💻 computer science

Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models

This paper validates the effectiveness of the Cross-Prompt Attack (CroPA) on Large Vision-Language Models through a reproducibility study and proposes three key enhancements—a novel initialization strategy, universal perturbations for cross-image transferability, and an attention-targeted loss function—that collectively improve adversarial attack success rates and transferability across diverse VLM architectures.

Original authors: Atharv Mittal, Agam Pandey, Amritanshu Tiwari, Sukrit Jindal, Swadesh Swain

Published 2026-05-04

📖 6 min read🧠 Deep dive

CC BY 4.0

Original authors: Atharv Mittal, Agam Pandey, Amritanshu Tiwari, Sukrit Jindal, Swadesh Swain

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Picture: The "Magic Eye" That Can Be Fooled

Imagine Vision-Language Models (VLMs) as incredibly smart, magical eyes that can look at a picture and describe it, answer questions about it, or classify what it is. They are like a super-intelligent assistant who can see and speak.

However, this paper reveals that these assistants have a weak spot. Just like a magician can be tricked by a specific sleight of hand, these AI models can be tricked by adversarial attacks. These are tiny, almost invisible changes to an image that make the AI say something completely wrong or harmful.

The specific trick this paper studies is called CroPA (Cross-Prompt Adversarial Attack).

The Problem: Usually, if you trick an AI with a specific question (a "prompt"), it might work. But if you change the question slightly (e.g., from "What is this?" to "Describe this"), the trick often stops working.
The Original Claim: A previous study claimed that CroPA is a "universal trick." They said you could create one tiny, invisible change to an image that would fool the AI no matter what question you asked it.

The Mission: Did the Magic Trick Actually Work?

The authors of this paper decided to play the role of skeptics. They wanted to:

Reproduce the Magic: Try to perform the original CroPA trick themselves to see if it really works as well as the original authors claimed.
Upgrade the Trick: If it works, can they make it even stronger, faster, and harder to detect?

Part 1: The Reproduction (Checking the Original Trick)

The team successfully recreated the original CroPA method.

The Result: They confirmed that the original trick works. The AI can indeed be fooled across many different questions.
The Catch: They found that while the trick works well for some tasks (like answering specific questions), it struggles a bit with others (like describing an image in detail). Also, the original method is very slow and computationally expensive, like trying to solve a Rubik's cube by turning one piece at a time for six hours.

Part 2: The Upgrades (Making the Trick Better)

The authors didn't just stop at copying the trick; they invented three new ways to make it much more effective.

1. The "Smart Start" (Noise Initialization)

The Old Way: The original method started by adding random static (noise) to the image, like turning on a TV with no signal, and hoping the AI would get confused. It was a blind guess.
The New Way: The authors used a "Crystal Ball" approach. Before adding the trick, they used a different AI (a diffusion model) to generate a picture that perfectly matches the meaning of the question they want to trick the AI with.
The Analogy: Imagine trying to sneak into a party. The old way was to wander around randomly hoping to find the back door. The new way is to look at the party map first, find the back door, and walk straight to it.
The Result: This "Smart Start" made the attack much faster and much more successful, increasing the success rate significantly.

2. The "Brain Surgery" (Target Value Vectors)

The Old Way: The original method tried to confuse the AI's whole brain at once.
The New Way: The authors realized the AI has a specific part of its brain (the Vision Encoder) that is responsible for understanding the picture. They decided to target the specific "value vectors" (the internal data packets) inside this part of the brain.
The Analogy: Instead of shouting at the whole room to confuse the AI, they are whispering a specific code directly into the ear of the person responsible for recognizing faces.
The Result: This made the attack incredibly precise. It worked so well that even when the AI was trying to be "safe" and refuse to say harmful words (like "Bomb"), the attack forced it to say them anyway.

3. The "Universal Key" (Cross-Image Transferability)

The Problem: The original trick worked great across different questions, but it only worked on the one specific image it was designed for. If you took the trick and put it on a different photo, it stopped working.
The New Way: The authors used a technique called SCMix. They took two different images, cut them up, and mixed them together during the training process.
The Analogy: Instead of learning how to pick the lock of one specific door, the thief practiced on a hundred different doors at once. This forced the trick to learn the "universal shape" of a lock rather than the specific scratches on one door.
The Result: This allowed the trick to work on new images it had never seen before, not just the one it was trained on.

The Trade-Offs (The "Catch")

The paper also discovered some important limits:

The "Family Resemblance" Rule: The "Brain Surgery" upgrade works great if the AI models are built by the same "family" (using the same vision encoder). However, if you try to use a trick designed for one type of AI on a completely different type of AI, it often fails. It's like a key made for a Ford car won't open a Toyota.
The Balancing Act: The paper found that making a trick work for many questions (Cross-Prompt) and making it work for many images (Cross-Image) are two different goals that fight against each other. You can't easily maximize both at the same time without compromise.

Summary

In short, this paper says:

Yes, the original "Cross-Prompt" trick (CroPA) is real and dangerous.
But, we can make it much better by starting with a smarter guess, targeting the AI's internal brain structures more precisely, and mixing up training images to make the trick work on new photos.
However, there are limits. A trick that works on one family of AI models might not work on another, and it's hard to make a single trick that works perfectly for every question and every picture simultaneously.

The authors conclude that understanding these tricks is vital because if we don't know how to break these AI systems, we can't build them securely enough to protect real-world data.

Technical Summary: Revisiting CroPA: A Reproducibility Study and Enhancements for Cross-Prompt Adversarial Transferability in Vision-Language Models

1. Problem Statement

Large Vision-Language Models (VLMs) have revolutionized tasks such as image classification, captioning, and visual question answering (VQA). However, they remain highly vulnerable to adversarial attacks where subtle perturbations to input images or text lead to incorrect or harmful outputs. While prior research has established Cross-Model Transferability (adversarial examples working across different architectures) and Cross-Image Transferability (Universal Adversarial Perturbations or UAPs), a newer dimension known as Cross-Prompt Transferability was introduced by Luo et al. (2024) via the Cross-Prompt Attack (CroPA).

CroPA aims to generate adversarial images that remain effective regardless of the textual prompt used to query the VLM. Despite its novelty, the robustness and generalizability of CroPA require further validation. Furthermore, the original CroPA framework faces limitations, including:

Random Initialization: Reliance on uninformed random noise initialization, leading to instability and slow convergence.
Task-Specific Weaknesses: Poor performance in specific tasks like Classification and Captioning.
Computational Intensity: High resource consumption (e.g., 6+ hours on a 48GB GPU for 50 images).
Limited Cross-Image Transferability: Perturbations are tightly coupled to the specific image they were generated on, hindering universal application.

This study addresses these issues by conducting a comprehensive reproducibility study of CroPA and proposing enhancements to improve its Attack Success Rate (ASR), convergence, and transferability across images and models.

2. Methodology

2.1 Reproducibility Study

The authors first rigorously reproduced the original CroPA experiments across prominent VLMs (Flamingo, BLIP-2, InstructBLIP, and LLaVA). They validated four core claims from Luo et al. (2024):

CroPA achieves superior cross-prompt transferability compared to baselines (Single-P and Multi-P).
CroPA maintains performance superiority even as the number of prompts increases.
CroPA converges to higher ASR with increased iterations.
CroPA outperforms baselines in few-shot (in-context learning) settings.

The reproduction confirmed the original claims, noting that CroPA consistently outperforms baselines, though it observed instability in convergence trends for specific tasks (e.g., Classification) compared to the original paper's aggregate metrics.

2.2 Proposed Enhancements

To address the identified limitations, the paper introduces three key methodological improvements:

A. Noise Initialization via Vision Encoding Optimization

Instead of random noise, the authors propose a semantically informed initialization:

Target Synthesis: A diffusion model (Stable Diffusion XL) generates an image ( $x_{target}$ ) corresponding to the target text prompt.
Vision-Encoder Anchoring: The initial perturbation ( $\delta_{init}$ ) is derived by minimizing the Mean Squared Error (MSE) between the vision encoder's representation of the original image plus perturbation and the vision encoder's representation of the synthesized target image:
$\delta_{init} = \arg \min_{\|\delta\|_\infty \le \epsilon} \|f_v(x + \delta) - f_v(x_{target})\|^2_2$
Optimization: This initialization is refined using Projected Gradient Descent (PGD) with an MSE loss, ensuring the perturbation starts in a semantically meaningful direction toward the adversarial goal.

B. Guiding Perturbations via Target Value Vectors (D-UAP Integration)

To improve transferability and attack strength, the authors integrate a loss function inspired by the Doubly-Universal Adversarial Perturbation (D-UAP) method. This approach targets the internal dynamics of the vision encoder's attention mechanism:

Mechanism: The method perturbs the value vectors of the attention layers in the vision encoder. It minimizes the cosine similarity loss between the value vectors of the perturbed image and the value vectors of a reference image corresponding to the target text.
Objective Function: The final loss combines the standard CroPA min-max objective with the value vector loss:
$\mathcal{L}_{re-CroPA} = \mathcal{L}_{CroPA} - \lambda \mathcal{L}_{d-UAP}$
where $\mathcal{L}_{d-UAP}$ encourages the perturbed image's value vectors to align with the target text's representation.

C. Cross-Image Transferability via Image Augmentation

To mitigate overfitting to specific image features and enable cross-image transferability, the authors integrate data augmentation strategies during perturbation generation:

SCMix: A two-stage mixing process involving self-mixing (blending cropped patches of the same image) and cross-mixing (blending with a secondary image). This forces the model to learn features invariant to spatial variations and inter-image blending.
CutMix: A hard-mask based regional replacement strategy that forces perturbations to target spatially invariant features rather than localized artifacts.

3. Key Contributions and Results

3.1 Reproduction Validation

The study successfully reproduced the original CroPA results, confirming that:

CroPA achieves significantly higher ASR than Single-P and Multi-P baselines across VQA, Classification, and Captioning tasks.
CroPA remains robust even when in-context learning examples are added during inference (few-shot settings).
The method's transferability is largely independent of the semantic meaning or word frequency of the target text.

3.2 Performance of Enhancements

Noise Initialization: The proposed initialization strategy significantly improved ASR. On BLIP-2, CroPA+Init achieved an overall ASR of 89.77% (vs. 77.08% for base CroPA) and up to 94.58% for specific targets like "I am sorry." It also reduced the number of optimization steps required for convergence.
Value Vector Guidance (D-UAP): Integrating the value vector loss further boosted performance. The CroPA+D-UAP method achieved an overall ASR of 96.85% on BLIP-2 (a 12.5% increase over base CroPA) and 92.70% on OpenFlamingo. Notably, this enhancement was effective even against "harmful" target texts like "Bomb," which typically trigger model guardrails.
Cross-Image Transferability: While base CroPA struggles with cross-image transferability, the integration of SCMix improved the overall untargeted ASR from 43.55% to 70.55%, and CutMix improved it to 55.65%. This demonstrates that augmentation can partially bridge the gap between cross-prompt and cross-image transferability.

3.3 Cross-Model Transferability Analysis

The study analyzed transferability between models with different architectures (e.g., BLIP-2 to Flamingo vs. BLIP-2 to InstructBLIP).

Findings: The D-UAP enhancement improved cross-model transferability, particularly between models sharing similar vision encoders (e.g., BLIP-2 to InstructBLIP, where ASR jumped from 50.65% to 68.50%).
Limitation: Transferability remained low between fundamentally different architectures (e.g., BLIP-2 to Flamingo), confirming that the value vector guidance is dependent on the specific vision encoder architecture.

4. Significance and Claims

The paper claims to provide a more robust framework for generating transferable adversarial examples in VLMs. Its significance lies in:

Validation: Confirming the existence and potency of cross-prompt adversarial vulnerabilities in state-of-the-art VLMs.
Efficiency and Efficacy: Demonstrating that semantically informed initialization and targeted loss functions can drastically improve attack success rates and convergence speed.
Generalization: Showing that while cross-prompt and cross-image transferability are often competing objectives, techniques like SCMix can improve cross-image generalization without sacrificing the core cross-prompt capabilities.
Security Implications: Highlighting that VLMs are vulnerable to attacks that manipulate outputs regardless of the prompt or model architecture (to a degree), posing risks for real-world deployment. Conversely, the authors note these perturbations could be used defensively to protect sensitive data by forcing models to output predetermined, non-sensitive text.

The authors conclude that while their enhancements push the boundaries of specific transferability dimensions, a fundamental trade-off exists between optimizing for cross-prompt, cross-image, and cross-model transferability simultaneously. They call for future research into multi-objective optimization and architecturally-aware attack designs to further understand and mitigate these vulnerabilities.