Pith. sign in

REVIEW 5 major objections 8 minor 28 references

Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates

T0 review · 5 major / 8 minor · reviewed 2026-08-07 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A small language model can be trained to rewrite captions so reliably that pre-trained multimodal encoders rank the false caption above the true one up to 52.87% of the time.

desk verdict A genuinely cross-modal adversarial compositionality benchmark with a self-training recipe that works, but the 'deception' rate is inflated by an NLI gate that counts neutral as non-entailing, while the comparative claims hold up. read the letter →

arxiv 2505.22943 v1 pith:4VWJ56OS submitted 2025-05-28 cs.CL cs.AIcs.CVcs.LGcs.SD

Jaewoo Ahn , Heeseung Yun , Dayoon Ko , Gunhee Kim This is my paper
classification cs.CLcs.AIcs.CVcs.LGcs.SD
keywords multimodaladversarialcompositionalitytextupdatesCLIPLanguageBindself-trainingrejectionsamplingfine-tuningattacksuccessratecaptiondiversity
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to prove that a relatively small instruction-tuned language model can reliably deceive pre-trained multimodal representations, models like CLIP and LanguageBind that map images, video, and audio into a shared embedding space. The deception takes the form of a minimally edited caption: the rewritten text must rank higher against the input modality than the original caption, while no longer meaning the same thing. To make this measurable, the authors build a benchmark called Multimodal Adversarial Compositionality (MAC) with four simultaneous success criteria, and then improve the generator with a self-training loop that keeps attacks diverse. In the paper's experiments the full method reaches a combined attack success rate of 52.87% on AudioCaps with LanguageBind and 42.10% on COCO with CLIP, roughly doubling the zero-shot baseline, and the deceptive captions transfer across CLIP, SigLIP, NegCLIP, and BLIP. A fair reader should care because it suggests structured composition, who does what to whom and what changed, is not reliably encoded by current contrastive embeddings, and that this failure can be found automatically with an 8-billion-parameter model.

What carries the argument

The load-bearing object is the MAC attack filter, a conjunction of four criteria: crossmodal (the generated caption is closer to the input embedding than the true caption), unimodal (multiple natural-language-inference models with a threshold of 0.5 agree that the original does not entail the generated caption), distance (Levenshtein distance under half the dataset's average caption length), and auxiliary (instruction and shortcut constraints). On top of that sits the diversity-promoting self-training loop: rejection-sampling fine-tuning on captions that pass all four filters, followed by a Gibbs-style selection step that repeatedly swaps candidate samples to maximize entropy of operation-POS-lemma tokens such as I_NOUN_man. The small generator, Llama-3.1-8B with LoRA, is what carries the claim that strong attacks do not require a frontier model.

What would settle it

Take a random sample of captions the framework labels successful attacks and ask independent human annotators to judge, for each pair of original and rewritten caption, whether the rewrite is truly non-entailing. The paper's own human check covers only 50 MSRVTT samples; a broader check over hundreds of samples across COCO, MSRVTT, and AudioCaps would settle whether the NLI-consensus criterion is inflating the attack success rate. If agreement drops well below the reported F1 above 0.9, the central claim would need to be scaled back.

Watch

Extended reading notes

Core claim

The paper's central claim is that pre-trained multimodal representations harbor systematic compositional vulnerabilities that an LLM can exploit through text updates alone, and that these vulnerabilities are substantially easier to expose than prior benchmarks suggest. A deceptive caption is judged successful only if it satisfies four conditions at once: it has higher crossmodal similarity to the input than the original text; a consensus of NLI models says it is not entailed by the original; it stays within a Levenshtein-distance budget; and it follows the generation instructions without shortcuts. On top of this filtering, the authors introduce diversity-promoting self-training, which fine-tunes the generator on successful samples and then iteratively reselects training samples to maximize the entropy of word-operation tokens. The result is an improvement in both attack success rate and diversity relative to zero-shot prompt-based generation, and the gains hold across image, video, and audio targets. The authors take this as evidence that the failure lies in the compositionality of the representations themselves, not in one dataset, modality, or model family.

Load-bearing premise

The whole benchmark's definition of a successful deception depends on the fixed-threshold agreement of three NLI models being a trustworthy judge of whether a rewritten caption no longer means the original; if that automatic judge is systematically wrong on a large share of captions, the reported attack success rates are inflated.

Editorial extensions

If this is right

  • In the paper's experiments, the full method raises Total ASR to 42.10% on COCO with CLIP and 52.87% on AudioCaps with LanguageBind, up from 19.19% and 29.02% for the zero-shot $N=4$ baseline.
  • Self-training with a budget of $N=4$ reaches the attack success rate that prompting alone needs $N=16$ to achieve, so the improvement comes from learning what deceives the encoder, not from brute-force sampling.
  • Deceptive captions transfer across target models: filtering with one of CLIP, SigLIP, NegCLIP, or BLIP and evaluating on another still yields Total ASR between 32.50% and 42.10%.
  • Diversity-promoting selection keeps the attack broad: after the full method, no single word-operation token dominates, whereas some baselines concentrate on a token like I_NOUN_weapon more than 25% of the time.
  • Because the protocol is text-only and modality-agnostic, the same benchmark applies to image, video, and audio pairs, and the long-caption experiments show the effect is not limited to short captions.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond the paper's claims, the same attack recipe could be pointed at retrieval systems, reward models, and VLM pipelines built on these embeddings; if a rewritten caption outranks the true one, downstream ranking can be manipulated without touching the image or audio.
  • The fixed NLI threshold is the natural knob to test: recalibrating it per dataset or replacing the NLI consensus with a stronger entailment judge would reveal how much of the reported ASR depends on the threshold choice.
  • A testable extension is to run the same diversity-promoting loop with other diversity measures, such as syntactic templates or relation types; different measures may expose different families of composition errors.
  • If these results hold, they shift the burden of proof: a model that ranks a swapped subject-object caption as more similar than the ground truth is showing a failure to encode relational structure, not simply a failure to do visual reasoning.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 8 minor

Summary. The paper introduces MAC (Multimodal Adversarial Compositionality), a benchmark for evaluating whether LLM-generated text edits can make a pre-trained multimodal representation (CLIP, LanguageBind, etc.) prefer a modified caption over the original grounded caption. For each multimodal pair, a generator (default Llama-3.1-8B) produces up to N candidate captions; a filter keeps candidates that satisfy four criteria: higher crossmodal similarity than the original, non-entailment under an NLI ensemble, limited edit distance, and compliance with auxiliary instruction constraints. The paper further proposes diversity-promoting self-training via rejection-sampling fine-tuning with a Gibbs-style selection procedure that iteratively chooses successful samples to maximize entropy of word-level edit tokens. Experiments on COCO, MSRVTT, and AudioCaps report attack success rates and diversity for zero-shot, self-trained, and large-N-distilled variants, plus transfer results to SigLIP, NegCLIP, BLIP, and LLaVA, additional datasets, and long captions. The central empirical claim is that the full method raises Total ASR from 19.19% to 42.10% on COCO/CLIP and from 29.02% to 52.87% on AudioCaps/LanguageBind, outperforming prior compositionality baselines.

Significance. The paper addresses a timely and useful problem: systematically probing compositional weaknesses of frozen multimodal encoders using fluent, LLM-generated text perturbations rather than rule-based swaps. Its modality-agnostic framing (image, video, audio), the unified evaluation protocol, the cross-model transfer analysis, and the use of a small open LLM with self-training are genuine strengths. If the reported attack rates are valid, the benchmark and the distilled self-training recipe would be a practical contribution for auditing multimodal representations before deployment. The authors also provide a project page, transparent appendices, and a human evaluation, which is commendable. However, the validity of the headline ASR hinges on the unimodal gate in Eq. (2), and as discussed below that gate treats neutral non-entailment as success, which can inflate the 'deception' numbers. With that concern resolved, the paper would be a solid empirical benchmark contribution.

major comments (5)
  1. [Appendix A.4] The unimodal criterion s^u_i = Π_j I(l_j(t_i, ~t_i) < τ) with τ = 0.5 counts any caption whose NLI entailment score is below threshold as a successful deception. Standard NLI models assign low entailment probabilities to both neutral and contradictory pairs, so a generated caption that is merely neutral with respect to the original—and possibly still true of the input—passes the gate. For example, changing 'reaching for the laptop keys' to 'looking at the laptop' is non-entailing but can be compatible with the same image; if the target model prefers it, that is not evidence of compositional deception. The generation prompt (Table 4) asks the LLM to 'Introduce a contradiction', and the human evaluation in §5.3 (Fig. 3c) labels contradiction, but the automatic filter never checks for contradiction. Consequently, the reported Total ASR values in Table 2 (e.g., 42.10% on COCO, 52.87% on AudioCaps) may overcount cases where the model merely prefers another correct description. The 1K GPT-4 concordance and the 50-sample human check validate correlation with entailment judgments, not the stronger property that successful samples are actually false of the input. I recommend either requiring a contradiction-specific NLI label, adding a three-way threshold that excludes neutral, or re-validating on a stratified sample of captions that pass all four criteria with human labels of truthfulness relative to the input.
  2. [Algorithm 1] The appendix states 'All reported results are based on a single run per experiment.' Many of the decisive comparisons in Table 2 and Fig. 4 rest on small absolute differences—e.g., COCO Total ASR 42.03 vs. 42.10 for large-N distilled with and without diversity promotion, and AudioCaps Cross ASR 58.38 vs. 60.25. Without multiple seeds, confidence intervals, or significance tests, the reader cannot determine whether the 'without sacrificing ASR (+2%)' claim and the ordering of the final variants are stable or due to sampling noise. The paper should report at least means and standard deviations over several seeds for the main rows of Table 2, and ideally for Fig. 4.
  3. [§5.1] The diversity-promoting self-training procedure has a free parameter K, the number of Gibbs-style iterations, but the paper never specifies its value in the experimental setup or in the results. Since this algorithm is a central contribution and the main diversity gains are attributed to it, the missing K value makes the experiments irreproducible. The initialization is also described as 'random' with no seed information. Please report the chosen K and any sensitivity analysis, or drop K and use a fixed number of passes with a stated value.
  4. [§3.3 and §4.4] For SeeTrue, VFC, and CompA—methods originally built on proprietary LLMs (PaLM, GPT-4)—the authors substitute Llama-3.1-8B and modify the prompts to fit that model. This is disclosed, but it means Table 2 does not compare against the published methods as they actually perform; it compares against re-implementations under the authors' generator model. The paper's 'outperforms prior work' claim is therefore confounded with the choice of generator. I recommend reporting the original published numbers alongside the re-implemented ones, or clearly restating the comparison as 'under a common Llama-3.1-8B generator' in the main text and headline claims.
  5. The diversity metric H (entropy over OP_POS_LEMMA tokens) is both the evaluation metric and the objective optimized in Algorithm 1's coordinate-ascent selection. It is therefore expected that diversity-promoting self-training improves H relative to naive self-training; the comparison measures the method's ability to optimize its own selection criterion more than an independent property of the generator. This is not a fatal flaw, but the paper should acknowledge that the diversity evaluation is not fully independent of the training objective, and should report an external diversity measure (e.g., distinct n-grams not used in training, or human-rated diversity) to support the claim that the samples are genuinely more diverse.
minor comments (8)
  1. [§5.3] The notation l_j is introduced without specifying that it denotes the entailment probability output of each NLI model; please define it explicitly and state that τ is applied to the entailment class probability, not to the contradiction or neutral probability.
  2. [Algorithm 1] The human evaluation reports F1 > 0.9 and Fleiss' kappa but no confidence intervals, and it involves only 50 MSRVTT samples. Given that the unimodal gate is a load-bearing component, I encourage a larger and more stratified sample, ideally drawn from captions that pass the full filter, with per-dataset breakdowns.
  3. [§4.3] Please state whether the random initialization of the selection set is seeded, and if so, with which seed; otherwise the diversity results may not be reproducible.
  4. [Appendix B.2] The phrase 'for the first time' regarding self-training for multimodal compositionality is a strong novelty claim. Consider softening it or providing a more focused literature comparison, since 'first' claims are hard to verify and can distract from the technical contribution.
  5. [Table 2] In Table 14, the parallel/sequential generation comparison reports time complexity but not wall-clock times; a concrete runtime comparison would make the practical argument more convincing.
  6. [Figure 2] The dagger footnote on CompA's results says 'the results are computed for a subset to which the method can be applied.' Please specify the subset size and selection rule; as written, the reader cannot interpret the † numbers.
  7. [§5.1] Figure 2 is dense and the arrows between the criteria and the filterer are easy to misread; labeling the crossmodal/unimodal/distance/auxiliary criteria with the corresponding equation numbers in the figure would improve readability.
  8. The statement that 'larger or proprietary models do not necessarily lead to more effective deception' is supported only by N=1 comparisons in Table 13; the interaction with N>1 and self-training is not explored, so the claim should be scoped accordingly.

Circularity Check

0 steps flagged · score 2.0 of 10

No significant circularity: the overlap between the MAC filter and the ASR metric is intentional training/evaluation design against fixed external models, not a derivation-by-construction.

full rationale

MAC is a benchmark, not a first-principles derivation. The sample-wise attack success rate R in Eq. 4 is defined as the product of four externally specified criteria: target-model cosine similarity (Eq. 1), NLI entailment scores below tau=0.5 (Eq. 2), Levenshtein distance (Eq. 3), and prompt-compliance validation. The zero-shot Best-of-N filter (Eqs. 5-6) selects candidates using exactly these criteria, and the self-training loss in Eq. 8 is optimized on samples satisfying the same product (Eq. 7). This overlap is an intentional design: the target multimodal representations and NLI models are fixed external functions, the training and test splits are disjoint, and no parameter is fitted to the reported test ASR numbers. Optimizing against the same metric that is later reported is standard supervised/adversarial methodology, not a logical circle. The unimodal criterion's use of NLI models is an acknowledged measurement concern: the paper validates it with GPT-4 concordance and a 50-sample human study, and the tau=0.5 threshold admits neutral (not only contradictory) pairs, which could inflate ASR. That is a construct-validity caveat, not an equivalence-by-construction. References to the authors' prior AudioCaps dataset are standard benchmark usage and are not load-bearing to the method's derivation. No uniqueness theorem or ansatz is imported from self-citations.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim depends on several design choices: the NLI threshold, the edit distance budget, the number of sampled candidates, and the unspecified Gibbs iterations in the diversity-promoting selection. None of these are fitted to data in the usual sense, but they are hand-picked and some are not fully specified.

free parameters (4)
  • NLI entailment threshold tau = 0.5
    Threshold in the unimodal entailment criterion (Eq. 2), set following Bansal et al. (2024); affects which generated captions count as non-entailing and therefore the measured attack success rate.
  • LLM sampling temperature = 0.7
    Nucleus sampling temperature for LLM generation (Appendix A.4); affects sample distribution and hence ASR and diversity.
  • Number of sampled candidates N in large-N distillation = 64
    Budget in Best-of-N sampling for training data; the paper shows ASR increases with N, and N=64 is chosen as a balance between performance and time.
  • Gibbs iteration count K in Algorithm 1 = not stated
    The number of coordinate ascent iterations in the diversity-promoting selection is not specified; this affects the degree of diversity optimization in self-training.
assumptions (4)
  • domain assumption Cosine similarity between embeddings is a valid measure of semantic alignment for the attack success.
    The crossmodal criterion (Eq. 1) uses cosine distance between embeddings as the measure of alignment, which is the standard CLIP objective but not an independent ground truth.
  • domain assumption The consensus of RoBERTa, DeBERTa, and BART NLI models with threshold 0.5 accurately captures human notion of non-entailment.
    The unimodal criterion (Eq. 2) relies on this consensus. The paper provides limited validation on 1K GPT-4 comparisons and 50 human examples.
  • domain assumption The datasets' ground-truth captions are correct descriptions of the paired modality.
    The attack success is defined relative to the original caption; if the original caption is wrong, the measurement is not meaningful.
  • domain assumption The LLM follows instructions and produces natural language that satisfies the prompt's generation criteria.
    The entire pipeline assumes the generator produces fluent, instruction-following captions rather than degenerate text that trivially passes the filters.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates." pith.science (2026). https://pith.science/paper/4VWJ56OS

@misc{pith2026250522943,
  author       = {Pith},
  title        = {Pith review of: Can LLMs Deceive CLIP? Benchmarking Adversarial Compositionality of Pre-trained Multimodal Representation via Text Updates},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/4VWJ56OS}},
  note         = {Machine review of arXiv:2505.22943}
}
read the original abstract

While pre-trained multimodal representations (e.g., CLIP) have shown impressive capabilities, they exhibit significant compositional vulnerabilities leading to counterintuitive judgments. We introduce Multimodal Adversarial Compositionality (MAC), a benchmark that leverages large language models (LLMs) to generate deceptive text samples to exploit these vulnerabilities across different modalities and evaluates them through both sample-wise attack success rate and group-wise entropy-based diversity. To improve zero-shot methods, we propose a self-training approach that leverages rejection-sampling fine-tuning with diversity-promoting filtering, which enhances both attack success rate and sample diversity. Using smaller language models like Llama-3.1-8B, our approach demonstrates superior performance in revealing compositional vulnerabilities across various multimodal representations, including images, videos, and audios.

Figures

Figures reproduced from arXiv: 2505.22943 by the authors.

Figure 1
Figure 1. Key idea of Multimodal Adversarial Com￾positionality (MAC). MAC benchmarks compositional vulnerabilities of a pre-trained multimodal representa￾tion (e.g., CLIP, LanguageBind) with a comprehensive set of criteria. CLIP(·, ·) denotes the cosine similarity between image and text embeddings from CLIP. et al., 2024). Moreover, its usage has become com￾monplace across various modalities beyond image￾language pairs. Contr… view at source ↗
Figure 2
Figure 2. Overview of (a) multimodal adversarial compositionality and (b) diversity-promoting self-training. [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Analysis of our proposed framework. Please refer to Sec. [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (8 more)
Figure 4
Figure 4. Figure 4: Influence of N in self-training. (Zero-shot) A lady dancing in the rain carrying a pink umbrella (Self-train) A lady walking in the rain under a broken pink umbrella (Ours) A lady walking in the rain with her pink umbrella left behind Cross Uni Dist (Zero-shot) The fem…
Figure 5
Figure 5. Figure 5: Qualitative examples from COCO, MSRVTT, and AudioCaps datasets (from top to bottom). MSRVTT results, please refer to Appendix B.5. Influence of large N in self-training. To better understand the influence of N in distillation-based self-training, we report the ASR of o…
Figure 6
Figure 6. Figure 6: User interface for human evaluation: Task 1 [PITH_FULL_IMAGE:figures/full_fig_p016_6.png]
Figure 7
Figure 7. Figure 7: User interface for human evaluation: Task 2 [PITH_FULL_IMAGE:figures/full_fig_p017_7.png]
Figure 8
Figure 8. Figure 8: Distribution of attribute-enhanced tokens from different methods. [PITH_FULL_IMAGE:figures/full_fig_p018_8.png]
Figure 9
Figure 9. Figure 9: Influence of multi-round self-training in [PITH_FULL_IMAGE:figures/full_fig_p018_9.png]
Figure 10
Figure 10. Figure 10: Qualitative examples for MAC on Stanford [PITH_FULL_IMAGE:figures/full_fig_p019_10.png]
Figure 11
Figure 11. Figure 11: More qualitative examples [PITH_FULL_IMAGE:figures/full_fig_p021_11.png]

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

28 extracted references · 26 canonical work pages

  1. [3]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", without expla- nation. Table 4: Deceptive-general prompt. A.4 Implementation Details ...

    work page 2020

  2. [4]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", without expla- nation. Table 5: Deceptive-specific prompt (replace-object). Deceptive...

    work page

  3. [7]

    Replace a key object in the given caption with a new object that is not in the given caption

    work page

  4. [11]

    Replace an adjective word in the given caption with a new adjective word that is not in the given caption

    work page

  5. [14]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", without expla- nation. Table 6: Deceptive-specific prompt (replace-attribute). Decept...

    work page

  6. [15]

    Replace an action or a spatial relationship in the given caption with a new action or spatial relationship that is not in the given caption

    work page

  7. [18]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", without expla- nation. Table 7: Deceptive-specific prompt (replace-relation). Decepti...

    work page

  8. [19]

    two" to

    Replace the numerical count of a key object in the given caption (e.g., from "two" to "three")

    work page

Show all 28 references
  1. [22]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", witho...

  2. [23]

    Generate a new plausible but uncommon object that’s not in the given caption, and then add the new object to make a new caption

  3. [26]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", witho...

  4. [27]

    Add a new plausible but uncommon attribute for the object in the given caption

  5. [30]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", witho...

  6. [31]

    woman looking at elephant

    First locate two swappable nouns in the given caption, and then swap them to make a new caption (e.g., from "woman looking at elephant" to "elephant looking at woman")

  7. [34]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", witho...

  8. [35]

    a red apple and a purple grape

    First locate two swappable adjectives in the given caption describing different objects, and then swap them to make a new caption (e.g., from "a red apple and a purple grape" to "a purple apple and a red grape")

  9. [36]

    Ensure the new caption has higher similarity to the {contents_modality} in {contents_modality}-text crossmodal model than the given caption

  10. [37]

    no", "not

    Introduce a contradiction compared to the given caption, but avoid simple negations (e.g., using words like "no", "not", "empty", or "without")

  11. [38]

    Generated Caption:

    Make fewer than {max_word_distance_plus_one} word-level changes (add, delete, or substitute words) to the given caption without fully rewriting it to generate the new caption. [Given Caption] - {caption} *** Write only the new caption starting with "Generated Caption: ", witho...

  12. [40]

    Decide if they contradict each other or convey similar meanings

  13. [41]

    Are two sentences contradictory based on the video?

    Provide a short explanation for your choice. Your Task Sentence A: a police officer drives his white car onto a grassy field and then back on to the street Sentence B: a police officer drives his white car onto a grassy field and then drives away from the street. Q. Do the two sente...

    2022

  14. [42]

    Read both sentences carefully

  15. [43]

    Decide if they contradict each other or convey similar meanings based on the video

  16. [44]

    Provide a short explanation for your choice. Your Task Sentence A: a police officer drives his white car onto a grassy field and then back on to the street Sentence B: a police officer drives his white car onto a grassy field and then drives away from the street. Q. Do the two sente...

    2023

  17. [2017]

    Does this image I match the following captionT? Answer Yes or No directly

    for image-text and ActivityNet Captions (Kr- ishna et al., 2017) for video-text, whose average word lengths are 60 and 48, respectively. Following Zhang et al. (2018); Gabeur et al. (2020), we aggre- gate all sentences from each video in chronological order to obtain long capt...

    2018

  18. [2021]

    Contextualized perturbation for textual ad- versarial attack. InNAACL. Jiwei Li, Michel Galley, Chris Brockett, Jianfeng Gao, and William B Dolan. 2016. A diversity-promoting objective function for neural conversation models. In NAACL. Junnan Li, Dongxu Li, Caiming Xiong, and ...

    2016 arXiv

  19. [2022]

    Vl-checklist: Evaluating pre-trained vision- language models with objects, attributes and relations. InEMNLP. Bin Zhu, Bin Lin, Munan Ning, Yang Yan, Jiaxi Cui, HongFa Wang, Yatian Pang, Wenhao Jiang, Junwu Zhang, Zongwei Li, et al. 2024. Languagebind: Ex- tending video-langua...

    2021

  20. [2024]

    Sharegpt4v: Improving large multi-modal models with better captions. InECCV. Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. 2018. Boosting adversarial attacks with momentum. InCVPR. Sivan Doveh, Assaf Arbelle, Sivan Harary, Eli Schwartz...

    2018 arXiv

Pith tools

Reviewed August 7, 2026 · model on record in the stance chip above.