PG-Attack: A Precision-Guided Adversarial Attack Framework Against Vision Foundation Models for Autonomous Driving

Motivated by the success of large language models [34, 3], the field of computer vision has similarly embraced equally powerful models. Qwen-VL’s [1] visual encoder uses the Vision Transformer (ViT) [8] architecture with pre-trained weights from Openclip’s [7] ViT-bigG. It resizes input images to a specific resolution, splits them into patches with a stride of 14, and generates a set of image features. Imp’s [26] visual module employs the SigLIP-SO400M/14@384 [32] as its pretrained visual encoder, enabling it to obtain fine-grained visual representations through large-scale image-text contrastive learning. Additionally, GPT-4V [24] offers a more profound understanding and analysis of user-provided image inputs, highlighting the significant advancements in multimodal capabilities within computer vision.

Adversarial attacks are classified into white-box attacks [11, 4] and black-box attacks [5, 6, 22] based on the attacker’s knowledge of the target model. In white-box attacks, the attacker has full access to the target model’s details, such as its network architecture and gradients. In black-box attacks, the attacker does not have access to the internal information of the target model. Adversarial transferability describes how effectively an attack developed on a source model performs when applied to a different target model. In computer vision, common adversarial attack methods include FGSM [11], I-FGSM [16], PGD [23], etc. In natural language processing, attacks such as TextFoole [14], BAE [10], and BERT-Attack [18] manipulate the text by adding, altering, or deleting specific components to achieve the desired attack performance.

In the attack on the multimodal large model, Zhang et al. [33] combines visual and textual bimodal information and proposes the first white-box attack, Co-attack, by utilizing the synergistic effect between images and text in the VLP model. Then, SGA [22] first explores the black-box attacks and use data augmentation to generate multiple groups of images, match them with multiple text descriptions, and comprehensively utilize cross-modal guidance information to improve the transferability of adversarial examples in black-box models. CMI-Attack  [9] enhances modality interaction by using Embedding Guidance and Interaction Enhancement modules, significantly boosting the attack success rate of transferring adversarial examples to other models. Based on this, we adopt CMI-Attack as the baseline method for our Precision Mask Perturbation Attack. Our approach further refines this by using mask patches to precisely locate attack regions and removing the text attack component, thereby focusing on enhancing the efficacy and subtlety of the visual perturbations.

Crafting effective adversarial examples that can disrupt a model’s performance across multiple tasks—color judgment, image classification, and object counting—is extremely challenging. The key difficulty lies in optimizing perturbations that can subtly alter the model’s perception for each individual task, while maintaining high cross-task transferability and image similarity under diverse conditions. Specifically, the adversarial examples must induce misclassification, color confusion, and counting errors simultaneously, without compromising spatial consistency or raising human suspicion. Optimizing for such diverse goals risks getting trapped in local optima, making the design of highly transferable and robust adversarial attacks an intricate endeavor. Furthermore, directly employing multimodal large models to infer adversarial attacks poses a significant challenge due to their immense memory footprint, rendering the direct utilization of such models for attack inference arduous. These challenges require careful planning, experimentation, and a deep understanding of both the target models and the nature of adversarial perturbations. With limited submission opportunities and a need for high naturalness in the adversarial examples, efficient use of resources and iterative refinement are crucial for success in the competition.

To address the aforementioned challenges, we have adopted the following measures:

• •

  Strategic Problem Transformation: We first view the entire task as a black-box transfer attack problem in the visual question answering (VQA) domain, which can then be transformed into an adversarial attack problem on vision-and-language models that have been widely used to solve VQA tasks. Specifically, we aim to generate input-based adversarial examples that cause the model under evaluation to fail to accurately answer the three types of task questions mentioned above.

• •

  Optimized Transferability and Effectiveness: Visual-Language Pre-training (VLP) models such as CLIP [25] and TCL [31], which leverage large-scale multimodal pre-training, offer several advantages for generating adversarial examples. Compared to multimodal large models, VLP models require significantly less memory, achieve faster inference speeds, and adversarial examples generated from them exhibit strong transferability. For these reasons, we leverage a VLP model as the source model for generating adversarial examples.

Our proposed method consists of three phases, as illustrated in Figure 2. Phase I is the modality expansion phase, where we input the initial dataset into the YOLOv8 model to compute the binary images with the key objects masked. Similarly, to obtain the textual modality of the dataset, we input the dataset into the BLIP model [17] and generate image captions through its Image Captioning task. Phase II represents the first attack stage of our method, employing the image attack component from the CMI-Attack framework and further enhancing its effectiveness through data augmentation. Notably, considering the challenge’s specific SSIM value requirements, we confine the attack range to the target region to achieve optimal performance. We refer to this process as the Precision Mask Perturbation Attack. Phase III constitutes the second attack stage of our method, where we incorporate disruptive text information into the images obtained from the previous stage in a bullet-chat-like manner to further enhance the attack’s effectiveness against the VQA task of the black-box model. The disruptive text is designed based on the content of the specific VQA task being attacked, aiming to mislead the model’s understanding. We refer to this attack process as the Deceptive Text Patch Attack. The whole description of the PG-Attack is shown in Algorithm 1.

This involves combining the CMI-Attack with mask patch method. The CMI-Attack [9] enhances the overall effectiveness and robustness of the attack by ensuring the perturbations are subtle yet impactful. The mask patch method, on the other hand, targets specific areas of the image to improve the attack’s precision and focus.

The original CMI-Attack framework incorporates text-based attacks; however, since the competition does not involve text attacks, we have modified the optimization objective of CMI-Attack. The overall optimization goal of our framework is to maximize the semantic distance between the adversarial image $Img_{Adv}$ generated by the source model in the feature space of the image encoder $E_{I}$ and the caption in the feature space of the text encoder $E_{T}$. This is formally represented by Equation 1:

It is noteworthy that the competition’s evaluation metrics incorporate assessments of luminance, contrast, and structure. Therefore, while maintaining the effectiveness of the attack on the target region, minimizing the impact of the attack on other areas will lead to a relatively higher overall SSIM value. To address this, we innovatively employ a mask image to constrain the attack range during each iteration of image perturbation. This constitutes a novel aspect of our approach. The process is formally described by Equation 2:

where $X_{i}$ denotes the image at the i-th attack iteration, $M$ represents the $0-1$ matrix obtained from the mask image, and $\delta$ denotes the perturbation calculated in the current step to be added.

DTP-Attack further deceives models by adding a text patch attack to the image. This stage leverages textual elements to further deceive the models, exploiting any weaknesses in handling mixed content (visual and textual).

The main algorithmic formula for the DTP-Attack is represented as follows:

where $Img^{adv}_{DTP}$ represents the adversarial image after applying the DTP-Attack. $RenderText(D,D_{Color},D_{Size})$ is the function responsible for rendering the text patch onto the image. $D$ represents the textual content, $D_{Color}$ signifies the color of the text, and $D_{Size}$ denotes the size of the text.

The incorporation of textual elements into the adversarial attack expands the attack surface and increases the complexity of the deception, making it more challenging for the model to discern between genuine and manipulated content.

The dataset is provided by the CVPR 2024 Workshop Challenge and generated using the CARLA simulator. The dataset for Phase I of the competition encompasses 461 images, encompassing key objects such as cars, pedestrians, motorcycles, traffic lights, and road signals. Notably, the cars exhibit a diverse array of colors, including but not limited to red, black, white, alternating green and white, alternating purple and white, alternating black and white, and others. Interestingly, the traffic lights display a reddish-orange hue instead of the typical red, along with yellow and green colors. For Phase II, the dataset consists of 100 images featuring similar key objects to Phase I.

The final score, which serves as the overall evaluation metric for the adversarial attack algorithms, is calculated as a weighted average of two components: the Attack Success Rate (ASR) and the Structural Similarity Index (SSIM). Specifically, for a set of n images, the final score is computed as Equation 4:

where $\operatorname{ASR}_{i}$ is the Attack Success Rate for the ith image, $\mathrm{SSIM}(x_{i},x_{adv})$ quantifies the structural similarity between the original image $x_{i}$ and adversarially perturbed image $x_{adv}$, and $\alpha$ (set to 0.5) determines the relative weighting between ASR and SSIM. A higher final score indicates better performance, as it signifies both a high success rate in misleading the target models and a high degree of visual similarity preservation compared to the original images.

In this section, we conduct ablation experiments to analyze various parameters of our approach. These parameters include the perturbation $\epsilon$ range of the CMI-Attack[9] on the mask part, the color of the disruptive text, the quantity of disruptive text, and the font of the disruptive text.

The ablation study shows that increasing the perturbation range on the mask part significantly boosts the attack success rate, indicating that larger perturbations are more effective in deceiving the model, as shown in Figure 3. Additionally, the text color plays a crucial role in the attack’s effectiveness, with black and contrasting color schemes, such as a white background with a black frame, resulting in higher success rates, as demonstrated in Figure 4. The effectiveness of disruptive text quantity varies, with six text elements achieving the highest attack success rate, followed by seven and five, suggesting an optimal quantity for maximum disruption, as illustrated in Figure 5. Finally, the choice of font does impact the attack success rate, with Times New Roman outperforming Calibri and Arial in misleading the model, as shown in Figure 6.

Through these ablation experiments, we identify key factors that influence the success rate of our proposed attack, providing insights for further optimization.