Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models

Fuente: arXiv
Saved in:
Bibliographic Details
Main Authors: Xu, Yuancheng, Yao, Jiarui, Shu, Manli, Sun, Yanchao, Wu, Zichu, Yu, Ning, Goldstein, Tom, Huang, Furong
Format: Preprint
Published: 2024
Subjects:
Online Access:
Tags: Add Tag
No Tags, Be the first to tag this record!
_version_ 1866917801556443136
author Xu, Yuancheng
Yao, Jiarui
Shu, Manli
Sun, Yanchao
Wu, Zichu
Yu, Ning
Goldstein, Tom
Huang, Furong
author_facet Xu, Yuancheng
Yao, Jiarui
Shu, Manli
Sun, Yanchao
Wu, Zichu
Yu, Ning
Goldstein, Tom
Huang, Furong
contents Vision-Language Models (VLMs) excel in generating textual responses from visual inputs, but their versatility raises security concerns. This study takes the first step in exposing VLMs' susceptibility to data poisoning attacks that can manipulate responses to innocuous, everyday prompts. We introduce Shadowcast, a stealthy data poisoning attack where poison samples are visually indistinguishable from benign images with matching texts. Shadowcast demonstrates effectiveness in two attack types. The first is a traditional Label Attack, tricking VLMs into misidentifying class labels, such as confusing Donald Trump for Joe Biden. The second is a novel Persuasion Attack, leveraging VLMs' text generation capabilities to craft persuasive and seemingly rational narratives for misinformation, such as portraying junk food as healthy. We show that Shadowcast effectively achieves the attacker's intentions using as few as 50 poison samples. Crucially, the poisoned samples demonstrate transferability across different VLM architectures, posing a significant concern in black-box settings. Moreover, Shadowcast remains potent under realistic conditions involving various text prompts, training data augmentation, and image compression techniques. This work reveals how poisoned VLMs can disseminate convincing yet deceptive misinformation to everyday, benign users, emphasizing the importance of data integrity for responsible VLM deployments. Our code is available at: https://github.com/umd-huang-lab/VLM-Poisoning.
format Preprint
id arxiv_https___arxiv_org_abs_2402_06659
institution arXiv
publishDate 2024
record_format arxiv
spellingShingle Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models
Xu, Yuancheng
Yao, Jiarui
Shu, Manli
Sun, Yanchao
Wu, Zichu
Yu, Ning
Goldstein, Tom
Huang, Furong
Cryptography and Security
Artificial Intelligence
Machine Learning
Vision-Language Models (VLMs) excel in generating textual responses from visual inputs, but their versatility raises security concerns. This study takes the first step in exposing VLMs' susceptibility to data poisoning attacks that can manipulate responses to innocuous, everyday prompts. We introduce Shadowcast, a stealthy data poisoning attack where poison samples are visually indistinguishable from benign images with matching texts. Shadowcast demonstrates effectiveness in two attack types. The first is a traditional Label Attack, tricking VLMs into misidentifying class labels, such as confusing Donald Trump for Joe Biden. The second is a novel Persuasion Attack, leveraging VLMs' text generation capabilities to craft persuasive and seemingly rational narratives for misinformation, such as portraying junk food as healthy. We show that Shadowcast effectively achieves the attacker's intentions using as few as 50 poison samples. Crucially, the poisoned samples demonstrate transferability across different VLM architectures, posing a significant concern in black-box settings. Moreover, Shadowcast remains potent under realistic conditions involving various text prompts, training data augmentation, and image compression techniques. This work reveals how poisoned VLMs can disseminate convincing yet deceptive misinformation to everyday, benign users, emphasizing the importance of data integrity for responsible VLM deployments. Our code is available at: https://github.com/umd-huang-lab/VLM-Poisoning.
title Shadowcast: Stealthy Data Poisoning Attacks Against Vision-Language Models
topic Cryptography and Security
Artificial Intelligence
Machine Learning
url https://arxiv.org/abs/2402.06659