On the Adversarial Robustness of Large Vision-Language Models under Visual Token Compression

TL;DR

This paper investigates the adversarial robustness of large vision-language models under visual token compression, revealing vulnerabilities overlooked by previous attacks and proposing a new method to better evaluate robustness.

Contribution

The paper introduces CAGE, a novel attack method that aligns perturbation optimization with token compression inference, exposing robustness weaknesses in compressed LVLMs.

Findings

CAGE achieves lower robust accuracy than baseline attacks across various compression methods.

Existing encoder-based attacks do not fully reveal vulnerabilities due to optimization-inference mismatch.

Robustness assessments ignoring compression may be overly optimistic.

Abstract

Visual token compression is widely used to accelerate large vision-language models (LVLMs) by pruning or merging visual tokens, yet its adversarial robustness remains unexplored. We show that existing encoder-based attacks cannot fully disclose the robustness vulnerabilities of compressed LVLMs, due to an optimization-inference mismatch: perturbations are optimized on the full-token representation, while inference is performed through a token-compression bottleneck. To address this gap, we propose the Compression-AliGnEd attack (CAGE), which aligns perturbation optimization with compression inference without assuming access to the deployed compression mechanism or its token budget. CAGE combines (i) expected feature disruption, which concentrates distortion on tokens likely to survive across plausible budgets, and (ii) rank distortion alignment, which actively aligns token distortions with rank scores to promote the retention of highly distorted evidence. Across diverse representative plug-and-play compression mechanisms and datasets, our results show that CAGE consistently achieves lower robust accuracy than the baseline. This work highlights that robustness assessments ignoring compression can be overly optimistic, calling for compression-aware security evaluation and defenses for efficient LVLMs.