Skip to content

A Frustratingly Simple Yet Highly Effective Attack Baseline: Over 90% Success Rate Against the Strong Black-box Models of GPT-4.5/4o/o1

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

M-Attack is a transfer-based targeted adversarial attack against closed-source commercial LVLMs that achieves >90% attack success rate on GPT-4.5, GPT-4o, and o1. The core insight is that prior attacks fail because their perturbations are semantically void (uniform-like), while random cropping with iterative local-to-local/global embedding alignment concentrates meaningful target semantics into local regions, dramatically improving black-box transferability.

Problem

Transfer-based targeted attacks against closed-source commercial LVLMs (GPT-4o, Claude, Gemini) have remained largely ineffective (<50% ASR). Analysis reveals that existing methods (AttackVLM, SSA-CWA, AnyAttack) produce perturbations with near-uniform spatial distributions devoid of semantic structure, causing commercial models to either ignore the perturbation as noise or describe it only vaguely. Global-to-global feature matching saturates early in optimization, preventing fine-grained semantic encoding.

Method

M-Attack combines two components:

  1. Local-level matching (LM): At each optimization step, the adversarial source image is randomly cropped (aspect ratio and scale controlled within [0.5, 1.0] of original area) and resized back to original dimensions. The cropped region's embedding is aligned via cosine similarity maximization with either a local crop or global embedding of the target image. This many-to-many/one mapping forces the global perturbation δ^g — aggregated across all local δ^l_i — to concentrate semantically rich content in the central image regions (where crops overlap most) while maintaining diversity at margins. The consistency constraint (overlapping crops share semantics) combined with a diversity constraint (non-overlapping regions encode new details) prevents overfitting and avoids the early saturation seen with global-global matching.

  2. Model ensemble (ENS): Three CLIP surrogate variants (ViT-B/16, ViT-B/32, ViT-g-14-laion2B) with complementary receptive fields are ensembled. Smaller patch sizes (14, 16) capture fine-grained perturbation details; larger (32) preserves global structure. The ensemble extracts shared semantics that transfer across the proprietary training distributions of target black-box models.

Optimization uses I-FGSM with ℓ∞ budget ε=16, 300 steps. Evaluation uses two new metrics: KMRScore (keyword matching at thresholds 0.25/0.5/1.0, semi-automated via GPT-4o) and GPTScore-based ASR (similarity > 0.3 between source/target captions).

Key Contributions

  • Diagnostic analysis showing failed attacks produce uniform-distribution perturbations that commercial LVLMs perceive as noise rather than semantic content (6–45% vague response rate across baselines).
  • M-Attack: random crop + resize + local embedding alignment as a simple, highly effective optimization procedure that encodes target semantics into local perturbation regions.
  • Formal characterization of the consistency/diversity trade-off (Eqs. 3–4) unifying local and global matching schemes under one framework.
  • KMRScore: a semi-automated, multi-threshold keyword matching metric that reduces human bias in adversarial transferability evaluation.
  • Demonstration that reasoning-augmented models (o1, Claude-3.7-thinking, Gemini-2.0-flash-thinking) are no more robust than their non-reasoning counterparts, likely because reasoning operates purely in the text modality while vision components remain shared.

Results

  • GPT-4o: ASR 0.95, KMRa 0.82, KMRb 0.54 vs. AnyAttack (best prior): ASR 0.42, KMRa 0.44 (ε=16).
  • Gemini-2.0-flash: ASR 0.78, KMRa 0.75 vs. AnyAttack: ASR 0.48, KMRa 0.46.
  • Claude-3.5-sonnet: ASR 0.29, KMRa 0.31 vs. AnyAttack: ASR 0.23, KMRa 0.25.
  • GPT-4.5: KMRa 0.82, ASR 0.95 (Tab. 5).
  • GPT-o1 (reasoning): KMRa 0.83, ASR 0.94 (Tab. 4).
  • Gemini-2.0-flash-thinking: KMRa 0.78, ASR 0.81 (Tab. 4).
  • Imperceptibility: M-Attack achieves lowest â„“1/â„“2 norms (0.030/0.036 at ε=16) vs. all baselines.
  • Ablation: removing ensemble reduces KMR and ASR by ~40%; removing local crop of source image (LCS) is the most damaging ablation; local crop of target (LCT) removal has only marginal impact.
  • Performance scales with steps: 200 extra steps beyond 300 yield ~10% gain on Gemini/Claude; near-100% ASR on GPT-4o at 500 steps.

Limitations

  • Claude-3.5/3.7 ASR remains substantially lower (0.29–0.37) than GPT models, suggesting Claude's vision pipeline is comparatively more resistant.
  • Evaluation uses only 100 images from the NIPS 2017 competition dataset resized to 224×224; ecological validity to real-world resolution and diverse content is unclear.
  • Surrogate models are CLIP variants; it is unknown whether the attack degrades if the target model's vision encoder is architecturally dissimilar to all CLIP variants.
  • KMRScore still relies on GPT-4o for keyword matching, introducing dependency on a proprietary system whose behavior may change.
  • The attack requires white-box access to surrogate models (CLIP) and substantial compute (300 optimization steps); this limits but does not eliminate real-world threat relevance.

Relevance to Vision-Language Models

This paper directly quantifies a critical security gap in state-of-the-art commercial VLMs — GPT-4o, Claude, Gemini, and their reasoning variants — showing they remain vulnerable to imperceptible image perturbations that redirect model outputs to attacker-specified semantics. The finding that reasoning models (o1, Claude-3.7-thinking) are no safer than base models is significant for the VLM robustness literature, as it suggests that chain-of-thought reasoning provides no defense when the visual encoder is shared and undefended. The semantic-alignment perspective — that effective adversarial perturbations must carry interpretable local semantics rather than uniform noise — informs both attack design and future defensive work on certified robustness and input-space filtering for VLMs.