Adversarial Hubness in Multi-Modal Retrieval

2024-12-18

arXiv.org

AI Summary

Hubness—the tendency of certain high-dimensional embedding vectors to appear as nearest neighbors for many queries—poses a critical vulnerability in multimodal retrieval systems, yet existing hubness-mitigation techniques fail to address adversarial exploitation. Method: We introduce the first generalizable adversarial hub concept: an attacker crafts a single malicious image or audio sample via gradient-based optimization, positioning it as the nearest neighbor to numerous heterogeneous text queries within an aligned multimodal embedding space—enabling cross-modal, high-coverage, concept-targeted universal attacks. Contribution/Results: Our method achieves 84.4% top-1 recall on 25,000 test queries across standard benchmarks and the Pinecone system—surpassing natural hubs (0.4%) by two orders of magnitude—and evades state-of-the-art hubness mitigation mechanisms. This work fundamentally advances the understanding of hubness in adversarial settings, establishing a new conceptual framework and strong baseline for securing multimodal retrieval systems.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Adversarial Learning & Robustness
• Search and Optimization: Adversarial Search

Application Category

• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• Graph Algorithms and Modeling for the Web: Graph embeddings and representation learning for Web-related graphs

Abstract

Hubness is a phenomenon in high-dimensional vector spaces where a single point from the natural distribution is unusually close to many other points. This is a well-known problem in information retrieval that causes some items to accidentally (and incorrectly) appear relevant to many queries. In this paper, we investigate how attackers can exploit hubness to turn any image or audio input in a multi-modal retrieval system into an adversarial hub. Adversarial hubs can be used to inject universal adversarial content (e.g., spam) that will be retrieved in response to thousands of different queries, as well as for targeted attacks on queries related to specific, attacker-chosen concepts. We present a method for creating adversarial hubs and evaluate the resulting hubs on benchmark multi-modal retrieval datasets and an image-to-image retrieval system implemented by Pinecone, a popular vector database. For example, in text-caption-to-image retrieval, a single adversarial hub, generated with respect to 100 randomly selected target queries, is retrieved as the top-1 most relevant image for more than 21,000 out of 25,000 test queries (by contrast, the most common natural hub is the top-1 response to only 102 queries), demonstrating the strong generalization capabilities of adversarial hubs. We also investigate whether techniques for mitigating natural hubness are an effective defense against adversarial hubs, and show that they are not effective against hubs that target queries related to specific concepts.

Problem

• Exploiting hubness for adversarial attacks in multi-modal retrieval
• Creating universal adversarial content retrievable by numerous queries
• Evaluating defenses against targeted adversarial hubness attacks

Innovation

• Exploiting hubness for adversarial attacks
• Creating adversarial hubs in multi-modal retrieval
• Evaluating hubness mitigation techniques' effectiveness