Replace-then-Perturb：面向视觉-语言模型的具备视觉推理能力的定向对抗攻击
Replace-then-Perturb: Targeted Adversarial Attacks With Visual Reasoning for Vision-Language Models
AI总结：
针对现有视觉-语言模型定向对抗攻击缺乏视觉推理、未考虑图像整体完整性的问题，提出Replace-then-Perturb攻击流程和Contrastive-Adv对比对抗损失，生成具备视觉推理能力的定向对抗样本，性能优于基线方法。
摘要：
传统的定向对抗攻击会向图像添加微小扰动，使神经网络模型将该图像判定为预定义的目标类别，即便该类别并非正确的目标类别。近年来，针对视觉-语言模型（VLM）的定向对抗攻击重点在于生成能让VLM输出预期目标文本的扰动。例如，这类攻击旨在对图像施加微小扰动，使VLM的回答从“有一个苹果”变为“有一个棒球”。然而，对于类似“如果有一个棒球，告诉我它下方是什么”这类需要推理的复杂问题，仅让模型输出预期文本是不够的。这是因为此类对抗攻击的目标未考虑原始图像的整体完整性，从而导致视觉推理能力的缺失。在本研究中，我们聚焦于生成针对VLM的、具备视觉推理能力的定向对抗样本。为此，我们提出了两项内容：1）一种新型对抗攻击流程——名为Replace-then-Perturb；2）一种基于对比学习的对抗损失——名为Contrastive-Adv。在Replace-then-Perturb流程中，我们首先利用文本引导的分割模型定位图像中的目标物体，随后移除该目标物体，并用预期提示词对空缺区域进行图像修复。通过这种方式，我们可以生成与预期提示词对应的目标图像，同时保持原始图像的整体完整性。此外，在Contrastive-Adv中，我们设计了一种新型损失函数以生成更优的对抗样本。我们的大量基准测试结果表明，Replace-then-Perturb和Contrastive-Adv的性能优于基线对抗攻击算法。我们注意到，用于复现实验结果的源代码将会公开。
英文摘要：
The conventional targeted adversarial attacks add a small perturbation to an image to make neural network models estimate the image as a predefined target class, even if it is not the correct target class. Recently, for visual-language models (VLMs), the focus of targeted adversarial attacks is to generate a perturbation that makes VLMs answer intended target text outputs. For example, they aim to make a small perturbation on an image to make VLMs' answers change from "there is an apple" to "there is a baseball." However, answering just intended text outputs is insufficient for tricky questions like "if there is a baseball, tell me what is below it." This is because the target of the adversarial attacks does not consider the overall integrity of the original image, thereby leading to a lack of visual reasoning. In this work, we focus on generating targeted adversarial examples with visual reasoning against VLMs. To this end, we propose 1) a novel adversarial attack procedure -- namely, Replace-then-Perturb and 2) a contrastive learning-based adversarial loss -- namely, Contrastive-Adv. In Replace-then-Perturb, we first leverage a text-guided segmentation model to find the target object in the image. Then, we get rid of the target object and inpaint the empty space with the desired prompt. By doing this, we can generate a target image corresponding to the desired prompt, while maintaining the overall integrity of the original image. Furthermore, in Contrastive-Adv, we design a novel loss function to obtain better adversarial examples. Our extensive benchmark results demonstrate that Replace-then-Perturb and Contrastive-Adv outperform the baseline adversarial attack algorithms. We note that the source code to reproduce the results will be available.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
