{"id":"bb8326c5-bc3b-484e-9212-6f999c9a51c1","arxiv_id":"2505.22943","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"LLM-generated adversarial captions, selected and self-trained with diversity-promoting filtering, deceive CLIP-style multimodal representations at high rates across image, video, and audio.","lead":"This paper introduces MAC, a benchmark that uses LLMs to generate deceptive captions that fool multimodal models like CLIP and LanguageBind into ranking the wrong description above the correct one. The authors also show that fine-tuning a small LLM on successful attacks substantially increases both attack success rate and diversity across image, video, and audio.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The unimodal gate (Eq. 2) treats neutral as non-entailing, so Total ASR may count CLIP preferring an alternate true caption rather than a deceptive one.","rationale":"The reader's weakest assumption concerned NLI model reliability and threshold calibration. My concern is more fundamental: even a perfectly calibrated entailment threshold is insufficient because Eq. 2 operationalizes deception as non-entailment, which includes neutral pairs. The paper's own text says the goal is to 'misalign or contradict' the original content (Sec. 1) and the prompt instructs 'Introduce a contradiction' (Table 4), but the automated criterion in Eq. 2 never verifies contradiction. This means a successful attack as defined by Eq. 4 may be a caption that is merely an alternative, still-true description. That would not demonstrate a compositional vulnerability; it would demonstrate that CLIP scores some true captions higher than the ground-truth caption, which is a much weaker claim. The human evaluation in Sec. 5.3 used a contradiction question and reported F1 > 0.9, but it covered only 50 MSRVTT samples, so it cannot establish that the COCO and AudioCaps 'successes' are genuinely contradictory or false. My concrete test would settle this by measuring the fraction of successful samples that human annotators judge to be contradictory and false of the input, and by recomputing Total ASR under that stricter definition. If the corrected ASR remains high, the central claim stands; if it drops substantially, the benchmark is measuring a different phenomenon than deception. Since this is a semantic-validity concern rather than a reproducibility flaw, it reinforces the need for conditional acceptance with a stronger human validation requirement, so the reader's verdict remains appropriate.","tokens_in":27029,"tokens_out":7274,"duration_ms":82531,"concrete_test":"Sample 100 successful attacks per dataset (COCO/CLIP, MSRVTT/LanguageBind, AudioCaps/LanguageBind) produced by the full method. Have at least three fluent annotators per item label the generated caption relative to the original caption as contradiction, neutral, or entailment, and also label whether it is false of the image/video/audio. Recompute Total ASR counting only items labeled contradiction AND false of the input media. If this corrected ASR falls materially below the reported 42.10/45.60/52.87, the headline deception rate is overstated.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that LLM-generated captions reliably deceive pre-trained multimodal representations, measured by Total ASR in Eq. 4. That measure hinges on the unimodal criterion s^u_i in Eq. 2, which only requires all three NLI models to output entailment score < τ=0.5. In standard NLI, neutral pairs also fall below this threshold; the criterion does not distinguish neutral from contradiction. The generation prompt (Table 4) asks the LLM to 'Introduce a contradiction', and the human evaluation in Sec. 5.3 instructs annotators to label contradiction, but the automatic filter never checks for contradiction. Thus a generated caption can be non-entailing yet compatible with the image (e.g., 'reaching for the laptop keys' changed to 'looking at the laptop' could both be true of the same image). When CLIP prefers such a caption, it is not necessarily being deceived—it may simply prefer another correct description. Since self-training optimizes against this same weak gate, the reported gains in Total ASR (e.g., 42.10% on COCO, 52.87% on AudioCaps) could be inflated by neutral-but-compatible samples. The existing 1K GPT-4 and 50-sample human checks validate correlation with entailment judgments, not the stronger property that successful samples are actually false of the input.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper introduces MAC (Multimodal Adversarial Compositionality), a benchmark for evaluating whether LLM-generated text edits can make a pre-trained multimodal representation (CLIP, LanguageBind, etc.) prefer a modified caption over the original grounded caption. For each multimodal pair, a generator (default Llama-3.1-8B) produces up to N candidate captions; a filter keeps candidates that satisfy four criteria: higher crossmodal similarity than the original, non-entailment under an NLI ensemble, limited edit distance, and compliance with auxiliary instruction constraints. The paper further proposes diversity-promoting self-training via rejection-sampling fine-tuning with a Gibbs-style selection procedure that iteratively chooses successful samples to maximize entropy of word-level edit tokens. Experiments on COCO, MSRVTT, and AudioCaps report attack success rates and diversity for zero-shot, self-trained, and large-N-distilled variants, plus transfer results to SigLIP, NegCLIP, BLIP, and LLaVA, additional datasets, and long captions. The central empirical claim is that the full method raises Total ASR from 19.19% to 42.10% on COCO/CLIP and from 29.02% to 52.87% on AudioCaps/LanguageBind, outperforming prior compositionality baselines.","tokens_in":27280,"tokens_out":6249,"duration_ms":67620,"significance":"The paper addresses a timely and useful problem: systematically probing compositional weaknesses of frozen multimodal encoders using fluent, LLM-generated text perturbations rather than rule-based swaps. Its modality-agnostic framing (image, video, audio), the unified evaluation protocol, the cross-model transfer analysis, and the use of a small open LLM with self-training are genuine strengths. If the reported attack rates are valid, the benchmark and the distilled self-training recipe would be a practical contribution for auditing multimodal representations before deployment. The authors also provide a project page, transparent appendices, and a human evaluation, which is commendable. However, the validity of the headline ASR hinges on the unimodal gate in Eq. (2), and as discussed below that gate treats neutral non-entailment as success, which can inflate the 'deception' numbers. With that concern resolved, the paper would be a solid empirical benchmark contribution.","major_comments":[{"comment":"The unimodal criterion s^u_i = Π_j I(l_j(t_i, ~t_i) < τ) with τ = 0.5 counts any caption whose NLI entailment score is below threshold as a successful deception. Standard NLI models assign low entailment probabilities to both neutral and contradictory pairs, so a generated caption that is merely neutral with respect to the original—and possibly still true of the input—passes the gate. For example, changing 'reaching for the laptop keys' to 'looking at the laptop' is non-entailing but can be compatible with the same image; if the target model prefers it, that is not evidence of compositional deception. The generation prompt (Table 4) asks the LLM to 'Introduce a contradiction', and the human evaluation in §5.3 (Fig. 3c) labels contradiction, but the automatic filter never checks for contradiction. Consequently, the reported Total ASR values in Table 2 (e.g., 42.10% on COCO, 52.87% on AudioCaps) may overcount cases where the model merely prefers another correct description. The 1K GPT-4 concordance and the 50-sample human check validate correlation with entailment judgments, not the stronger property that successful samples are actually false of the input. I recommend either requiring a contradiction-specific NLI label, adding a three-way threshold that excludes neutral, or re-validating on a stratified sample of captions that pass all four criteria with human labels of truthfulness relative to the input.","section":"Appendix A.4"},{"comment":"The appendix states 'All reported results are based on a single run per experiment.' Many of the decisive comparisons in Table 2 and Fig. 4 rest on small absolute differences—e.g., COCO Total ASR 42.03 vs. 42.10 for large-N distilled with and without diversity promotion, and AudioCaps Cross ASR 58.38 vs. 60.25. Without multiple seeds, confidence intervals, or significance tests, the reader cannot determine whether the 'without sacrificing ASR (+2%)' claim and the ordering of the final variants are stable or due to sampling noise. The paper should report at least means and standard deviations over several seeds for the main rows of Table 2, and ideally for Fig. 4.","section":"Algorithm 1"},{"comment":"The diversity-promoting self-training procedure has a free parameter K, the number of Gibbs-style iterations, but the paper never specifies its value in the experimental setup or in the results. Since this algorithm is a central contribution and the main diversity gains are attributed to it, the missing K value makes the experiments irreproducible. The initialization is also described as 'random' with no seed information. Please report the chosen K and any sensitivity analysis, or drop K and use a fixed number of passes with a stated value.","section":"§5.1"},{"comment":"For SeeTrue, VFC, and CompA—methods originally built on proprietary LLMs (PaLM, GPT-4)—the authors substitute Llama-3.1-8B and modify the prompts to fit that model. This is disclosed, but it means Table 2 does not compare against the published methods as they actually perform; it compares against re-implementations under the authors' generator model. The paper's 'outperforms prior work' claim is therefore confounded with the choice of generator. I recommend reporting the original published numbers alongside the re-implemented ones, or clearly restating the comparison as 'under a common Llama-3.1-8B generator' in the main text and headline claims.","section":"§3.3 and §4.4"},{"comment":"The diversity metric H (entropy over OP_POS_LEMMA tokens) is both the evaluation metric and the objective optimized in Algorithm 1's coordinate-ascent selection. It is therefore expected that diversity-promoting self-training improves H relative to naive self-training; the comparison measures the method's ability to optimize its own selection criterion more than an independent property of the generator. This is not a fatal flaw, but the paper should acknowledge that the diversity evaluation is not fully independent of the training objective, and should report an external diversity measure (e.g., distinct n-grams not used in training, or human-rated diversity) to support the claim that the samples are genuinely more diverse.","section":null}],"minor_comments":[{"comment":"The notation l_j is introduced without specifying that it denotes the entailment probability output of each NLI model; please define it explicitly and state that τ is applied to the entailment class probability, not to the contradiction or neutral probability.","section":"§5.3"},{"comment":"The human evaluation reports F1 > 0.9 and Fleiss' kappa but no confidence intervals, and it involves only 50 MSRVTT samples. Given that the unimodal gate is a load-bearing component, I encourage a larger and more stratified sample, ideally drawn from captions that pass the full filter, with per-dataset breakdowns.","section":"Algorithm 1"},{"comment":"Please state whether the random initialization of the selection set is seeded, and if so, with which seed; otherwise the diversity results may not be reproducible.","section":"§4.3"},{"comment":"The phrase 'for the first time' regarding self-training for multimodal compositionality is a strong novelty claim. Consider softening it or providing a more focused literature comparison, since 'first' claims are hard to verify and can distract from the technical contribution.","section":"Appendix B.2"},{"comment":"In Table 14, the parallel/sequential generation comparison reports time complexity but not wall-clock times; a concrete runtime comparison would make the practical argument more convincing.","section":"Table 2"},{"comment":"The dagger footnote on CompA's results says 'the results are computed for a subset to which the method can be applied.' Please specify the subset size and selection rule; as written, the reader cannot interpret the † numbers.","section":"Figure 2"},{"comment":"Figure 2 is dense and the arrows between the criteria and the filterer are easy to misread; labeling the crossmodal/unimodal/distance/auxiliary criteria with the corresponding equation numbers in the figure would improve readability.","section":"§5.1"},{"comment":"The statement that 'larger or proprietary models do not necessarily lead to more effective deception' is supported only by N=1 comparisons in Table 13; the interaction with N>1 and self-training is not explored, so the claim should be scoped accordingly.","section":null}],"recommendation":"major_revision","confidential_remarks":"The paper is well organized and the appendices are unusually transparent, but the central metric's neutrality loophole is the key correctness risk. The single-run experiments and the unspecified K in Algorithm 1 are fixable with additional experiments and reporting. I would be willing to look at a revised version that addresses the contradiction-vs-neutral issue and adds error bars; if the authors can show that the headline ASR values survive a contradiction-only gate, the paper would be a solid benchmark contribution for this journal."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"My read: this is a real contribution, and the central claim mostly survives scrutiny, with one important caveat about what the attack-success numbers actually measure.\n\nWhat is new: MAC unifies image, video, and audio under one adversarial text-update protocol, which no prior benchmark does. SeeTrue is image-only, VFC video-only, CompA audio-only. The sample-wise criteria (crossmodal, unimodal non-entailment, edit distance, auxiliary compliance) and the group-wise entropy-based diversity metric are precisely defined, and the fine-grained ablation in Appendix B.4 makes clear where each component contributes. The diversity-promoting self-training (rejection-sampling fine-tuning with the Gibbs-style selection in Algorithm 1) is new and it does what it claims: it beats naive self-training on both ASR and diversity, consistently across COCO, MSRVTT, AudioCaps, and the added datasets. Transfer results across CLIP, SigLIP, NegCLIP, BLIP, and LLaVA strengthen the benchmark's usefulness, and the finding that Llama-3.1-8B with Best-of-N outperforms GPT-4o at N=1 is a useful data point. The experiments are broad, the ablations isolate the method, and the paper is honest about scope in its Limitations section.\n\nThe soft spots, in proportion. The stress-test concern is legitimate and is the paper's most important caveat. The unimodal gate in Eq. 2 uses an entailment threshold of 0.5, so neutral pairs count as non-entailing; the generation prompt says 'introduce a contradiction,' but the automatic filter never verifies contradiction. Consequently, a successful attack can be a caption that is simply an alternate true description that CLIP ranks above the ground truth. That is a real preference instability, but 'deception' overstates it. The GPT-4 concordance (~93% on 1K samples) and the 50-sample human check (F1>0.9) validate correlation with contradiction judgments, not the stronger property that successful samples are actually false of the input. The paper itself flags reliance on the model-based unimodal assessment as a limitation, and this is exactly where it bites. It is fixable: use a three-way NLI that requires contradiction, or report a secondary ASR under a strict contradiction gate. I do not think it sinks the paper, because every baseline faces the same gate, so the comparative claims survive; but the headline numbers (42% COCO, 53% AudioCaps) should be read as rank-flip rate, not falsity rate.\n\nOther issues are moderate: single-run results with no error bars, only 50 human-validated samples, baselines originally run with GPT-4/PaLM re-executed with Llama-3.1-8B and modified prompts, unspecified Gibbs iteration count K, and no released code or data. The evaluation/filter circularity is standard attack methodology and I would not dock the paper for it.\n\nWho this is for: researchers in multimodal robustness, CLIP-style embedding evaluation, or LLM-based adversarial text generation. It deserves a serious referee; the contribution is real and the weaknesses are repairable rather than structural. Send it to review, and ask for multi-seed results, released code, a specified K, and a contradiction-gated ASR check on the headline numbers.","headline":"A genuinely cross-modal adversarial compositionality benchmark with a self-training recipe that works, but the 'deception' rate is inflated by an NLI gate that counts neutral as non-entailing, while the comparative claims hold up.","tokens_in":27839,"tokens_out":7450,"would_cite":true,"duration_ms":67774,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A small language model can be trained to rewrite captions so reliably that pre-trained multimodal encoders rank the false caption above the true one up to 52.87% of the time.","keywords":["multimodal adversarial compositionality","text updates","CLIP","LanguageBind","self-training","rejection sampling fine-tuning","attack success rate","caption diversity"],"falsifier":"Take a random sample of captions the framework labels successful attacks and ask independent human annotators to judge, for each pair of original and rewritten caption, whether the rewrite is truly non-entailing. The paper's own human check covers only 50 MSRVTT samples; a broader check over hundreds of samples across COCO, MSRVTT, and AudioCaps would settle whether the NLI-consensus criterion is inflating the attack success rate. If agreement drops well below the reported F1 above 0.9, the central claim would need to be scaled back.","tokens_in":26808,"feed_emoji":"🎭","tokens_out":7613,"duration_ms":74953,"temperature":0.7,"pith_summary":"This paper tries to prove that a relatively small instruction-tuned language model can reliably deceive pre-trained multimodal representations, models like CLIP and LanguageBind that map images, video, and audio into a shared embedding space. The deception takes the form of a minimally edited caption: the rewritten text must rank higher against the input modality than the original caption, while no longer meaning the same thing. To make this measurable, the authors build a benchmark called Multimodal Adversarial Compositionality (MAC) with four simultaneous success criteria, and then improve the generator with a self-training loop that keeps attacks diverse. In the paper's experiments the full method reaches a combined attack success rate of 52.87% on AudioCaps with LanguageBind and 42.10% on COCO with CLIP, roughly doubling the zero-shot baseline, and the deceptive captions transfer across CLIP, SigLIP, NegCLIP, and BLIP. A fair reader should care because it suggests structured composition, who does what to whom and what changed, is not reliably encoded by current contrastive embeddings, and that this failure can be found automatically with an 8-billion-parameter model.","feed_headline":"Deceptive captions fool CLIP and LanguageBind up to 53% of the time","feed_subtitle":"A self-trained 8-billion-parameter model rewrites captions that outrank the true text across image, video, and audio.","key_machinery":"The load-bearing object is the MAC attack filter, a conjunction of four criteria: crossmodal (the generated caption is closer to the input embedding than the true caption), unimodal (multiple natural-language-inference models with a threshold of 0.5 agree that the original does not entail the generated caption), distance (Levenshtein distance under half the dataset's average caption length), and auxiliary (instruction and shortcut constraints). On top of that sits the diversity-promoting self-training loop: rejection-sampling fine-tuning on captions that pass all four filters, followed by a Gibbs-style selection step that repeatedly swaps candidate samples to maximize entropy of operation-POS-lemma tokens such as I_NOUN_man. The small generator, Llama-3.1-8B with LoRA, is what carries the claim that strong attacks do not require a frontier model.","core_discovery":"The paper's central claim is that pre-trained multimodal representations harbor systematic compositional vulnerabilities that an LLM can exploit through text updates alone, and that these vulnerabilities are substantially easier to expose than prior benchmarks suggest. A deceptive caption is judged successful only if it satisfies four conditions at once: it has higher crossmodal similarity to the input than the original text; a consensus of NLI models says it is not entailed by the original; it stays within a Levenshtein-distance budget; and it follows the generation instructions without shortcuts. On top of this filtering, the authors introduce diversity-promoting self-training, which fine-tunes the generator on successful samples and then iteratively reselects training samples to maximize the entropy of word-operation tokens. The result is an improvement in both attack success rate and diversity relative to zero-shot prompt-based generation, and the gains hold across image, video, and audio targets. The authors take this as evidence that the failure lies in the compositionality of the representations themselves, not in one dataset, modality, or model family.","pith_inferences":["Beyond the paper's claims, the same attack recipe could be pointed at retrieval systems, reward models, and VLM pipelines built on these embeddings; if a rewritten caption outranks the true one, downstream ranking can be manipulated without touching the image or audio.","The fixed NLI threshold is the natural knob to test: recalibrating it per dataset or replacing the NLI consensus with a stronger entailment judge would reveal how much of the reported ASR depends on the threshold choice.","A testable extension is to run the same diversity-promoting loop with other diversity measures, such as syntactic templates or relation types; different measures may expose different families of composition errors.","If these results hold, they shift the burden of proof: a model that ranks a swapped subject-object caption as more similar than the ground truth is showing a failure to encode relational structure, not simply a failure to do visual reasoning."],"forward_implications":["In the paper's experiments, the full method raises Total ASR to 42.10% on COCO with CLIP and 52.87% on AudioCaps with LanguageBind, up from 19.19% and 29.02% for the zero-shot $N=4$ baseline.","Self-training with a budget of $N=4$ reaches the attack success rate that prompting alone needs $N=16$ to achieve, so the improvement comes from learning what deceives the encoder, not from brute-force sampling.","Deceptive captions transfer across target models: filtering with one of CLIP, SigLIP, NegCLIP, or BLIP and evaluating on another still yields Total ASR between 32.50% and 42.10%.","Diversity-promoting selection keeps the attack broad: after the full method, no single word-operation token dominates, whereas some baselines concentrate on a token like I_NOUN_weapon more than 25% of the time.","Because the protocol is text-only and modality-agnostic, the same benchmark applies to image, video, and audio pairs, and the long-caption experiments show the effect is not limited to short captions."],"supporting_citations":[{"why":"Supplies CLIP, the primary image-text target representation whose embedding similarities define the crossmodal criterion.","marker":"Radford et al. (2021)"},{"why":"Supplies LanguageBind, the target multimodal representation for the video and audio experiments.","marker":"Zhu et al. (2024)"},{"why":"Supplies Llama-3.1-8B, the generator and the model fine-tuned by diversity-promoting self-training.","marker":"Dubey et al. (2024)"},{"why":"One of the three NLI models whose consensus defines the unimodal non-entailment criterion.","marker":"Liu et al. (2019)"},{"why":"Second NLI model in the unimodal consensus used in Eq. (2).","marker":"Lewis et al. (2020)"},{"why":"Third NLI model in the unimodal consensus used in Eq. (2).","marker":"He et al. (2021)"},{"why":"Source of rejection-sampling fine-tuning that the self-training loop is based on.","marker":"Touvron et al. (2023)"},{"why":"Supplies the COCO image-caption dataset used for the image benchmark and training captions.","marker":"Lin et al. (2014)"},{"why":"Supplies the MSRVTT video-caption dataset used for the video benchmark.","marker":"Xu et al. (2016)"},{"why":"Supplies the AudioCaps audio-caption dataset used for the audio benchmark.","marker":"Kim et al. (2019)"}],"fun_headline_variants":["LLM-rewritten captions fool CLIP up to 53% of the time","Self-trained LLM sharpens caption attacks on CLIP","Text-only updates expose hidden blindness in CLIP","LLM-generated deceptive text exposes CLIP's weak spots"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The whole benchmark's definition of a successful deception depends on the fixed-threshold agreement of three NLI models being a trustworthy judge of whether a rewritten caption no longer means the original; if that automatic judge is systematically wrong on a large share of captions, the reported attack success rates are inflated.","fun_headline_variants_meta":{"raw":{"variants":["LLM-rewritten captions fool CLIP up to 53% of the time","Self-trained LLM sharpens caption attacks on CLIP","Text-only updates expose hidden blindness in CLIP","LLM-generated deceptive text exposes CLIP's weak spots"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000767,"raw_usage":{"total_tokens":3376,"prompt_tokens":900,"completion_tokens":2476,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":516,"completion_tokens_details":{"reasoning_tokens":2404}},"tokens_in":516,"tokens_out":2476,"duration_ms":18603,"temperature":1.0,"reasoning_tokens":2404,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-07T12:56:34.856648+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Take a random sample of captions the framework labels successful attacks and ask independent human annotators to judge, for each pair of original and rewritten caption, whether the rewrite is truly non-entailing. The paper's own human check covers only 50 MSRVTT samples; a broader check over hundreds of samples across COCO, MSRVTT, and AudioCaps would settle whether the NLI-consensus criterion is inflating the attack success rate. If agreement drops well below the reported F1 above 0.9, the central claim would need to be scaled back.","supporting_citations":[],"review_version":1}