Effective and Efficient Adversarial Detection for Vision-Language Models via A Single Vector

• The method does not address adversarial attacks aimed at generating benign yet contextually altered text, which may not contain harmful content but still alters the original intent. Could the authors discuss how their approach might be extended or modified to handle such cases, where adversarial examples produce benign text that misrepresents the original context?
• The threat model needs further clarification. Could the authors define the assumed threat model more explicitly, specifying the attacker’s level of access, capabilities, and the defender's available resources? Including this in a dedicated section would enhance clarity, particularly around the assumed white-box access to the victim model.
• The method currently relies on having both adversarial and benign samples to calculate the direction and threshold. Could the authors discuss how their approach might be adapted for scenarios where only single images are available for evaluation, or clarify any limitations in these cases?
• Why does the method focus on the last layer of the LLM? Could the authors justify this choice, ideally through an ablation study comparing performance across different layers?
• While the method appears efficient based on empirical results, some visualization of the "attacking direction" would be helpful, particularly in the context of cross-model transferability.
• Only one baseline is provided for comparison, which limits the evaluation of the method's effectiveness. Could the authors explain why other relevant baselines, such as the approach in Xu et al. [1] that leverages the semantic relationship between malicious queries and adversarial images, were not included? Expanding the baseline comparisons would strengthen the evaluation in a revised version of the paper. [1] Xu, Yue, et al. 'Defending jailbreak attack in vlms via cross-modality information detector.'"
• What if the training and testing images come from different datasets? Could the authors evaluate the robustness of their method across diverse image distributions by conducting additional experiments using separate datasets for training and testing? This would help assess the method's generalizability.
• Line 478: Summarize the results rather than simply directing readers to the appendix.

1. Structural Issues:

   • The organization of supplementary materials could be improved by merging Appendix A and D to enhance readability and logical flow.

2. Limited Evaluation Scope:

   • The NEARSIDE method's evaluation is confined to the proposed RADAR dataset.
   • Cross-dataset validation would strengthen the method's generalizability claims.

3. Technical Oversight:

   • The method's behavior under mixed adversarial-benign inputs (adversarial image + benign text) requires clarification.
   • Comparison with multi-modal detection methods like JailGuard needs more detailed discussion.

4. Minor Issues:

   • Typographical error in Figure 6 caption ("exemplar")

1.The concept of attacking direction is intriguing, yet the paper does not adequately address its stability across varying training datasets and model architectures. This is particularly relevant given that visual language models (VLMs) are frequently updated in practice. I suggest conducting experiments to evaluate how changes in training data or slight architectural modifications impact the stability of the attacking direction. A deeper analysis of these factors could enhance the understanding of NEARSIDE's detection performance.

2.The evaluation of the proposed method is primarily limited to LLaVA and MiniGPT-4, raising concerns about its applicability to other VLMs and LLMs with different architectures. While the initial cross-model transferability analysis is a good starting point, a more extensive evaluation is necessary. I recommend testing NEARSIDE across a broader spectrum of models, particularly those with varied visual encoders and training methodologies, to better assess its generality and potential need for modifications.

3.The current focus on detecting adversarial images generated by existing techniques overlooks the possibility of attackers developing new strategies to evade detection. As the landscape of adversarial attacks evolves, it is crucial to evaluate NEARSIDE's resilience against these future threats. Conducting simulations of more sophisticated adaptive attacks could provide insights into potential countermeasures and enhance the robustness of the detection method.

4.The paper acknowledges that the detection threshold, determined from the training set, may not be optimal across all datasets. However, it lacks a thorough investigation into dynamic threshold adjustment methods. I recommend exploring adaptive thresholding techniques or statistical analyses that could lead to more reliable threshold settings. Additionally, a detailed examination of how different thresholds affect false positive and false negative rates would be beneficial.

5.Although NEARSIDE is claimed to be efficient relative to baseline methods, the computational complexity analysis is somewhat superficial. The current focus on inference time neglects other critical factors, such as memory usage and training costs associated with extracting the attacking direction. A more comprehensive breakdown of computational costs throughout the process is essential. Discussing potential optimizations could further enhance NEARSIDE's scalability and performance in practical applications.

The evaluation design is very flawed.

• The evaluation does not include performance on benign queries. As a result, how likely the method generate false alarms is unknown.
• While the RADAR dataset is larger than previous ones and is generated using different attack queries, all the images are generated in the same way. As a result, the experiment results may not generalize to other attack methods.
• The evaluation also lacks experiments on adaptive attacks, i.e., whether it's possible to generate adversarial images that would lead to harmful output yet does not go beyond the learned threshold.