Fooling Contrastive Language-Image Pre-Training with CLIPMasterPrints

We thank the reviewer for their feedback and questions. We address them in a point-by-point manner:

I am not very convinced by the setting of the problem. In particular, I am not convinced why we need a fooling image that maximizes its possibility with many other prompts. What are the potential concerns of this vulnerability?

The reviewer makes an excellent point for classification settings: Indeed, we find that in a classification setting, where the similarity scores are passed through a softmax, the attack has the same effect as a regular adversarial attack (i.e. the adverserial class with the incidentally highest similarity score becomes the predicted output class).

Nevertheless, as emphasised by the authors of CLIP (Radford et al., 2021), a further highly relevant application is zero-shot image retrieval, which offers plenty of attack surface by means of CLIPMasterPrints. In more detail, inserting a single CLIPMasterprint into an existing database of images could potentially disrupt the system’s functionality for a wide range of search terms, as for each targeted search term the inserted fooling master image is likely to be the top result.

When inserting several CLIPMasterPrints into the database, even the top n results could consist entirely of these adversarial images rather than the true results. While this is also possible when inserting “regular” adversarial examples, the amount of examples needed for an attack using fooling master images is orders of magnitude lower than for regular adversarial examples. Practical malicious applications of this vulnerability could be

• censorship of images related to a list of censored topics
• adversarial product placement: targeting a variety of searched brands to advertise a different product as the top result
• disruption of service: introducing a larger number of unrecognizable CLIPMasterPrints for a wide range of topics, resulting in unintelligible results for many queries, reducing the quality of service of an image retrieval system.

Mechanisms of introducing CLIPMasterprints into a database depend on the application but could be as simple as putting images online to be crawled by search engines or uploading them through webforms.
To make this point more clear, we have added a Section 5 on “Potential Attack Scenarios” to revised manuscript.

It seems that the methodology is not different enough with the existing literature. In particular, as admitted in the paper, none of SGD, LVE, or PGD is a technical contribution of this paper, and it seems that this paper is just evaluating those methods in the context of fooling CLIP.

As we also point out in the response to Reviewer zgK9, It is important to note that LVE is a family of approaches and that our approach is not very similar to previous work, which we have also clarified again in the revised manuscript. For example, it differs in the evolved solutions, generative model, optimized loss function, and application domain.

Only original CLIP models are evaluated in the paper but there are many later improvement such as TCL (https://arxiv.org/pdf/2202.10401.pdf), ALBEF (https://arxiv.org/abs/2107.07651), BLIP (https://arxiv.org/abs/2201.12086), and so on. Do they have the same vulnerability? How does this vulnerability scale with the size of pre-training data (https://arxiv.org/abs/2210.08402)?

Given the much more common use of CLIP compared to its reiterations we find that the vulnerability of the original model to be of high significance even as newer approaches exist. Nevertheless, we agree that an evaluation on these improved models is desirable, and have therefore mined additional CLIPMasterPrints for BLIP (Li et al.,2022) and SigLIP (Zhai et al., 2023) models and find that both approaches are vulnerable to the attack as well. The corresponding results can be found in Figure 5 of the revised manuscript. Investigating how the vulnerability scales w.r.t. dataset size would be a valuable addition to the manuscript which we plan to add in the future by comparing e.g. the performance of mined CLIPMasterPrints on OpenCLIP models trained on LAION datasets of different sizes.

The title is misleading. If I understand correctly, the paper does not have pre-training experiments but only carry out evaluations of pre-trained CLIP.

We decided to spell out CLIP in the title rather as we found “Fooling CLIP with CLIPMasterPrints”, to be a poor choice in terms of style. But we agree with the reviewer that it could be misleading and therefore renamed the paper to "Fooling Contrastive Language-Image Pre-trained Models with CLIPMasterPrints"

Concerning the reviewer’s remark not conducting any pre-training: We propose a mitigation approach where we refine the original ViT weights in order to push the manifold of text embeddings away from mined CLIPMasterPrints. However this approach has been moved to the Appendix due to limited space.

We thank the reviewer for their insights and kind words regarding our work. Figure 4 in the revised manuscript shows the performance of PGD-mined CLIPMasterPrints for an ensemble of 64 ResNet50 models as an image encoder on Imagenet. Additionally, we ran more experiments to compare to more recent improvements over CLIP, such as BLIP (Li et al.,2022) and SigLIP (Zhai et al., 2023). Our results show that the model using a ResNet ensemble is somewhat less vulnerable to CLIPMasterPrints, yet the obtained scores are still on par with the baseline. Furthermore, BLIP and SigLIP seem to be vulnerable to CLIPMasterPrints as well. We agree that results on different datasets would add to the overall picture and plan to add these (e.g. Flickr30k) in the future.

We thank the reviewer for the feedback. However, we respectfully disagree concerning the paper’s contribution. We argue the acceptance of a manuscript at major venues should not only depend on how simple or complex its proposed approaches are, but rather on the insight and results provided by the conducted work. We consider work that contributes in terms of analysis of existing widely-used approaches such as CLIP equally important to work that proposes novel algorithms. In this work, we have focused on analysis and insight, demonstrating a novel, and in our opinion, somewhat unexpected and counterintuitive result. We show that the result can be obtained using different approaches, after which we connect it to a phenomenon previously observed in the literature (the modality gap) by showing that countermeasures against the observed phenomenon also mitigates the model's vulnerability towards the attack. It is also important to note that LVE is a family of approaches and that our approach clearly differs from previous work, which we have clarified in the updated manuscript. For example, it is completely different from existing approaches in terms of evolved solutions, used generative model, optimized loss function, and application domain.

In a nutshell: the paper’s novelty is not about the applied approaches (although we are not aware of any previous work using our LVE approach, also with respect to generating off-manifold images), but about the results and insights obtained, as well as directing attention to the vulnerability investigated. We have clarified these points in the revised manuscript.

We hope we were able to address the main concerns of the reviewers? We understand this is quite short-term, yet we would be grateful to receive brief feedback by the reviewers on our recent revision before the discussion period closes.

If there are any further questions or issues, please let us know.