SPARTA: Evaluating Reasoning Segmentation Robustness through Black-Box Adversarial Paraphrasing in Text Autoencoder Latent Space

2025/10/28 by Zinkovich, Viktoriia, Antonov, Anton, Spiridonov, Andrei +6
#Computation and Language (cs.CL) #Computer Vision and Pattern Recognition (cs.CV) #FOS: Computer and information sciences

paper · doi:10.48550/arxiv.2510.24446

Abstract

Multimodal large language models (MLLMs) have shown impressive capabilities in vision-language tasks such as reasoning segmentation, where models generate segmentation masks based on textual queries. While prior work has primarily focused on perturbing image inputs, semantically equivalent textual paraphrases-crucial in real-world applications where users express the same intent in varied ways-remain underexplored. To address this gap, we introduce a novel adversarial paraphrasing task: generating grammatically correct paraphrases that preserve the original query meaning while degrading segmentation performance. To evaluate the quality of adversarial paraphrases, we develop a comprehensive automatic evaluation protocol validated with human studies. Furthermore, we introduce SPARTA-a black-box, sentence-level optimization method that operates in the low-dimensional semantic latent space of a text autoencoder, guided by reinforcement learning. SPARTA achieves significantly higher success rates, outperforming prior methods by up to 2x on both the ReasonSeg and LLMSeg-40k datasets. We use SPARTA and competitive baselines to assess the robustness of advanced reasoning segmentation models. We reveal that they remain vulnerable to adversarial paraphrasing-even under strict semantic and grammatical constraints. All code and data will be released publicly upon acceptance.

Citations

• Qwen3 Embedding: Advancing Text Embedding and Reranking Through Foundation Models
• Region-Guided Attack on the Segment Anything Model (SAM)
• HelpSteer2-Preference: Complementing Ratings with Preferences
• PARAPHRASUS : A Comprehensive Benchmark for Evaluating Paraphrase Detection Models
• Qwen2-VL: Enhancing Vision-Language Model's Perception of the World at Any Resolution
• Textual Similarity as a Key Metric in Machine Translation Quality Estimation
• MoST: Multi-modality Scene Tokenization for Motion Prediction
• LLM-Seg: Bridging Image Segmentation and Large Language Model Reasoning
• Finding a Needle in the Adversarial Haystack: A Targeted Paraphrasing Approach For Uncovering Edge Cases with Minimal Distribution Distortion
• PPO-Clip Attains Global Optimality: Towards Deeper Understandings of Clipping
• General Object Foundation Model for Images and Videos at Scale
• See, Say, and Segment: Teaching LMMs to Overcome False Premises
• Universal Segmentation at Arbitrary Granularity with Language Instruction
• Graph-Induced Syntactic-Semantic Spaces in Transformer-Based Variational AutoEncoders
• GLaMM: Pixel Grounding Large Multimodal Model
• An LLM can Fool Itself: A Prompt-Based Adversarial Attack
• Jailbreaking Black Box Large Language Models in Twenty Queries
• Improved Baselines with Visual Instruction Tuning
• MotionLM: Multi-Agent Motion Forecasting as Language Modeling
• SONAR: Sentence-Level Multimodal and Language-Agnostic Representations
• ChatEval: Towards Better LLM-based Evaluators through Multi-Agent Debate
• ParaFuzz: An Interpretability-Driven Technique for Detecting Poisoned Samples in NLP
• RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control
• Hierarchical Open-vocabulary Universal Image Segmentation
• Kosmos-2: Grounding Multimodal Large Language Models to the World
• Large Language Models are not Fair Evaluators
• Can Large Language Models Be an Alternative to Human Evaluations?
• Automatically Auditing Large Language Models via Discrete Optimization
• Is ChatGPT a Good NLG Evaluator? A Preliminary Study
• PaLM-E: An Embodied Multimodal Language Model
• DeCap: Decoding CLIP Latents for Zero-Shot Captioning via Text-Only Training
• ConvNeXt V2: Co-designing and Scaling ConvNets with Masked Autoencoders
• Generalized Decoding for Pixel, Image, and Language
• Gradient-based Adversarial Attacks against Text Transformers
• An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale
• Language Models are Few-Shot Learners
• BERT-ATTACK: Adversarial Attack Against BERT Using BERT
• Is BERT Really Robust? A Strong Baseline for Natural Language Attack on Text Classification and Entailment
• Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attacks
• Adversarial Example Generation with Syntactically Controlled Paraphrase\n Networks
• Black-box Generation of Adversarial Text Sequences to Evade Deep Learning Classifiers
• Proximal Policy Optimization Algorithms
• Categorical Reparameterization with Gumbel-Softmax
• Trust Region Policy Optimization
• Qwen-VL: A Versatile Vision-Language Model for Understanding, Localization, Text Reading, and Beyond

Related

• PixelThink: Towards Efficient Chain-of-Pixel Reasoning
• LISA: Reasoning Segmentation via Large Language Model
• Think Before You Segment: High-Quality Reasoning Segmentation with GPT Chain of Thoughts
• Empowering Segmentation Ability to Multi-modal Large Language Models
• CORA: Consistency-Guided Semi-Supervised Framework for Reasoning Segmentation