对比两款视觉大模型在对抗攻击下的表现，发现性能越高的模型反而更脆弱。
Adversarial Robustness of Vision in Open Foundation Models
- 用PGD攻击测试视觉模型的抗干扰能力
- Llama 3.2 Vision在高干扰下性能下降更小
- 模型鲁棒性与基准性能无直接关联
随着深度学习的发展，理解AI系统如何识别物体变得愈发困难。攻击者可通过添加未见元素修改图像，误导AI识别。本文研究了LLaVA-1.5-13B和Meta Llama 3.2 Vision-8B-2在无目标PGD攻击下的视觉模态鲁棒性，并在VQA v2数据集子集上进行实证评估。使用标准VQA准确率量化攻击效果，并对比两模型在攻击前后的准确率下降。结果表明，尽管Llama 3.2 Vision基线准确率较低，但在高扰动水平下性能下降幅度小于LLaVA。研究证实，视觉模态是当前开源视觉语言模型（VLMs）的有效攻击路径，且对抗鲁棒性与标准基准性能无直接相关性，可能受架构和训练因素影响。
原文摘要 · Abstract (English)
With the increase in deep learning, it becomes increasingly difficult to understand the model in which AI systems can identify objects. Thus, an adversary could aim to modify an image by adding unseen elements, which will confuse the AI in its recognition of an entity. This paper thus investigates the adversarial robustness of LLaVA-1.5-13B and Meta's Llama 3.2 Vision-8B-2. These are tested for untargeted PGD (Projected Gradient Descent) against the visual input modality, and empirically evaluated on the Visual Question Answering (VQA) v2 dataset subset. The results of these adversarial attacks are then quantified using the standard VQA accuracy metric. This evaluation is then compared with the accuracy degradation (accuracy drop) of LLaVA and Llama 3.2 Vision. A key finding is that Llama 3.2 Vision, despite a lower baseline accuracy in this setup, exhibited a smaller drop in performance under attack compared to LLaVA, particularly at higher perturbation levels. Overall, the findings confirm that the vision modality represents a viable attack vector for degrading the performance of contemporary open-weight VLMs, including Meta's Llama 3.2 Vision. Furthermore, they highlight that adversarial robustness does not necessarily correlate directly with standard benchmark performance and may be influenced by underlying architectural and training factors.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。