{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/avibench-towards-evaluating-the-robustness-of","title":"B-AVIBench: Towards Evaluating the Robustness of Large Vision-Language Model on Black-box Adversarial Visual-Instructions","arxiv_id":"2403.09346","date":"2024-03-14","proceeding":null,"authors":["Hao Zhang","Wenqi Shao","Hong Liu","Yongqiang Ma","Ping Luo","Yu Qiao","Nanning Zheng","Kaipeng Zhang"],"abstract":"Large Vision-Language Models (LVLMs) have shown significant progress in responding well to visual-instructions from users. However, these instructions, encompassing images and text, are susceptible to both intentional and inadvertent attacks. Despite the critical importance of LVLMs' robustness against such threats, current research in this area remains limited. To bridge this gap, we introduce B-AVIBench, a framework designed to analyze the robustness of LVLMs when facing various Black-box Adversarial Visual-Instructions (B-AVIs), including four types of image-based B-AVIs, ten types of text-based B-AVIs, and nine types of content bias B-AVIs (such as gender, violence, cultural, and racial biases, among others). We generate 316K B-AVIs encompassing five categories of multimodal capabilities (ten tasks) and content bias. We then conduct a comprehensive evaluation involving 14 open-source LVLMs to assess their performance. B-AVIBench also serves as a convenient tool for practitioners to evaluate the robustness of LVLMs against B-AVIs. Our findings and extensive experimental results shed light on the vulnerabilities of LVLMs, and highlight that inherent biases exist even in advanced closed-source LVLMs like GeminiProVision and GPT-4V. This underscores the importance of enhancing the robustness, security, and fairness of LVLMs. The source code and benchmark are available at https://github.com/zhanghao5201/B-AVIBench.","url_abs":"https://arxiv.org/abs/2403.09346v2","url_pdf":"https://arxiv.org/pdf/2403.09346v2.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"avibench-towards-evaluating-the-robustness-of","repo_url":"https://github.com/zhanghao5201/b-avibench","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"jax","reach":{"status":"ok"}}],"tasks":[{"task_slug":"fairness","task_name":"Fairness"},{"task_slug":"language-modeling","task_name":"Language Modeling"},{"task_slug":"language-modelling","task_name":"Language Modelling"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2403.09346","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2403.09346"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/zhanghao5201/b-avibench","reach":{"status":"ok"}}],"summary":{"ran":10,"ran_draft_wrong":3,"ran_violates":1},"by_repo_kind":{"official":{"samples":14,"ran":14,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":14,"samples":[{"code_sha256_prefix":"7786a8831d5bfb5b","entry":"AdditiveGaussianNoise_sample_noise","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/additive_noise.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/additive_noise.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"7786a8831d5bfb5b"}},{"code_sha256_prefix":"c21df7851a7b88a6","entry":"EN","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/distances.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/distances.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c21df7851a7b88a6"}},{"code_sha256_prefix":"4c1b107103b7c856","entry":"cook_refs","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/cider.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/cider.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4c1b107103b7c856"}},{"code_sha256_prefix":"3573c4bc85f65dfd","entry":"cook_test","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/cider.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/cider.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3573c4bc85f65dfd"}},{"code_sha256_prefix":"9d182c3d31753e0b","entry":"crossentropy","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/patch_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/patch_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9d182c3d31753e0b"}},{"code_sha256_prefix":"acb002c8cfa36ce4","entry":"has_word","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/tools.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/tools.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"acb002c8cfa36ce4"}},{"code_sha256_prefix":"0341e020ac3d0eec","entry":"l2_distance","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/evolutionary_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/evolutionary_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"0341e020ac3d0eec"}},{"code_sha256_prefix":"4e3512469bf0c742","entry":"ortho","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/evolutionary_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/evolutionary_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"4e3512469bf0c742"}},{"code_sha256_prefix":"9560e3e3e41bc1b2","entry":"precook","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/cider.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/cider.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"9560e3e3e41bc1b2"}},{"code_sha256_prefix":"e31b66bc75d6322c","entry":"remove_special_chars","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/tools.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/tools.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e31b66bc75d6322c"}},{"code_sha256_prefix":"54d240ee561c7a4e","entry":"sample_dataset","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/eval_image_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/eval_image_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"54d240ee561c7a4e"}},{"code_sha256_prefix":"b7880bde365e8087","entry":"sigmoid","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/evolutionary_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/evolutionary_attack.py","link_basis":"plan_row","language":"python","status":"ran_violates","verification_level":1,"contract_check":"VIOLATES","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"b7880bde365e8087"}},{"code_sha256_prefix":"36fe3fda88777bd1","entry":"softmax","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/patch_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/patch_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"36fe3fda88777bd1"}},{"code_sha256_prefix":"1764686cb6fe593f","entry":"to_cuda","repo":"zhanghao5201/b-avibench","repo_kind":"official","path":"image_attack_tool/models/patch_attack.py","file_url":"https://github.com/zhanghao5201/b-avibench/blob/HEAD/image_attack_tool/models/patch_attack.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"1764686cb6fe593f"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}