Summary
Many AI systems combine different vision models to understand images better, assuming that if each model is secure, the whole system will be safe. This paper shows that this assumption is wrong because these models rely on sharing information without checking if it makes sense together. The authors introduce an attack called CrACK that disrupts this shared information between models without changing the images or models themselves. This attack can cause the entire system to fail, even though each model alone appears to work fine. Their findings highlight that protecting AI systems needs to focus on how models communicate, not just the individual models.
Vision Foundation ModelsAdversarial AttackCross-Model ConsistencySemantic-Spatial AlignmentCLIPSAMDINOAffinity MatrixVision-Language ModelsCollaborative AI Systems
Authors
Feifei Liu, Jintao Cheng, Chi Man Vong, Xiaoyu Tang
Abstract
Training-free collaborative pipelines that integrate Vision Foundation Models such as CLIP, SAM, and DINO achieve strong open-vocabulary dense prediction and are increasingly deployed in safety-critical applications. The security of these systems is commonly assumed to follow from the robustness of their individual models. We challenge this assumption. We identify a vulnerability shared by every collaborative pipeline: each model consumes the intermediate output of another without verifying semantic consistency, an unverified premise that we term the semantic-spatial alignment dependency. Existing adversarial attacks target a single model and overlook this premise, leaving the inter-model interface entirely unguarded. We propose CrACK (Cross-model Adversarial Consistency attack), an inference-time attack that exploits this interface without modifying any input pixel, model weight, or training data. CrACK operates in two stages: Adversarial Affinity Contradiction Injection corrupts the cross-modal affinity matrix by inverting SAM encoder features under the guidance of CLIP patch-level semantics, and Semantic Interface Poisoning steers the prediction through a max-distance label permutation derived from CLIP text embeddings. Experiments on four collaborative pipelines across eight benchmarks show that CrACK causes catastrophic degradation while every individual model continues to produce its unchanged standalone output, rendering per-model defenses structurally blind. The corruption further cascades into large vision-language model reasoning, driving models such as LLaVA to produce erroneous responses from visually intact inputs. Our results show that the security of a collaborative AI system cannot be reduced to the robustness of its components, and that inter-model feature interfaces must be treated as first-class security boundaries.