduce two methods: a temporal decay ⁢(t)T(t)T ( t ) for loss weighting and an addition of the momentum m. As shown in Table IV, both methods contribute to the longer length of the generated sequences. Furthermore, the longest length is obtained by combining temporal decay and momentum, which indicates that temporal decay and momentum can work synergistically to induce high energy-latency cost for MLLMs. 4.4 Differences between verbose images and videos To induce high energy-latency cost of video-based LLMs, we do not directly use the previously proposed verbose images. Instead, we introduce verbose videos, which are specifically tailored for video-based LLMs. To illustrate the reason behind it, we design two experiments as follows to compare differences between verbose images and videos. (1) From the difference of loss objectives, verbose images and videos have a different modality specific L3⁢(⋅)subscript3⋅L_3(·)L3 ( ⋅ ). For clearer expression, L3⁢(⋅)subscript3⋅L_3(·)L3 ( ⋅ ) in verbose images and videos are abbreviated as L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ) and L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ), respectively. Therein, L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) aims to destroy the diversity of frame features, targeting specific video data with multiple frames rather than image data, making it inapplicable to image-based LLMs. Conversely, L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ) in verbose images aims to improve the diversity of hidden states among all generated tokens, which can be applied to both image-based LLMs and video-based LLMs because they both employ auto-regressive token generation. Therefore, we explore the effect when replacing L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) with L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ) to generate verbose videos. Results in Table V reveal that using L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) alone outperforms solely employing L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ). Correspondingly, verbose videos with L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) exhibit a superior length of generated sequences, indicating its effectiveness in generating better verbose videos compared with L3⁢_⁢i⁢m⁢g⁢(⋅)subscript3_⋅L_3\_img(·)L3 _ i m g ( ⋅ ). (2) Considering various ways to utilize verbose images, we investigate the impact of using either a single verbose image or a combination of multiple verbose images to form a video, compared to the direct application of verbose videos. Specifically, we conduct an experiment where we randomly select a frame from a video and use it to generate a verbose image. Additionally, we randomly select eight frames, generate a corresponding verbose image for each, and then combine these to form a video, the same frame number as our verbose videos. As demonstrated in Table V, the generated sequences of both methods are lower compared to our verbose videos. We conjecture the reason is that a single verbose image or multiple verbose images do not take into account the temporal relationship among different frames within a video. Our verbose videos, on the other hand, consider it using L3⁢_⁢v⁢i⁢d⁢(⋅)subscript3_⋅L_3\_vid(·)L3 _ v i d ( ⋅ ) and introduce inconsistent semantics, which is a crucial factor in the effectiveness of the energy-latency manipulation for video-based LLMs. Figure 5: GradCAM for the original image xitalic_x and our verbose counterpart ′superscript′ x italic_x′. The attention of our verbose images is more dispersed and uniform. Figure 6: GradCAM for the original video Xitalic_X and our verbose counterpart ′superscript′ X italic_X′. The attention of our verbose videos is more dispersed and uniform. TABLE VIII: The length of generated sequences, energy consumption (J), latency time (s), and LIPIS against BLIP-2 on MS-COCO and ImageNet of verbose images and against VideoChat-2 on MSVD and TGIF of verbose videos with different perturbation magnitudes ϵitalic-ϵεϵ. A larger magnitude leads to a longer sequence and a more perceptible image. ϵitalic-ϵεϵ MS-COCO ImageNet MSVD TGIF Length Latency Energy LIPIS Length Latency Energy LIPIS Length Latency Energy LIPIS Length Latency Energy LIPIS 2 91.75 3.06 126.22 0.003 103.51 3.50 144.30 0.003 27.28 7.12 242.45 0.030 26.15 6.82 225.98 0.036 4 141.46 4.63 187.14 0.012 147.30 4.90 199.24 0.013 41.62 11.56 414.59 0.104 41.82 10.51 400.14 0.116 8 226.72 7.97 321.59 0.036 250.72 10.26 398.58 0.037 165.77 35.88 1323.42 0.382 198.43 46.07 1741.97 0.366 16 251.09 8.41 355.00 0.087 272.95 9.51 380.86 0.086 450.14 96.34 3541.62 0.802 478.18 102.40 3865.42 0.827 32 287.22 9.13 377.64 0.160 321.65 10.61 429.77 0.157 508.21 110.60 3742.91 1.600 510.05 115.21 4089.93 1.701 TABLE IX: The length of generated sequences, energy consumption (J), and latency time (s) of black-box transferability across four image-based LLMs of our verbose images. Our verbose images can transfer across different image-based LLMs. Source model Target model MS-COCO ImageNet Length Latency Energy Length Latency Energy None BLIP 10.03 0.21 9.51 10.17 0.22 9.10 BLIP 318.66 5.13 406.65 268.25 4.31 344.91 BLIP-2 14.51 0.24 10.05 14.03 0.24 10.23 InstructBLIP 63.43 2.84 142.46 54.14 2.52 131.22 MiniGPT-4 48.50 10.23 316.28 49.14 10.20 321.29 None BLIP-2 8.82 0.39 16.08 8.11 0.37 15.39 BLIP 36.09 1.19 47.07 73.22 2.39 99.24 BLIP-2 226.72 7.97 321.59 250.72 10.26 398.58 InstructBLIP 140.05 3.91 166.40 145.39 4.07 175.01 MiniGPT-4 140.88 3.81 154.43 140.92 3.91 165.95 None InstructBLIP 63.79 2.97 151.80 54.40 2.60 128.03 BLIP 91.94 4.13 203.94 82.66 3.77 186.51 BLIP-2 109.01 4.87 240.30 99.25 4.53 225.55 InstructBLIP 140.35 6.15 316.06 131.79 6.05 300.43 MiniGPT-4 100.08 4.42 210.58 99.42 4.47 219.08 None MiniGPT-4 45.29 10.39 329.50 40.93 9.11 294.68 BLIP 229.10 48.90 1562.25 254.57 54.57 1691.51 BLIP-2 296.77 58.84 1821.66 289.19 58.79 1826.81 InstructBLIP 270.73 48.88 1551.04 258.32 50.26 1632.01 MiniGPT-4 321.35 67.14 2113.29 321.24 64.31 2024.62 TABLE X: The length of generated sequences, energy consumption (J), and latency time (s) of black-box transferability across three video-based LLMs of our verbose videos. Our verbose videos can transfer across different video-based LLMs. Source model Target model MSVD TGIF Length Latency Energy Length Latency Energy None VideoChat-2 13.97 4.79 153.08 14.47 5.16 163.22 VideoChat-2 165.77 35.88 1323.42 198.43 46.07 1741.97 Video-Vicuna 72.53 13.48 412.85 78.28 15.03 433.29 Video-LLaMA 63.15 11.43 349.65 61.31 12.14 353.93 None Video-Vicuna 77.18 13.05 429.36 83.67 13.88 441.52 VideoChat-2 90.65 15.26 503.73 105.23 16.46 532.66 Video-Vicuna 262.97 45.52 1488.95 277.56 47.88 1513.22 Video-LLaMA 102.46 17.32 539.88 125.83 18.85 563.25 None Video-LLaMA 59.51 12.01 441.58 60.07 13.02 465.73 VideoChat-2 84.63 14.91 462.36 87.03 15.48 494.05 Video-Vicuna 102.74 17.53 536.52 110.32 18.86 548.85 Video-LLaMA 180.01 41.15 1815.22 179.24 39.83 1726.57 4.5 Unified interpretation To better reveal the mechanisms behind our verbose samples, we propose a unified interpretation, which conducts two further studies, including the visual interpretation where we adopt Grad-CAM [60] to generate the attention maps and the textual interpretation where we evaluate the object hallucination in generated sequences by CHAIR [61]. Textual Interpretation. We investigate object hallucination in generated sequences using CHAIR [61]. CHAIRisubscriptCHAIRCHAIR_iCHAIRi is calculated as the fraction of hallucinated object instances, while CHAIRssubscriptCHAIRCHAIR_sCHAIRs represents the fraction of sentences containing a hallucinated object, with the results presented in Table VII and Table VII. Compared to original samples, which exhibit a lower object hallucination rate, the longer sequences produced by our verbose samples contain a broader set of objects. This observation implies that our verbose samples can prompt MLLMs to generate sequences that include objects not present in the visual input, thereby leading to longer sequences and higher energy-latency cost. Visual Interpretation. We adopt GradCAM [60], a gradient-based visualization technique that generates attention maps highlighting the relevant regions in the visual input for the generated sequences. From Fig. 6 and Fig. 6, the attention of original images and videos primarily concentrates on a local region containing a specific object mentioned in the generated caption. In contrast, our verbose images can effectively disperse attention and cause image-based LLMs to shift their focus from a specific object to the entire image region. Similarly, our verbose videos are shown to distribute attention throughout the video frames in both spatial and temporal dimensions, rather than focus on specific actions or scenes. Since the attention mechanism serves as a bridge between the visual input and the output sequence of MLLMs, we conjecture that the generation of a longer sequence can be reflected in an inaccurate focus and dispersed and uniform attention from the visual input. In summary, our proposed verbose samples exhibit a higher hallucination rate and uniform attention distribution. Therefore, we hope that our proposed unified interpretation will serve as a valuable analytical tool for further research. 4.6 Discussions Different perturbation magnitudes. In our default setting, the perturbation magnitude ϵitalic-ϵεϵ is set as 8. To investigate the impact of different magnitudes, we vary ϵitalic-ϵεϵ under [2,4,8,16,32]2481632[2,4,8,16,32][ 2 , 4 , 8 , 16 , 32 ] in Table VIII and calculate the corresponding LIPIS [62] between original ones and their verbose counterpart, which quantifies the perceptual difference. It can be observed that a larger perturbation magnitude ϵitalic-ϵεϵ results in a longer generated sequence by MLLMs but produces more perceptible verbose samples. Consequently, this trade-off between visual perceptibility and energy-latency cost highlights the importance of choosing an appropriate perturbation magnitude during evaluation. Figure 7: An example of generated sequences from MiniGPT-4 by different input prompts. Users have diverse requirements and input data, leading to a wide range of lengths of generated sequences. TABLE XI: The length of generated sequences, energy consumption (J), and latency time (s) against BLIP-2 and VideoChat-2 on captioning and question answering tasks. Our verbose samples can still achieve better on different multi-modal tasks. Attacking method Image Caption Image QA Video Caption Video QA Length Latency Energy Length Latency Energy Length Latency Energy Length Latency Energy Original 8.82 0.39 16.08 6.43 0.44 17.92 13.97 4.79 153.08 16.66 5.67 181.13 Noise 9.55 0.43 17.53 6.62 0.45 17.09 14.49 4.84 156.84 16.94 7.04 211.58 Sponge samples 22.53 0.73 30.20 133.24 5.04 191.16 28.84 6.99 222.83 22.89 5.91 170.45 NICGSlowDown 103.54 3.78 156.61 127.96 5.07 190.13 29.99 7.02 224.11 23.69 6.41 201.94 Verbose samples (Ours) 226.72 7.97 321.59 271.95 11.49 365.49 165.77 35.88 1323.42 112.09 24.11 864.65 Different adversary knowledge. We explore a different adversary knowledge from main experiments, where the victim MLLMs are unknown in black-box settings [63, 64]. To induce high energy-latency cost of black-box MLLMs, we can leverage the transferability property [65] of our verbose samples. We can first craft verbose samples on a known and accessible surrogate model and then utilize them to transfer to the target victim MLLMs. The black-box transferability results across four image-based LLMs of our verbose images are evaluated in Table IX, while the transferability results of our verbose videos are assessed across three video-based LLMs, presented in Table X. When the source model is set as ‘None’, it indicates that we evaluate the energy-latency cost for the target model by utilizing the original samples. The results demonstrate that our transferable verbose samples are less effective than the white-box verbose samples but still result in a longer generated sequence. Different multi-modal tasks. To verify the effectiveness of our methods, we induce high energy-latency cost on an additional multi-modal task: visual question answering (VQA). For verbose images, we use VQAv2 dataset [66] in image question answering and for verbose videos, we employ MSVD-QA dataset [57] in video question answering. We use BLIP-2 as the target image-based LLM and VideoChat-2 as the target video-based LLM. Unless otherwise specified, other settings remain unchanged. Table XI demonstrates that our verbose samples can induce the highest energy-latency cost among different multi-modal tasks. Potential defenses. An intuitive defense to mitigate the energy-latency vulnerability is to impose a limitation on the length of generated sequences. We argue that such an intuitive defense is infeasible and the reason is as follows. (1) Users have diverse requirements and input data, leading to a wide range of sentence lengths and complexities. For example, the prompt text of ‘Describe the given image in one sentence.’ and ‘Describe the given image in details.’ can introduce different lengths of generated sentences. We visualize a case in Fig. 7. Consequently, service providers often consider a large token limit to accommodate these diverse requirements and ensure that the generated sentences are complete and meet users’ expectations. Previous work, NICGSlowDown [20], also states the same view as us. Besides, as shown in Table XI, the results can demonstrate that our verbose samples are adaptable for different prompt texts and can induce the length of generated sentences closer to the token limit set by the service provider. As a result, the energy-latency cost can be increased while staying within the imposed constraints. (2) We argue that this attack surface about availability of MLLMs becomes more important and our verbose samples can induce more serious attack consequences in the era of (multi-modal) large language models. The development of MLLMs has led to models capable of generating longer sentences with logic and coherence. Consequently, service providers have been increasing the maximum allowed length of generated sequences to ensure high-quality user experiences. For instance, gpt-3.5-turbo and gpt-4-turbo allow up to 4,096 and 8,192 tokens, respectively. Hence, we would like to uncover that while longer generated sequences can indeed improve service quality, they also introduce potential security risks about energy-latency cost, as our verbose samples demonstrate. Therefore, when MLLMs service providers consider increasing the maximum length of generated sequences for better user experience, they should not only focus on the ability of MLLMs but also take the maximum energy consumption payload into account. In terms of potential defenses, common data pre-processing methods, such as compressing or generative models, should be beneficial in defending our verbose samples. Furthermore, it is crucial to focus on safety-based alignment strategies, as they can significantly enhance the robustness of MLLMs against attacks. In our future work, we plan to investigate and develop defense methods to address the security threat introduced by energy-latency manipulation in a comprehensive manner. 5 Conclusion and limitation In this paper, we aim to craft an imperceptible perturbation to induce high energy-latency cost of MLLMs during the inference stage. We propose verbose samples to prompt MLLMs to generate as many tokens as possible. Extensive experimental results demonstrate that, compared to original images, our verbose images can increase the average length of generated sequences by 7.87× and 8.56× on MS-COCO and ImageNet across four image-based LLMs. Our verbose videos can increase the average length of generated sequences by 4.04× and 4.14× compared to original videos on MSVD and TGIF datasets across three video-based LLMs. In addition, we compare and discuss differences between verbose images and videos, highlighting the significance of the proposed verbose videos for video-based LLMs instead of directly using a single verbose image or a combination of multiple verbose images. For a deeper understanding, we propose a unified framework from hallucination and visual attention to interpret the mechanism behind the energy-latency manipulation of MLLMs. We hope that our verbose samples can serve as a baseline to manipulate high energy-latency cost of MLLMs. The primary limitation of our verbose samples lies in the focus on the digital world, where input samples are directly fed into the models. As technology progresses, MLLMs are expected to be deployed in more complex, real-world scenarios, such as autonomous driving. In these situations, input samples would not be pre-recorded but captured in real-time from physical environments using cameras. Therefore, the current verbose samples may not fully address the challenges and complexities associated with energy-latency manipulation in real-world, dynamic settings. Future research should investigate the implementation and impact of energy-latency manipulation techniques in the physical world to ensure their effectiveness in practical applications. Please note that we restrict all experiments in the laboratory environment and do not support our verbose samples in the real scenario. The purpose of our work is to raise the awareness of the security concern in availability of MLLMs and call for practitioners to pay more attention to the manipulation of energy-latency cost for MLLMs and model trustworthy deployment. References [1] J.-B. Alayrac, J. Donahue, P. Luc, A. Miech, I. Barr, Y. Hasson, K. Lenc, A. Mensch, K. Millican, M. Reynolds et al., “Flamingo: a visual language model for few-shot learning,” in NeurIPS, 2022. [2] J. Chen, H. Guo, K. Yi, B. Li, and M. Elhoseiny, “Visualgpt: Data-efficient adaptation of pretrained language models for image captioning,” in CVPR, 2022. [3] H. Liu, C. Li, Q. Wu, and Y. J. Lee, “Visual instruction tuning,” arXiv preprint arXiv:2304.08485, 2023. [4] J. Li, R. Selvaraju, A. Gotmare, S. Joty, C. Xiong, and S. C. H. Hoi, “Align before fuse: Vision and language representation learning with momentum distillation,” in NeurIPS, 2021. [5] J. Li, D. Li, S. Savarese, and S. Hoi, “Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models,” in ICML, 2023. [6] OpenAI, “Gpt-4 technical report,” 2023. [7] J. Li, D. Li, C. Xiong, and S. Hoi, “Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation,” in ICML, 2022. [8] W. Dai, J. Li, D. Li, A. M. H. Tiong, J. Zhao, W. Wang, B. Li, P. Fung, and S. Hoi, “Instructblip: Towards general-purpose vision-language models with instruction tuning,” in NeurIPS, 2023. [9] D. Zhu, J. Chen, X. Shen, X. Li, and M. Elhoseiny, “Minigpt-4: Enhancing vision-language understanding with advanced large language models,” 2023. [10] Z. Peng, W. Wang, L. Dong, Y. Hao, S. Huang, S. Ma, and F. Wei, “Kosmos-2: Grounding multimodal large language models to the world,” arXiv preprint arXiv:2306.14824, 2023. [11] K. Li, Y. Wang, Y. He, Y. Li, Y. Wang, Y. Liu, Z. Wang, J. Xu, G. Chen, P. Luo et al., “Mvbench: A comprehensive multi-modal video understanding benchmark,” in CVPR, 2024. [12] H. Zhang, X. Li, and L. Bing, “Video-llama: An instruction-tuned audio-visual language model for video understanding,” in EMNLP, 2023. [13] B. Lin, B. Zhu, Y. Ye, M. Ning, P. Jin, and L. Yuan, “Video-llava: Learning united visual representation by alignment before projection,” arXiv preprint arXiv:2311.10122, 2023. [14] K. Chen, Z. Zhang, W. Zeng, R. Zhang, F. Zhu, and R. Zhao, “Shikra: Unleashing multimodal llm’s referential dialogue magic,” arXiv preprint arXiv:2306.15195, 2023. [15] J. Chen, D. Zhu, X. Shen, X. Li, Z. Liu, P. Zhang, R. Krishnamoorthi, V. Chandra, Y. Xiong, and M. Elhoseiny, “Minigpt-v2: large language model as a unified interface for vision-language multi-task learning,” arXiv preprint arXiv:2310.09478, 2023. [16] M. Maaz, H. Rasheed, S. Khan, and F. S. Khan, “Video-chatgpt: Towards detailed video understanding via large vision and language models,” arXiv preprint arXiv:2306.05424, 2023. [17] G. Bai, Z. Chai, C. Ling, S. Wang, J. Lu, N. Zhang, T. Shi, Z. Yu, M. Zhu, Y. Zhang et al., “Beyond efficiency: A systematic survey of resource-efficient large language models,” arXiv preprint arXiv:2401.00625, 2024. [18] D. Patterson, J. Gonzalez, Q. Le, C. Liang, L.-M. Munguia, D. Rothchild, D. So, M. Texier, and J. Dean, “Carbon emissions and large neural network training,” 2021. [19] I. Shumailov, Y. Zhao, D. Bates, N. Papernot, R. Mullins, and R. Anderson, “Sponge examples: Energy-latency attacks on neural networks,” in IEEE EuroS&P, 2021. [20] S. Chen, Z. Song, M. Haque, C. Liu, and W. Yang, “Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models,” in CVPR, 2022. [21] H. Touvron, T. Lavril, G. Izacard, X. Martinet, M.-A. Lachaux, T. Lacroix, B. Rozière, N. Goyal, E. Hambro, F. Azhar et al., “Llama: Open and efficient foundation language models,” arXiv preprint arXiv:2302.13971, 2023. [22] A. Chowdhery, S. Narang, J. Devlin, M. Bosma, G. Mishra, A. Roberts, P. Barham, H. W. Chung, C. Sutton, S. Gehrmann et al., “Palm: Scaling language modeling with pathways,” arXiv preprint arXiv:2204.02311, 2022. [23] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and harnessing adversarial examples,” in ICLR, 2015. [24] K. Gao, Y. Bai, J. Gu, S.-T. Xia, P. Torr, Z. Li, and W. Liu, “Inducing high energy-latency of large vision-language models with verbose images,” in ICLR, 2024. [25] C. Silberer, V. Ferrari, and M. Lapata, “Visually grounded meaning representations,” IEEE transactions on pattern analysis and machine intelligence, vol. 39, no. 11, p. 2284–2297, 2016. [26] L. Peng, Y. Yang, Z. Wang, Z. Huang, and H. T. Shen, “Mra-net: Improving vqa via multi-modal relation attention network,” IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 44, no. 1, p. 318–329, 2020. [27] Z. Zhang, K. Chen, R. Wang, M. Utiyama, E. Sumita, Z. Li, and H. Zhao, “Universal multimodal representation for language understanding,” IEEE Transactions on Pattern Analysis and Machine Intelligence, 2023. [28] Y. Zhao, T. Pang, C. Du, X. Yang, C. Li, N.-M. Cheung, and M. Lin, “On evaluating adversarial robustness of large vision-language models,” arXiv preprint arXiv:2305.16934, 2023. [29] Y. Dong, H. Chen, J. Chen, Z. Fang, X. Yang, Y. Zhang, Y. Tian, H. Su, and J. Zhu, “How robust is google’s bard to adversarial image attacks?” in NeurIPS Workshop, 2023. [30] N. Carlini, M. Nasr, C. A. Choquette-Choo, M. Jagielski, I. Gao, A. Awadalla, P. W. Koh, D. Ippolito, K. Lee, F. Tramer et al., “Are aligned neural networks adversarially aligned?” arXiv preprint arXiv:2306.15447, 2023. [31] K. Gao, Y. Bai, J. Bai, Y. Yang, and S.-T. Xia, “Adversarial robustness for visual grounding of multimodal large language models,” in ICLR Workshop, 2024. [32] J. Bai, K. Gao, S. Min, S.-T. Xia, Z. Li, and W. Liu, “Badclip: Trigger-aware prompt learning for backdoor attacks on clip,” in CVPR, 2024. [33] H. Luo, J. Gu, F. Liu, and P. Torr, “An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models,” in ICLR, 2024. [34] H. Wang, K. Dong, Z. Zhu, H. Qin, A. Liu, X. Fang, J. Wang, and X. Liu, “Transferable multimodal attack on vision-language pre-training models,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2024, p. 102–102. [35] X. Qi, K. Huang, A. Panda, M. Wang, and P. Mittal, “Visual adversarial examples jailbreak large language models,” in AAAI, 2024. [36] Y. Wu, X. Li, Y. Liu, P. Zhou, and L. Sun, “Jailbreaking gpt-4v via self-adversarial attacks with system prompts,” arXiv preprint arXiv:2311.09127, 2023. [37] Y. Li, H. Guo, K. Zhou, W. X. Zhao, and J.-R. Wen, “Images are achilles’ heel of alignment: Exploiting visual vulnerabilities for jailbreaking multimodal large language models,” arXiv preprint arXiv:2403.09792, 2024. [38] S. Chen, C. Liu, M. Haque, Z. Song, and W. Yang, “Nmtsloth: understanding and testing efficiency degradation of neural machine translation systems,” in Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, 2022, p. 1148–1160. [39] S. Hong, Y. Kaya, I.-V. Modoranu, and T. Dumitraş, “A panda? no, it’s a sloth: Slowdown attacks on adaptive multi-exit neural network inference,” in ICLR, 2021. [40] S. Chen, H. Chen, M. Haque, C. Liu, and W. Yang, “The dark side of dynamic routing neural networks: Towards efficiency backdoor injection,” in CVPR, 2023. [41] H. Liu, Y. Wu, Z. Yu, Y. Vorobeychik, and N. Zhang, “Slowlidar: Increasing the latency of lidar-based detection using adversarial examples,” in CVPR, 2023. [42] K. Pelechrinis, M. Iliofotou, and S. V. Krishnamurthy, “Denial of service attacks in wireless networks: The case of jammers,” IEEE Communications surveys & tutorials, vol. 13, no. 2, p. 245–257, 2010. [43] Y. Liu, M. Ott, N. Goyal, J. Du, M. Joshi, D. Chen, O. Levy, M. Lewis, L. Zettlemoyer, and V. Stoyanov, “Roberta: A robustly optimized bert pretraining approach,” arXiv preprint arXiv:1907.11692, 2019. [44] P. Anderson, X. He, C. Buehler, D. Teney, M. Johnson, S. Gould, and L. Zhang, “Bottom-up and top-down attention for image captioning and visual question answering,” in CVPR, 2018. [45] A. Holtzman, J. Buys, L. Du, M. Forbes, and Y. Choi, “The curious case of neural text degeneration,” in ICLR, 2020. [46] E. Bagdasaryan, T.-Y. Hsieh, B. Nassi, and V. Shmatikov, “(ab) using images and sounds for indirect instruction injection in multi-modal llms,” arXiv preprint arXiv:2307.10490, 2023. [47] Y. Bengio, R. Ducharme, and P. Vincent, “A neural probabilistic language model,” in NeurIPS, 2000. [48] C. E. Shannon, “A mathematical theory of communication,” The Bell system technical journal, vol. 27, no. 3, p. 379–423, 1948. [49] S. Kullback and R. A. Leibler, “On information and sufficiency,” The annals of mathematical statistics, vol. 22, no. 1, p. 79–86, 1951. [50] M. Fazel, “Matrix rank minimization with applications,” Ph.D. dissertation, Stanford University, 2002. [51] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” in ICLR, 2018. [52] S. Zhang, S. Roller, N. Goyal, M. Artetxe, M. Chen, S. Chen, C. Dewan, M. Diab, X. Li, X. V. Lin et al., “Opt: Open pre-trained transformer language models,” 2022. [53] W.-L. Chiang, Z. Li, Z. Lin, Y. Sheng, Z. Wu, H. Zhang, L. Zheng, S. Zhuang, Y. Zhuang, J. E. Gonzalez et al., “Vicuna: An open-source chatbot impressing gpt-4 with 90% chatgpt quality,” 2022. [54] T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in ECCV, 2014. [55] J. Deng, W. Dong, R. Socher, L.-J. Li, K. Li, and L. Fei-Fei, “Imagenet: A large-scale hierarchical image database,” in CVPR, 2009. [56] H. Touvron, L. Martin, K. Stone, P. Albert, A. Almahairi, Y. Babaei, N. Bashlykov, S. Batra, P. Bhargava, S. Bhosale et al., “Llama 2: Open foundation and fine-tuned chat models,” arXiv preprint arXiv:2307.09288, 2023. [57] D. Chen and W. B. Dolan, “Collecting highly parallel data for paraphrase evaluation,” in ACL, 2011. [58] Y. Jang, Y. Song, Y. Yu, Y. Kim, and G. Kim, “Tgif-qa: Toward spatio-temporal reasoning in visual question answering,” in CVPR, 2017. [59] N. Carlini, A. Athalye, N. Papernot, W. Brendel, J. Rauber, D. Tsipras, I. Goodfellow, A. Madry, and A. Kurakin, “On evaluating adversarial robustness,” arXiv preprint arXiv:1902.06705, 2019. [60] R. R. Selvaraju, M. Cogswell, A. Das, R. Vedantam, D. Parikh, and D. Batra, “Grad-cam: Visual explanations from deep networks via gradient-based localization,” in ICCV, 2017. [61] A. Rohrbach, L. A. Hendricks, K. Burns, T. Darrell, and K. Saenko, “Object hallucination in image captioning,” in EMNLP, 2018. [62] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, “The unreasonable effectiveness of deep features as a perceptual metric,” in CVPR, 2018. [63] A. Ilyas, L. Engstrom, A. Athalye, and J. Lin, “Black-box adversarial attacks with limited queries and information,” in ICML, 2018. [64] Y. Bai, Y. Zeng, Y. Jiang, Y. Wang, S.-T. Xia, and W. Guo, “Improving query efficiency of black-box adversarial attack,” in ECCV, 2020. [65] Y. Dong, F. Liao, T. Pang, H. Su, J. Zhu, X. Hu, and J. Li, “Boosting adversarial attacks with momentum,” in CVPR, 2018. [66] Y. Goyal, T. Khot, D. Summers-Stay, D. Batra, and D. Parikh, “Making the v in vqa matter: Elevating the role of image understanding in visual question answering,” in CVPR, 2017.

Instant research discovery