Pith. sign in

REVIEW 3 major objections 5 minor 57 references

MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Models

T0 review · 3 major / 5 minor · reviewed 2026-08-08 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read MAA attack makes adversarial images transfer across unseen vision-language models by zooming and sliding over local details.

arxiv 2502.08079 v3 pith:QIEWJ6WA submitted 2025-02-12 cs.CV

Peng-Fei Zhang , Guangdong Bai , Zi Huang This is my paper · ORCID
classification cs.CV
keywords adversarialattacktransferabilityvision-languagepre-trainedmodelsimage-textretrievalmulti-granularitysimilaritydisruptionresizingandslidingcroprobustnessevaluationCLIP
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that adversarial examples for vision-language pre-trained models can be made much more transferable by attacking fine-grained, low-level image features rather than model-specific high-level semantics. It proposes MAA, which first rescales and slides crop windows over the adversarial image so the source model sees many local, overlapping views, then maximizes the feature distance between those views and the original image across every layer and component, plus the distance between image and text embeddings. The authors argue low-level layers and local details are shared across CLIP, ALBEF, TCL, and BLIP, so perturbing them on one model generalizes. If correct, images alone, without conspicuous text edits, can break retrieval, captioning, grounding, and even large vision-language models they were never trained on. The paper reports large gains in image-text retrieval, for example I2T R@1 on CLIP ViT-L/14 rising from 42.54% with VLPTransferAttack to 54.36% with MAA.

What carries the argument

The load-bearing mechanism is the resizing and sliding crop (RScrop) augmentation feeding a multi-granularity similarity disruption (MGSD) objective. RScrop scales the adversarial image up by factors typically between 1.25 and 2 and slides a crop window across it in small random steps, producing a set of transformed images $R(x_{adv})$; it is designed to overcome the fixed-size, non-overlapping patch processing of ViTs and the fixed receptive fields of CNNs, which miss boundaries and local dependencies. MGSD then minimizes the cosine similarity between every transformed adversarial crop and the original image at all layers and components of the image encoder as well as the image-text embedding, so the perturbation is forced to disrupt shared low-level features rather than overfit the source model. The resizing and sliding are justified by scale- and translation-invariance properties of deep networks.

What would settle it

Take the CLIP ViT-B/16 source model, change its patch embedding to a different patch size, and regenerate MAA perturbations; if transferability to CLIP ViT-L/14 and ALBEF remains at the reported level, the attack cannot be relying on matching low-level visual features.

Watch

Extended reading notes

Core claim

The central claim is formalized as Equation (3), $L_{img} = L_1 + L_2$, where $L_1$ maximizes the feature distance between resized and sliding-cropped adversarial images and the original image across every layer and component of the source image encoder, and $L_2$ maximizes the distance between those adversarial crops and the paired text embedding. Minimizing this combined objective pushes the perturbation onto low-level visual features that the paper argues are less model-specific, while simultaneously widening the cross-modal gap. The paper claims this produces adversarial images that achieve notable improvements in transferability over existing attack methods, while remaining imperceptible under an $\ell_\infty$ bound, and supports the claim with attack success rates across source-target model pairs on Flickr30K and MSCOCO, visual grounding on RefCOCO+, image captioning on MSCOCO, and black-box large vision-language models.

Load-bearing premise

MAA depends on low-level visual features and local details being broadly shared across different vision-language models, so pushing those features apart in the source model also breaks models the attacker never saw.

Editorial extensions

If this is right

  • Image-only perturbations account for most of MAA's transferability, so robustness evaluation of VLP models cannot rely on attacks that also edit text.
  • The gap between white-box and black-box attack success shrinks, making MAA a stronger option for assessing robustness against undisclosed target models.
  • Ablations show that full-coverage sliding matters more than simple scaling, indicating that coverage of local regions, not just data diversity, drives transferability.
  • MAA's advantage grows with larger perturbation budgets, whereas comparison methods mostly overfit the source model.
  • The method transfers to black-box large vision-language models such as MiniGPT-4 and Llama 3.2 on captioning and visual question answering, though the absolute gains there are limited.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper leaves implicit that the same RScrop view set could be used defensively: training with these crops might harden VLP models against exactly the fine-grained local disruptions MAA exploits.
  • A testable extension is to replace the random step-size distribution with a learned or gradient-aware step policy; the paper samples uniformly, so better step choices may push transferability higher.
  • The claim that low-level features are shared across models implies MAA should transfer across more diverse architectures than the CLIP, ALBEF, TCL, and BLIP family tested; if it fails on a structurally different source, the shared-features explanation needs qualification.
  • The CLIP-score evaluation on large vision-language models measures feature shift rather than task failure, so stronger evidence would come from human-evaluated semantic degradation of generated captions.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. This paper proposes Meticulous Adversarial Attack (MAA), a transferable adversarial attack for vision-language pre-trained (VLP) models. The image-side attack combines a resizing-and-sliding-crop augmentation (RScrop) with a multi-granularity similarity disruption (MGSD) loss that maximizes feature distances between adversarial views and original images across layers, plus an image-text embedding distance term; text-side attacks use BERT-Attack. Experiments evaluate MAA against CLIP, ALBEF, TCL, and BLIP on image-text retrieval, visual grounding, image captioning, and black-box large vision-language models, with ablations and parameter analyses supporting the two main components.

Significance. If the empirical claims hold, MAA is a practically useful step for black-box transferability of multimodal adversarial attacks. The paper is strong in scope: four VLP model families, three datasets, several downstream tasks, ablations isolating RScrop and MGSD, and a parameter study. It also explicitly acknowledges the limited success against large LVLMs, which is a useful honest limitation. However, no code is released, the random components of RScrop are under-specified, and the central loss in Eq. (1) has a baseline ambiguity that weakens the paper's mechanistic interpretation of why MAA transfers. These issues are addressable but require additional experiments and reporting.

major comments (3)
  1. [Section 3.2, Eq. (1)] The loss L1 compares features of RScrop-transformed adversarial images f^i(x') with features of the untransformed original image f^i(x). Because RScrop involves nontrivial resizing and cropping, f^i(T(x)) differs from f^i(x) even when x_adv = x; minimizing L1 can therefore exploit the geometric view mismatch rather than sample-intrinsic, model-generic vulnerabilities. This ambiguity affects the central transferability claim in Tables 2 and 3 and the interpretation in Section 3.2 that low-level features are less model-specific. Please add a control experiment that uses a transformed baseline, e.g., L1 = sum over i, x' in R(x_adv) of cos(f^i(x'), f^i(x'_orig)) where x'_orig is the same RScrop transformation applied to the clean image, and report whether the observed transferability gains persist.
  2. [Section 4.1 and Eq. (1)] The RScrop implementation is not reproducible as specified. The random step sizes are defined with bounds beta1 and beta2 in Eq. (1), but their numerical values are never given; the scaling ratios are randomly selected every 10 iterations from {1.25, 1.5, 1.75, 2}, but no seed, number of runs, or variance is reported. Since the ablation in Table 6 shows that RScrop is the larger contributor to the gains, the reported numbers cannot be independently verified or distinguished from randomness. Please release code or fully specify all random choices, and report means and standard deviations across at least three seeds for the main tables.
  3. [Section 3.2 and Tables 2–3] The claim that low-level layers and components are 'generally less model-specific' and therefore drive transferability is asserted without direct evidence. The empirical gains in Tables 2 and 3 are substantially larger when the target shares the CLIP architecture than when the target is ALBEF or TCL; for example, on Flickr30K I2T R@1 the improvement over VLPTransferAttack is about 11.8 points for CLIP ViT-L/14 but only about 1.5 points for ALBEF. This pattern is compatible with an alternative explanation that MAA mainly transfers within the same visual backbone. Please add a layer-wise or component-wise ablation (e.g., using only low-level, mid-level, or high-level features) to test the stated mechanism, or temper the mechanistic claim to match the evidence.
minor comments (5)
  1. [Section 3.2, Eq. (2)] The notation \hat{x}'_k is used in Eq. (2) but never defined; it should be a member of R(x_adv), presumably x'_k, and should be written consistently with Eq. (1).
  2. [Section 4.2.1] The text refers to 'the proposed MMA' instead of MAA in the paragraph discussing Table 2; please correct the typo.
  3. [Figure 3(a)] The legend entries such as '0.25~1, 0.25' and '0~2, random' are not explained in the caption or text; the reader cannot tell whether the first number is a range of scaling factors and the second a step size or interval.
  4. [Section 4.5, Table 7] The direction of the CLIP-score comparison is not stated explicitly: the paper reports MAA as best with the lowest scores, but it should state clearly that smaller CLIP scores indicate stronger attack effectiveness and explain how the 'Random Shuffle' row serves as the reference bar.
  5. [Section 4.1] The implementation details say scaling ratios are randomly selected from a discrete set, while the parameter analysis in Figure 3(a) reports continuous ranges with intervals; please reconcile these two descriptions and specify whether scaling is applied per dimension independently.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: MAA's objective is an empirical attack construction benchmarked against external baselines, and its ablations and transfer results are self-contained.

full rationale

The central objective L_img = L1 + L2 (Eq. 3) is an attack-generation loss defined on the source model's image and text encoders; it is not derived from, nor fitted to, the target-model success rates that constitute the transferability claim. Eq. (1) maximizes cosine distance between RScrop-transformed adversarial images and untransformed originals at multiple layers, and Eq. (2) widens the image-text embedding distance; both are standard feature-disruption objectives with no parameter fitted to the reported benchmarks. The RScrop parameters, such as the resizing range and sliding step, are selected through ablations on the same datasets, which is hyperparameter tuning rather than a prediction forced by construction. The only self-citations are the authors' prior ETU work used as a baseline and a survey pointer, and neither is load-bearing: MAA's improvements are benchmarked against external methods (Co-Attack, SGA, VLATTACK, VLPTransferAttack) on public datasets and held-out target models, including black-box LVLMs. The skeptical concern that Eq. (1) compares transformed adversarial images with untransformed originals is a mechanistic-correctness question about what the loss rewards, not a circularity, because the comparison is not equivalent to the paper's input by definition. No equation in the paper reduces to its own inputs, and no fitted parameter is renamed as a prediction.

Assumptions & free parameters 3 free parameters · 3 assumptions · 0 invented entities

The central contribution is a heuristic combination of input augmentation and feature-space disruption. It imports two empirical assumptions about DNN and VLP behavior and carries several hand-tuned or unspecified hyperparameters (resizing ratios, random step bounds, number of crops). No new physical or conceptual entities are introduced.

free parameters (3)
  • RScrop random step size bounds beta1, beta2 = not reported
    The step size alpha_i is drawn from UniformDiscrete(beta1, beta2), said to be smaller than the patch or filter dimension, but exact values are never given. These bounds control the sliding coverage in Eq. (1) and hence the entire augmented set R(x_adv).
  • Resizing factor range = {1.25, 1.5, 1.75, 2}
    Scaling ratios are randomly selected every 10 PGD iterations (Section 4.1). The parameter study in Section 4.3.2 shows peak performance between 1.25 and 2 and degradation beyond, indicating the range is tuned to the evaluation benchmarks.
  • Number of sliding crops k = not specified
    The size of R(x_adv) is never given, and the sliding walk defined by L_i does not state a stopping condition or the exact number of crops, affecting optimization cost and the gradient signal.
assumptions (3)
  • domain assumption DNNs exhibit scale and translation invariance
    Section 3.2 invokes Lin et al. (2019) and Dong et al. (2019) to justify that resizing and sliding-crop transformations preserve transferable gradient directions. This is an empirical property, not proven for VLP models.
  • domain assumption Low-level features are less model-specific and shared across VLP models
    Section 3.2 states that low-level layers and components are generally less model-specific, and this underpins why maximizing source-model feature distances transfers to unknown targets.
  • domain assumption Patch-based ViT processing loses boundary information between adjacent patches
    Section 1 and Section 3.2 motivate RScrop by claiming non-overlapping patch embedding ignores boundary areas, which limits fine-grained local dependencies. This claim is plausible but not formally established in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Models." pith.science (2026). https://pith.science/paper/QIEWJ6WA

@misc{pith2026250208079,
  author       = {Pith},
  title        = {Pith review of: MAA: Meticulous Adversarial Attack against Vision-Language Pre-trained Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/QIEWJ6WA}},
  note         = {Machine review of arXiv:2502.08079}
}
read the original abstract

Current adversarial attacks for evaluating the robustness of vision-language pre-trained (VLP) models in multi-modal tasks suffer from limited transferability, where attacks crafted for a specific model often struggle to generalize effectively across different models, limiting their utility in assessing robustness more broadly. This is mainly attributed to the over-reliance on model-specific features and regions, particularly in the image modality. In this paper, we propose an elegant yet highly effective method termed Meticulous Adversarial Attack (MAA) to fully exploit model-independent characteristics and vulnerabilities of individual samples, achieving enhanced generalizability and reduced model dependence. MAA emphasizes fine-grained optimization of adversarial images by developing a novel resizing and sliding crop (RScrop) technique, incorporating a multi-granularity similarity disruption (MGSD) strategy. Extensive experiments across diverse VLP models, multiple benchmark datasets, and a variety of downstream tasks demonstrate that MAA significantly enhances the effectiveness and transferability of adversarial attacks. A large cohort of performance studies is conducted to generate insights into the effectiveness of various model configurations, guiding future advancements in this domain.

Figures

Figures reproduced from arXiv: 2502.08079 by the authors.

Figure 1
Figure 1. An illustration of the proposed (a) RScrop augmentation and (b) MAA method. For [PITH_FULL_IMAGE:figures/full_fig_p004_1.png] view at source ↗
Figure 2
Figure 2. Test accuracy on Flickr30K with varying image perturbation magnitudes. The source [PITH_FULL_IMAGE:figures/full_fig_p009_2.png] view at source ↗
Figure 3
Figure 3. (a) Resizing parameter analysis: appropriate scaling can achieve competitive performance. [PITH_FULL_IMAGE:figures/full_fig_p010_3.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

57 extracted references · 50 canonical work pages

  1. [1]

    write newline

    " write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION format.date year duplicate empty "emp...

  2. [2]

    Boosting adversarial attacks with momentum

    Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 9185--9193, 2018

    work page 2018

  3. [3]

    Evading defenses to transferable adversarial examples by translation-invariant attacks

    Yinpeng Dong, Tianyu Pang, Hang Su, and Jun Zhu. Evading defenses to transferable adversarial examples by translation-invariant attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 4312--4321, 2019

    work page 2019

  4. [4]

    An image is worth 16x16 words: transformers for image recognition at scale

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, et al. An image is worth 16x16 words: transformers for image recognition at scale. In Proceedings of the International Conference on Learning Representations, 2020

    work page 2020

  5. [5]

    Learning to learn transferable attack

    Shuman Fang, Jie Li, Xianming Lin, and Rongrong Ji. Learning to learn transferable attack. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 36, pp.\ 571--579, 2022

    work page 2022

  6. [6]

    Fda: Feature disruptive attack

    Aditya Ganeshan, Vivek BS, and R Venkatesh Babu. Fda: Feature disruptive attack. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 8069--8079, 2019

    work page 2019

  7. [7]

    Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory

    Sensen Gao, Xiaojun Jia, Xuhong Ren, Ivor Tsang, and Qing Guo. Boosting transferability in vision-language attacks via diversification along the intersection region of adversarial trajectory. In Proceedings of the European Conference on Computer Vision, pp.\ 442--460, 2024

    work page 2024

  8. [8]

    Sa-attack: improving adversarial transferability of vision-language pre-training models via self-augmentation

    Bangyan He, Xiaojun Jia, Siyuan Liang, Tianrui Lou, Yang Liu, and Xiaochun Cao. Sa-attack: improving adversarial transferability of vision-language pre-training models via self-augmentation. arXiv preprint arXiv:2312.04913, 2023

    arXiv 2023

Show all 57 references
  1. [9]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 770--778, 2016

    2016

  2. [10]

    Natural adversarial examples

    Dan Hendrycks, Kevin Zhao, Steven Basart, Jacob Steinhardt, and Dawn Song. Natural adversarial examples. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 15262--15271, 2021

    2021

  3. [11]

    Adversarial examples are not bugs, they are features

    Andrew Ilyas, Shibani Santurkar, Dimitris Tsipras, Logan Engstrom, Brandon Tran, and Aleksander Madry. Adversarial examples are not bugs, they are features. In Proceedings of the International Conference on Neural Information Processing Systems, pp.\ 125--136, 2019

    2019

  4. [12]

    Transferable perturbations of deep feature distributions

    Nathan Inkawhich, Kevin Liang, Lawrence Carin, and Yiran Chen. Transferable perturbations of deep feature distributions. In Proceedings of the International Conference on Learning Representations, 2019

    2019

  5. [13]

    Adversarial example generation with syntactically controlled paraphrase networks

    Mohit Iyyer, John Wieting, Kevin Gimpel, and Luke Zettlemoyer. Adversarial example generation with syntactically controlled paraphrase networks. In Proceedings of the Conference of the North American Chapter of the Association for Computational Linguistics: Human Language Tech...

    2018

  6. [14]

    Is bert really robust? a strong baseline for natural language attack on text classification and entailment

    Di Jin, Zhijing Jin, Joey Tianyi Zhou, and Peter Szolovits. Is bert really robust? a strong baseline for natural language attack on text classification and entailment. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp.\ 8018--8025, 2020

    2020

  7. [15]

    Align before fuse: vision and language representation learning with momentum distillation

    Junnan Li, Ramprasaath Selvaraju, Akhilesh Gotmare, Shafiq Joty, Caiming Xiong, and Steven Chu Hong Hoi. Align before fuse: vision and language representation learning with momentum distillation. pp.\ 9694--9705, 2021

    2021

  8. [16]

    Blip: bootstrapping language-image pre-training for unified vision-language understanding and generation

    Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: bootstrapping language-image pre-training for unified vision-language understanding and generation. In Proceedings of the International Conference on Machine Learning, pp.\ 12888--12900. PMLR, 2022

    2022

  9. [17]

    Bert-attack: adversarial attack against bert using bert

    Linyang Li, Ruotian Ma, Qipeng Guo, Xiangyang Xue, and Xipeng Qiu. Bert-attack: adversarial attack against bert using bert. In Proceedings of the Conference on Empirical Methods in Natural Language Processing, pp.\ 6193--6202, 2020

    2020

  10. [18]

    Nesterov accelerated gradient and scale invariance for adversarial attacks

    Jiadong Lin, Chuanbiao Song, Kun He, Liwei Wang, and John E Hopcroft. Nesterov accelerated gradient and scale invariance for adversarial attacks. In Proceedings of the International Conference on Learning Representations, 2019

    2019

  11. [19]

    Microsoft coco: common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll \'a r, and C Lawrence Zitnick. Microsoft coco: common objects in context. In Proceedings of the European Conference on Computer Vision, pp.\ 740--755, 2014

    2014

  12. [20]

    Delving into transferable adversarial examples and black-box attacks

    Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial examples and black-box attacks. In Proceedings of the International Conference on Learning Representations, 2016

    2016

  13. [21]

    On the convergence of an adaptive momentum method for adversarial attacks

    Sheng Long, Wei Tao, LI Shuohao, Jun Lei, and Jun Zhang. On the convergence of an adaptive momentum method for adversarial attacks. In Proceedings of the AAAI Conference on Artificial Intelligence, volume 38, pp.\ 14132--14140, 2024

    2024

  14. [22]

    Set-level guidance attack: boosting adversarial transferability of vision-language pre-training models

    Dong Lu, Zhiqiang Wang, Teng Wang, Weili Guan, Hongchang Gao, and Feng Zheng. Set-level guidance attack: boosting adversarial transferability of vision-language pre-training models. In Proceedings of the IEEE International Conference on Computer Vision, pp.\ 102--111, 2023

    2023

  15. [23]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In Proceedings of the International Conference on Learning Representations, 2018

    2018

  16. [24]

    Universal adversarial perturbations

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 1765--1773, 2017

    2017

  17. [25]

    Stress test evaluation for natural language inference

    Aakanksha Naik, Abhilasha Ravichander, Norman Sadeh, Carolyn Rose, and Graham Neubig. Stress test evaluation for natural language inference. In Proceedings of the International Conference on Computational Linguistics, pp.\ 2340--2353, 2018

    2018

  18. [26]

    Cross-domain transferability of adversarial perturbations

    Muzammal Naseer, Salman Khan, Muhammad Haris Khan, Fahad Shahbaz Khan, and Fatih Porikli. Cross-domain transferability of adversarial perturbations. In Proceedings of the International Conference on Neural Information Processing Systems, pp.\ 12905--12915, 2019

    2019

  19. [27]

    Flickr30k entities: collecting region-to-phrase correspondences for richer image-to-sentence models

    Bryan A Plummer, Liwei Wang, Chris M Cervantes, Juan C Caicedo, Julia Hockenmaier, and Svetlana Lazebnik. Flickr30k entities: collecting region-to-phrase correspondences for richer image-to-sentence models. In Proceedings of the IEEE International Conference on Computer Vision...

    2015

  20. [28]

    Generative adversarial perturbations

    Omid Poursaeed, Isay Katsman, Bicheng Gao, and Serge Belongie. Generative adversarial perturbations. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 4422--4431, 2018

    2018

  21. [29]

    Understanding and improving robustness of vision transformers through patch-based negative augmentation

    Yao Qin, Chiyuan Zhang, Ting Chen, Balaji Lakshminarayanan, Alex Beutel, and Xuezhi Wang. Understanding and improving robustness of vision transformers through patch-based negative augmentation. In Proceedings of the International Conference on Neural Information Processing Sy...

    2022

  22. [30]

    Learning transferable visual models from natural language supervision

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, et al. Learning transferable visual models from natural language supervision. In Proceedings of the International Conference on M...

    2021

  23. [31]

    Generating natural language adversarial examples through probability weighted word saliency

    Shuhuai Ren, Yihe Deng, Kun He, and Wanxiang Che. Generating natural language adversarial examples through probability weighted word saliency. In Proceedings of the Annual Meeting of the Association for Computational Linguistics, pp.\ 1085--1097, 2019

    2019

  24. [32]

    Grad-cam: visual explanations from deep networks via gradient-based localization

    Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: visual explanations from deep networks via gradient-based localization. In Proceedings of the IEEE International Conference on Computer Vision, pp.\ 618--626, 2017

    2017

  25. [33]

    Intriguing properties of neural networks

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Proceedings of the International Conference on Learning Representations, 2014

    2014

  26. [34]

    Llama: Open and efficient foundation language models

    Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timoth \'e e Lacroix, Baptiste Rozi \`e re, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023

    2023 arXiv

  27. [35]

    Boosting adversarial transferability by block shuffle and rotation

    Kunyu Wang, Xuanran He, Wenxuan Wang, and Xiaosen Wang. Boosting adversarial transferability by block shuffle and rotation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 24336--24346, 2024

    2024

  28. [36]

    Admix: enhancing the transferability of adversarial attacks

    Xiaosen Wang, Xuanran He, Jingdong Wang, and Kun He. Admix: enhancing the transferability of adversarial attacks. In Proceedings of the IEEE International Conference on Computer Vision, pp.\ 16158--16167, 2021 a

    2021

  29. [37]

    Structure invariant transformation for better adversarial transferability

    Xiaosen Wang, Zeliang Zhang, and Jianping Zhang. Structure invariant transformation for better adversarial transferability. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp.\ 4607--4619, 2023

    2023

  30. [38]

    Prototype-supervised adversarial network for targeted attack of deep hashing

    Xunguang Wang, Zheng Zhang, Baoyuan Wu, Fumin Shen, and Guangming Lu. Prototype-supervised adversarial network for targeted attack of deep hashing. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 16357--16366, 2021 b

    2021

  31. [39]

    Enhancing the self-universality for transferable targeted attacks

    Zhipeng Wei, Jingjing Chen, Zuxuan Wu, and Yu-Gang Jiang. Enhancing the self-universality for transferable targeted attacks. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 12281--12290, 2023

    2023

  32. [40]

    Improving transferability of adversarial examples with input diversity

    Cihang Xie, Zhishuai Zhang, Yuyin Zhou, Song Bai, Jianyu Wang, Zhou Ren, and Alan L Yuille. Improving transferability of adversarial examples with input diversity. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 2730--2739, 2019

    2019

  33. [41]

    Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability

    Yifeng Xiong, Jiadong Lin, Min Zhang, John E Hopcroft, and Kun He. Stochastic variance reduced ensemble adversarial attack for boosting the adversarial transferability. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.\ 14983--14992, 2022

    2022

  34. [42]

    Fooling vision and language models despite localization and attention mechanism

    Xiaojun Xu, Xinyun Chen, Chang Liu, Anna Rohrbach, Trevor Darrell, and Dawn Song. Fooling vision and language models despite localization and attention mechanism. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pp.\ 4951--4961, 2018

    2018

  35. [43]

    Vision-language pre-training with triple contrastive learning

    Jinyu Yang, Jiali Duan, Son Tran, Yi Xu, Sampath Chanda, Liqun Chen, Belinda Zeng, Trishul Chilimbi, and Junzhou Huang. Vision-language pre-training with triple contrastive learning. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.\ 156...

    2022

  36. [44]

    Vlattack: multimodal adversarial attacks on vision-language tasks via pre-trained models

    Ziyi Yin, Muchao Ye, Tianrong Zhang, Tianyu Du, Jinguo Zhu, Han Liu, Jinghui Chen, Ting Wang, and Fenglong Ma. Vlattack: multimodal adversarial attacks on vision-language tasks via pre-trained models. In Proceedings of the International Conference on Neural Information Process...

    2023

  37. [45]

    Modeling context in referring expressions

    Licheng Yu, Patrick Poirson, Shan Yang, Alexander C Berg, and Tamara L Berg. Modeling context in referring expressions. In Proceedings of the European Conference on Computer Vision, pp.\ 69--85. Springer, 2016

    2016

  38. [46]

    Towards adversarial attack on vision-language pre-training models

    Jiaming Zhang, Qi Yi, and Jitao Sang. Towards adversarial attack on vision-language pre-training models. In Proceedings of the ACM International Conference on Multimedia, pp.\ 5005--5013, 2022

    2022

  39. [47]

    A survey on image perturbations for model robustness: Attacks and defenses

    Peng-Fei Zhang and Zi Huang. A survey on image perturbations for model robustness: Attacks and defenses. 2024

    2024

  40. [48]

    Privacy protection in deep multi-modal retrieval

    Peng-Fei Zhang, Yang Li, Zi Huang, and Hongzhi Yin. Privacy protection in deep multi-modal retrieval. In Proceedings of the International ACM SIGIR Conference on Research and Development in Information Retrieval, pp.\ 634--643, 2021 a

    2021

  41. [49]

    Proactive privacy-preserving learning for cross-modal retrieval

    Peng-Fei Zhang, Guangdong Bai, Hongzhi Yin, and Zi Huang. Proactive privacy-preserving learning for cross-modal retrieval. ACM Transactions on Information Systems, 41 0 (2): 0 1--23, 2023

    2023

  42. [50]

    Universal adversarial perturbations for vision-language pre-trained models

    Peng-Fei Zhang, Zi Huang, and Guangdong Bai. Universal adversarial perturbations for vision-language pre-trained models. In Proceedings of the International ACM SIGIR Conference on Research and Development in Information Retrieval, pp.\ 862--871, 2024

    2024

  43. [51]

    Adversarial robustness through the lens of causality

    Yonggang Zhang, Mingming Gong, Tongliang Liu, Gang Niu, Xinmei Tian, Bo Han, Bernhard Sch \"o lkopf, and Kun Zhang. Adversarial robustness through the lens of causality. In Proceedings of the International Conference on Learning Representations, 2021 b

    2021

  44. [52]

    On evaluating adversarial robustness of large vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongxuan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. In Proceedings of the International Conference on Neural Information Processing Systems, pp.\ 54111--54138, 2023

    2023

  45. [53]

    Minigpt-4: Enhancing vision-language understanding with advanced large language models

    Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. arXiv preprint arXiv:2304.10592, 2023 a

    2023 arXiv

  46. [54]

    Efficient query-based black-box attack against cross-modal hashing retrieval

    Lei Zhu, Tianshi Wang, Jingjing Li, Zheng Zhang, Jialie Shen, and Xinhua Wang. Efficient query-based black-box attack against cross-modal hashing retrieval. ACM Transactions on Information Systems, 41 0 (3): 0 1--25, 2023 b

    2023

  47. [55]

    @esa (Ref

    \@ifxundefined[1] #1\@undefined \@firstoftwo \@secondoftwo \@ifnum[1] #1 \@firstoftwo \@secondoftwo \@ifx[1] #1 \@firstoftwo \@secondoftwo [2] @ #1 \@temptokena #2 #1 @ \@temptokena \@ifclassloaded agu2001 natbib The agu2001 class already includes natbib coding, so you should ...

  48. [56]

    \@lbibitem[] @bibitem@first@sw\@secondoftwo \@lbibitem[#1]#2 \@extra@b@citeb \@ifundefined br@#2\@extra@b@citeb \@namedef br@#2 \@nameuse br@#2\@extra@b@citeb \@ifundefined b@#2\@extra@b@citeb @num @parse #2 @tmp #1 NAT@b@open@#2 NAT@b@shut@#2 \@ifnum @merge>\@ne @bibitem@firs...

  49. [57]

    X"bDls= L9 l֡33*!ںj@vp?3m endstream endobj 26 0 obj << /Filter /FlateDecode /Length 249 >> stream xMQI 0 @!^CC 9 X 1 ,=!s7 ٻYz

    @open @close @open @close and [1] URL: #1 \@ifundefined chapter * \@mkboth \@ifxundefined @sectionbib * \@mkboth * \@mkboth\@gobbletwo \@ifclassloaded amsart * \@ifclassloaded amsbook * \@ifxundefined @heading @heading NAT@ctr thebibliography [1] @ \@biblabel @NAT@ctr \@bibset...

Pith tools

Reviewed August 8, 2026 · model on record in the stance chip above.