🤖 machine learning

GeoDetect: Geometric Adversarial Detection for VLPs

This paper introduces GeoDetect, a geometric adversarial detection method for Vision-Language Pre-trained models (VLPs) that leverages the increased off-manifold distance of adversarial examples in anisotropic embedding spaces to reliably identify attacks across diverse architectures and threat scenarios.

Original authors: Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie, James Bailey, Sarah Erfani

Published 2026-07-17

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie, James Bailey, Sarah Erfani

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a world where computers don't just see pictures or read words, but understand how they dance together. This is the realm of Vision-Language Pre-trained Models (VLPs). Think of them as super-smart librarians who have read every book and seen every painting in the universe, learning to match a description of a sunset with a photo of one perfectly. They are the engines behind cool tech like finding images with text, answering questions about photos, or even describing a scene without being told what to look for. But, like any powerful tool, they have a weak spot: adversarial attacks. These are like tiny, almost invisible "glitches" or "tricks" added to an image or a sentence that confuse the computer, making it see a panda as a gibbon or a stop sign as a speed limit sign. While we know how to spot these tricks in single-mode systems (like just looking at photos), we haven't really figured out how to catch them when the computer is juggling both pictures and words at the same time. This is a big deal because if these models are used in safety-critical jobs, we need to know when they are being tricked before they make a dangerous mistake.

Enter GeoDetect, a new method proposed by researchers Afsaneh Hasanebrahimi and her team at the University of Melbourne and Monash University. They decided to investigate the "shape" of the computer's brain to see if they could spot the tricks. They discovered that the way these models store information is a bit like a crowded room where everyone is standing in a very specific, narrow hallway rather than spreading out evenly in a big open field. They call this anisotropy—a fancy word meaning the data is stretched out in certain directions and squished in others.

The team's big idea is that when someone tries to trick the model with an adversarial attack, the model's internal "map" gets pushed out of that crowded hallway and into the empty, weird spaces where no normal data lives. It's like if everyone in a dance club is doing a specific routine in the center of the floor, and a prankster tries to sneak in and do a weird, jerky move; they end up standing in the empty space near the walls, far away from the group. GeoDetect acts like a bouncer who measures the distance between a new person and the crowd. If the new person is standing too far out in the empty space (off the "manifold," or the natural shape of the data), the bouncer knows something is up.

To do this, GeoDetect uses a toolkit of geometric measuring sticks. It checks things like Local Intrinsic Dimensionality (LID), which is like asking, "How many directions does this point need to describe itself?" It also uses k-Nearest Neighbors (k-NN) to see how close a point is to its friends, Mahalanobis distance to measure how weird a point looks compared to the average shape of the crowd, and Kernel Density Estimation (KDE) to see how crowded the area around a point is. By combining these measurements, the system can tell if an input is a normal, clean example or a sneaky adversarial one.

The researchers tested this idea on various models, including popular ones like CLIP and ALBEF. They found that their theory holds up: adversarial examples really do end up in those "off-manifold" regions, further away from the normal data than clean examples are. In their experiments, GeoDetect was able to spot these attacks across different types of models and different kinds of tricks, including attacks that mess with just the image, just the text, or both. The best part? It doesn't need to retrain the model or learn new things; it just looks at the geometry of the data as it is. This suggests that by simply understanding the shape of the data space, we can build a robust, lightweight shield to keep these powerful AI models safe from being fooled.

Technical Summary: GeoDetect – Geometric Adversarial Detection for VLPs

Problem Definition

Vision-Language Pre-trained models (VLPs), such as CLIP, ALBEF, and TCL, have achieved state-of-the-art performance in multimodal tasks like image-text retrieval, visual question answering, and zero-shot classification. However, these models remain vulnerable to adversarial examples (AEs), where slight perturbations to image or text inputs cause misclassification or degraded performance.

While adversarial detection methods have shown success in unimodal settings (pure vision or pure language), their applicability to VLPs is uncertain. Multimodal alignment and fusion mechanisms in VLPs reshape the geometry of embedding spaces, potentially rendering unimodal detection signals ineffective. Furthermore, existing defense strategies often rely on computationally expensive adversarial training or task-specific probing (e.g., attention-based methods limited to Visual Question Answering), leaving a gap in robust, generalizable detection for diverse VLP architectures and attack types.

Methodology: GeoDetect

The authors propose GeoDetect, a model-agnostic framework that detects adversarial examples by analyzing the geometric properties of VLP embedding spaces. The approach is grounded in the observation that VLP embeddings exhibit anisotropy (uneven dispersion across dimensions) and that adversarial perturbations push representations into off-manifold regions.

1. Theoretical Foundation

The core theoretical contribution posits that VLP embedding spaces are anisotropic, forming structures like low-aperture cones or double-ellipsoids. Under this structure:

Anisotropy: The covariance matrix of clean embeddings is positive-definite but not isotropic (eigenvalues vary significantly).
Off-Manifold Deviation: Adversarial perturbations, when optimized to maximize divergence from the clean distribution, tend to suppress components along the manifold (tangent directions) and amplify components orthogonal to it (normal directions).
Geometric Consequence: Consequently, adversarial embeddings exhibit a greater expected geometric distance to randomly sampled clean points compared to their clean counterparts. This increased separation allows for detection via geometric metrics.

2. Detection Pipeline

GeoDetect operates in three stages: Generation, Extraction, and Detection.

Generation: A balanced dataset of clean and adversarial samples is prepared. Adversarial attacks target image, text, or both modalities.
Extraction: Deep representations are extracted from VLP encoders. The framework computes geometric scores using four classical metrics:
- Local Intrinsic Dimensionality (LID): Estimated via maximum likelihood. Uniquely, GeoDetect applies LID layer-wise, evaluating outputs from both image encoders and multimodal fusion layers (in fused VLPs), making it sensitive to perturbations across the entire network.
- k-Nearest Neighbors (k-NN): Computes the average distance to the $k$ nearest neighbors in a clean reference batch.
- Mahalanobis Distance: Measures the distance of a sample from the mean of the clean distribution, normalized by the covariance matrix.
- Kernel Density Estimation (KDE): Estimates the probability density of the sample relative to the clean distribution.
Detection: The computed scores serve as features for a decision function $\mathcal{H}$ $H$ .
- For k-NN, Mahalanobis, and KDE, a threshold-based rule is applied.
- For LID, a logistic regression classifier is trained on multi-layer features to determine if an input is adversarial.

Key Contributions

Theoretical Analysis of VLP Geometry: The paper provides a theoretical demonstration that VLP embedding spaces are anisotropic and that adversarial attacks inherently push examples into off-manifold regions, resulting in larger geometric deviations from clean data.
GeoDetect Framework: Introduction of a novel, model-agnostic detection method that leverages geometric discrepancies (LID, k-NN, Mahalanobis, KDE) to identify AEs in VLPs. Unlike previous methods, it supports both fused (e.g., ALBEF) and aligned (e.g., CLIP) architectures and handles unimodal and multimodal attacks.
Comprehensive Evaluation: Extensive validation across various VLP architectures and threat settings (including adaptive attacks) demonstrates that GeoDetect achieves consistently high Area Under the Curve (AUC) scores without requiring model fine-tuning.

Results and Performance

The authors evaluate GeoDetect on diverse VLP architectures (CLIP, ALBEF, TCL, etc.) against unimodal (image-only, text-only) and multimodal attacks.

Robustness: The method maintains high detection performance across different downstream tasks, including zero-shot classification and retrieval.
Efficiency: GeoDetect is lightweight and does not require the computational overhead of adversarial training or fine-tuning the underlying VLP.
Layer Sensitivity: The use of layer-wise LID extraction proves particularly effective for detecting multimodal attacks, as it captures perturbations within the multimodal encoder layers that other methods might miss.

Significance

The paper claims that GeoDetect addresses a critical gap in the safety and reliability of VLPs. By establishing a theoretical link between anisotropic embedding structures and off-manifold adversarial behavior, the work provides a principled approach to detection that transcends specific model architectures or task constraints. It offers a practical, cost-effective solution for identifying potentially harmful queries in real-world applications, enhancing the robustness of VLPs without compromising their performance through heavy retraining.