这篇研究告诉你，红外视觉语言模型有多脆弱——一个 QR 风格的边角补丁就能让 OpenAI CLIP 准确率从 98.67% 跌到 0.70%，还能黑盒攻击其它模型。搞安全或对抗训练的值得一看。
InfraQR 是一种针对红外视觉语言模型的攻击方法，将紧凑结构化补丁沿图像边界放置，通过代理 CLIP 编码器优化可学习网格单元。在 300 张红外图像基准上，InfraQR 将 OpenAI CLIP 的分类准确率从 98.67% 降至 0.70%。攻击还迁移到黑盒字幕和 VQA 模型，导致字幕语义退化，并在 GPT-5.4 评估下产生更易错的答案。结果表明红外视觉语言模型易受边缘结构化扰动影响，需进一步研究跨任务鲁棒性。
InfraQR: Edge-Placed QR-Inspired Structured Patch Attacks on Infrared Vision-Language Models
Infrared vision-language models are increasingly used for perception under low-light and adverse visual conditions, yet their robustness to localized structured perturbations remains underexplored. Existing infrared adversarial studies mainly focus on object detectors, leaving the security of infrared vision-language models less systematically examined. We present InfraQR, a QR-inspired structured patch attack for infrared vision-language models. Unlike localized attacks that attach perturbations to the target object, InfraQR places a compact structured patch along image boundaries and optimizes learnable grid cells through surrogate CLIP-style encoders. The resulting patch has a near-binary structured appearance, but is not required to be a valid or machine-readable QR code. We evaluate InfraQR on infrared classification, caption transfer, and question-answer-aware visual question answering (VQA) tasks. On a 300-image infrared benchmark, InfraQR sharply reduces the accuracy of multiple CLIP-style classifiers, including reducing OpenAI CLIP accuracy from 98.67% to 0.70%. The generated adversarial images also transfer to black-box captioning and VQA models, causing semantic degradation in captions and more error-prone answers under GPT-5.4-based evaluation. These results show that infrared vision-language models remain vulnerable to structured edge-placed perturbations, motivating further study of cross-task robustness beyond direct object occlusion.
- Latent Space (swyx)07-08 02:20原文