arXiv:2607.18958cs.CVcs.AI2026-07

用双监督机制提升视觉语言模型抗攻击能力,跨任务通用性强。

Dual Adversarial Fine-tuning for Enhancing Robustness of Large Vision Language Model

论文配图:Dual Adversarial Fine-tuning for Enhancing Robustness of Large Vision Language Model
图 1 · 摘自论文原文
  • 通过视觉与语义双分支监督,联合优化模型鲁棒性。
  • 在零样本分类、图像描述和VQA任务上均超越现有最优方法。
  • 替换原模型的CLIP编码器即可实现跨任务防护,无需重训。

大型视觉语言模型(如LLaVA和GPT-4V)虽表现卓越,但其视觉输入仍易受对抗攻击,存在重大安全风险。现有防御方法多针对单一任务(如零样本分类),缺乏跨多模态任务的泛化能力。为此,本文提出一种双对抗微调框架,通过联合优化来自两个模态的视觉与语义监督信号,增强模型鲁棒性并实现跨下游任务的泛化。该框架包含两个核心组件:视觉监督分支利用冻结的原始视觉编码器从干净图像中提取特征以指导鲁棒性训练;语义监督分支引入图文对齐作为上下文信号,确保攻击下语义一致性。此外,本方法仅需替换原模型中的CLIP视觉编码器即可实现跨任务鲁棒性,无需任务特定重训或架构修改。大量实验表明,该方法在零样本分类、图像描述和视觉问答(VQA)任务上的对抗鲁棒性评估中均优于当前最优方法。

原文摘要 · Abstract (English)

While Large Vision-Language Models (LVLMs), represented by LLaVA and GPT-4V, have demonstrated remarkable capabilities, their visual inputs remain vulnerable to adversarial attacks, posing significant security risks. Existing defense methods predominantly target single-task scenarios (e.g., zero-shot classification) and consequently lack generalizability across various multimodal tasks. To address this limitation, we propose a dual adversarial fine-tuning framework that jointly optimizes visual and semantic supervision signals from two modalities, enhancing model robustness while generalizing across multiple downstream tasks. The proposed framework comprises two core components, i.e., $\textbf{Visual}$ supervision branch and $\textbf{Semantic}$ supervision branch. The former branch leverages features from clean images, extracted via a frozen original vision encoder, to guide adversarial robustness while the latter incorporates caption-image alignment as a contextual signal to preserve semantic coherence under attack. Moreover, our method achieves cross-task robustness by simply replacing the CLIP vision encoder in the original model, with no need of separate task-specific retraining or architecture modifications.Extensive experiments demonstrate that our approach outperforms the state-of-the-art method in adversarial robustness evaluation across zero-shot classification, image captioning, and visual question answering (VQA) tasks.

视觉语言模型对抗攻击鲁棒性双监督

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。