LAMP: Learning Universal Adversarial Perturbations for Multi-Image Tasks via Pre-trained Models

AI summary

Overview

Research area: Adversarial machine learning and multimodal large language models (MLLMs), specifically black-box universal adversarial perturbations (UAPs) against models that accept multiple images as input.

Technical level: Advanced. The paper assumes familiarity with transformer self-attention, decoder-layer hidden states, adversarial transferability, and threat-model terminology (white-box vs. black-box).

Scope: The paper proposes LAMP, a black-box method that learns a small fixed set of universal perturbations on a frozen pretrained MLLM and transfers them to other multi-image MLLMs, datasets, and downstream tasks, then evaluates attack success rate across several benchmarks.

What This Paper Is About

Multimodal large language models such as GPT-4V, Gemini, LLaVA-NeXT, and Idefics now handle multiple images in one prompt, but almost all prior adversarial attack research targets single-image settings and assumes the attacker has white-box access to gradients from the fine-tuned target model. That assumption is unrealistic when the attacker only has a public pretrained model and cannot control how many images a downstream model ingests, in what order, or which of them are perturbed.

The goal of LAMP is to learn a small, fixed number of imperceptible universal perturbations that can be added to only a subset of images in an interleaved multi-image prompt and still corrupt the target model's output, without any knowledge of the target architecture, dataset, or task.

Key Contributions

1. First adversarial attack targeting multi-image MLLMs. The authors state this is the first attack to exploit the multi-image attack surface, and it is designed to transfer across MLLMs without being tailored to a specific downstream model or task.
2. UAP learning through the LLM self-attention module. Perturbations are learned while keeping the MLLM frozen, using a relaxed Pompeiu-Hausdorff distance to force the head-averaged attention weights of clean and adversarial inputs apart.
3. A "contagious" objective. Perturbed image tokens are encouraged to attract attention from clean image and text tokens, so adversarial influence spreads to unperturbed images and a fixed number of perturbations suffices even when the number of images at inference time is unknown.
4. An index-attention suppression loss. Because multi-image prompts contain index markers such as "image 1:" and "image 2:", the method penalizes attention from image tokens to their associated index tokens, making the attack position-invariant.

Main Findings

• Large average ASR gain over prior attacks. Across all target models and datasets, LAMP reaches 75.8% average attack success rate versus 56.3% for the best prior attack, an improvement of +19.5 percentage points. The strong baselines compared include CPGC-UAP, UAP-VLP, Doubly-UAP, Jailbreak-MLLM, Pandora's box, and X-transfer.
• Consistent per-model improvements. ASR rises from 51.5 to 71.9 (+20.4) on Mantis-CLIP, 51.6 to 71.9 (+20.3) on Mantis-SIGLIP, 49.2 to 72.4 (+23.2) on Mantis-Idefics2, 56.1 to 76.2 (+20.1) on VILA-1.5, 58.5 to 78.9 (+20.4) on LLaVA-v1.6, 64.4 to 79.9 (+15.5) on Qwen-VL-Chat, and 62.5 to 79.4 (+16.9) on Qwen-2.5.
• Consistent per-dataset improvements. ASR rises from 59.4 to 77.7 (+18.4) on Mantis Eval, 39.4 to 59.7 (+20.3) on NLVR2, 66.9 to 85.7 (+18.8) on BLINK, 52.5 to 76.0 (+23.4) on Q-Bench, and 63.1 to 80.0 (+16.9) on MVBench.
• Two perturbations are optimal. The paper reports |δ| = 2 as the optimal number of perturbations. ASR improves significantly going from 1 to 2 perturbations but does not improve significantly beyond that, which the authors attribute to the contagious effect acting on clean images in attention space.
• Position matters. Attacks are most effective when the first two images are perturbed; ASR decreases slightly when the last two images are perturbed and is lowest when the first and last images are perturbed.
• Works on single-image and multi-image VQA too. On Mantis-CLIP, LAMP scores 70.32 on Mantis Eval, 73.45 on MM-Vet, and 68.31 on LLaVA Bench, versus 49.23 / 50.32 / 45.60 for CPGC-UAP, 46.45 / 50.21 / 37.67 for Doubly-UAP, and 44.45 / 48.21 / 35.67 for Jailbreak-MLLM.
• Robust to black-box query defenses. Under the defense of Qin et al. (2021), LAMP retains 70.23% ASR, compared with 56.33% for Liu et al. (2024a). Under the defense of Li et al. (2022a), LAMP retains 69.21% ASR versus 20.21% for Liu et al. (2024a). Evaluated on the Mantis Eval dataset with the Mantis-CLIP model.
• More imperceptible than the strongest baseline. Using LPIPS, lower values indicate greater imperceptibility; LAMP scores 0.021 against 0.068 for the best-performing baseline.
• All loss terms matter. In the loss ablation, the full combination of five losses gives 73.43 on Mantis Eval, 52.73 on NLVR2, and 84.86 on BLINK, and removing the contagious and index-attention suppression losses reduces performance.
• PatchCleanser is not applicable. The paper notes that because the perturbations are imperceptible rather than visible patches, the certifiable patch defense PatchCleanser does not apply; the authors instead evaluate against query-based black-box defenses.
• Training converges by epoch 20. ASR does not change significantly after epoch 20, which is why 20 epochs were used.

Methodology in Plain English

The attacker picks a publicly available pretrained multi-image model, Mantis-CLIP, as a surrogate. Its image encoder and language model stay frozen; the only thing being optimized is a set of small image-sized noise patterns (each 336 × 336 pixels) constrained so that no pixel changes by more than 12/255.

Training uses 17,000 samples from the Mantis Instruct dataset, AdamW with weight decay, a cosine scheduler starting at a learning rate of 10⁻⁴ with a decay rate of 0.2, a batch size of 128, and a maximum context length of 8192, over 20 epochs on A100 GPUs. In each sample, the perturbations are added to only some of the images (fewer than the total number), leaving the rest clean.

Five objectives are combined, each with a positive weight (λ₁ through λ₅):

1. An adversarial language modeling loss that lowers the predicted probability of the correct next token, pushing the model toward wrong answers.
2. A hidden-states loss that maximizes the cosine distance between the mean decoder hidden states of clean and adversarial inputs, layer by layer.
3. An attention loss that uses a relaxed Pompeiu-Hausdorff distance between head-averaged attention matrices of clean and adversarial inputs, so the internal focus of the model differs in a worst-case sense even where global distributions look similar.
4. A contagious loss that increases how much clean tokens attend to noisy image tokens, spreading the adversarial effect without perturbing every image.
5. An index-attention suppression loss that reduces attention from image tokens to the "image 1:" / "image 2:" index tokens, so the attack does not depend on where an image sits in the sequence.

The learned perturbations are then applied zero-shot to eight target models, including Mantis variants, VILA-1.5, LLaVA-v1.6, Qwen-VL-Chat, Qwen-2.5, and MiniGPT4, and measured by attack success rate, defined as the percentage of adversarial examples that successfully deceive the model into generating incorrect outputs.

Why This Matters

Impact on research. The paper opens a threat model that prior adversarial work did not study: universal, transferable, subset-only attacks on interleaved multi-image prompts. It also shows that attention-space constraints on a frozen model can be as useful for attack transferability as gradient access to the target, which is relevant to the broader transferability literature.

Real-world applications:

• Poisoned advertising. The paper explicitly describes an attacker serving image-based ads that contain adversarial noise, where the attacker does not control the other images or text on the page.
• Social media and online comments. Perturbed images posted publicly may be assembled into multi-image prompts by a downstream model in ways the attacker never sees.
• Red-teaming and robustness auditing of deployed multi-image assistants, so that model providers can measure exposure before deployment.
• Benchmarking data pipelines, where a small number of contaminated images can spread influence to clean images in the same query.

Industry relevance. Any product that lets users submit multiple images at once — shopping comparison, document and screenshot reasoning, video-frame understanding — inherits the multi-image attack surface. Because LAMP is black-box and transferable, it is directly relevant to model providers who cannot rely on secrecy of their architecture as a defense, and it motivates query-side detection rather than only patch-style input sanitization.

Future Directions

1. Stronger defenses for subset-only perturbations. LAMP survives the two black-box query defenses tested, so effective detection of contaminated queries in interleaved multi-image prompts remains an open problem. The authors note patch-based certifiable defenses do not apply.
2. Scaling beyond the fixed perturbation count. The paper finds ASR saturates at |δ| = 2 and attributes this to the contagious effect; understanding whether this holds for much larger image counts, or where the saturation breaks down, is unresolved.
3. Extending to other modalities and interleavings. The method is demonstrated on images; whether contagious attention effects carry over to video frames, audio, or document-page sequences is untested.
4. Closing the gap on already-robust models. Gains were smaller on Qwen-VL-Chat (+15.5) and Qwen-2.5 (+16.9) than on other targets, suggesting model-specific robustness factors worth investigating.

Target Audience

Researchers and graduate students working on adversarial robustness, multimodal LLM security, and vision-language transferability; security engineers and red teams assessing multi-image assistants; and model providers who need to understand how universal perturbations learned on a public pretrained model transfer to their proprietary or unknown architectures. Readers need a working knowledge of transformer attention and MLLM architectures to follow the loss formulations, though the high-level threat model and results are accessible to a broader security audience.

Note: The provided text is truncated. Additional results referenced for selection-free VQA (OK-VQA) and image captioning (MSCOCO), complexity analysis, hyperparameter sensitivity, position-invariant attack visualizations, and loss-interaction analysis are described as appearing in appendices, but the specific numbers are not included in the excerpted content and are therefore not reported here.

Authors’ abstract

Multimodal Large Language Models (MLLMs) have achieved remarkable performance across vision-language tasks. Recent advancements allow these models to process multiple images as inputs. However, the vulnerabilities of multi-image MLLMs remain unexplored. Existing adversarial attacks focus on single-image settings and often assume a white-box threat model, which is impractical in many real-world scenarios. This paper introduces LAMP, a black-box method for learning Universal Adversarial Perturbations (UAPs) targeting multi-image MLLMs. LAMP applies an attention-based constraint that prevents the model from effectively aggregating information across images. LAMP also introduces a novel cross-image contagious constraint that forces perturbed tokens to influence clean tokens, spreading adversarial effects without requiring all inputs to be modified. Additionally, an index-attention suppression loss enables a robust position-invariant attack. Experimental results show that LAMP outperforms SOTA baselines and achieves the highest attack success rates across multiple vision-language tasks and models.