Adversarial Video Promotion Against Text-to-Video Retrieval

Thanks to the development of cross-modal models, text-to-video retrieval (T2VR) is advancing rapidly, but its robustness remains largely unexamined. Existing attacks against T2VR are designed to push videos away from queries, i.e., suppressing the ranks of videos, while the attacks that pull videos towards selected queries, i.e., promoting the ranks of videos, remain largely unexplored. These attacks can be more impactful as attackers may gain more views/clicks for financial benefits and widespread (mis)information. To this end, we pioneer the first attack against T2VR to promote videos adversarially, dubbed the Video Promotion attack (ViPro). We further propose Modal Refinement (MoRe) to capture the finer-grained, intricate interaction between visual and textual modalities to enhance black-box transferability. Comprehensive experiments cover 2 existing baselines, 3 leading T2VR models, 3 prevailing datasets with over 10k videos, evaluated under 3 scenarios. All experiments are conducted in a multi-target setting to reflect realistic scenarios where attackers seek to promote the video regarding multiple queries simultaneously. We also evaluated our attacks for defences and imperceptibility. Overall, ViPro surpasses other baselines by over $30/10/4\%$ for white/grey/black-box settings on average. Our work highlights an overlooked vulnerability, provides a qualitative analysis on the upper/lower bound of our attacks, and offers insights into potential counterplays. Code will be publicly available at https://github.com/michaeltian108/ViPro.

Key Contributions

First adversarial attack targeting rank promotion (rather than suppression) in text-to-video retrieval, evaluated in a realistic multi-target setting
Modal Refinement (MoRe) module that captures fine-grained visual-textual interactions to enhance black-box transferability
Comprehensive evaluation across 3 T2VR models, 3 datasets (10k+ videos), 3 threat scenarios, including defense and imperceptibility analysis

🛡️ Threat Analysis

Input Manipulation Attack

ViPro crafts adversarial perturbations on video frames to inflate retrieval ranks for targeted text queries at inference time. Uses gradient-based optimization in white-box settings with transferability to black-box — a textbook input manipulation / evasion attack on a cross-modal ML model.