{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/ceci-n-est-pas-une-pomme-adversarial","title":"Adversarial Illusions in Multi-Modal Embeddings","arxiv_id":"2308.11804","date":"2023-08-22","proceeding":null,"authors":["Tingwei Zhang","Rishi Jha","Eugene Bagdasaryan","Vitaly Shmatikov"],"abstract":"Multi-modal embeddings encode texts, images, thermal images, sounds, and videos into a single embedding space, aligning representations across different modalities (e.g., associate an image of a dog with a barking sound). In this paper, we show that multi-modal embeddings can be vulnerable to an attack we call \"adversarial illusions.\" Given an image or a sound, an adversary can perturb it to make its embedding close to an arbitrary, adversary-chosen input in another modality. These attacks are cross-modal and targeted: the adversary can align any image or sound with any target of his choice. Adversarial illusions exploit proximity in the embedding space and are thus agnostic to downstream tasks and modalities, enabling a wholesale compromise of current and future tasks, as well as modalities not available to the adversary. Using ImageBind and AudioCLIP embeddings, we demonstrate how adversarially aligned inputs, generated without knowledge of specific downstream tasks, mislead image generation, text generation, zero-shot classification, and audio retrieval. We investigate transferability of illusions across different embeddings and develop a black-box version of our method that we use to demonstrate the first adversarial alignment attack on Amazon's commercial, proprietary Titan embedding. Finally, we analyze countermeasures and evasion attacks.","url_abs":"https://arxiv.org/abs/2308.11804v4","url_pdf":"https://arxiv.org/pdf/2308.11804v4.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"ceci-n-est-pas-une-pomme-adversarial","repo_url":"https://github.com/ebagdasa/adversarial_illusions","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[{"task_slug":"image-generation","task_name":"Image Generation"},{"task_slug":"text-generation","task_name":"Text Generation"},{"task_slug":"zero-shot-learning","task_name":"Zero-Shot Learning"},{"task_slug":null,"task_name":"zero-shot-classification"}],"methods":[{"method_slug":"align","method_name":"ALIGN"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2308.11804","atlas_url":"https://app.syntology.ai/?focus=2308.11804","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2308.11804"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/ebagdasa/adversarial_illusions","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran":10,"unverified":3},"by_repo_kind":{"official":{"samples":13,"ran":10,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"d0a996dc0d594c8a","entry":"chroma_subsampling","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"DiffJPEG/compression.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/DiffJPEG/compression.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d0a996dc0d594c8a"}},{"code_sha256_prefix":"176dfa1e026fb136","entry":"dense_to_onehot","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"query_attack.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/query_attack.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"176dfa1e026fb136"}},{"code_sha256_prefix":"996d7797acf3500c","entry":"get_embeddings","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"dataset_utils.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/dataset_utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"996d7797acf3500c"}},{"code_sha256_prefix":"8c9d8492e3dce2ec","entry":"load_and_transform_thermal_data","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"thermal_illusion_classification.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/thermal_illusion_classification.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8c9d8492e3dce2ec"}},{"code_sha256_prefix":"b136faae866d109f","entry":"norm","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"anomaly_detection.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/anomaly_detection.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b136faae866d109f"}},{"code_sha256_prefix":"38d2254621bf5bec","entry":"norm","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"38d2254621bf5bec"}},{"code_sha256_prefix":"e836b43eb275f963","entry":"rgb_to_ycbcr_jpeg","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"DiffJPEG/compression.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/DiffJPEG/compression.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e836b43eb275f963"}},{"code_sha256_prefix":"c368473e2e381cfc","entry":"unnorm","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"anomaly_detection.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/anomaly_detection.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"c368473e2e381cfc"}},{"code_sha256_prefix":"312f083d8548f733","entry":"unnorm","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"312f083d8548f733"}},{"code_sha256_prefix":"f72f537462f8ab03","entry":"unnorm_audio","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"utils.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f72f537462f8ab03"}},{"code_sha256_prefix":"da99f5c09a8efea7","entry":"get_loss","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"query_attack.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/query_attack.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"da99f5c09a8efea7"}},{"code_sha256_prefix":"f9b6705425c9fde9","entry":"rgb_to_ycbcr","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"DiffJPEG/compression.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/DiffJPEG/compression.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"f9b6705425c9fde9"}},{"code_sha256_prefix":"8bf374c9e1999142","entry":"softmax","repo":"ebagdasa/adversarial_illusions","repo_kind":"official","path":"query_attack.py","file_url":"https://github.com/ebagdasa/adversarial_illusions/blob/HEAD/query_attack.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"8bf374c9e1999142"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}