Stop Reasoning! When Multimodal LLM with Chain-of-Thought Reasoning Meets Adversarial Image

Abstract: Multimodal LLMs (MLLMs) with a great ability of text and image understanding have received great attention. To achieve better reasoning with MLLMs, Chain-of-Thought (CoT) reasoning has been widely explored, which further promotes MLLMs' explainability by giving intermediate reasoning steps. Despite the strong power demonstrated by MLLMs in multimodal reasoning, recent studies show that MLLMs still suffer from adversarial images. This raises the following open questions: Does CoT also enhance the adversarial robustness of MLLMs? What do the intermediate reasoning steps of CoT entail under adversarial attacks? To answer these questions, we first generalize existing attacks to CoT-based inferences by attacking the two main components, i.e., rationale and answer. We find that CoT indeed improves MLLMs' adversarial robustness against the existing attack methods by leveraging the multi-step reasoning process, but not substantially. Based on our findings, we further propose a novel attack method, termed as stop-reasoning attack, that attacks the model while bypassing the CoT reasoning process. Experiments on three MLLMs and two visual reasoning datasets verify the effectiveness of our proposed method. We show that stop-reasoning attack can result in misled predictions and outperform baseline attacks by a significant margin.

• The paper introduces a novel stop-reasoning attack that disrupts chain-of-thought reasoning in multimodal large language models.
• The methodology employs dual-component attacks on both answer and rationale components, revealing critical vulnerabilities.
• Experimental results show that stop-reasoning attacks substantially weaken the nominal robustness gained from chain-of-thought strategies.

Evaluating Adversarial Robustness in Multimodal LLMs with Chain-of-Thought Reasoning

Multimodal LLMs (MLLMs) have demonstrated impressive capabilities in image understanding by combining visual processing with LLMs. However, they remain susceptible to adversarial attacks similar to conventional vision models, especially when chain-of-thought (CoT) reasoning is integrated. This study critically examines MLLMs' robustness against adversarial images and introduces a novel "stop-reasoning" attack technique. While CoT reasoning marginally enhances robustness against existing adversarial strategies, the stop-reasoning attack effectively neutralizes these improvements by halting the CoT-induced reasoning process.

Introduction

MLLMs enrich image understanding by harmonizing vision and text inputs to generate coherent image-to-text outputs. Despite advancements, such models suffer from heightened vulnerability to adversarial examples, which exploit model weaknesses using imperceptible perturbations. CoT reasoning improves model transparency by elucidating auxiliary reasoning steps, potentially augmenting adversarial robustness. However, the degree of robustness enhancement solely due to CoT reasoning remains underexplored. This investigation centers around whether CoT reasoning genuinely fortifies MLLMs against adversarial intrusions and introduces a specific attack aimed at exploiting CoT reasoning weaknesses.

To address these concerns, our study examines:

• The influence of CoT reasoning on the adversarial robustness of MLLMs and whether certain attack modalities effectively undermine models using CoT.
• Insights into CoT-generated rationales when MLLMs mispredict answers in the presence of adversarial images.

  Figure 1: The chain of thought reasoning provides an explanation for the incorrect predictions made by multimodal LLMs when confronted with adversarial images. The phrases highlighted in red are found to inaccurately depict the actual facts.

Methodology: Attack Strategy Design

The research formulates a dual-component attack targeting both the rationale and answer components of CoT reasoning:

• Answer Attack: Utilizing cross-entropy loss between predicted and true answers, this approach maximizes divergence using Projected Gradient Descent, fostering incorrect answer prediction.
• Rationale Attack: This strategy quantifies KL divergence between clean and adversarial rationale, encouraging model missteps in rationale. Concurrently, adversarial image perturbations aim to disrupt coherent rationale outcomes.
• Stop-Reasoning Attack: This novel approach seeks to interrupt rationale formation by imposing an answer template, effectively sidestepping embedded reasoning paths and direct answers without rational justification.

  Figure 2: Attack pipeline diagram. First, the original textual question (with choices) and the input image (containing a horse carriage) are given into an MLLM and a clean prediction (at the top) is generated. Then, an adversarial prediction is generated with the perturbed image and the original text input.

Experimental Results: Comparative Analysis

Across diverse MLLMs and datasets, we observed:

• CoT reasoning marginally augments model robustness, yet primarily under answer and rationale attacks, as evident from evaluation on models such as MiniGPT4, OpenFlamingo, and LLaVA.
• Answer attacks frequently modify both answer and rationale components, suggesting interconnected alterations within CoT reasoning.

  Figure 3: Prediction with CoT. The complete inference process, illustrated on the left, can be divided into two components: the rationale and the answer, presented on the right. The rationale comprises a sequence of intermediate reasoning steps employed for deducing the final answer.

Stop-reasoning attacks notably undermine robustness more effectively than rationale or answer attacks, indicating the illusory nature of CoT-induced resilience. Further statistical analyses confirm altered rationale components under successful attacks, highlighting the difficulty in precisely identifying and modifying critical rationale information.

Implications

While CoT reasoning introduces nominal robustness enhancements against traditional adversarial strategies, the stop-reasoning attack effectively undermines these defenses. Our findings illuminate the necessity for defensive protocols safeguarding CoT paths in MLLMs. Future increases in adversarial resistance will likely necessitate stronger defensive architectures against specific adversarial strategies. Moreover, CoT-enhanced models offer transparency in understanding adversarial missteps, promising future security advances via clearer rationalization processes.

Conclusion

Though CoT reasoning brings slight adversarial robustness improvements to MLLMs, the stop-reasoning attack effectively dismantles these advances by bypassing the reasoning process. This study instills deeper comprehension of the adversarial attack mechanics within CoT paradigms and presents tangible insights for the development of robust MLLM defenses against adversarial threats. By exposing latent vulnerabilities, this research paves the way for strategic advancements in the secure deployment of multimodal models in critical applications.