Skip to content

Back to the catalog

Detecting Adversarial Images through Response Profiles of Vision-Language Models
arxiv.orgpaper

Detecting Adversarial Images through Response Profiles of Vision-Language Models

This paper introduces a detector for adversarial images targeting frozen vision-language models (VLMs) by building a 'response profile' from how an image interacts with a bank of general semantic prompts — using category-level statistics, inter-prompt relationships, deviation from clean reference distributions, and stability under weak image transforms, then classifying that compact profile with a lightweight model. Evaluated across multiple public datasets, several CLIP-style visual backbones, and gradient-based, optimization-based, automated, and spatial attacks, the method outperforms embedding-geometry baselines, generalizes partially to unseen attacks, and is tested against detector-aware adaptive attacks.

TL;DR A response-profile-based detector flags adversarial images fed to frozen CLIP-style VLMs, beating embedding-geometry baselines even under adaptive attacks.
Open original ↗
Document

What it is

A detector for adversarial images against frozen CLIP-style vision-language models, built from the University of New Brunswick's Trustworthy and Secure AI Lab. The core unit of analysis is a "response profile": instead of looking at a single confidence score or embedding distance, the method looks at the full vector of image-text similarities produced when an image is scored against a bank of general semantic prompts (separate from the dataset's classification prompts).

How it works

The pipeline builds five feature groups from this similarity vector, all on a frozen VLM:

  • Category-level statistics: prompts are grouped into K semantic categories (paper specifies seven); for each category it computes positive semantic mass, mean, standard deviation, and max response, then derives a normalized category distribution, its entropy (diffuse vs. concentrated response), and the margin between the top two category masses.
  • Graph-structured representation: prompts become nodes in a graph built from top-r nearest-neighbor similarity of their text embeddings. A graph Laplacian over this structure yields a global smoothness score and per-node deviation values, summarized by max, mean, variance, and the mean of the k largest deviations — catching whether an image's semantic irregularity is localized to a few prompts or spread across many.
  • Semantic residual modeling: per-category clean mean and covariance are estimated from clean training data; the live response's deviation from this reference is a residual feature (the page's text cuts off mid-definition here).
  • Graph diffusion and transformation-stability features (smoothing over the prompt graph; response change under weak image transforms) are mentioned as the remaining two components but not detailed before the fetched text ends.

All of these are concatenated into one compact vector and classified by a lightweight MLP — the VLM backbone, text encoder, and prompt graph stay frozen; only this small classifier is trained.

Preconditions / Affected

Applies to CLIP-style VLMs under white-box attack, where the adversary has access to the image encoder, class-level text embeddings, logits, and gradients to craft perturbations via the classification loss (PGD, MI-FGSM, CW, AutoAttack, flow-based attacks). Backbones tested: ViT-B/16, ViT-B/32, ConvNeXt. Datasets: CIFAR-10, STL-10, Tiny-ImageNet.

What to do

No commands or config — this is a detection methodology, not an operational tool or patch. Teams building adversarial-robustness tooling for VLM-based classifiers could reproduce the feature construction (category stats + prompt graph Laplacian + clean-reference residuals + stability-under-transform) as a detection layer in front of a frozen CLIP-style model, training only the lightweight MLP head.

Caveats

The fetched page cuts off mid-section (residual modeling definition incomplete; graph diffusion and transformation stability not described at all), so the full feature formulas and the detector-aware adaptive attack results referenced in the abstract aren't available from this text.

Technologies named here

Techniques named here

  • Gradient-based adversarial attacks
  • Optimization-based adversarial attacks
  • Automated adversarial attacks
  • Spatial adversarial attacks
  • Detector-aware adaptive attacks
  • Response-profile based adversarial image detection

Related in AI Security