Enhancing CLIP Robustness via Cross-Modality Alignment

TL;DR

This paper introduces COLA, a training-free, optimal transport-based method that improves CLIP's robustness to adversarial attacks by enhancing cross-modal alignment between image and text features.

Contribution

The paper proposes COLA, a novel framework that restores global and local feature alignment in CLIP using optimal transport, significantly boosting adversarial robustness without additional training.

Findings

Average 6.7% accuracy improvement on ImageNet under PGD attacks.

Maintains high accuracy on clean samples.

Effective across 14 zero-shot classification benchmarks.

Abstract

Vision-language models (VLMs) such as CLIP demonstrate strong generalization in zero-shot classification but remain highly vulnerable to adversarial perturbations. Existing methods primarily focus on adversarial fine-tuning or prompt optimization; they often overlook the gaps in CLIP's encoded features, which is shown as the text and image features lie far apart from each other. This misalignment is significantly amplified under adversarial perturbations, leading to severe degradation in classification performance. To address this problem, we propose Cross-modality Alignment, dubbed COLA, an optimal transport-based framework that explicitly addresses adversarial misalignment by restoring both global image-text alignment and local structural consistency in the feature space. (1) COLA first projects adversarial image embeddings onto a subspace spanned by class text features, effectively filtering out non-semantic distortions while preserving discriminative information. (2) It then models images and texts as discrete distributions over multiple augmented views and refines their alignment via OT, with the subspace projection seamlessly integrated into the cost computation. This design ensures stable cross-modal alignment even under adversarial conditions. COLA is training-free and compatible with existing fine-tuned models. Extensive evaluations across 14 zero-shot classification benchmarks demonstrate the effectiveness of COLA, especially with an average improvement of 6.7% on ImageNet and its variants under PGD adversarial attacks, while maintaining high accuracy on clean samples.