Search papers, labs, and topics across Lattice.
This paper introduces AirflowAttack, the first adversarial attack specifically designed for infrared remote-sensing vision-language models (VLMs), leveraging thermal-airflow turbulence as a perturbation mechanism. The method employs a lightweight generator to create a single input-agnostic perturbation that is optimized on a surrogate CLIP model, achieving a mean attack success rate of 48.5% across multiple CLIP backbones. Notably, while this attack reduces scene-classification accuracy by up to 38.2%, it paradoxically increases the confidence of some models in their incorrect predictions, highlighting significant vulnerabilities in the deployment of VLMs in security-sensitive applications.
AirflowAttack reveals that adversarial perturbations can not only deceive infrared VLMs but also enhance their false confidence in erroneous classifications.
Vision-language models (VLMs) are increasingly deployed on infrared (IR) remote sensing imagery in security-critical settings, yet their adversarial robustness remains unexamined. We present AirflowAttack, to our knowledge the first adversarial attack for IR remote-sensing VLMs and the first to weaponize thermal-airflow turbulence as the perturbation prior. A lightweight generator synthesizes a single input-agnostic perturbation regularized toward physically plausible airflow patterns. Optimized on one surrogate CLIP model, it attains a mean zero-shot scene-classification attack success rate (ASR, the fraction of samples whose top-1 class changes) of 48.5% across five diverse CLIP backbones, far exceeding four IR-specific physical baselines (27.7--37.0%). Applied to six state-of-the-art VLMs, it cuts scene-classification accuracy by up to 38.2% relative, yet paradoxically makes some models more confident in their IR analysis, confabulating the perturbation as genuine thermal evidence such as temperature gradients and convection. Ablations show the airflow prior raises physical plausibility at no measurable cost to attack success. Together with a benchmark spanning eleven models and four tasks, these findings expose critical vulnerabilities in the rapidly expanding IR VLM ecosystem.
