Search papers, labs, and topics across Lattice.
This paper investigates the geometric properties of vision-language pre-trained models (VLPs) to address their vulnerability to adversarial attacks. By analyzing the anisotropic structure of VLP embedding spaces, the authors find that adversarial examples (AEs) exhibit greater expected distances from clean samples, indicating a tendency to push representations out of manifold regions. The proposed GeoDetect method utilizes these geometric deviations to effectively identify AEs across various VLP architectures and attack scenarios, demonstrating robust performance in enhancing model safety and reliability.
Adversarial examples in vision-language models can be detected by their tendency to stray further from the data manifold, revealing a critical vulnerability in multimodal AI systems.
Vision-language pre-trained models (VLPs) are widely used in real-world applications. However, they remain vulnerable to adversarial attacks. Although adversarial detection methods have demonstrated success in single-modality settings (either vision or language), their effectiveness and reliability in multimodal models such as VLPs remain largely unexplored. In this work, we study the geometry of VLP embedding spaces and observe structured anisotropy that differs from unimodal vision models. Our theoretical analysis shows that under this anisotropic structure, adversarial attacks increase the expected geometric separation between clean and adversarial examples (AEs). Specifically, we demonstrate that AEs consistently exhibit greater expected distances to randomly sampled points than their clean counterparts, indicating that AEs tend to push representations out of manifold regions. Building on these insights, we propose GeoDetect, which leverages these off-manifold deviations via geometric scores to identify AEs. Through comprehensive evaluations, we show that our approach reliably detects AEs across diverse VLP architectures and threat settings, covering unimodal and multimodal attacks as well as adaptive attacks, thereby providing a robust and practical approach to improving the safety and reliability of these models.
