用网页中的非匹配文字和图形元素攻击视觉语言模型，成功率可达100%
Web Artifact Attacks Disrupt Vision Language Models
- 通过搜索网页中非匹配文本与图形符号，构造新型干扰攻击
- 在五个数据集上实现最高100%攻击成功率，跨模型迁移达90%
- 揭示现有防御机制局限性，为提升模型鲁棒性提供新思路
视觉语言模型（如CLIP、LLaVA）在大规模轻度筛选的网络数据集上训练，学习到语义概念与无关视觉信号之间的意外关联，导致模型预测依赖偶然模式而非真实视觉理解。已有研究利用这些关联进行攻击，例如在图像上添加欺骗性类别文本的“字体攻击”。此类攻击成功源于模型对文本的过度依赖——由于图像描述中重复可见文字而非内容描述。然而，现有方法仅针对与目标类别完全匹配的文本，忽略了更广泛的关联，包括不匹配文本和图形符号，这些多源于网络数据中丰富的品牌内容。为此，我们提出“基于制品”的攻击：一种新型操纵方式，使用不匹配文本与图形元素误导模型。与传统字体攻击不同，这些制品未预先设定，使其更难防御且难以发现。我们将其建模为搜索问题，并在五个数据集上验证其有效性，部分制品可协同作用，实现100%攻击成功率。攻击在模型间具有高达90%的迁移能力，可攻击未见过的模型。为防御，我们扩展了先前的制品感知提示机制至图形场景，结果显示相比标准提示，成功率下降最多15%，表明该方向具备提升模型鲁棒性的潜力。
原文摘要 · Abstract (English)
Vision-language models (VLMs) (e.g. CLIP, LLaVA) are trained on large-scale, lightly curated web datasets, leading them to learn unintended correlations between semantic concepts and unrelated visual signals. These associations degrade model accuracy by causing predictions to rely on incidental patterns rather than genuine visual understanding. Prior work has weaponized these correlations as an attack vector to manipulate model predictions, such as inserting a deceiving class text onto the image in a "typographic" attack. These attacks succeed due to VLMs' text-heavy bias-a result of captions that echo visible words rather than describing content. However, this attack has focused solely on text that matches the target class exactly, overlooking a broader range of correlations, including non-matching text and graphical symbols, which arise from the abundance of branding content in web-scale data. To address this gap, we introduce "artifact-based" attacks: a novel class of manipulations that mislead models using both non-matching text and graphical elements. Unlike typographic attacks, these artifacts are not predefined, making them simultaneously harder to defend against and more challenging to find. We address this by framing artifact attacks as a search problem and demonstrate their effectiveness across five datasets, with some artifacts reinforcing each other to reach 100% attack success rates. These attacks transfer across models with up to 90% effectiveness, making it possible to attack unseen models. To defend against these attacks, we extend prior work's artifact aware prompting to the graphical setting. We see a moderate reduction of success rates of up to 15% relative to standard prompts, suggesting a promising direction for enhancing model robustness. Code: https://github.com/mqraitem/Web-Artifact-Attacks
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。