Improving Generalizability and Undetectability for Targeted Adversarial Attacks on Multimodal Pre-trained Models

In plain words

Many AI systems place pictures and sentences in one shared space, so a picture can be compared with a sentence. An attacker can change a picture slightly so the system treats it as matching a sentence of the attacker's choice. The earlier version of this attack was tuned to one exact sentence. If the wording changed to a close synonym, the fooling dropped sharply. Those attacked pictures also looked unusual in the shared space, so simple outlier detectors could flag them.

The method in this paper, called Proxy Targeted Attack, tries to fix both problems. Instead of one target sentence, it uses several sentences that describe the same idea. It also uses several ordinary pictures of the kind being attacked, so the changed picture stays among normal ones. The authors argue that these two goals pull against each other, and they give a mathematical account of that trade-off. The method is tested on three multimodal models, on two tasks (classifying a picture against text labels, and searching pictures with text queries), and against four standard outlier detectors.

It is a security study. It shows how a poisoned picture could surface in a search index or get past a classifier, and it treats detection of such pictures as one possible complementary defence.

TL;DR

PTA optimises an image so that its embedding is close to several text proxies for the target concept and close to benign source-image proxies, weighted by a balance factor α eq. 4 §4.1. The perturbation is limited in the ℓ∞ norm, and the experiments use PGD with 100 iterations at ε = 8/255 §5.1. Author-reported: 98.31% average classification ASR and 77.72% average retrieval R@1 ASR without defense, falling to 84.17% and 61.80% under the anomaly-detection defense tab. 2 tab. 3. No official code was found at compile time.

Problem

Targeted attacks on multimodal pre-trained models such as ImageBind move an input's embedding toward a chosen target embedding, so cross-modal matching returns the wrong result §1. The paper names two limits of the prior single-target method, Illusion Attack §1 §3.2 §3.3:

• Limited generalizability. The attacker usually knows only part of the target: a keyword, a category or a sample query. An example aligned to one exact text fails on semantically similar texts. The paper's example is an elephant image that ranks first for "A photo of an elephant" but drops sharply for "A walking elephant" fig. 1.
• Limited undetectability. Attacked embeddings lie outside the benign data region, so simple anomaly detectors (kNN, LOF, Isolation Forest and PCA) flag them and their success after detection falls §1 §3.3 tab. 1. Adding more target examples improves generalizability but pushes the attacked embeddings further from the source-modal reference points §1 fig. 2.

The threat model: the adversary picks source-modal inputs, knows a prior Q that defines a distribution of plausible targets, and never sees the true target §3.1 §3.2. Scenarios named are content moderation with private prompts and product search where a seller injects an image into a gallery §3.1. Retrieval poisoning is evaluated by injecting adversarial images into an MSCOCO gallery §5.2 tab. 4. The paper treats detection of adversarial embeddings as a complementary defence to adversarial fine-tuning §2.

Method

Overview. PTA keeps the standard targeted-attack setting (an image encoder f_S, a text or image encoder f_T for the target modality, cosine similarity τ) and changes the objective in two ways. It replaces the single target with a set of target-modal proxies, and it adds a term that keeps the adversarial embedding near source-modal proxies §4.1.

1. Threat model and objective. The adversary maximises the match τ(f_S(x_δ), f_T(y_t)) for an unknown true target y_t, inside an ℓ∞ ball of radius ε around the clean input x §3.1. Generalizability is the expected match over the target distribution conditioned on Q §3.2 (unnumbered in the paper).
2. Undetectability as outlier score. A detector scores each embedding. Items above the (1 − r) quantile of the scores are outliers, where r is a pre-set anomaly ratio §3.3 (unnumbered).
3. Relaxed trade-off. In embedding space, the adversary minimises the expected squared distance to target embeddings while keeping the expected squared distance to source embeddings below a threshold β eq. 1 §3.4. Theorem 1 gives the optimum value §3.4.
4. Target-proxy loss. L_G averages one minus the cosine similarity to N_c target-modal proxies ŷ_j, sampled from the estimated target distribution eq. 2 §4.1.
5. Source-proxy loss. L_D averages the L2 distance from the adversarial embedding to N_s source-modal proxies x̂_i, sampled from the estimated source distribution eq. 3 §4.1.
6. Combined objective. Minimise L_G + α·L_D over x_δ, subject to ||x_δ − x||∞ ≤ ε eq. 4 §4.1. α balances generalizability (small α) and undetectability (large α) §5.5.
7. Proxy construction. For classification, target proxies come from handcrafted templates and LLM-written category descriptions, and source proxies are same-category images §5.1 §5.7.1. For retrieval, target proxies are captions containing the target keyword, split from the true queries, and source proxies are the images paired with those captions §5.1 §5.7.1.
8. Optional proxy cleaning. ProxySelect removes near-duplicates, removes outliers by an anchor-similarity rule and keeps one medoid per cluster of a spherical k-means run alg. 1 §5.7.2. The paper does not say whether the main tables used it §5.7.2.
9. Optimiser. The method section does not name one. The experiments use PGD under ℓ∞ with 100 iterations §5.1.

Key equations. Equation 1 is the relaxed embedding problem, equations 2 to 4 are the PTA losses:

\min_{\mathbf{v}} \ \mathbb{E}_{\mathbf{y}}\left[\|\mathbf{v}-f_{\theta_T}(\mathbf{y})\|_2^2\right] \quad \text{s.t.} \quad \mathbb{E}_{\mathbf{x}}\left[\|\mathbf{v}-f_{\theta_S}(\mathbf{x})\|_2^2\right] \le \beta eq. 1

\mathcal{L}_G(\mathbf{x}_\delta) = 1 - \frac{1}{N_c}\sum_{j=1}^{N_c} \tau\big(f_{\theta_S}(\mathbf{x}_\delta),\, f_{\theta_T}(\hat{\mathbf{y}}_j)\big) eq. 2

\mathcal{L}_D(\mathbf{x}_\delta) = \frac{1}{N_s}\sum_{i=1}^{N_s} \big\|f_{\theta_S}(\mathbf{x}_\delta) - f_{\theta_S}(\hat{\mathbf{x}}_i)\big\|_2 eq. 3

\arg\min_{\mathbf{x}_\delta} \ \mathcal{L}_G(\mathbf{x}_\delta) + \alpha\, \mathcal{L}_D(\mathbf{x}_\delta) \quad \text{s.t.} \quad \|\mathbf{x}_\delta - \mathbf{x}\|_\infty \le \epsilon eq. 4

Theorem 1 (embedding-space trade-off) §3.4. Write Δ = E[f_T(y)] − E[f_S(x)] for the modality gap, σ_T = tr Var[f_T(y)] and σ_S = tr Var[f_S(x)]. Assume β ≥ σ_S. Then the optimum of eq. 1 is

\min_{\mathbf{v}} L(\mathbf{v}) = \Big(\max\big\{\|\boldsymbol{\Delta}\|_2 - \sqrt{\beta - \sigma_S},\ 0\big\}\Big)^2 + \sigma_T

with optimal v = μ_S + √(β − σ_S)·Δ/‖Δ‖ when ‖Δ‖ > √(β − σ_S), and v = μ_T otherwise (μ denotes the expected embedding). The proof relies on Lemma 1, which splits E‖x − y‖² into a squared-bias term and a trace-of-variance term §3.4.

Theorem 2 (source-proxy lower bound) §4.2. Let P_S be the convex hull of the source-proxy embeddings v̂_i, let h_S(v) be the distance from v to that hull, and let B = min_i τ(v̂_i, t), where t is the true-target embedding and all embeddings are unit norm. Then τ(v, t) ≥ B if v is inside the hull, and τ(v, t) ≥ B − h_S(v) otherwise.

Theorem 3 (target-proxy coverage bound) §4.2. The same form with target proxies: with P_T the hull of the target-proxy embeddings, h_T(t) the distance from t to that hull and B = min_j τ(v, ẑ_j), τ(v, t) ≥ B if t is inside the hull, and τ(v, t) ≥ B − h_T(t) otherwise.

Why one target fails §4.3. For a single target z_0 that the attack matches to within η (τ ≥ 1 − η), the expected generalizability over the target distribution is bounded by ‖μ_T‖² + √(2η) = 1 − tr Var[z] + √(2η) when z_0 is itself drawn from the distribution. With N_c proxies, the averaged target direction has expected squared error tr Var[z] / N_c under representative sampling §4.3.

Pseudocode of the PTA loop. The paper gives the objective but no loop. The sketch below follows eqs. 2 to 4 and the experiment settings. The start point, step size and pixel-range clipping are not stated, so they are marked.

# PTA: optimise one batch of adversarial images  [§4.1] [eq. 4]
# Input:  images (B, 3, H, W) clean source-modal inputs
#         target_proxies (N_c, d) unit-norm target-modal embeddings
#         source_proxies (N_s, d) source-encoder embeddings of benign inputs
#         alpha, epsilon (l_inf radius, 8/255 in the experiments)
# Output: adversarial images (B, 3, H, W) with ||x_adv - x||_inf <= epsilon

def pta_attack(images, target_proxies, source_proxies, alpha, epsilon):
    # Start from the clean images; the start point is not stated  [§5.1]
    adversarial = images.clone()
    for _ in range(100):  # PGD iterations used in the experiments  [§5.1]
        # Embed the current adversarial images with the source encoder  [§4.1]
        embeddings = encode_source(adversarial)           # (B, d)
        # Mean cosine to the target-modal proxies, per image  [eq. 2]
        similarity = mean(cosine(embeddings, target_proxies), axis=1)
        loss_target = 1 - similarity                      # (B,)
        # Mean L2 distance to the source-modal proxies, per image  [eq. 3]
        distance = mean(l2(embeddings, source_proxies), axis=1)  # (B,)
        # Weighted sum, averaged over the batch  [eq. 4]
        loss = mean(loss_target + alpha * distance)
        # Gradient of the loss with respect to the image pixels  [eq. 4]
        grad = gradient(loss, adversarial)
        # Descent step on the gradient sign (PGD); step size not stated  [§5.1]
        adversarial = adversarial - step_size * sign(grad)
        # Project into the epsilon ball around the clean images  [eq. 4]
        adversarial = clip(adversarial, images - epsilon, images + epsilon)
    return adversarial

ProxySelect alg. 1 §5.7.2. The only algorithm in the paper. It cleans the keyword-retrieved target candidates in three passes.

# ProxySelect: choose N_T target-modal proxies  [alg. 1] [§5.7.2]
# Input:  candidates (M, d) unit-norm target-modal embeddings
#         concept_anchor (d,) unit-norm embedding of the concept
#         budget N_T (number of proxies to keep)
# Output: proxies (N_T, d), one medoid per cluster

def proxy_select(candidates, concept_anchor, budget):
    # Greedy deduplication: keep a candidate only if its cosine to every
    # previously kept candidate is below 0.95  [alg. 1]
    kept = []
    for candidate in candidates:
        if all(dot(candidate, other) < 0.95 for other in kept):
            kept.append(candidate)
    # Outlier removal: drop candidates whose cosine to the anchor is below
    # the median minus 3 times the MAD of those cosines  [alg. 1]
    scores = [dot(candidate, concept_anchor) for candidate in kept]
    threshold = median(scores) - 3 * mad(scores)
    kept = [c for c, s in zip(kept, scores) if s >= threshold]
    # Spherical k-means seeded by farthest points, at most 25 rounds  [alg. 1]
    centres = farthest_point_seeds(kept, budget)
    previous = None
    for _ in range(25):
        assignment = nearest_by_cosine(kept, centres)
        if assignment == previous:
            break
        previous = assignment
        centres = normalise(mean_per_cluster(kept, assignment))
    # Keep the member most similar to each centre as its medoid  [alg. 1]
    return [medoid(kept, assignment, k, centres[k]) for k in range(budget)]

Hyperparameters

Results

Author-reported. Setup: three multimodal encoders (ImageBind, LanguageBind, One-PEACE). Classification uses zero-shot class prompts; retrieval uses text-to-image queries. Metrics are classification ASR (share classified as the target class) and R@K ASR (share of AEs retrieved in the top K that match the true target). ASRD is the share of all attempts that both evade detection and succeed §5.1. Baselines are Illusion Attack, CrossFire and MF-ii (targeted), and Sep-Attack, Co-Attack, SGA and CMI-Attack (untargeted, used only for gallery poisoning) §5.1. The table cells carry a small subscript that the text does not define; the tables below show the main value only. The Average column is the plain mean of the six cells, which I checked for tables 2 and 3.

Headline numbers (author-reported):

• Classification, no defense: PTA averages 98.31% vs 93.18% for Illusion Attack tab. 2 §5.2.
• Classification, anomaly-detection defense: PTA averages 84.17% ASRD vs 20.04% for Illusion Attack tab. 2.
• Retrieval, no defense: PTA averages 77.72% R@1 ASR vs 46.49% for Illusion Attack tab. 3.
• Retrieval, anomaly-detection defense: PTA averages 61.80% R@1 ASRD vs 14.84% for Illusion Attack tab. 3.
• Gallery poisoning with 1% injected AEs, ImageBind: R@1 falls from 41.02 to 20.04 tab. 4.
• Black box: PTA is above Illusion Attack in all 16 cells of tab. 6 and in all 12 pairs of tab. 7.

Anomaly ranks (LanguageBind AEs, 100 reference points) tab. 1. Higher means harder to detect (the paper's wording: a larger rank indicates higher undetectability).

White-box classification, ASR and ASRD (%) tab. 2. Columns: XmediaNet (ImageBind, LanguageBind, One-PEACE), ImageNet (same three), Average.

(XI = XmediaNet ImageBind, XL = XmediaNet LanguageBind, XO = XmediaNet One-PEACE; II, IL, IO the same for ImageNet. "yes" means the anomaly-detection defense is on, and the values are ASRD.)

White-box retrieval, R@1 ASR and ASRD (%) tab. 3. Columns: XmediaNet (three models), MSCOCO (three models), Average.

(MI, ML, MO = MSCOCO ImageBind, LanguageBind, One-PEACE.)

Gallery poisoning, R@1 after injecting AEs into the MSCOCO image gallery (drop from the no-attack row in brackets) tab. 4. Injection ratio is the share of injected images.

Model geometry (diagnostic) tab. 5. Each cell holds two values. The text writes "source/target" §5.2, which suggests that order, but the table does not label them.

Black-box, Square attack (ε = 16/255), ASR (%) tab. 6. Columns: classification on XmediaNet and ImageNet, retrieval on XmediaNet and MSCOCO, each for ImageBind and LanguageBind.

(XI / XL = XmediaNet classification ImageBind / LanguageBind; II / IL = ImageNet classification; RXI / RXL = XmediaNet retrieval; RMI / RML = MSCOCO retrieval.)

Transfer, ImageNet zero-shot classification, ε = 8/255, Cls ASR (%) tab. 7. Each entry is Illusion Attack → PTA; rows are surrogate encoders, columns target encoders.

Textual and audio AEs (ASR and ASRD in %) tab. 8. Columns show no defense and with defense for each source modality.

Limited prior knowledge, MSCOCO R@1 ASR (%) tab. 9. Known entity sets vary from one to three keywords.

Unknown target modality (audio targets, XmediaNet), ASR (%) tab. 10. The attacker optimises against image and text only.

Additional audio datasets, no defense, ASR (%) tab. 12. The paper says these were added to cover AudioSet and AudioCaps with AudioCLIP.

Adversarial fine-tuning (TeCoA on CLIP ViT-B/32), ASR (%) tab. 11. Columns: classification on XmediaNet and ImageNet; retrieval on XmediaNet and MSCOCO.

Input transformations, LanguageBind on XmediaNet, retrieval R@1 ASR (%) tab. 13. The three transformations act as defences. The noise is optimised through differentiable approximations of them §5.4.

DiffPure, LanguageBind on XmediaNet, ASR (%) tab. 14. An adaptive BPDA+EOT attack is also used §5.4.

Prompt variety, ImageNet classification, ε = 4/255, Cls ASR (%) tab. 15. Rows give the training prompts, columns the test prompts.

Compute overhead tab. 16. ImageBind on an NVIDIA V100, 100 target proxies and 50 source proxies, per epoch.

Proxy quality, ImageNet classification, ImageBind, Cls ASRD (%) tab. 17. Columns: standard prompts (baseline), biased ChatGPT-style prompts, noisy Waffle-style prompts §5.7.3.

Proxy quality, MSCOCO retrieval, ImageBind, R@1 ASR (%) tab. 18. Columns: baseline, biased proxies (a narrow context subset), distant queries.

Single target versus PTA, MSCOCO retrieval, ImageBind (averaged over three concepts) tab. 19.

ProxySelect ablation on noisy target pools, R@1 ASR and ASRD (%) tab. 20. Random selection versus ProxySelect.

Cross-domain proxies, ImageBind, ASR / ASRD (%) tab. 21. Same-domain controls use proxies and targets from one dataset.

Ablations described in the text (no table). The α sweep is shown only in fig. 4 for classification (α from 0 to 1.0) and retrieval (α from 0 to 0.8); the text says lower α favours generalizability and higher α favours undetectability §5.5. The heatmap of proxy counts is fig. 5. The text reports that a few dozen proxies suffice §5.5. For diversity of target proxies, decomposed prompts keep a share ρ of context words §5.7.4. With the proxy count fixed, retrieval R@1 ASR rises from about 1% to about 55% and ASRD from about 1% to about 42% as ρ increases; classification Cls ASR rises from about 42% to about 48% and ASRD from about 41% to about 47% §5.7.4 fig. 6. The text does not state the ρ values at those endpoints.

Figures described in words. fig. 1 shows the elephant rank drop in retrieval and the classification fooling with an exact prompt. fig. 2 is a t-SNE of the embedding space for three strategies: single-target, adding target-modal examples, and PTA. fig. 3 compares ASR*, ASR and ASRD, where ASR* is the success with the true target known §3.2. Figure values beyond those in the text are not extracted.

Paper vs code

No official code. Searched in order: (1) the paper's LaTeX source and the arXiv abstract page, which list no code link and no comments, and the source only says the full implementation will be released §5.7.2; (2) the paper links no project page; (3) GitHub repository search for "proxy targeted attack", "ProxyTargetedAttack", "proxy-targeted-attack", "imagebind adversarial" and "targeted adversarial multimodal proxy", none of which returned a matching repository. A GitHub account under an author's name (Lei Feng) holds only a personal Pages site, so it was not used. Text-table discrepancies are listed under Pitfalls.

Pitfalls

• The optimiser is named, not specified. The method gives eq. 4 under an ℓ∞ constraint but no algorithm. The experiments name PGD with 100 iterations §5.1. Step size, start point, restarts and clipping to the valid pixel range are not stated, and the paper gives no sensitivity analysis for them.
• Embedding normalisation is inconsistent. The theorems assume unit-norm embeddings §3.4 §4.2, and eq. 2 uses cosine. Eq. 3 uses a plain L2 distance and does not say whether the source embeddings are normalised. Normalising changes the scale of L_D, and therefore the meaning of α, so check which one the implementation uses.
• α is task-specific and switched off without defense. The values (0.4 and 1.0 with defense; 0 without) are given without a rule for choosing them §5.1. α = 0 removes the source term entirely, so the no-defense rows measure target alignment only.
• The defense is not specified enough to reproduce ASRD. The outlier rule §3.3 and the four detectors are named, but K = 50, the ratio r = 1 − N_adv/K, N_adv and T = 2 are given without definitions §5.1. The detectors' own settings (neighbours for kNN and LOF, components for PCA, tree settings for Isolation Forest) are not stated, and Table 1 uses 100 reference points. ASRD numbers cannot be reproduced from the text.
• Proxy construction is underspecified. The handcrafted templates, the LLM and its prompt, the number of descriptions, the proxy and true-query split and the sampling of source images are not stated §5.1 §5.7.1. The only stated rules are "same-category images" for classification and "images paired with proxy captions" for retrieval.
• Main results use same-distribution proxies. Proxies and true targets come from one dataset or category §5.7.1. The cross-domain check tab. 21 shows PTA's retrieval ASR falling from 55.78 to 43.59, while its classification ASR stays near 99.5 to 99.7. The paper's own note is that both methods mostly degrade under the shift §5.7.5.
• Whether ProxySelect was used in the main tables is not stated. It is introduced as a pipeline §5.7.2, and its ablation is only on noisy pools tab. 20. Treat the main numbers as proxies chosen by the rules in §5.1.
• Some ablation values do not match the main tables, and the paper does not reconcile them. tab. 17 gives a baseline of 95.35 Cls ASRD at (N_s, N_c) = (20, 10) for ImageBind on ImageNet with defense. tab. 2 gives 77.54 for the same model, dataset and defence at the main classification setting (25, 10). tab. 18 gives 67.34 for its (50, 20) baseline, while tab. 3 gives 71.31 for ImageBind on MSCOCO at the main retrieval setting (20, 50). The (50, 20) row also reverses the main retrieval pair §5.1 fig. 6. The paper does not say whether the labels are reversed or the configurations differ.
• Table subscripts are undefined. The subscripts in tab. 2, tab. 3, tab. 6, tab. 8, tab. 9, tab. 11 and tab. 13 are not explained. They are omitted here. Do not read them as confidence intervals without the authors' confirmation.
• Theorem 1 is an embedding-space surrogate. It uses squared-L2 source proximity, optimises a free embedding v, and does not model every detector's score §3.4. The paper states that for Isolation Forest there is no deterministic guarantee, only a conditional intuition §3.4. The input-space result only approximates the embedding optimum, and the paper states this §3.4.
• Theorem 3's bound is informative only with coherent proxies. The bound uses the minimum similarity over proxies, while the loss uses the average. The paper says the bound is informative only when the proxies are semantically coherent and the adversarial embedding keeps high similarity to all of them §4.2.
• The baseline's objective is not written. Illusion Attack is cited for its objective §1 §4.3 and is described here only as single-target cosine alignment. Implement the baseline from its own paper, not from this card.
• Attack budgets differ across tables. White-box uses ε = 8/255 §5.1, the Square attack uses ε = 16/255 §5.3.1, and transfer uses ε = 8/255 §5.3.1. Figures are not comparable across these settings.
• Injection comparisons are not budget-matched. tab. 4 injects 10% of images for the untargeted baselines, 1% for Illusion Attack, and 0.1% to 1% for PTA. The comparison is by injection ratio, not by cost.
• Compute numbers use other proxy counts. tab. 16 uses 100 target and 50 source proxies, not the main settings §5.1. Proxy collection and embedding are counted as offline and untimed §5.6, so the 0.16% overhead does not include them.
• Anomaly ranks are reported for one model. tab. 1 uses LanguageBind's AEs only, with 100 reference points.
• Textual and audio results are partial. The text says textual AEs are generally weaker than image AEs, while audio AEs are comparable §5.3.2. tab. 8 gives no image rows to check this against. The unknown-modality test covers only audio targets on XmediaNet §5.3.4 tab. 10.
• Defenses beyond anomaly detection are not universal. The paper says so §5.4. TeCoA gives one cell where PTA is lower (XmediaNet classification at 16/255: 78.16 against 80.42) tab. 11. The DiffPure adaptive attack's settings (number of samples, EOT count) are not stated §5.4.
• Several figure values are not in the text. The α sweep fig. 4, the proxy-count heatmap fig. 5 and the abilities comparison fig. 3 can only be read from the plots. This card does not extract them.
• Version. The card follows arXiv v3 (updated 2026-09-05), the version fetched. Earlier versions were not checked.

Lineage

• Builds on: projected gradient descent under ℓ∞ [Madry et al., arXiv:1706.06083], named as the experiment optimiser §5.1. Cosine-similarity targeted attacks on multimodal embeddings, from Illusion Attack [Zhang et al., USENIX Security 2024, "Adversarial Illusions in Multi-Modal Embeddings"]; PTA changes the target from one embedding to a proxy set and adds a source-proxy term §4.1 §4.3.
• Models attacked: ImageBind [Girdhar et al., CVPR 2023], LanguageBind [arXiv:2310.01852], One-PEACE [arXiv:2305.11172] §5.1. The modality gap in Theorem 1 follows Liang et al., "Mind the Gap" (NeurIPS 2024) §3.4.
• Compared against: Illusion Attack [Zhang et al., USENIX Security 2024]; CrossFire [arXiv:2409.06793]; MF-ii [Zhao et al., NeurIPS, "On Evaluating Adversarial Robustness of Large Vision-Language Models"]; for gallery poisoning, Sep-Attack, Co-Attack, SGA and CMI-Attack §5.1.
• Superseded by: not known from wiki content.