This work examines the vulnerability of multimodal (image + text) models to adversarial threats similar to those discussed in previous literature on unimodal (image- or text-only) models. We introduce realistic assumptions of partial model knowledge and access, and discuss how these assumptions differ from the standard "black-box"/"white-box" dichotomy common in current literature on adversarial attacks. Working under various levels of these "gray-box" assumptions, we develop new attack methodologies unique to multimodal classification and evaluate them on the Hateful Memes Challenge classification task. We find that attacking multiple modalities yields stronger attacks than unimodal attacks alone (inducing errors in up to 73% of cases), and that the unimodal image attacks on multimodal classifiers we explored were stronger than character-based text augmentation attacks (inducing errors on average in 45% and 30% of cases, respectively).
Adversarial samples are perturbed inputs crafted to mislead the machine learning systems. A training mechanism, called adversarial training, which presents adversarial samples along with clean samples has been introduced to learn robust models. In order to scale adversarial training for large datasets, these perturbations can only be crafted using fast and simple methods (e.g., gradient ascent). However, it is shown that adversarial training converges to a degenerate minimum, where the model appears to be robust by generating weaker adversaries. As a result, the models are vulnerable to simple…
A Gray-box Attack against Latent Diffusion Model-based Image Editing by Posterior Collapse
School of Computer Science, University of St Andrews（圣安德鲁大学计算机科学学院）；Department of Data Science, City University of Hong Kong（香港城市大学数据科学系）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；School of Computer Science, University of Nottingham（诺丁汉大学计算机科学学院）；Department of Data Science and Artificial Intelligence, Monash University（墨尔本大学数据科学与人工智能系）；College of Information Science & Electronic Engineering, Zhejiang University（浙江大学信息科学与电子工程学院）
German Research Center for Artificial Intelligence (DFKI)（德国人工智能研究中心（DFKI））；TU Kaiserslautern（凯泽斯劳滕工业大学）
Adversarial attack methods have demonstrated the fragility of deep neural networks. Their imperceptible perturbations are frequently able fool classifiers into potentially dangerous misclassifications. We propose a novel way to interpret adversarial perturbations in terms of the effective input signal that classifiers actually use. Based on this, we apply specially trained autoencoders, referred to as S2SNets, as defense mechanism. They follow a two-stage training scheme: first unsupervised, followed by a fine-tuning of the decoder, using gradients from an existing classifier. S2SNets induce a…
When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Models
TGAI Lab, School of Engineering, Westlake University（西拉库大学工程学院TGAI实验室）；Pennsylvania State University（宾夕法尼亚州立大学）；Sony Research, Sony（索尼研究实验室，索尼）；Xidian University（西安电子科技大学）
Intel Corporation（英特尔公司）；Georgia Institute of Technology（佐治亚理工学院）
In this appraisal paper, we evaluate the efficacy of SHIELD, a compression-based defense framework for countering adversarial attacks on image classification models, which was published at KDD 2018. Here, we consider alternative threat models not studied in the original work, where we assume that an adaptive adversary is aware of the ensemble defense approach, the defensive pre-processing, and the architecture and weights of the models used in the ensemble. We define scenarios with varying levels of threat and empirically analyze the proposed defense by varying the degree of information availa…
University of Technology Sydney（悉尼科技大学）；Shenzhen Institutes of Advanced Technology, CAS（中国科学院深圳先进技术研究院）；The University of Sydney（悉尼大学）；Tencent AI Lab（腾讯人工智能实验室）；JD AI Research（京东人工智能研究院）；The Chinese University of Hong Kong（香港中文大学）
Recent studies have highlighted that deep neural networks (DNNs) are vulnerable to adversarial attacks, even in a black-box scenario. However, most of the existing black-box attack algorithms need to make a huge amount of queries to perform attacks, which is not practical in the real world. We note one of the main reasons for the massive queries is that the adversarial example is required to be visually similar to the original image, but in many cases, how adversarial examples look like does not matter much. It inspires us to introduce a new attack called \emph{input-free} attack, under which …
School of Information Technology, Monash University Malaysia（蒙纳士大学马来西亚校区信息技术学院）；Data61, CSIRO（澳大利亚联邦科学与工业研究组织 Data61）；Faculty of Computer Science and Technology, Wenzhou University（温州大学计算机科学与技术学院）；Monash Suzhou Research Institute（蒙纳士苏州研究院）；Department of Data Science and AI, Monash University（蒙纳士大学数据科学与人工智能系）；The University of Sassari（萨萨里大学）
The majority of adversarial attack techniques perform well against deep face recognition when the full knowledge of the system is revealed (\emph{white-box}). However, such techniques act unsuccessfully in the gray-box setting where the face templates are unknown to the attackers. In this work, we propose a similarity-based gray-box adversarial attack (SGADV) technique with a newly developed objective function. SGADV utilizes the dissimilarity score to produce the optimized adversarial example, i.e., similarity-based adversarial attack. This technique applies to both white-box and gray-box att…
The Pennsylvania State University（宾夕法尼亚州立大学）；Shanghai Jiao Tong University（上海交通大学）；Amplitude（Amplitude公司）
Deep neural networks (DNNs) have been broadly adopted in health risk prediction to provide healthcare diagnoses and treatments. To evaluate their robustness, existing research conducts adversarial attacks in the white/gray-box setting where model parameters are accessible. However, a more realistic black-box adversarial attack is ignored even though most real-world models are trained with private data and released as black-box services on the cloud. To fill this gap, we propose the first black-box adversarial attack method against health risk prediction models named MedAttacker to investigate …
Black-box Attacks on Image Activity Prediction and its Natural Language Explanations
Idiap Research Institute（伊迪亚普研究所）；University of Perugia（佩鲁贾大学）；École Polytechnique Fédérale de Lausanne（洛桑联邦理工学院）；Queen Mary University of London（伦敦玛丽女王大学）
BoxTuning: Directly Injecting the Object Box for Multimodal Model Fine-Tuning
School of Computer Science and Technology, Tianjin University（天津大学计算机科学与技术学院）；Faculty of Computer Science and Artificial Intelligence, Shenzhen University of Advanced Technology（深圳理工大学计算机科学与人工智能学院）
Adversarial machine learning is an emerging area showing the vulnerability of deep learning models. Exploring attack methods to challenge state of the art artificial intelligence (A.I.) models is an area of critical concern. The reliability and robustness of such A.I. models are one of the major concerns with an increasing number of effective adversarial attack methods. Classification tasks are a major vulnerable area for adversarial attacks. The majority of attack strategies are developed for colored or gray-scaled images. Consequently, adversarial attacks on binary image recognition systems …
Manually annotating 3D point clouds is laborious and costly, limiting the training data preparation for deep learning in real-world object detection. While a few previous studies tried to automatically generate 3D bounding boxes from weak labels such as 2D boxes, the quality is sub-optimal compared to human annotators. This work proposes a novel autolabeler, called multimodal attention point generator (MAP-Gen), that generates high-quality 3D labels from weak 2D boxes. It leverages dense image information to tackle the sparsity issue of 3D point clouds, thus improving label quality. For each 2…
Near-infrared imaging has been considered as a solution to provide high quality photographs in dim lighting conditions. This imaging system captures two types of multimodal images: one is near-infrared gray image (NGI) and the other is the visible color image (VCI). NGI is noise-free but it is grayscale, whereas the VCI has colors but it contains noise. Moreover, there exist serious edge and brightness discrepancies between NGI and VCI. To deal with this problem, a new transfer-based fusion method is proposed for noise removal. Different from conventional fusion approaches, the proposed method…
Multimodal supervision has achieved promising results in many visual language understanding tasks, where the language plays an essential role as a hint or context for recognizing and locating instances. However, due to the defects of the human-annotated language corpus, multimodal supervision remains unexplored in fully supervised object detection scenarios. In this paper, we take advantage of language prompt to introduce effective and unbiased linguistic supervision into object detection, and propose a new mechanism called multimodal knowledge learning (\textbf{MKL}), which is required to lea…
Security-sensitive applications that rely on Deep Neural Networks (DNNs) are vulnerable to small perturbations that are crafted to generate Adversarial Examples(AEs). The AEs are imperceptible to humans and cause DNN to misclassify them. Many defense and detection techniques have been proposed. Model's confidences and Dropout, as a popular way to estimate the model's uncertainty, have been used for AE detection but they showed limited success against black- and gray-box attacks. Moreover, the state-of-the-art detection techniques have been designed for specific attacks or broken by others, nee…
Beyond SFT-to-RL: Pre-alignment via Black-Box On-Policy Distillation for Multimodal RL
Hong Kong University of Science and Technology (Guangzhou)（香港理工大学（广州））；Tsinghua University（清华大学）；Nanyang Technological University（南洋理工大学）；Renmin University of China（中国人民大学）；University of Science and Technology of China（中国科学技术大学）；University of Chinese Academy of Sciences（中国科学院大学）
IoU-PD: IoU-Aware Privileged Distillation for Visual Grounding with Multimodal Large Language Models
University of Chinese Academy of Sciences（中国科学院大学）；State Key Laboratory of Communication Content Cognition（通信内容认知技术国家重点实验室）；Peng Cheng Laboratory（鹏城实验室）
To See is Not to Learn: Protecting Multimodal Data from Unauthorized Fine-Tuning of Large Vision-Language Model
School of Computing；Augmented Intelligence, Arizona State University, Tempe, AZ, USA；Department of Computer Science；Engineering, Texas A\&M University, College Station, TX, USA
$\left|\,\circlearrowright\,\boxed{\text{BUS}}\,\right|$: A Large and Diverse Multimodal Benchmark for evaluating the ability of Vision-Language Models to understand Rebus Puzzles
Tredence Inc.（特伦德公司）；Indian Institute of Technology Kharagpur（印度理工学院克拉格浦尔分校）；Inria Paris-Rocquencourt（巴黎-罗克琴库特研究所）；Rajiv Gandhi University（拉吉夫·甘地大学）；Tsinghua University（清华大学）；Palmer Research Laboratories（帕勒姆研究实验室）
University at Albany, State University of New York（纽约州立大学奥尔巴尼分校）；Tencent AI Lab（腾讯人工智能实验室）
Recent years have seen fast development in synthesizing realistic human faces using AI technologies. Such fake faces can be weaponized to cause negative personal and social impact. In this work, we develop technologies to defend individuals from becoming victims of recent AI synthesized fake videos by sabotaging would-be training data. This is achieved by disrupting deep neural network (DNN) based face detection method with specially designed imperceptible adversarial perturbations to reduce the quality of the detected faces. We describe attacking schemes under white-box, gray-box and black-bo…
SAGA: Semantic-Aware Gray color Augmentation for Visible-to-Thermal Domain Adaptation across Multi-View Drone and Ground-Based Vision Systems
Department of Aerospace Engineering, Indian Institute of Science（航空航天工程系，印度科学研究院）；Robert Bosch Centre for Cyber Physical Systems, Indian Institute of Science（网络物理系统研究中心，印度科学研究院）
Advancing Grounded Multimodal Named Entity Recognition via LLM-Based Reformulation and Box-Based Segmentation
College of Intelligence and Computing, Tianjin University（智能与计算学院，天津大学）；NJUST（南京理工大学）；College of Mathematics, Taiyuan University of Technology（数学学院，太原科技大学）；Tianjin University of Science and Technology（天津科技大学）
Shanghai AI Laboratory（上海人工智能实验室）；Tencent AI Lab（腾讯人工智能实验室）；CUHK（香港中文大学）；SenseTime Research（商汤科技研究院）
Multimodal ambiguity and color bleeding remain challenging in colorization. To tackle these problems, we propose a new GAN-based colorization approach PalGAN, integrated with palette estimation and chromatic attention. To circumvent the multimodality issue, we present a new colorization formulation that estimates a probabilistic palette from the input gray image first, then conducts color assignment conditioned on the palette through a generative model. Further, we handle color bleeding with chromatic attention. It studies color affinities by considering both semantic and intensity correlation…
MMLSv2: A Multimodal Dataset for Martian Landslide Detection in Remote Sensing Imagery
Fairfield University（费尔菲尔德大学）；Michigan Technological University（密歇根技术大学）；Computer Vision Center（计算机视觉中心）；Universitat Autònoma de Barcelona（巴塞罗那自治大学）；ESPOL Polytechnic University（ESPOL多科大学）；University of Kerala（喀拉拉大学）；University of Mississippi（密西西比大学）
University of Washington（华盛顿大学）；Allen Institute for Artificial Intelligence（艾伦人工智能研究所）
As humans, we understand events in the visual world contextually, performing multimodal reasoning across time to make inferences about the past, present, and future. We introduce MERLOT, a model that learns multimodal script knowledge by watching millions of YouTube videos with transcribed speech -- in an entirely label-free, self-supervised manner. By pretraining with a mix of both frame-level (spatial) and video-level (temporal) objectives, our model not only learns to match images to temporally corresponding words, but also to contextualize what is happening globally over time. As a result,…
