Pith. sign in

REVIEW 4 major objections 5 minor 12 references

Technical Report for ICML 2024 TiFA Workshop MLLM Attack Challenge: Suffix Injection and Projected Gradient Descent Can Easily Fool An MLLM

T0 review · 4 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This paper shows that appending an incorrect answer option to the text and adding small PGD image noise is enough to make LLaVA-1.5 output the wrong answer, with attack success rising from 48.09 to 80.92 on the TiFA Helpful track.

desk verdict A competition write-up that credibly shows simple suffix injection is the main driver of attack success on LLaVA-1.5 for the TiFA benchmark, but the reported numbers need code and a clearer metric before they can be trusted. read the letter →

arxiv 2412.15614 v1 pith:77QZ6JLF submitted 2024-12-20 cs.CR cs.CV

Yangyang Guo , Ziwei Xu , Xilie Xu , YongKang Wong , Liqiang Nie , Mohan Kankanhalli This is my paper · ORCID
classification cs.CRcs.CV
keywords adversarialattacksmultimodallargelanguagemodelsLLaVA-1.5suffixinjectionprojectedgradientdescentTiFAbenchmarkpromptmisalignment
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This technical report describes the top-ranked solution to the 2024 TiFA MLLM attack challenge: take a multiple-choice question, append the text of an option that is known to be wrong (pseudo-labeled by GPT-4o and manually verified), and then add small gradient-based image noise via projected gradient descent (PGD). Applied to the fixed LLaVA-1.5 (13B) model, the combination raises attack success from 48.09 to 80.92 on the Helpful dimension and from 62.25 to 69.54 on Honesty, while Harmlessness improves only slightly, from 38.22 to 39.27. The authors' central claim is that these two simple techniques are sufficient to fool a large multimodal model, and that the text suffix is the more powerful component. The report also argues the result exposes a language bias in multimodal models, which tend to follow the text shortcut and neglect visual evidence.

What carries the argument

The machinery is a two-stage adversarial pipeline. Stage one is suffix injection: choose an incorrect option from GPT-4o pseudo-labels, then append its longest sub-sentence to the query so that the modified text stays within a BERT cosine-similarity threshold of 0.9. Stage two is vanilla PGD on the image: starting from an adaptively chosen perturbation radius from {32, 16, 8, 4, 2, 1}/255, the attack maximizes cross-entropy loss on the LLaVA-1.5 output over up to 1,000 steps while checking a ResNet cosine-similarity threshold of 0.9. The adaptive epsilon search matters because LLaVA-1.5 and ResNet preprocess images differently, so a fixed radius often violates the visual constraint. The suffix does the heavy lifting; PGD supplies an additional, smaller push.

What would settle it

Re-run the attack on a subset of instances where the correct option is independently validated by multiple human annotators or by a trusted source, and drop any instance where the pseudo-label disagrees; if the attack success gain on the fully verified subset is much smaller than the reported 80.92 percent, or if LLaVA-1.5 frequently picks the pseudo-labeled wrong options even on clean images, the claimed attack strength is partly an artifact of label noise.

Watch

Extended reading notes

Core claim

On the paper's own terms, the discovery is that a targeted attack on a multimodal large language model does not need elaborate alignment-breaking mechanisms: appending the text of an incorrect option to the query, under a BERT cosine-similarity constraint of 0.9, and then running vanilla PGD on the image, under a ResNet cosine-similarity constraint of 0.9, reliably makes LLaVA-1.5 output the attacker-chosen wrong answer. The authors report total attack-success gains of +32.83 on Helpful, +7.29 on Honest, and +1.05 on Harmless relative to no attack. They additionally observe that the suffix alone contributes most of the gain (a 22.14 percentage-point improvement over image attack alone on Helpful questions) and that longer suffixes keep helping. For Harmless questions, free-form safety output resists this recipe; the authors instead append external harmful content and attribute the remaining gap to prompt misalignment between their evaluation and the challenge system's evaluation.

Load-bearing premise

The whole attack depends on the pseudo-labels being correct: the authors ask GPT-4o for the right answer and then manually verify it, and a randomly chosen different option is treated as truly wrong; if a pseudo-label is wrong, the attack target is actually the correct answer and the reported success numbers would no longer mean the model was fooled.

Editorial extensions

If this is right

  • If the claim holds, then defending a multimodal model requires treating the text channel as at least as important as the image channel; filtering or constraining text suffixes could block most of this attack.
  • A fixed model with frozen weights can be steered toward a specified wrong answer using only query text plus image noise, which matters for real-world deployment of MLLMs in multiple-choice settings.
  • The small Harmless gain implies safety-aligned free-form output is more resistant to this recipe, but the authors' reported 80 percent local success versus 39.27 percent system success warns that evaluation-protocol differences, not model robustness, can dominate measured safety.
  • Constraining attacks to be perceptually similar (cosine similarity above 0.9 in both modalities) does not prevent the attack; stealth and success coexist.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A testable extension: if the authors' language-bias explanation is right, the same suffix recipe should transfer to other instruction-tuned MLLMs that share LLaVA-style training; running the suffix without PGD against a different open-source model would check whether the wrong-option preference persists.
  • A useful ablation the report does not run is a fully blank or black image with the same suffix: if the model still picks the wrong option, that would isolate the text shortcut from the PGD contribution.
  • The reported discrepancy between local and system evaluation for Harmless suggests future challenge designs should standardize prompts before declaring a defense robust; this is an implication about benchmarking, not about model safety.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper describes the authors' top-ranked solution for the ICML 2024 TiFA workshop MLLM attack challenge, targeting the LLaVA-1.5 (13B) model. For the Helpful (H1) and Honest (H2) multiple-choice dimensions, the authors use GPT-4o with manual verification to pseudo-label the correct option, randomly select one incorrect option, append that option's text to the query as a suffix, and additionally apply a vanilla PGD attack to the image with an adaptive perturbation radius. For the Harmless (H3) dimension, they enumerate harmful texts from an external corpus and append them to the query. The paper reports attack success rates in Table 1, with gains of +32.83 on Helpful, +7.29 on Honest, and +1.05 on Harmless, and concludes that suffix injection and PGD can easily fool an MLLM. Section 3 acknowledges limitations concerning pseudo-label bias, prompt misalignment, and the labor-intensive labeling process.

Significance. If the headline numbers are reliable, the paper provides a clear demonstration that simple text-side manipulation (literally appending a chosen answer) combined with a standard white-box PGD image perturbation can substantially change LLaVA-1.5's multiple-choice outputs. The ablations in Figure 1, showing that longer suffixes increase attack success, are a useful empirical contribution. The paper is also candid in stating its limitations, which is commendable. However, the report does not ship code, seeds, per-instance results, or error bars, and the official success metric for H1/H2 is not precisely defined. The central quantitative claims therefore remain plausible but not fully established in this document.

major comments (4)
  1. [Sec. 2.3 and Sec. 3] The attack target for every H1/H2 instance is an option that GPT-4o and the authors judged to be incorrect, but the paper does not provide verification statistics (e.g., per-instance agreement, number of corrected labels) and Section 3 explicitly acknowledges that both GPT-4o and humans may introduce labeling biases. Because the reported success rate depends entirely on whether the chosen target is truly wrong, the authors must either report a verified-label subset with the attack success recomputed on it, or provide ground-truth-verified labels for all instances. They should also state clearly whether the official H1/H2 metric counts output of the attacker-specified option as success regardless of ground truth, or compares against the hidden ground-truth label; the former would make the metric circular, while the latter would mean label errors deflate rather than inflate the official numbers.
  2. [Table 1] The 'without attack' row is copied from the Blackfyre team's results, and the paper itself notes that these numbers 'might not be entirely accurate.' Since every reported improvement is a difference against this baseline, an inaccurate baseline directly invalidates the headline gains. The authors should obtain the official no-attack scores for their own test split or rerun a no-attack baseline under the same evaluation protocol, and report per-seed or per-instance variability.
  3. [Eq. (2) and Algorithm 1] The stated objective in Eq. (2), min dist(t, t') subject to similarity constraints, does not match Algorithm 1, which performs PGD with a cross-entropy loss to maximize the likelihood of the attacker-chosen incorrect text t'. These are different objectives: one minimizes semantic distance between clean and adversarial outputs, the other maximizes the probability of a specific target. This inconsistency prevents exact reproduction and should be resolved by rewriting Eq. (2) to describe the actual targeted adversarial objective used in the algorithm.
  4. [Sec. 2.4 and Table 1] For the Harmless dimension, the authors report that their own evaluation achieved an 80% attack success rate while the official system evaluation gave 39.27%, a discrepancy they attribute to prompt misalignment. This means the H3 result in Table 1 (+1.05) is not obtained under the authors' own controlled protocol, and the paper does not provide enough information (e.g., the set of system prompts tried, or an analysis of which lexical or stylistic differences caused the gap) to determine whether the reported improvement is meaningful. Without closing this local-versus-official gap, the H3 conclusion is not interpretable.
minor comments (5)
  1. [Table 2] The caption says the table compares adaptive epsilon and fixed epsilon, but the rows labeled ✗ and ✓ are not explained; the reader cannot tell which row corresponds to adaptive epsilon and which to fixed epsilon, or what the numbers in parentheses (4/255, 16/255) mean. Please clarify the table structure and define all symbols.
  2. [Fig. 1] The y-axes in Figure 1 are annotated with '-22.14' and '-4.64', but the later text describes these as improvements of 22.14% and 4.64%. The sign convention should be made explicit or the annotations changed to match the text.
  3. [Algorithm 1] The algorithm description contains several underspecified details: the initialization of t' inside the repeat loop, the conditions under which the Adaptive epsilon and Text Perturbation flags are set, and the exact loss used for the PGD update (e.g., cross-entropy with the target text as the label). Adding these details would improve reproducibility.
  4. [Sec. 1 and Alg. 1] The text says the selected incorrect label is appended using the 'longest sub-sentence rule,' while Algorithm 1 appends the longest sub-sentence while the BERT similarity exceeds beta_q. It should be stated whether the suffix is the full incorrect option or a truncated sub-sentence, and how the truncation length is chosen.
  5. [Throughout] There are minor typographical issues, such as inconsistent spacing in 'LLaV A' in the abstract and Section 1, and the reference for the Visual-Adversarial-Examples harmful corpus is given only as a URL rather than a formal citation. Please clean these up.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the attack-success claim is an externally evaluated empirical result, with pseudo-label bias a validity caveat rather than a circular reduction.

full rationale

The paper makes no theoretical derivation in which a predicted quantity reduces to a fitted input or to a self-referential definition. Its central claim is empirical: appending a pseudo-labeled incorrect option and applying PGD raises the official attack-success rate (Table 1). The target option is chosen from GPT-4o-generated, manually verified pseudo-labels (Sec. 2.3), and the paper explicitly acknowledges that both GPT-4o and humans may introduce labeling biases (Sec. 3). That is a validity caveat about the quality of the ground-truth estimate, not circularity: the leaderboard rates are externally computed, and if a pseudo-label were wrong, the attacker-specified option would actually be the correct answer, which would tend to lower, not define, official attack success. No parameter is fitted and then reported as a prediction; no load-bearing self-citation appears; no uniqueness theorem or ansatz is imported from the authors' prior work. The suffix-injection method intentionally places the target text in the prompt, but the reported success rate is an empirical frequency observed in the model's outputs, not an identity forced by construction. The acknowledged limitation regarding label bias should be addressed in future work, but it does not make the derivation circular.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several hand-set hyperparameters (step size, similarity thresholds, epsilon schedule, number of PGD steps) and on assumptions about the correctness of GPT-4o pseudo-labels and the validity of embedding-based similarity constraints. No new physical or conceptual entities are introduced, so the invented-entities list is empty.

free parameters (6)
  • PGD step size alpha = 1/255
    Chosen empirically; larger steps violate the ResNet-50 similarity constraint (Section 2.2).
  • Similarity thresholds beta_v and beta_q = 0.9
    Set to 0.9 for both image and text cosine similarity constraints (Section 2.1).
  • Adaptive epsilon candidate set = {32, 16, 8, 4, 2, 1} / 255
    Search over epsilon values at PGD initialization to satisfy the image similarity constraint (Section 2.3).
  • PGD attack steps tau = 1000
    Number of PGD iterations for Helpful and Honest questions (Section 2.2).
  • Image constraint checkpoint interval tau_v = not specified
    Interval for checking the image similarity constraint during PGD; exact value not given (Algorithm 1).
  • Batch size = 1
    Batch size for attacks (Section 2.2).
assumptions (4)
  • domain assumption GPT-4o pseudo-labels, after manual verification, correctly identify the true answer for each Helpful and Honest question.
    The attack target is an incorrect option selected from these labels (Sections 1 and 2.3). If a pseudo-label is wrong, the selected 'incorrect' option may be the correct answer, invalidating the success metric.
  • domain assumption Cosine similarity in ResNet-50 and BERT embedding spaces is a reliable proxy for semantic preservation and imperceptibility.
    Equation (2) constrains attacks with sim(v_cle,v_adv)>beta_v and sim(q_cle,q_adv)>beta_q. The authors report that input-preprocessing mismatches break this proxy and require adaptive epsilon, so the proxy is fragile but load-bearing.
  • domain assumption The LLaVA-1.5 (13B) model is available as a white-box with fixed weights and differentiable outputs for gradient computation.
    Algorithm 1 and Eq. (1) assume gradients through f(v,q|Phi) with Phi fixed; the entire PGD attack depends on this white-box access.
  • domain assumption MD-Judge provides a valid safety label for the Harmless dimension.
    Used to select unsafe options and to measure H3 attack success (Section 2.4); no independent validation of MD-Judge is provided.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Technical Report for ICML 2024 TiFA Workshop MLLM Attack Challenge: Suffix Injection and Projected Gradient Descent Can Easily Fool An MLLM." pith.science (2026). https://pith.science/paper/77QZ6JLF

@misc{pith2026241215614,
  author       = {Pith},
  title        = {Pith review of: Technical Report for ICML 2024 TiFA Workshop MLLM Attack Challenge: Suffix Injection and Projected Gradient Descent Can Easily Fool An MLLM},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/77QZ6JLF}},
  note         = {Machine review of arXiv:2412.15614}
}
read the original abstract

This technical report introduces our top-ranked solution that employs two approaches, \ie suffix injection and projected gradient descent (PGD) , to address the TiFA workshop MLLM attack challenge. Specifically, we first append the text from an incorrectly labeled option (pseudo-labeled) to the original query as a suffix. Using this modified query, our second approach applies the PGD method to add imperceptible perturbations to the image. Combining these two techniques enables successful attacks on the LLaVA 1.5 model.

Figures

Figures reproduced from arXiv: 2412.15614 by the authors.

Figure 1
Figure 1. Attack performance w.r.t. varying suffix lengths. A suffix length of 0 indicates that no suffix injection is used to attack the LLaVA 1.5 model. It is important to note that the suffix length may be truncated prematurely due to text constraints or the end of the selected undesirable response. 2.3. Attack on Helpful and Honest Questions In this section, we provide more details about our attack strategy on Helpful and… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

12 extracted references · 9 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    and Hein, M

    Croce, F. and Hein, M. Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks. In ICML, 2020

    2020

  3. [3]

    BERT: pre-training of deep bidirectional transformers for language understanding

    Devlin, J., Chang, M., Lee, K., and Toutanova, K. BERT: pre-training of deep bidirectional transformers for language understanding. In NAACL, pp.\ 4171--4186. ACL, 2019

    work page 2019

  4. [4]

    Deep residual learning for image recognition

    He, K., Zhang, X., Ren, S., and Sun, J. Deep residual learning for image recognition. In CVPR, pp.\ 770--778. IEEE , 2016

    work page 2016

  5. [5]

    Salad-bench: A hierarchical and comprehensive safety benchmark for large language models

    Li, L., Dong, B., Wang, R., Hu, X., Zuo, W., Lin, D., Qiao, Y., and Shao, J. Salad-bench: A hierarchical and comprehensive safety benchmark for large language models. In ACL. ACL, 2024

    work page 2024

  6. [6]

    Hallusionbench: You see what you think? or you think what you see? an image-context reasoning benchmark challenging for gpt-4v(ision), llava-1.5, and other multi-modality models

    Liu, F., Guan, T., Li, Z., Chen, L., Yacoob, Y., Manocha, D., and Zhou, T. Hallusionbench: You see what you think? or you think what you see? an image-context reasoning benchmark challenging for gpt-4v(ision), llava-1.5, and other multi-modality models. In CVPR. IEEE , 2024 a

    work page 2024

  7. [7]

    Liu, H., Li, C., Li, Y., and Lee, Y. J. Improved baselines with visual instruction tuning. In CVPR. IEEE, 2024 b

    work page 2024

  8. [8]

    Towards deep learning models resistant to adversarial attacks

    Madry, A., Makelov, A., Schmidt, L., Tsipras, D., and Vladu, A. Towards deep learning models resistant to adversarial attacks. In ICLR. OpenReview.net, 2018

    work page 2018

Show all 12 references
  1. [9]

    Visual adversarial examples jailbreak aligned large language models

    Qi, X., Huang, K., Panda, A., Henderson, P., Wang, M., and Mittal, P. Visual adversarial examples jailbreak aligned large language models. In AAAI, pp.\ 21527--21536. AAAI Press, 2024

    2024

  2. [10]

    Assessment of multimodal large language models in alignment with human values

    Shi, Z., Wang, Z., Fan, H., Zhang, Z., Li, L., Zhang, Y., Yin, Z., Sheng, L., Qiao, Y., and Shao, J. Assessment of multimodal large language models in alignment with human values. CoRR, abs/2403.17830, 2024

    2024 arXiv

  3. [11]

    Zong, Y., Bohdal, O., Yu, T., Yang, Y., and Hospedales, T. M. Safety fine-tuning at (almost) no cost: A baseline for vision large language models. In ICML. PMLR, 2024

    2024

  4. [12]

    Z., and Fredrikson, M

    Zou, A., Wang, Z., Kolter, J. Z., and Fredrikson, M. Universal and transferable adversarial attacks on aligned language models. CoRR, 2023

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.