arXiv:2511.09064cs.CV2025-11中稿 · AAAI被引 2

提升视觉语言模型抗攻击能力,通过多样化的对抗反制增强鲁棒性。

Diversifying Counterattacks: Orthogonal Exploration for Robust CLIP Inference

  • 引入正交梯度与动量更新,扩展反制扰动搜索空间。
  • 在16个数据集上显著提升抗攻击能力,同时保持良好正常精度。
  • 适合关注模型安全性与测试时防御的研究者。

视觉-语言预训练模型(VLPs)具备强大的多模态理解与零样本泛化能力,但仍易受对抗样本影响,威胁其可靠性。近期工作测试时反制(TTC)通过使用PGD生成最大化嵌入偏移的扰动来提升鲁棒性,但因对抗攻击与反制目标本质不同,仅依赖对抗输入的梯度会使搜索局限于狭窄空间,导致反制过拟合特定攻击模式,缺乏多样性。本文提出方向正交反制(DOC),通过引入正交梯度方向和动量更新,拓展反制空间,提升扰动多样性,从而发现更具泛化性的反制策略。同时,设计基于平均余弦相似度的方向敏感度评分,增强样本区分能力并自适应调节反制强度。在16个数据集上的大量实验表明,DOC在多种攻击下均显著提升鲁棒性,且保持竞争力的干净准确率。代码已开源。

原文摘要 · Abstract (English)

Vision-language pre-training models (VLPs) demonstrate strong multimodal understanding and zero-shot generalization, yet remain vulnerable to adversarial examples, raising concerns about their reliability. Recent work, Test-Time Counterattack (TTC), improves robustness by generating perturbations that maximize the embedding deviation of adversarial inputs using PGD, pushing them away from their adversarial representations. However, due to the fundamental difference in optimization objectives between adversarial attacks and counterattacks, generating counterattacks solely based on gradients with respect to the adversarial input confines the search to a narrow space. As a result, the counterattacks could overfit limited adversarial patterns and lack the diversity to fully neutralize a broad range of perturbations. In this work, we argue that enhancing the diversity and coverage of counterattacks is crucial to improving adversarial robustness in test-time defense. Accordingly, we propose Directional Orthogonal Counterattack (DOC), which augments counterattack optimization by incorporating orthogonal gradient directions and momentum-based updates. This design expands the exploration of the counterattack space and increases the diversity of perturbations, which facilitates the discovery of more generalizable counterattacks and ultimately improves the ability to neutralize adversarial perturbations. Meanwhile, we present a directional sensitivity score based on averaged cosine similarity to boost DOC by improving example discrimination and adaptively modulating the counterattack strength. Extensive experiments on 16 datasets demonstrate that DOC improves adversarial robustness under various attacks while maintaining competitive clean accuracy. Code is available at https://github.com/bookman233/DOC.

对抗防御CLIP多模态鲁棒性

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。