Airflow turbulence fools infrared vision-language models
New research shows a single, airflow-like perturbation can mislead infrared (IR) vision-language models without touching the target system. Trained on one surrogate CLIP model, it flips top-1 scene labels 48.5% across five backbones and cuts accuracy on six VLMs by up to 38.2%, sometimes increasing false confidence.
Infrared remote sensing is sold as physics-heavy and therefore safer. This paper punctures that story. The authors craft one universal, airflow-shaped perturbation that pushes infrared vision-language models off the road across architectures, tasks and vendors. No knowledge of the target is needed once the pattern is learned.
Here is the trick. A lightweight generator maps a 32×32 latent code to a full-resolution single-channel perturbation and blends a fixed airflow prior with a learnable residual (ratio 0.60). It is bounded by an L∞ budget of 100 on an 8-bit scale. The loss reduces the model’s confidence in the clean caption and nudges the pattern to correlate with plausible airflow templates. Train it for 800 steps on a single IR-finetuned CLIP backbone. Then reuse it everywhere.
Results are not subtle. The perturbation achieves a 48.5% attack success rate for zero-shot scene classification across five different CLIP backbones, beating four IR-specific physical baselines that land between 27.7% and 37.0%. On held-out samples, nearest-caption retrieval flips 94.4% to 98.8%, which screams domain-general shortcutting rather than model-specific quirks. Taken to six state-of-the-art multimodal models, scene-classification accuracy drops by up to 38.2% relative. Captioning and VQA degrade too. Object-level F1 holds up better, which tells you the attack rides global texture more than sharp local structure.
The weirdest bit is the IR-cue paradox. Some models get more certain under attack. They misread the airflow pattern as real thermal phenomena like temperature gradients or convection and then double down. If you use model confidence or IR-cue detectors as a tripwire, this is a trap, not a defence.
Before the doomers start celebrating, caveats matter. All experiments are digital. No physical heat sources or field deployments are shown. No defences are tested. The attack is weaker on images dominated by high-contrast local structure. But the lack of target-model access and the strong transfer are the important operational qualities. An adversary with the ability to introduce subtle airflow-like thermal perturbations into sensor inputs could cause broad, model-agnostic misclassification and misleading narratives.
The punchline
Infrared does not grant safety by physics. These models lean on texture priors that a universal, physically plausible pattern can hijack. The clean read is not that airflow beats vision; it is that our IR encoders confabulate. If your pipeline treats confidence as truth, you are measuring the strength of its delusion. My take: stop assuming modality equals mitigation; your IR stack is only as trustworthy as its biases.
Additional analysis of the original ArXiv paper
📋 Original Paper Title and Abstract
AirflowAttack: Thermal-Airflow Adversarial Perturbations against Infrared Remote-Sensing Vision-Language Models
🔍 ShortSpan Analysis of the Paper
Problem
This paper studies the adversarial robustness of vision-language models applied to infrared remote-sensing imagery, a high-consequence domain used for environmental monitoring, disaster response and reconnaissance. Infrared sensors record single-channel temperature-derived intensity maps with physical constraints distinct from RGB data, yet security assessments for IR-adapted VLMs were previously unexamined. The authors investigate whether physically plausible thermal disturbances can act as transferable universal adversarial perturbations against IR VLMs and downstream reasoning tasks.
Approach
AirflowAttack synthesises a single input-agnostic infrared perturbation that mimics thermal-airflow turbulence. A lightweight generator maps a 32×32 latent code to a full-resolution single-channel perturbation and combines a fixed precomputed airflow prior with a learnable residual (residual ratio 0.60). The perturbation is constrained by an L∞ budget of ε=100 (8-bit scale) and optimised on a surrogate IR-finetuned CLIP backbone using a confidence loss that reduces the model's alignment with the clean caption and an airflow-correlation loss that enforces spatial similarity to plausible airflow templates. Optimisation runs for 800 steps; the final universal perturbation is applied without access to target models. Evaluation uses a 10,000-sample IR test set for CLIP zero-shot scene classification and a 1,000-sample diagnostic pool to test six state-of-the-art VLMs across captioning, scene classification, object recognition and IR-cue explanation.
Key Findings
- A single perturbation optimised on one surrogate CLIP model achieves a mean attack success rate (ASR) of 48.5% for zero-shot scene classification across five CLIP backbones, outperforming four IR-specific physical baselines that range from 27.7% to 37.0%.
- The perturbation transfers strongly across architectures: nearest-caption retrieval flip rates on held-out samples range from 94.4% to 98.8% despite optimisation on a single surrogate, indicating the attack exploits domain-general thermal representations.
- When applied to six generative VLMs, AirflowAttack reduces scene-classification accuracy by up to 38.2% relative and degrades captioning and VQA quality, while object-level F1 is comparatively resistant.
- An unexpected "IR-cue paradox" was observed: two VLMs show increased certainty on infrared-cue detection under attack, interpreting the perturbation as genuine thermal phenomena such as temperature gradients or convection, thereby confabulating evidence.
- Ablations show attack strength is driven mainly by the confidence loss; the airflow prior raises measured physical plausibility (correlation up to ~0.893) without measurable cost to ASR.
Limitations
Experiments are digital; physical realisability using heat sources or field deployment is not demonstrated. Defences were not evaluated. The study compares AirflowAttack to IR-specific physical baselines rather than unstructured digital UAPs in all analyses, and some transfer splits may share vocabulary with optimisation data. The attack primarily perturbs global scene-level texture and is weaker on images with dominant, high-contrast local structure.
Implications
An adversary with the ability to introduce subtle, airflow-like thermal perturbations into sensor inputs could cause widespread, model-agnostic misclassification of scenes and mislead multimodal reasoning systems without target-model access. The perturbation is both transferable across diverse VLMs and physically plausible, and in some cases actively induces false thermal evidence that increases model confidence. This exposes a modality-specific offensive vector for remote-sensing operations, enabling attacks that alter situational awareness, trigger false alarms or mask events while remaining hard to detect using standard RGB-focused defences.
