攻击者可微调文档内容，让OCR-free模型答错却看不出异常。
Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering
- 设计视觉无感但语义精准的伪造攻击，诱导模型输出错误答案。
- 在Pix2Struct和Donut上成功实现目标误导与系统性失效。
- 揭示当前文档问答模型的脆弱性，适合安全与鲁棒性研究者参考。
文档视觉问答（DocVQA）实现了基于文档内容的端到端推理。尽管近期模型表现优异，但仍易受对抗攻击影响。本文提出一种新型攻击场景：通过视觉上难以察觉但语义精确的伪造方式修改文档内容，使攻击者能诱导特定或普遍错误的答案。我们开发了针对不同攻击目标的专用攻击算法，涵盖定向误导与系统性失败。实验验证了该方法对两种最先进的端到端模型的有效性：Pix2Struct（联合处理图像与文本的视觉语言变换器）和Donut（直接从文档图像中提取文本并回答问题的Transformer模型）。结果揭示了当前DocVQA系统的重大安全隐患，亟需更鲁棒的防御机制。代码已开源：https://github.com/pralab/adv-docVQA。
原文摘要 · Abstract (English)
Document Visual Question Answering (DocVQA) enables end-to-end reasoning grounded on information present in a document input. While recent models have shown impressive capabilities, they remain vulnerable to adversarial attacks. In this work, we introduce a novel attack scenario that aims to forge document content in a visually imperceptible yet semantically targeted manner, allowing an adversary to induce specific or generally incorrect answers from a DocVQA model. We develop specialized attack algorithms that can produce adversarially forged documents tailored to different attackers' goals, ranging from targeted misinformation to systematic model failure scenarios. We demonstrate the effectiveness of our approach against two end-to-end state-of-the-art models: Pix2Struct, a vision-language transformer that jointly processes image and text through sequence-to-sequence modeling, and Donut, a transformer-based model that directly extracts text and answers questions from document images. Our findings highlight critical vulnerabilities in current DocVQA systems and call for the development of more robust defenses. We release our open source code at https://github.com/pralab/adv-docVQA.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。