Adversarial attack method and system for large visual language model spatial reasoning

Abstract

This invention proposes an adversarial attack method and system for spatial reasoning of large-scale visual language models. The method operates in a gray-box environment, utilizing only accessible open-source visual encoders, image editing tools, depth estimators, and model input-output feedback to complete the attack. The method mainly includes four steps: First, a target image is generated based on the original image and the spatial problem, transforming only spatial relationships while maintaining semantic element consistency; second, an initial spatial adversarial perturbation is generated by combining visual feature loss and depth consistency loss; next, stochastic gradient estimation is performed using the victim model's query output and a public text encoder to enhance and optimize the initial perturbation; finally, the optimized perturbation is superimposed on the original image to obtain the final adversarial image, causing the large-scale visual language model under test to output incorrect spatial answers in qualitative spatial relationship or quantitative distance / scale reasoning tasks, while preserving semantic information such as object categories and scene descriptions as much as possible.

Description

Technical Field

[0001] This invention relates to the fields of artificial intelligence security, computer vision, multimodal model security, and embodied intelligence security, and particularly to adversarial attack methods and systems for spatial reasoning of large visual language models, which can be used legally. Background Technology

[0002] Large-scale visual language models can simultaneously receive visual images and natural language questions, and output textual answers about the image content. With the development of multimodal large-scale models, large-scale visual language models with spatial reasoning capabilities are increasingly being applied to tasks such as robot navigation, robotic arm operation, autonomous driving, human-robot collaboration, and smart homes. In these safety-critical scenarios, the models not only need to identify the categories of objects in images, but also determine the spatial relationships between objects, such as left-right, up-down, front-back, distance, scale, and orientation. Spatial reasoning errors can directly affect the action decisions of embodied intelligent systems, such as resulting in dangerous actions during grasping, obstacle avoidance, or object delivery.

[0003] Existing adversarial attacks on large-scale visual language models are mostly geared towards semantic understanding tasks. They typically involve adding subtle perturbations to the input image to prevent the model from recognizing a particular object or to induce the model to generate text unrelated to the image's semantics. While these methods can expose semantic security risks in visual language models, they are significantly inadequate for spatial reasoning tasks. Spatial reasoning relies on scene geometry, depth information, and the relative positions of objects. Traditional semantic attacks often require substantial perturbations to affect spatial judgments, and their results typically manifest as incorrect object recognition rather than accurately altering the spatial answer while preserving the semantic content.

[0004] In embodied intelligence scenarios, merely misleading semantic information does not necessarily lead to direct action risks. For example, if a robot cannot recognize a knife, it may choose to wait or stop operating; however, if the model can still recognize the knife but misjudges its orientation, position, or distance, it may perform dangerous actions. Therefore, it is necessary to propose an adversarial attack method specifically targeting the spatial reasoning capabilities of large-scale visual language models, enabling them to output erroneous spatial relationships while maintaining semantic understanding as much as possible. This reveals the vulnerability of such models in the spatial reasoning stage and provides a testing basis for subsequent defense methods. Summary of the Invention

[0005] To address the lack of specific attack methods for spatial reasoning capabilities of large visual language models in existing technologies, this invention provides an adversarial attack method and system for spatial reasoning of large visual language models. Through three core stages—target image generation, initial spatial adversarial perturbation generation, and perturbation enhancement optimization—it can achieve targeted misleading of spatially related information under gray-box conditions while preserving the semantic information of the image as much as possible.

[0006] On the one hand, according to the design scheme of the present invention, an adversarial attack method for spatial reasoning of large-scale visual language models is provided, which can be used legally, and includes:

[0007] Obtain the original image and the corresponding spatial problem, and generate the target image based on the original image and the spatial problem;

[0008] An optimization perturbation is initialized, and a preset iterative update process is performed on the optimization perturbation until a preset iteration termination condition is met. The final optimal perturbation is then used as the initial spatial adversarial perturbation. Each iteration update process includes: superimposing the perturbation updated in the previous iteration onto the original image to obtain the attacked image; calculating the total loss between the attacked image, the original image, and the target image; and minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the optimization perturbation in the current iteration process.

[0009] The initial spatial adversarial perturbation is optimized using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation.

[0010] The spatial adversarial perturbation is superimposed onto the original image to obtain the final adversarial image;

[0011] The final adversarial image is input into the large visual language model under test to evaluate its spatial reasoning ability.

[0012] Furthermore, the process of generating the target image based on the original image and the spatial problem specifically includes:

[0013] The original image and the spatial problem are input into a visual language model with spatial reasoning capabilities to obtain the original spatial relationship description. The spatial relationships in the original spatial relationship description are modified only by a preset large language model to generate corresponding image editing prompts. The target image is generated by calling a preset image editing model based on the image editing prompts.

[0014] Furthermore, the spatial problem includes qualitative spatial relationship problems and quantitative spatial relationship problems. The qualitative spatial relationship problem is used to reflect the relative positional relationship of each object in the original image, and the quantitative spatial relationship problem is used to characterize the scale information of the target object in the original image, as well as the relative distance information between each object.

[0015] Furthermore, the total loss is expressed as:

[0016]

[0017] in, Indicates the total loss. Indicates visual feature loss, This represents the loss of deep consistency. This represents the weighting coefficient.

[0018] Furthermore, the visual feature loss The visual feature representation used to bring the attacked image closer to the target image and further away from the original image is:

[0019]

[0020] in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a visual encoder. This represents the parameters of the visual encoder.

[0021] Furthermore, the depth consistency loss This is used to make the depth map of the attacked image approximate the depth map of the target image:

[0022]

[0023] in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a depth estimator. This represents the parameters of the depth estimator.

[0024] Furthermore, the optimization of the initial space against perturbations using the query feedback-based stochastic gradient estimation method specifically includes:

[0025] N random perturbations are generated. For each random perturbation, it is added to the initial spatial adversarial perturbation to construct the corresponding query sample; and the target text is obtained from the target image.

[0026] All query samples are input into the large visual language model to be tested for query processing; for each query, the output text of the large visual language model to be tested is obtained, and the similarity between the output text and the target text is calculated by a preset text encoder; the estimated gradient is calculated using the similarity, and the initial spatial adversarial perturbation is updated according to the estimated gradient; and the updated initial spatial adversarial perturbation is cropped.

[0027] The final clipped initial spatial adversarial perturbation is the spatial adversarial perturbation.

[0028] Furthermore, the estimated gradient is expressed as:

[0029]

[0030] in, This indicates the estimation of the gradient. Indicates the direction of the nth random sampling. Let N represent the scale of the random perturbation, and N represent the number of queries. This indicates that the output text and the target text are in the encoder. The similarity between them.

[0031] Furthermore, the final adversarial image is represented as:

[0032]

[0033] in, Indicates the final adversarial image, Indicates the maximum permissible disturbance amplitude. This indicates that the space is resistant to disturbances. Indicates the original image The perturbation clipping operation is centered on this.

[0034] On the other hand, the present invention also provides an adversarial attack system for spatial reasoning of large visual language models, which, when used legally, includes:

[0035] Target image generation module: used to acquire the original image and the corresponding spatial problem, and generate a target image based on the original image and the spatial problem;

[0036] The perturbation iterative update module is used to initialize a perturbation to be optimized, perform a preset iterative update process on the perturbation to be optimized until a preset iteration termination condition is met, and then use the final optimal perturbation as the initial spatial adversarial perturbation. Each iterative update process includes: superimposing the perturbation updated in the previous iteration on the original image to obtain the attacked image; calculating the total loss between the attacked image, the original image, and the target image; and minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the perturbation to be optimized in the current iteration process.

[0037] Perturbation enhancement module: used to optimize the initial spatial adversarial perturbation using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation;

[0038] Final adversarial image generation module: used to superimpose the spatial adversarial perturbation onto the original image to obtain the final adversarial image;

[0039] Spatial reasoning ability assessment module: used to evaluate the spatial reasoning ability of the large visual language model under test by inputting the final adversarial image.

[0040] The beneficial effects of this invention are:

[0041] First, this invention specifically designs an attack process targeting the spatial reasoning stage of large-scale visual language models, rather than merely misleading semantic recognition, enabling a more accurate assessment of spatial security risks in embodied intelligence scenarios. Second, this invention separates spatial and semantic information through the target image, focusing perturbation optimization on changes in spatial relationships, inducing the model to output incorrect spatial answers while preserving the semantics of objects and scenes. Next, this invention simultaneously introduces visual feature loss and depth consistency loss, utilizing the visual encoder and depth estimator to jointly constrain the perturbation direction, enhancing the attack capability against 3D geometric features and spatial layout information. Finally, this invention can complete perturbation enhancement in gray-box scenarios relying solely on a public visual encoder and model query output, demonstrating strong practicality and transferability. Therefore, this invention addresses the lack of specialized attack methods for the spatial reasoning capabilities of large-scale visual language models in existing technologies; moreover, the method provided by this invention has a high attack success rate on multiple large-scale visual language models with spatial reasoning capabilities, exceeding 90% in most scenarios, and effectively preserving semantic information. This invention's method can be applied in legitimate scenarios such as model robustness training, data augmentation, and image privacy protection. Attached Figure Description

[0042] Figure 1 This is a flowchart illustrating the adversarial attack method for spatial reasoning of large visual language models in an embodiment of the present invention.

[0043] Figure 2 This is a schematic diagram of the target image generation structure in the adversarial attack method for spatial reasoning of large visual language models in an embodiment of the present invention;

[0044] Figure 3 This is a structural diagram of generating the initial spatial adversarial perturbation in the adversarial attack method for spatial reasoning of large visual language models in this embodiment of the invention.

[0045] Figure 4 This is a schematic diagram of perturbation enhancement and model output in the adversarial attack method for spatial reasoning of large visual language models in an embodiment of the present invention;

[0046] Figure 5 This is a schematic diagram of the architecture of an adversarial attack system for spatial reasoning of large visual language models in an embodiment of the present invention. Detailed Implementation

[0047] To make the objectives, technical solutions, and advantages of this invention clearer and more understandable, the technical solutions of the embodiments of this invention will be clearly described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of this invention, and not all embodiments. Based on the embodiments of this invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of this invention.

[0048] like Figure 1 As shown, this embodiment of the invention provides an adversarial attack method for spatial reasoning of large visual language models, which can be used legally and includes:

[0049] S101. Obtain the original image and the corresponding spatial problem, and generate the target image based on the original image and the spatial problem;

[0050] Specifically, first, acquire the original image. And the corresponding spatial problem t. The spatial problem can be a qualitative spatial relationship problem, such as judging the left, right, up, down, front, back, and orientation relationships between two objects from the observer's perspective; or it can be a quantitative spatial relationship problem, such as changing the distance between objects or changing the size of the objects themselves.

[0051] Secondly, the original spatial description is obtained. For qualitative tasks, the original image and spatial question are input into a large visual language model or annotation module with spatial reasoning capabilities to obtain the original spatial relationship description. For example, the original answer could be "the black cup is on the left side of the table"; the qualitative task corresponds to the qualitative spatial relationship question, which is to generate the opposite spatial relationship based on the original spatial answer; the annotation module is used for grounding tasks to help the model identify the corresponding objects.

[0052] Next, image editing prompts are generated. The original spatial relationship description is input into a large language model, which inverts the spatial relationship while preserving semantic elements such as object category, background, and color. For example, "The black cup is on the left side of the table" is transformed into "Move the black cup to the right side of the table, while keeping other objects and the background unchanged."

[0053] Finally, the image editing model is called to generate the target image. The target image has the same semantic elements as the original image, but its spatial layout differs from the target spatial relationship. That is, the target image retains the object categories, background, and semantic elements of the original image, only changing information related to spatial reasoning. For quantitative tasks, image editing prompts can control the range of changes in the target object scale and the relative distance between objects. For example, the target object scale can be reduced by 0 to 0.75 times the original scale, and the relative distance between objects can be enlarged by more than 1.25 times the original distance. The quantitative task corresponds to the quantitative spatial relationship problem.

[0054] As one possible implementation method, such as Figure 2 As shown, if the original image includes a black cup and a green cup, and the black cup is on the left and the green cup is on the right relative to the observer, then the spatial problem can be set as "Is the black cup on the left or right of the observer?" The original spatial description output by the spatial LVM is "the black cup is on the left". The editing prompt word generated by the large language model is to reverse the spatial relationship without changing the semantic elements. The image editing model is called to synthesize the target image based on the original image and the prompt word, that is, to obtain the target image with the black cup on the right and the green cup on the left.

[0055] S102. Initialize a perturbation to be optimized, and perform a preset iterative update process on the perturbation to be optimized until a preset iteration termination condition is met. Then, use the final optimal perturbation as the initial spatial adversarial perturbation. Each iteration update process includes: superimposing the perturbation updated in the previous iteration on the original image to obtain the attacked image, calculating the total loss between the attacked image, the original image, and the target image; minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the perturbation to be optimized in the current iteration process.

[0056] The core of this step is to leverage an accessible open-source visual encoder and an independent depth estimator to push the features and depth representation of the original image onto the target image under gray-box conditions, thereby concentrating the perturbation into spatially relevant regions.

[0057] like Figure 3 As shown, Figure 3 To generate the initial spatial structure diagram against disturbances, the specific process is as follows:

[0058] First, the original image Superimposed disturbances to be optimized Obtain the attacked image The image to be attacked, the original image, and the target image are respectively input into a public visual encoder. To obtain the corresponding visual features.

[0059] Secondly, the visual feature loss is calculated, and the visual feature loss is expressed as:

[0060]

[0061] in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a visual encoder. This represents the parameters of the visual encoder.

[0062] The visual feature loss makes the visual features of the attacked image closer to the target image and farther away from the original image, so that the visual representation of the attacked image is closer to the target state after the inverted spatial relationship.

[0063] Next, the image to be attacked and the target image are input into the depth estimator. The depth maps of the two objects are obtained, and the depth consistency loss is calculated. The depth consistency loss is expressed as:

[0064]

[0065] in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a depth estimator. This represents the parameters of the depth estimator.

[0066] The depth consistency loss constraint on the three-dimensional spatial layout causes the perturbation to not only change the two-dimensional pixel features, but also affect the geometric features on which spatial reasoning depends.

[0067] Finally, calculate the total loss. The total loss is expressed as:

[0068]

[0069] in, This represents the weighting coefficient.

[0070] The perturbation is iteratively updated along the direction that minimizes the total loss to obtain the initial spatial adversarial perturbation. The update process is represented as follows:

[0071]

[0072] As one possible implementation, the depth estimator uses ZoeDepth with weighting coefficients. When set to 0.5, the disturbance amplitude is limited to no more than 8 / 255.

[0073] S103. The initial spatial adversarial perturbation is optimized using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation.

[0074] like Figure 4 The diagram illustrates the perturbation enhancement and model output. Since the internal parameters and gradients of the victimized large visual language model (i.e., the large visual language model to be tested) are unavailable, this embodiment employs a gradient estimation method based on random queries for optimization. The specific process is as follows:

[0075] Specifically, resisting disturbances in the initial space Add N random perturbations Multiple query samples were constructed and input into the victim's large-scale visual language model. .

[0076] For each query, the victim model's output text is obtained and processed by a public text encoder. Calculate the similarity between the target text and the target image. The target text can be the spatial answer obtained after inputting the target image into the victim model, or it can be a textual answer artificially constructed from the spatial relationships of the target image. Calculate the estimated gradient according to the following formula. The perturbation is updated in directions that improve the similarity to the target text. The enhancement phase uses query feedback to make LVLM output the target space answer more stably.

[0077] The estimated gradient The calculation process is expressed as follows:

[0078]

[0079] in, Indicates the direction of the nth random sampling. Let N represent the scale of the random perturbation, and N represent the number of queries. This indicates that the output text and the target text are in the encoder. The similarity between them.

[0080] S104. The spatial adversarial perturbation is superimposed onto the original image to obtain the final adversarial image;

[0081] Specifically, after each update, the disturbance is pruned to keep it within an acceptable range. Within the range. After T rounds of optimization, the enhanced spatial counter-perturbation is obtained. The final adversarial image is generated according to the following formula. ,

[0082]

[0083] in, Indicates the maximum permissible disturbance amplitude. This indicates that the space is resistant to disturbances. Indicates the original image The perturbation clipping operation is centered on this.

[0084] S105. The final adversarial image is input into the large visual language model under test to evaluate its spatial reasoning ability.

[0085] Specifically, the spatial reasoning vulnerability of large-scale visual language models is assessed using final adversarial images. The original spatial problem t is input into the victim's large-scale visual language model, and the spatial-related answers in the model's output are observed to see if they are misleading. If the spatial answers in the output differ from the original correct answers, but the semantic information such as object categories and scene descriptions remain consistent, the attack is considered successful.

[0086] Furthermore, the spatial reasoning attack target is represented as:

[0087]

[0088] In equation (1), x represents the original image, and t represents the spatial problem. A large visual language model representing the victim. This represents the model's output sequence. This indicates the key answers directly related to the spatial problem. This represents an attack function that adds adversarial perturbations to the original image. This indicates a spatial answer that has been misled.

[0089] Furthermore, the attack scenario of this invention is a gray-box scenario, in which the attacker cannot access the internal structure, network weights, or language model backend of the victim's large visual language model, but can use the publicly available visual encoder, depth estimator, image editing model, and the input and output query results of the victim model.

[0090] As one possible implementation, the victim model may include large visual language models with spatial reasoning capabilities, such as SpatialVLM, SpatialBot, SpatialReasoner, and SpatialLadder; the test data includes quantitative task data and qualitative task data, with quantitative task images coming from SpatialRGPT and qualitative task images coming from SpatialBot, RoboRefer, and 3DSRBench. Comparative attack methods include Adv-Attack and VE-Attack.

[0091] As one feasible implementation, the attack success rate (ASR) can be used as the primary evaluation metric. For qualitative tasks, an attack is considered successful if the spatial relationship text in the model output differs from the original correct spatial relationship. For quantitative tasks, an attack is considered successful if the difference between the distance or scale output by the model and the true distance or scale exceeds 25%. Experimental data shows that this method achieves high attack success rates in both qualitative and quantitative spatial reasoning tasks, exceeding 90% on multiple models, and outperforms traditional semantic adversarial attacks in terms of semantic preservation.

[0092] As an alternative implementation, the semantic preservation effect can also be evaluated using metrics such as word error rate (WER), normalized semantic similarity (NSEM), and word shift distance (WED). Results show that the perturbations generated by this method are mainly concentrated in pixel regions related to spatial relationships, automatically focusing on object regions that affect spatial location judgment without significantly disrupting semantic content unrelated to the problem.

[0093] In summary, this invention achieves targeted attacks on the spatial reasoning capabilities of large visual language models under gray-box conditions by combining target image generation, initial spatial adversarial perturbation generation, and perturbation enhancement optimization. This method can be used to discover potential risks in the spatial understanding of large visual language models and provides a technical foundation for subsequent construction of spatial reasoning robustness evaluation and defense mechanisms.

[0094] On the other hand, such as Figure 5 As shown, this invention also provides an adversarial attack system for spatial reasoning of large visual language models, which, when used legally, includes:

[0095] Target image generation module: used to acquire the original image and the corresponding spatial problem, and generate a target image based on the original image and the spatial problem;

[0096] The perturbation iterative update module is used to initialize a perturbation to be optimized, perform a preset iterative update process on the perturbation to be optimized until a preset iteration termination condition is met, and then use the final optimal perturbation as the initial spatial adversarial perturbation. Each iterative update process includes: superimposing the perturbation updated in the previous iteration on the original image to obtain the attacked image; calculating the total loss between the attacked image, the original image, and the target image; and minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the perturbation to be optimized in the current iteration process.

[0097] Perturbation enhancement module: used to optimize the initial spatial adversarial perturbation using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation;

[0098] Final adversarial image generation module: used to superimpose the spatial adversarial perturbation onto the original image to obtain the final adversarial image;

[0099] Spatial reasoning ability assessment module: used to evaluate the spatial reasoning ability of the large visual language model under test by inputting the final adversarial image.

[0100] This invention enables large visual language models to output incorrect spatial answers in qualitative spatial relationship or quantitative distance tasks, thereby revealing the vulnerability of large visual language models in spatial reasoning and providing a technical basis for model evaluation and protection research in safety-critical applications such as embodied intelligence, robot navigation, and human-computer interaction.

[0101] It should be noted that the adversarial attack system for spatial reasoning of large visual language models provided in this embodiment of the invention can be specifically referred to in the above method embodiments to implement the functions described above.

[0102] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention, and not to limit them; although the present invention has been described in detail with reference to the foregoing embodiments, those skilled in the art should understand that modifications can still be made to the technical solutions described in the foregoing embodiments, or equivalent substitutions can be made to some of the technical features; and these modifications or substitutions do not cause the essence of the corresponding technical solutions to deviate from the spirit and scope of the technical solutions of the embodiments of the present invention.

Claims

1. An adversarial attack method for spatial reasoning of large-scale visual language models, characterized in that, Used under legal circumstances, including: Obtain the original image and the corresponding spatial problem, and generate the target image based on the original image and the spatial problem; An optimization perturbation is initialized, and a preset iterative update process is performed on the optimization perturbation until a preset iteration termination condition is met. The final optimal perturbation is then used as the initial spatial adversarial perturbation. Each iteration update process includes: superimposing the perturbation updated in the previous iteration onto the original image to obtain the attacked image; calculating the total loss between the attacked image, the original image, and the target image; and minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the optimization perturbation in the current iteration process. The initial spatial adversarial perturbation is optimized using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation. The spatial adversarial perturbation is superimposed onto the original image to obtain the final adversarial image; The final adversarial image is input into the large visual language model under test to evaluate its spatial reasoning ability.

2. The adversarial attack method for spatial reasoning of large visual language models according to claim 1, characterized in that, The process of generating a target image based on the original image and the spatial problem specifically includes: The original image and the spatial problem are input into a visual language model with spatial reasoning capabilities to obtain the original spatial relationship description. The spatial relationships in the original spatial relationship description are modified only by a preset large language model to generate corresponding image editing prompts. The target image is generated by calling a preset image editing model based on the image editing prompts.

3. The adversarial attack method for spatial reasoning of large visual language models according to claim 2, characterized in that, The spatial problem includes qualitative spatial relationship problems and quantitative spatial relationship problems. The qualitative spatial relationship problem is used to reflect the relative positional relationship of each object in the original image, and the quantitative spatial relationship problem is used to characterize the scale information of the target objects in the original image, as well as the relative distance information between each object.

4. The adversarial attack method for spatial reasoning of large visual language models according to claim 1, characterized in that, The total loss is expressed as: in, Indicates the total loss. Indicates visual feature loss, This represents the loss of deep consistency. This represents the weighting coefficient.

5. The adversarial attack method for spatial reasoning of large visual language models according to claim 4, characterized in that, The visual feature loss The visual feature representation used to bring the attacked image closer to the target image and further away from the original image is: in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a visual encoder. This represents the parameters of the visual encoder.

6. The adversarial attack method for spatial reasoning of large visual language models according to claim 4, characterized in that, The depth consistency loss This is used to make the depth map of the attacked image approximate the depth map of the target image: in, Represents the original image. Represents the target image. This indicates the disturbance to be optimized. Represents a depth estimator. This represents the parameters of the depth estimator.

7. The adversarial attack method for spatial reasoning of large visual language models according to claim 1, characterized in that, The optimization of the initial space against perturbations using a query feedback-based stochastic gradient estimation method specifically includes: N random perturbations are generated. For each random perturbation, it is added to the initial spatial adversarial perturbation to construct the corresponding query sample; and the target text is obtained from the target image. All query samples are input into the large visual language model to be tested for query processing; for each query, the output text of the large visual language model to be tested is obtained, and the similarity between the output text and the target text is calculated by a preset text encoder; the estimated gradient is calculated using the similarity, and the initial spatial adversarial perturbation is updated according to the estimated gradient; and the updated initial spatial adversarial perturbation is cropped. The final clipped initial spatial adversarial perturbation is the spatial adversarial perturbation.

8. The adversarial attack method for spatial reasoning of large visual language models according to claim 7, characterized in that, The estimated gradient is expressed as: in, Indicates the estimation of gradient, Indicates the direction of the nth random sampling. Let N represent the scale of the random perturbation, and N represent the number of queries. This indicates that the output text and the target text are in the encoder. The similarity between them.

9. The adversarial attack method for spatial reasoning of large visual language models according to claim 1, characterized in that, The final adversarial image is represented as follows: in, Indicates the final adversarial image, Indicates the maximum permissible disturbance amplitude. This indicates that the space is resistant to disturbances. Indicates the original image The perturbation clipping operation is centered on this.

10. An adversarial attack system for spatial reasoning of large-scale visual language models, characterized in that, Used under legal circumstances, including: Target image generation module: used to acquire the original image and the corresponding spatial problem, and generate a target image based on the original image and the spatial problem; The perturbation iterative update module is used to initialize a perturbation to be optimized, perform a preset iterative update process on the perturbation to be optimized until a preset iteration termination condition is met, and then use the final optimal perturbation as the initial spatial adversarial perturbation. Each iterative update process includes: superimposing the perturbation updated in the previous iteration on the original image to obtain the attacked image; calculating the total loss between the attacked image, the original image, and the target image; and minimizing the total loss so that the attacked image simultaneously approaches the target image and moves away from the original image in multiple representation dimensions, thereby updating the perturbation to be optimized in the current iteration process. Perturbation enhancement module: used to optimize the initial spatial adversarial perturbation using a query feedback-based stochastic gradient estimation method to obtain the spatial adversarial perturbation; Final adversarial image generation module: used to superimpose the spatial adversarial perturbation onto the original image to obtain the final adversarial image; Spatial reasoning ability assessment module: used to evaluate the spatial reasoning ability of the large visual language model under test by inputting the final adversarial image.

Images