Reinforcement and Complementary Space Search for Multimodal Black-Box Attack

Collaborative attack, an adversarial attack method that could attack multiple modalities simultaneously, has attracted significant interest in the research community. Vision-Language Pre-training (VLP) models have shown their vulnerability to collaborative attacks, as they perform tasks through the interaction of images and texts. However, current collaborative attacks against VLP models are mainly focused on white-box and transfer-based, which require full or partial prior knowledge of victim VLP models. Besides that, VLP collaborative attacks iteratively optimize the adversarial example on one set of image-text pairs, which may ignore other potential attack targets and cause local overfitting. In this paper, we propose a reinforcement and complementary space search attack (RCSS-Attack) as a new decision-based attack for multimodal models. Based on Markov Decision Process (MDP), we adaptatively model the adversarial attack process as a policy search process, which could enlarge the search space. We also utilize step-level constraint optimization to design a complementary space search policy. Benefiting from the wide-range search capability of reinforcement learning, the RCSS-Attack uses the reward mechanism to select the optimal direction between different image-text pairs, which could relieve the overfitting problem. In the experiments, we evaluate the RCSS-Attack on 4 V+L tasks with 3 datasets and 4 metrics.