Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images

Kuofeng GaoYang BaiJindong GuShu-Tao XiaPhilip TorrZhifeng LiWei Liu

article2024ICLR77 citations

Demonstrates a severe availability vulnerability in vision-language models by generating imperceptible image perturbations that delay termination tokens to multiply output lengths more than eightfold and exhaust computational resources.

Peng Cheng Laboratory Tencent Tsinghua University University of Oxford computational resources high energy consumption high resolution image

arXiv: 2401.11170 KuofengGao/Verbose_Images

Cover for Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images

Abstract

Large vision-language models (VLMs) such as GPT-4 have achieved exceptional performance across various multi-modal tasks. However, the deployment of VLMs necessitates substantial energy consumption and computational resources. Once attackers maliciously induce high energy consumption and latency time (energy-latency cost) during inference of VLMs, it will exhaust computational resources. In this paper, we explore this attack surface about availability of VLMs and aim to induce high energy-latency cost during inference of VLMs. We find that high energy-latency cost during inference of VLMs can be manipulated by maximizing the length of generated sequences. To this end, we propose verbose images, with the goal of crafting an imperceptible perturbation to induce VLMs to generate long sentences during inference. Concretely, we design three loss objectives. First, a loss is proposed to delay the occurrence of end-of-sequence (EOS) token, where EOS token is a signal for VLMs to stop generating further tokens. Moreover, an uncertainty loss and a token diversity loss are proposed to increase the uncertainty over each generated token and the diversity among all tokens of the whole generated sequence, respectively, which can break output dependency at token-level and sequence-level. Furthermore, a temporal weight adjustment algorithm is proposed, which can effectively balance these losses. Extensive experiments demonstrate that our verbose images can increase the length of generated sequences by 7.87 times and 8.56 times compared to original images on MS-COCO and ImageNet datasets, which presents potential challenges for various applications. Our code is available at this https URL.

Topics

computational resources high energy consumption high resolution image inference language model

1 Introduction
2 Related Work
3 Preliminaries
3.1 Threat model
3.2 Problem formulation
4 Methodology
4.1 Loss design
4.2 Optimization
5 Experiments
5.1 Experimental Setups
5.2 Main Results
5.3 Discussions
5.4 Ablation studies
6 Conclusion
References
A Implementation details
A.1 Target models
A.2 Experimental setups
B Black-box setting
C More tasks
D More results of length distribution
E joint optimization of both images and texts
F Visual interpretation
G Additional discussions
G.1 feasibility analysis of an intuitive solution
G.2 evaluation performance of energy-latency manipulation
G.3 image embedding distance between original images and attacked counterpart
G.4 energy consumption for generating one attacked image
G.5 standard deviation results
H Additional ablation studies
H.1 different sampling policies
H.2 different maximum lengths of generated sequences
I Grid search
I.1 different parameters of loss weights
I.2 different momentum values
J Visualization

Knowls

Knowl 1 — Verbose Images Attack Objective for Large Vision-Language Models
model/method
Auto-regressive large vision-language models (VLMs) exhibit an approximately positive linear relationship between sequence generation length $N$ and the resulting energy consumption (in Joules) and response latency (in seconds) during inference. The verbose images attack seeks to induce computational resource exhaustion and latency slowdown (energy-latency cost) by adding an imperceptible visual perturbation to the input image $x$ , inducing the VLM to generate sequences of maximum possible length.

Given an input image $x$ and an optional textual prompt $c_{\text{in}}$ , the attack crafts a perturbed image $x'$ subject to an $l_p$ -norm bounded perturbation constraint $\|x' - x\|_p \le \epsilon$ . The overall optimization objective integrates three complementary terms: $\min_{x'} \lambda_1 \mathcal{L}_1(x') + \lambda_2 \mathcal{L}_2(x') + \lambda_3 \mathcal{L}_3(x'), \quad \text{s.t.} \quad \|x' - x\|_p \le \epsilon$ where $\mathcal{L}_1(x')$ suppresses the end-of-sequence (EOS) token probability across all generation positions, $\mathcal{L}_2(x')$ maximizes the entropy of each step's output probability distribution to disrupt token-level dependency, and $\mathcal{L}_3(x')$ maximizes the diversity of hidden state representations across all generated tokens to disrupt sequence-level dependency. The loss weights $\lambda_1, \lambda_2, \lambda_3$ are dynamically updated during iterative gradient descent via a temporal weight adjustment algorithm.
Knowl 2 — Delayed End-of-Sequence Loss
equation
In auto-regressive vision-language models, sequence generation halts when an end-of-sequence (EOS) token is predicted or when a predefined maximum sequence length is reached. Because auto-regressive decoding is a stochastic process under nucleus or temperature sampling, the precise token position where EOS occurs cannot be determined in advance.

The delayed EOS loss $\mathcal{L}_1(x')$ minimizes the average probability assigned to the EOS token across all $N$ generated token positions: $\mathcal{L}_1(x') = \frac{1}{N} \sum_{i=1}^N f_i^{\text{EOS}}(x')$ where $f_i(x') \in \mathbb{R}^V$ represents the post-Softmax probability distribution over the vocabulary of size $V$ for the $i$ -th generated token given perturbed image $x'$ , and $f_i^{\text{EOS}}(x')$ denotes the scalar probability assigned specifically to the EOS token at step $i$ . Minimizing $\mathcal{L}_1(x')$ discourages the model from halting generation at any step.
Knowl 3 — Token-Level Uncertainty Loss
equation
Auto-regressive generation imposes a directional output dependency where each token is conditioned on all previously generated prefix tokens. When prefix tokens remain unchanged, the model often remains confident in completing the sentence normally, making EOS minimization alone insufficient to prolong the sequence.

To break output dependency at the token level, the uncertainty loss $\mathcal{L}_2(x')$ maximizes the entropy of the predicted token distributions, encouraging the VLM to deviate from standard output trajectories toward diverse candidate tokens. This is formulated as minimizing the Kullback-Leibler (KL) divergence between each token's post-Softmax probability distribution $f_i(x') \in \mathbb{R}^V$ and a discrete uniform distribution $\mathcal{U} \in \mathbb{R}^V$ over vocabulary size $V$ across all $N$ generated tokens: $\mathcal{L}_2(x') = \sum_{i=1}^N D_{\text{KL}}\left(f_i(x') \parallel \mathcal{U}\right)$ Minimizing this divergence drives the prediction at every generation step toward maximum uncertainty, disrupting sequential output dependency.
Knowl 4 — Sequence-Level Token Diversity Loss via Matrix Nuclear Norm
model/method
To break sequential output dependency across the entire generated sequence, token diversity is defined as the rank of the concatenated matrix of internal hidden states across all generated tokens. Let $g_i(x') \in \mathbb{R}^C$ denote the concatenated hidden state vector across all model layers for the $i$ -th generated token, where $C$ is the total hidden dimension across layers. The concatenated representation matrix across $N$ tokens is: $G(x') = [g_1(x'); g_2(x'); \dots; g_N(x')] \in \mathbb{R}^{C \times N}$

Maximizing $\operatorname{Rank}(G(x'))$ directly is a non-convex, NP-hard problem. The nuclear norm $\|\cdot\|_*$ (the sum of singular values) is used as a convex surrogate for matrix rank. The token diversity loss $\mathcal{L}_3(x')$ is formulated as: $\mathcal{L}_3(x') = - \|[g_1(x'); g_2(x'); \dots; g_N(x')]\|_*$ Minimizing $\mathcal{L}_3(x')$ maximizes the nuclear norm of the token representation matrix, diversifying internal feature representations across the sequence and preventing the model from converging to a short, coherent output.
Knowl 5 — Optimization of Verbose Images with Temporal Weight Adjustment
algorithm
The verbose image perturbation is optimized via Projected Gradient Descent (PGD) with an adaptive temporal weight adjustment mechanism. Because the loss functions $\mathcal{L}_1$ , $\mathcal{L}_2$ , and $\mathcal{L}_3$ exhibit different gradient magnitudes and convergence rates across iterations, their weights $\lambda_j(t)$ are dynamically normalized relative to $\|\mathcal{L}_2\|_1$ , modulated by logarithmic temporal decay functions $T_j(t) = a_j \ln(t) + b_j$ , and smoothed with an exponential moving average parameter $m \in [0, 1)$ .
Input: Original image $x$ , perturbation budget $\epsilon$ , step size $\alpha$ , total iterations $T$ , momentum parameter $m$ , decay parameters $(a_1, b_1, a_2, b_2, a_3, b_3)$
Output: Verbose image $x'$
$x'_0 \leftarrow x + \text{Uniform}(-\epsilon, +\epsilon)$
$\lambda'_1(0) \leftarrow 1$ , $\lambda'_2(0) \leftarrow 1$ , $\lambda'_3(0) \leftarrow 1$
for $t \leftarrow 1$ to $T$ do
    Forward pass with $x'_{t-1}$ to generate $N$ tokens and extract hidden states
    Compute $\mathcal{L}_1(x'_{t-1})$ , $\mathcal{L}_2(x'_{t-1})$ , and $\mathcal{L}_3(x'_{t-1})$
    for $j \in \{1, 2, 3\}$ do
         $T_j(t) \leftarrow a_j \ln(t) + b_j$
         $\lambda_j(t) \leftarrow \frac{\|\mathcal{L}_2(x'_{t-1})\|_1}{\|\mathcal{L}_j(x'_{t-1})\|_1 \cdot T_j(t)}$
         $\lambda'_j(t) \leftarrow m \cdot \lambda'_j(t-1) + (1 - m) \cdot \lambda_j(t)$
    end for
     $\mathcal{L}_{\text{total}} \leftarrow \sum_{j=1}^3 \lambda'_j(t) \cdot \mathcal{L}_j(x'_{t-1})$
     $x'_t \leftarrow x'_{t-1} - \alpha \cdot \text{sign}(\nabla_{x'_{t-1}} \mathcal{L}_{\text{total}})$
     $x'_t \leftarrow \text{Clip}(x'_t, x - \epsilon, x + \epsilon)$
end for
return $x'_T$
Standard hyperparameter settings are: perturbation budget $\epsilon = 8$ under $l_\infty$ restriction, step size $\alpha = 1$ , iterations $T = 1000$ , momentum $m = 0.9$ , and decay parameters $a_1 = 10$ , $b_1 = -20$ , $a_2 = 0$ , $b_2 = 1$ (keeping $T_2(t)=1$ ), $a_3 = 0.5$ , and $b_3 = 1$ .

Knowl 6 — Energy-Latency and Sequence Length Amplification on Vision-Language Models

data/table

When evaluated across 1,000 images from MS-COCO and 1,000 images from ImageNet on an NVIDIA Tesla A100 GPU (40GB) with maximum generated token length set to 512 and nucleus sampling ( $p=0.9$ , temperature $t=1.0$ ), verbose images induce significant increases in sequence length, latency (in seconds), and energy consumption (in Joules, measured via NVIDIA Management Library).

VLM Model	Method	MS-COCO			ImageNet
VLM Model	Method	Length	Latency (s)	Energy (J)	Length	Latency (s)	Energy (J)
BLIP (224M)	Original	10.03	0.21	9.51	10.17	0.22	9.10
	Random Noise	9.98	0.17	8.57	9.87	0.18	8.29
	Sponge Samples	65.83	1.10	73.57	76.67	1.26	86.00
	NICGSlowDown	179.42	2.84	220.73	193.68	2.98	243.84
	Verbose Images (Ours)	318.66	5.13	406.65	268.25	4.31	344.91
BLIP-2 (OPT-2.7B)	Original	8.82	0.39	16.08	8.11	0.37	15.39
	Random Noise	9.55	0.43	17.53	8.37	0.44	19.39
	Sponge Samples	22.53	0.73	30.20	43.59	1.51	63.27
	NICGSlowDown	103.54	3.78	156.61	129.68	4.34	180.06
	Verbose Images (Ours)	226.72	7.97	321.59	250.72	10.26	398.58
InstructBLIP (Vicuna-7B)	Original	63.79	2.97	151.80	54.40	2.60	128.03
	Random Noise	62.76	2.91	148.64	53.01	2.50	125.42
	Sponge Samples	92.69	4.10	209.81	80.26	3.55	175.17
	NICGSlowDown	93.70	4.08	200.51	81.64	3.56	174.44
	Verbose Images (Ours)	140.35	6.15	316.06	131.79	6.05	300.43
MiniGPT-4 (Vicuna-7B)	Original	45.29	10.39	329.50	40.93	9.11	294.68
	Random Noise	45.15	10.35	327.04	47.78	10.98	348.66
	Sponge Samples	220.30	43.84	1390.73	228.70	47.74	1528.58
	NICGSlowDown	232.80	46.39	1478.74	245.51	51.22	1624.06
	Verbose Images (Ours)	321.35	67.14	2113.29	321.24	64.31	2024.62

Compared to unperturbed images, verbose images expand generated sequence length by an average factor of $7.87\times$ on MS-COCO and $8.56\times$ on ImageNet, consistently surpassing sponge samples and NICGSlowDown across small and large multi-modal architectures.

Knowl 7 — Object Hallucination and Dispersed Visual Attention Induced by Verbose Images

empirical result

Mechanistic analysis of verbose images indicates two primary drivers of sequence length expansion:

Visual Attention Dispersion: Grad-CAM visualizations demonstrate that while clean images yield localized cross-attention maps focusing on specific objects described in the text, verbose images disperse model attention across the entire visual field uniformly. The absence of focused visual cues prevents the VLM from grounding the visual input into a concise description.
Drastic Object Hallucination: Using the CHAIR metric (where $\text{CHAIR}_i$ is the fraction of hallucinated object instances and $\text{CHAIR}_s$ is the fraction of sentences containing a hallucinated object, evaluated with SEEM segmentation for ground-truth objects), verbose images significantly elevate hallucination rates across all target VLMs:

VLM	$\text{CHAIR}_i$ (%)				$\text{CHAIR}_s$ (%)
	MS-COCO		ImageNet		MS-COCO		ImageNet
	Original	Ours	Original	Ours	Original	Ours	Original	Ours
BLIP	11.41	79.93	22.29	89.80	12.77	84.22	13.77	90.33
BLIP-2	12.03	52.30	25.30	69.83	10.99	35.02	11.77	46.11
InstructBLIP	23.66	55.56	40.11	69.27	38.04	75.46	34.55	64.55
MiniGPT-4	19.42	46.65	29.20	65.50	19.61	52.01	16.57	54.37

The continuous generation of ungrounded entities prevents early convergence and sequence termination.

Knowl 8 — Black-Box Cross-Architecture Transferability of Verbose Images
empirical result
Verbose images crafted on a known surrogate VLM transfer across architectures to increase sequence length, latency, and energy consumption on unseen black-box target models, despite being less pronounced than white-box attacks:
- Target BLIP (Clean baseline: length 10.03, latency 0.21s, energy 9.51J on MS-COCO): Surrogate perturbations from InstructBLIP increase generated length to 63.43 (latency 2.84s, energy 142.46J); perturbations from MiniGPT-4 increase length to 48.50 (latency 10.23s, energy 316.28J).
- Target BLIP-2 (Clean baseline: length 8.82, latency 0.39s, energy 16.08J on MS-COCO): Surrogate perturbations from BLIP increase length to 36.09 (latency 1.19s, energy 47.07J); perturbations from InstructBLIP reach length 140.05 (latency 3.91s, energy 166.40J); perturbations from MiniGPT-4 reach length 140.88 (latency 3.81s, energy 154.43J).
- Target InstructBLIP (Clean baseline: length 63.79, latency 2.97s, energy 151.80J on MS-COCO): Surrogate perturbations from BLIP increase length to 91.94 (latency 4.13s, energy 203.94J); perturbations from BLIP-2 increase length to 109.01 (latency 4.87s, energy 240.30J); perturbations from MiniGPT-4 reach length 100.08 (latency 4.42s, energy 210.58J).
- Target MiniGPT-4 (Clean baseline: length 45.29, latency 10.39s, energy 329.50J on MS-COCO): Surrogate perturbations from BLIP increase length to 229.10 (latency 48.90s, energy 1562.25J); perturbations from BLIP-2 reach length 296.77 (latency 58.84s, energy 1821.66J); perturbations from InstructBLIP reach length 270.73 (latency 48.88s, energy 1551.04J).
Knowl 9 — Ablation Analysis of Loss Objectives and Optimization Components
empirical result
Ablation evaluations conducted on BLIP-2 demonstrate the necessity and synergy of each designed loss term and optimization module:
1. Loss Components (MS-COCO / ImageNet):
  - Individual losses: $\mathcal{L}_1$ alone achieves sequence length 119.46 / 147.87; $\mathcal{L}_2$ alone achieves 139.54 / 161.46; $\mathcal{L}_3$ alone achieves 104.03 / 129.02.
  - Pairwise combinations: $\mathcal{L}_1 + \mathcal{L}_2$ yields length 177.95 / 217.78; $\mathcal{L}_1 + \mathcal{L}_3$ yields 150.79 / 151.57; $\mathcal{L}_2 + \mathcal{L}_3$ yields 176.53 / 206.43.
  - Full objective: $\mathcal{L}_1 + \mathcal{L}_2 + \mathcal{L}_3$ achieves the maximum sequence length of 226.72 (latency 7.97s, energy 321.59J) on MS-COCO and 250.72 (latency 10.26s, energy 398.58J) on ImageNet.
2. Optimization Modules (MS-COCO / ImageNet):
  - Baseline without temporal decay and momentum: length 152.49 / 144.90.
  - Adding temporal decay only: length 199.92 / 231.03.
  - Adding momentum only ( $m=0.9$ ): length 187.32 / 214.92.
  - Full optimization (temporal decay + momentum $m=0.9$ ): length 226.72 / 250.72.
Knowl 10 — Generalization to VQA, Visual Reasoning, and Joint Multi-Modal Optimization
empirical result
The energy-latency vulnerability extends across multiple multi-modal task types and when optimizing vision and language inputs jointly on BLIP-2:
1. Multi-Modal Task Generalization:
  - Visual Question Answering (VQAv2 dataset): Unperturbed images yield sequence length 6.43 (latency 0.44s, energy 17.92J); verbose images increase sequence length to 271.95 (latency 11.49s, energy 365.49J).
  - Visual Reasoning (GQA dataset): Unperturbed images yield sequence length 5.70 (latency 0.44s, energy 18.23J); verbose images increase sequence length to 280.10 (latency 12.52s, energy 413.06J).
2. Joint Image-Text Optimization: When 8 input text tokens are jointly optimized (using a parameterized distribution matrix updated via Adam with learning rate 0.5) alongside visual image perturbations:
  - On MS-COCO: Clean images yield length 5.81 (latency 0.37s, energy 14.81J), whereas joint verbose attacks achieve length 270.25 (latency 9.39s, energy 378.14J), outperforming joint sponge samples (length 162.78) and joint NICGSlowDown (length 185.21).
  - On ImageNet: Clean images yield length 5.85 (latency 0.35s, energy 13.48J), whereas joint verbose attacks achieve length 262.92 (latency 9.03s, energy 365.28J), outperforming joint sponge samples (length 190.52) and joint NICGSlowDown (length 200.51).

Coverage note — Omitted individual hyperparameter grid-search tables (Tables 15-20) and qualitative visual examples (Figures 9-12) from the appendices, as the optimal hyperparameter values, standard deviation trends, and qualitative behavior are fully captured in the methodology, algorithm, and main empirical result knowls.

References

1.Jean-Baptiste Alayrac, Jeff Donahue, Pauline Luc, Antoine Miech, Iain Barr, Yana Hasson, Karel Lenc, Arthur Mensch, Katherine Millican, Malcolm Reynolds, et al. Flamingo: a visual language model for few-shot learning. In NeurIPS, 2022.
2.Peter Anderson, Xiaodong He, Chris Buehler, Damien Teney, Mark Johnson, Stephen Gould, and Lei Zhang. Bottom-up and top-down attention for image captioning and visual question answering. In CVPR, 2018.
3.Eugene Bagdasaryan, Tsung-Yin Hsieh, Ben Nassi, and Vitaly Shmatikov. (ab) using images and sounds for indirect instruction injection in multi-modal llms. arXiv preprint arXiv:2307.10490, 2023.
4.Jiawang Bai, Bin Chen, Yiming Li, Dongxian Wu, Weiwei Guo, Shu-tao Xia, and En-hui Yang. Targeted attack for deep hashing based retrieval. In ECCV, 2020a.
5.Jiawang Bai, Bin Chen, Kuofeng Gao, Xuan Wang, and Shu-Tao Xia. Practical protection against video data leakage via universal adversarial head. Pattern Recognition, 131:108834, 2022a.
6.Jiawang Bai, Kuofeng Gao, Dihong Gong, Shu-Tao Xia, Zhifeng Li, and Wei Liu. Hardly perceptible trojan attack against neural networks with bit flips. In ECCV, 2022b.
7.Jiawang Bai, Baoyuan Wu, Yong Zhang, Yiming Li, Zhifeng Li, and Shu-Tao Xia. Targeted attack against deep neural networks via flipping limited weight bits. ICLR, 2022c.
8.Jiawang Bai, Li Yuan, Shu-Tao Xia, Shuicheng Yan, Zhifeng Li, and Wei Liu. Improving vision transformers by revisiting high-frequency components. In ECCV, 2022d.
9.Yang Bai, Yuyuan Zeng, Yong Jiang, Yisen Wang, Shu-Tao Xia, and Weiwei Guo. Improving query efficiency of black-box adversarial attack. In ECCV, 2020b.
10.Yang Bai, Yuyuan Zeng, Yong Jiang, Shu-Tao Xia, Xingjun Ma, and Yisen Wang. Improving adversarial robustness via channel-wise activation suppressing. In ICLR, 2021.
11.Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness. arXiv preprint arXiv:1902.06705, 2019.
12.Jun Chen, Han Guo, Kai Yi, Boyang Li, and Mohamed Elhoseiny. Visualgpt: Data-efficient adaptation of pretrained language models for image captioning. In CVPR, 2022a.
13.Simin Chen, Cong Liu, Mirazul Haque, Zihe Song, and Wei Yang. Nmtsloth: understanding and testing efficiency degradation of neural machine translation systems. In Proceedings of the 30th ACM Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering, pp. 1148–1160, 2022b.
14.Simin Chen, Zihe Song, Mirazul Haque, Cong Liu, and Wei Yang. Nicgslowdown: Evaluating the efficiency robustness of neural image caption generation models. In CVPR, 2022c.
15.Simin Chen, Hanlin Chen, Mirazul Haque, Cong Liu, and Wei Yang. The dark side of dynamic routing neural networks: Towards efficiency backdoor injection. In CVPR, 2023.
16.Wei-Lin Chiang, Zhuohan Li, Zi Lin, Ying Sheng, Zhanghao Wu, Hao Zhang, Lianmin Zheng, Siyuan Zhuang, Yonghao Zhuang, Joseph E Gonzalez, et al. Vicuna: An open-source chatbot impressing gpt-4 with 90% chatgpt quality. 2022.
17.Aakanksha Chowdhery, Sharan Narang, Jacob Devlin, Maarten Bosma, Gaurav Mishra, Adam Roberts, Paul Barham, Hyung Won Chung, Charles Sutton, Sebastian Gehrmann, et al. Palm: Scaling language modeling with pathways. arXiv preprint arXiv:2204.02311, 2022.
18.Wenliang Dai, Junnan Li, Dongxu Li, Anthony Meng Huat Tiong, Junqi Zhao, Weisheng Wang, Boyang Li, Pascale Fung, and Steven Hoi. Instructblip: Towards general-purpose vision-language models with instruction tuning. In NeurIPS, 2023.
19.Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In CVPR, 2009.
20.Yinpeng Dong, Fangzhou Liao, Tianyu Pang, Hang Su, Jun Zhu, Xiaolin Hu, and Jianguo Li. Boosting adversarial attacks with momentum. In CVPR, 2018.
21.Maryam Fazel. Matrix rank minimization with applications. PhD thesis, Stanford University, 2002.
22.Kuofeng Gao, Yang Bai, Jindong Gu, Yong Yang, and Shu-Tao Xia. Backdoor defense via adaptively splitting poisoned dataset. In CVPR, 2023.
23.Dihong Gong, Zhifeng Li, Jianzhuang Liu, and Yu Qiao. Multi-feature canonical correlation analysis for face photo-sketch image retrieval. In ACM MM, 2013.
24.Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In ICLR, 2015.
25.Yash Goyal, Tejas Khot, Douglas Summers-Stay, Dhruv Batra, and Devi Parikh. Making the v in vqa matter: Elevating the role of image understanding in visual question answering. In CVPR, 2017.
26.Jindong Gu, Volker Tresp, and Yao Qin. Are vision transformers robust to patch perturbations? In ECCV, 2022a.
27.Jindong Gu, Hengshuang Zhao, Volker Tresp, and Philip HS Torr. Segpgd: An effective and efficient adversarial attack for evaluating and boosting segmentation robustness. In ECCV, 2022b.
28.Chuan Guo, Alexandre Sablayrolles, Hervé Jégou, and Douwe Kiela. Gradient-based adversarial attacks against text transformers. In ACL, 2021.
29.Bangyan He, Jian Liu, Yiming Li, Siyuan Liang, Jingzhi Li, Xiaojun Jia, and Xiaochun Cao. Generating transferable 3d adversarial point cloud via random perturbation factorization. In AAAI, 2023.
30.Ari Holtzman, Jan Buys, Li Du, Maxwell Forbes, and Yejin Choi. The curious case of neural text degeneration. In ICLR, 2020.
31.Sanghyun Hong, Yiğitcan Kaya, Ionuț-Vlad Modoranu, and Tudor Dumitraș. A panda? no, it’s a sloth: Slowdown attacks on adaptive multi-exit neural network inference. In ICLR, 2021.
32.Drew A Hudson and Christopher D Manning. Gqa: A new dataset for real-world visual reasoning and compositional question answering. In CVPR, 2019.
33.Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. Black-box adversarial attacks with limited queries and information. In ICML, 2018.
34.Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. In ICLR, 2015.
35.Solomon Kullback and Richard A Leibler. On information and sufficiency. The annals of mathematical statistics, 22(1):79–86, 1951.
36.Boheng Li, Yishuo Cai, Haowei Li, Feng Xue, Zhifeng Li, and Yiming Li. Nearest is not dearest: Towards practical defense against quantization-conditioned backdoor attacks. In CVPR, 2024.
37.Dongxu Li, Junnan Li, Hung Le, Guangsen Wang, Silvio Savarese, and Steven CH Hoi. Lavis: A one-stop library for language-vision intelligence. In ACL, 2023a.
38.Junnan Li, Ramprasaath Selvaraju, Akhilesh Gotmare, Shafiq Joty, Caiming Xiong, and Steven Chu Hong Hoi. Align before fuse: Vision and language representation learning with momentum distillation. In NeurIPS, 2021.
39.Junnan Li, Dongxu Li, Caiming Xiong, and Steven Hoi. Blip: Bootstrapping language-image pre-training for unified vision-language understanding and generation. In ICML, 2022a.
40.Junnan Li, Dongxu Li, Silvio Savarese, and Steven Hoi. Blip-2: Bootstrapping language-image pre-training with frozen image encoders and large language models. In ICML, 2023b.
41.Yiming Li, Baoyuan Wu, Yan Feng, Yanbo Fan, Yong Jiang, Zhifeng Li, and Shu-Tao Xia. Semi-supervised robust training with generalized perturbed neighborhood. Pattern Recognition, 124: 108472, 2022b.
42.Zhifeng Li, Dihong Gong, Qiang Li, Dacheng Tao, and Xuelong Li. Mutual component analysis for heterogeneous face recognition. ACM Transactions on Intelligent Systems and Technology (TIST), 7(3):1–23, 2016.
43.Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In ECCV, 2014.
44.Han Liu, Yuhao Wu, Zhiyuan Yu, Yevgeniy Vorobeychik, and Ning Zhang. Slowlidar: Increasing the latency of lidar-based detection using adversarial examples. In CVPR, 2023a.
45.Haotian Liu, Chunyuan Li, Qingyang Wu, and Yong Jae Lee. Visual instruction tuning. arXiv preprint arXiv:2304.08485, 2023b.
46.Wei Liu, Zhifeng Li, and Xiaoou Tang. Spatio-temporal embedding for statistical face recognition from video. In ECCV, 2006.
47.Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, and Xiaochun Cao. Watermark vaccine: Adversarial attacks to prevent watermark removal. In ECCV, 2022.
48.Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Mandar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. Roberta: A robustly optimized bert pretraining approach. arXiv preprint arXiv:1907.11692, 2019.
49.Yue Ma, Yali Wang, Yue Wu, Ziyu Lyu, Siran Chen, Xiu Li, and Yu Qiao. Visual knowledge graph for human action reasoning in videos. In MM, 2022.
50.Yue Ma, Yingqing He, Xiaodong Cun, Xintao Wang, Ying Shan, Xiu Li, and Qifeng Chen. Follow your pose: Pose-guided text-to-video generation using pose-free videos. In AAAI, 2024.
51.Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In ICLR, 2018.
52.OpenAI. Gpt-4 technical report. 2023.
53.Adam Paszke, Sam Gross, Francisco Massa, Adam Lerer, James Bradbury, Gregory Chanan, Trevor Killeen, Zeming Lin, Natalia Gimelshein, Luca Antiga, et al. Pytorch: An imperative style, high-performance deep learning library. In NeurIPS, 2019.
54.David Patterson, Joseph Gonzalez, Quoc Le, Chen Liang, Lluis-Miquel Munguia, Daniel Rothchild, David So, Maud Texier, and Jeff Dean. Carbon emissions and large neural network training. 2021.
55.Konstantinos Pelechrinis, Marios Iliofotou, and Srikanth V Krishnamurthy. Denial of service attacks in wireless networks: The case of jammers. IEEE Communications surveys & tutorials, 13(2): 245–257, 2010.
56.Xiangyu Qi, Kaixuan Huang, Ashwinee Panda, Mengdi Wang, and Prateek Mittal. Visual adversarial examples jailbreak large language models. arXiv preprint arXiv:2306.13213, 2023.
57.Anna Rohrbach, Lisa Anne Hendricks, Kaylee Burns, Trevor Darrell, and Kate Saenko. Object hallucination in image captioning. In EMNLP, 2018.
58.Ramprasaath R Selvaraju, Michael Cogswell, Abhishek Das, Ramakrishna Vedantam, Devi Parikh, and Dhruv Batra. Grad-cam: Visual explanations from deep networks via gradient-based localization. In ICCV, 2017.
59.Claude Elwood Shannon. A mathematical theory of communication. The Bell system technical journal, 27(3):379–423, 1948.
60.Ilia Shumailov, Yiren Zhao, Daniel Bates, Nicolas Papernot, Robert Mullins, and Ross Anderson. Sponge examples: Energy-latency attacks on neural networks. In IEEE EuroS&P, 2021.
61.Xiaoou Tang and Zhifeng Li. Video based face recognition using multiple classifiers. In ICAFGR, 2004.
62.Hugo Touvron, Thibaut Lavril, Gautier Izacard, Xavier Martinet, Marie-Anne Lachaux, Timothée Lacroix, Baptiste Rozière, Naman Goyal, Eric Hambro, Faisal Azhar, et al. Llama: Open and efficient foundation language models. arXiv preprint arXiv:2302.13971, 2023.
63.Xiaosen Wang, Zeliang Zhang, Kangheng Tong, Dihong Gong, Kun He, Zhifeng Li, and Wei Liu. Triangle attack: A query-efficient decision-based adversarial attack. In ECCV, 2022.
64.Baoyuan Wu, Shaokui Wei, Mingli Zhu, Meixi Zheng, Zihao Zhu, Mingda Zhang, Hongrui Chen, Danni Yuan, Li Liu, and Qingshan Liu. Defenses in adversarial machine learning: A survey. arXiv preprint arXiv:2312.08890, 2023.
65.Jia Xu, Yiming Li, Yong Jiang, and Shu-Tao Xia. Adversarial defense via local flatness regularization. In ICIP, 2020.
66.Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In CVPR, 2018.
67.Susan Zhang, Stephen Roller, Naman Goyal, Mikel Artetxe, Moya Chen, Shuohui Chen, Christopher Dewan, Mona Diab, Xian Li, Xi Victoria Lin, et al. Opt: Open pre-trained transformer language models. 2022.
68.Yong Zhang, Baoyuan Wu, Weiming Dong, Zhifeng Li, Wei Liu, Bao-Gang Hu, and Qiang Ji. Joint representation and estimator learning for facial action unit intensity estimation. In CVPR, 2019.
69.Deyao Zhu, Jun Chen, Xiaoqian Shen, Xiang Li, and Mohamed Elhoseiny. Minigpt-4: Enhancing vision-language understanding with advanced large language models. 2023.
70.Xueyan Zou, Jianwei Yang, Hao Zhang, Feng Li, Linjie Li, Jianfeng Gao, and Yong Jae Lee. Segment everything everywhere all at once. arXiv preprint arXiv:2304.06718, 2023.

Citation

MLA

Gao, K., et al. “Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images”. arXiv, 2024, http://arxiv.org/abs/2401.11170v2.

APA

Gao, K., Bai, Y., Gu, J., Xia, S.-T., Torr, P., Li, Z., & Liu, W. (2024). Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images. arXiv. http://arxiv.org/abs/2401.11170v2

Chicago

Gao, K., Y. Bai, J. Gu, et al. 2024. “Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images”. arXiv. http://arxiv.org/abs/2401.11170v2.

Harvard

Gao, K. et al. (2024) “Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images”, arXiv [Preprint]. Available at: http://arxiv.org/abs/2401.11170v2.

Vancouver

1. Gao K, Bai Y, Gu J, Xia S-T, Torr P, Li Z, Liu W (2024) Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images. arXiv

BibTeX

@article{gao2024inducing,
  title = {Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images},
  author = {Gao, Kuofeng and Bai, Yang and Gu, Jindong and Xia, Shu-Tao and Torr, Philip and Li, Zhifeng and Liu, Wei},
  year = {2024},
  journal = {arXiv},
  url = {http://arxiv.org/abs/2401.11170v2},
  eprint = {2401.11170}
}

Metadata:arXiv

Source Code

This paper has an official code repository available. Click below to access the source code.

View Repository

Access the Paper

This paper is available from its original source. Click below to access the PDF.

Open PDF

License: Authors

Inducing High Energy-Latency of Large Vision-Language Models with Verbose Images

Abstract

Topics

Table of Contents

Knowls

Knowl 1 — Verbose Images Attack Objective for Large Vision-Language Models

Knowl 2 — Delayed End-of-Sequence Loss

Knowl 3 — Token-Level Uncertainty Loss

Knowl 4 — Sequence-Level Token Diversity Loss via Matrix Nuclear Norm

Knowl 5 — Optimization of Verbose Images with Temporal Weight Adjustment