Abstract
With the increase in deep learning, it becomes increasingly difficult to understand the model in which AI systems can identify objects. Thus, an adversary could aim to modify an image by adding unseen elements, which will confuse the AI in its recognition of an entity. This paper thus investigates the adversarial robustness of LLaVA-1.5-13B and Meta's Llama 3.2 Vision-8B-2. These are tested for untargeted PGD (Projected Gradient Descent) against the visual input modality, and empirically evaluated on the Visual Question Answering (VQA) v2 dataset subset. The results of these adversarial attacks are then quantified using the standard VQA accuracy metric. This evaluation is then compared with the accuracy degradation (accuracy drop) of LLaVA and Llama 3.2 Vision. A key finding is that Llama 3.2 Vision, despite a lower baseline accuracy in this setup, exhibited a smaller drop in performance under attack compared to LLaVA, particularly at higher perturbation levels. Overall, the findings confirm that the vision modality represents a viable attack vector for degrading the performance of contemporary open-weight VLMs, including Meta's Llama 3.2 Vision. Furthermore, they highlight that adversarial robustness does not necessarily correlate directly with standard benchmark performance and may be influenced by underlying architectural and training factors.
Abstract (translated)
随着深度学习的发展，理解AI系统如何识别对象的模型变得越来越困难。因此，对手可能会试图通过在图像中添加未见过的元素来修改图像，从而混淆AI对实体的识别能力。本文研究了LLaVA-1.5-13B和Meta的Llama 3.2 Vision-8B-2这两种AI系统在对抗攻击下的稳健性。它们针对视觉输入模式进行了无目标PGD（Projected Gradient Descent）测试，并在Visual Question Answering (VQA) v2数据集子集中进行经验评估。这些对抗攻击的结果使用标准的VQA准确率指标量化。这种评估结果与LLaVA和Llama 3.2 Vision的准确性下降（准确度降低）进行了比较。 一个关键发现是，尽管在该设置中的基线精度较低，但Llama 3.2 Vision在受到攻击时表现出更小的性能下降，特别是在更高的扰动水平下比LLaVA表现得更好。总体而言，这些研究结果证实了视觉模式可以作为破坏当代开放式权重VLM（Vision-Language Models）性能的有效攻击途径，包括Meta的Llama 3.2 Vision。此外，它们还强调了对抗稳健性不一定直接与标准基准性能相关联，并且可能受底层架构和训练因素的影响。
URL
https://arxiv.org/abs/2512.17902
