v1.3: add Stage 1 universal abstract image display + v3 judge methodology link

app.py

@@ -1,18 +1,20 @@
 """
-VisInject — HF Space Demo
-==========================
+VisInject — HF Space Demo (v1.3)
+=================================
 Stage 2 (AnyAttack fusion) only. Stripped-down, CPU-only Gradio app.
 
 How it works:
     1. Pick an attack prompt (7 options) from the dropdown
-    2. Upload a clean image
-    3. The app loads:
+    2. The app immediately displays the corresponding **Stage 1 universal
+       adversarial image** — the abstract noise-like image that encodes the
+       target phrase in CLIP feature space (offline-trained on HPC, fetched
+       from HF Dataset jeffliulab/visinject).
+    3. Upload a clean image
+    4. The app:
          • CLIP ViT-B/32 (cached after first call)
          • AnyAttack Decoder, fetched from `jiamingzz/anyattack` on HF
-         • Precomputed universal adversarial image for the chosen prompt,
-           fetched from `jeffliulab/visinject` (Dataset) on HF
-    4. CLIP encodes universal → 512-d embedding → Decoder → bounded noise
-       (eps = 16/255) → noise + clean → adversarial image
+         • Encodes universal image → 512-d embedding → Decoder → bounded noise
+           (eps = 16/255) → noise + clean → adversarial image
     5. Returns the adv image + PSNR
 
 This Space cannot run Stage 1 (multi-VLM PGD optimization) or Stage 3 (VLM
@@ -20,7 +22,7 @@ inference verification): both need GPU + multiple VLMs loaded simultaneously,
 which exceeds the free-tier 16 GB RAM / CPU-only budget.
 
 Source code, full pipeline, and HPC scripts:
-    https://github.com/jeffliulab/VisInject  (replace with actual URL)
+    https://github.com/jeffliulab/VisInject
 """
 
 import glob
@@ -123,7 +125,7 @@ def _get_universal_path(tag: str) -> str:
     return matches[0]
 
 
-# ── Stage 2 fusion ────────────────────────────────────────────────
+# ── UI helpers ────────────────────────────────────────────────────
 
 def _format_prompt_choice(tag: str, phrase: str) -> str:
     return f"{tag}  —  \"{phrase}\""
@@ -133,6 +135,32 @@ def _choice_to_tag(choice: str) -> str:
     return choice.split("  —  ", 1)[0].strip()
 
 
+def show_universal_image(prompt_choice: str):
+    """Triggered on Prompt dropdown change. Returns (universal_path, info_text)."""
+    if not prompt_choice:
+        return None, ""
+    tag = _choice_to_tag(prompt_choice)
+    target_phrase = dict(PROMPTS).get(tag, "")
+    try:
+        universal_path = _get_universal_path(tag)
+    except Exception as e:
+        return None, f"⚠️ Failed to fetch universal image for '{tag}': {e}"
+
+    info = (
+        f"Stage 1 product: universal_{tag}_2m  →  {os.path.basename(universal_path)}\n"
+        f"Target phrase encoded in CLIP-feature space: \"{target_phrase}\"\n"
+        f"\n"
+        f"This abstract image was obtained by running PGD optimisation jointly\n"
+        f"on Qwen2.5-VL-3B + BLIP-2-OPT-2.7B (the 2-model ensemble) until each\n"
+        f"target VLM emitted the target phrase when seeing this image. The\n"
+        f"signal lives in CLIP feature space — Stage 2 (next step) decodes it\n"
+        f"into bounded noise that can be added to ANY clean photo."
+    )
+    return universal_path, info
+
+
+# ── Stage 2 fusion ────────────────────────────────────────────────
+
 def run_fusion(prompt_choice: str, clean_image_path: str):
     """Run Stage 2 fusion. Returns (adv_path, info_text, explanation)."""
     if clean_image_path is None:
@@ -193,11 +221,11 @@ def build_ui():
             """
 # VisInject — Adversarial Prompt Injection Demo
 
-Pick an **attack prompt**, upload a **clean image**, and the app will fuse a
-precomputed universal adversarial image into yours via CLIP ViT-B/32 + the
-AnyAttack Decoder.
+Pick an **attack prompt**, see the **Stage 1 universal abstract image** that
+encodes it, then upload a **clean image** and the app fuses the two via
+CLIP ViT-B/32 + the AnyAttack Decoder.
 
-The output is visually indistinguishable from your original (PSNR ≈ 25 dB),
+The output is visually indistinguishable from your clean image (PSNR ≈ 25 dB),
 but Vision-Language Models read it as containing the target phrase.
 
 **Limitations**: this demo runs only **Stage 2** (fusion). It cannot retrain
@@ -211,21 +239,41 @@ image download to the Space cache. Subsequent calls are 2–5 s.
         )
 
         with gr.Tab("Generate adversarial image"):
+            # Step 1: Prompt selection
+            prompt_dd = gr.Dropdown(
+                choices=choices,
+                value=choices[0],
+                label="Step 1 — Pick an attack prompt",
+                info="The target phrase the attacker wants the VLM to emit",
+            )
+
+            # Step 2: Stage 1 universal image (auto-displayed when prompt changes)
             with gr.Row():
                 with gr.Column():
-                    prompt_dd = gr.Dropdown(
-                        choices=choices,
-                        value=choices[0],
-                        label="Attack prompt",
-                        info="Select the target phrase to inject",
+                    universal_img = gr.Image(
+                        label="Stage 1 — Universal Adversarial Image (abstract; encodes the target in CLIP space)",
+                        type="filepath",
+                        interactive=False,
+                        height=300,
+                    )
+                with gr.Column():
+                    universal_info = gr.Textbox(
+                        label="Stage 1 — info",
+                        lines=8,
+                        interactive=False,
                     )
+
+            # Step 3: Clean image upload + Stage 2 fusion
+            with gr.Row():
+                with gr.Column():
                     clean_img = gr.Image(
-                        label="Clean image",
+                        label="Step 3 — Upload a clean image",
                         type="filepath",
                         sources=["upload", "clipboard"],
                     )
                     go_btn = gr.Button(
-                        "Generate adversarial image", variant="primary"
+                        "Step 4 — Run Stage 2 fusion → adversarial image",
+                        variant="primary",
                     )
                 with gr.Column():
                     adv_img = gr.Image(
@@ -237,6 +285,20 @@ image download to the Space cache. Subsequent calls are 2–5 s.
                         label="What next?", lines=4, interactive=False
                     )
 
+            # Wire up: prompt change → show universal image
+            prompt_dd.change(
+                fn=show_universal_image,
+                inputs=[prompt_dd],
+                outputs=[universal_img, universal_info],
+            )
+            # Load default universal image on Space startup
+            demo.load(
+                fn=show_universal_image,
+                inputs=[prompt_dd],
+                outputs=[universal_img, universal_info],
+            )
+
+            # Wire up: button click → Stage 2 fusion
             go_btn.click(
                 fn=run_fusion,
                 inputs=[prompt_dd, clean_img],
@@ -249,9 +311,18 @@ image download to the Space cache. Subsequent calls are 2–5 s.
 ## About
 
 - **Code**: [github.com/jeffliulab/VisInject](https://github.com/jeffliulab/VisInject)
-- **Experimental data** (147 response_pairs, 21 universal images, 147 adv images): [datasets/jeffliulab/visinject](https://huggingface.co/datasets/jeffliulab/visinject)
+- **Experimental data** (147 response_pairs, 21 universal images, 147 adv images, v3 dual-axis judge results): [datasets/jeffliulab/visinject](https://huggingface.co/datasets/jeffliulab/visinject)
 - **Decoder weights**: [`jiamingzz/anyattack`](https://huggingface.co/jiamingzz/anyattack) — from Zhang et al., *AnyAttack: Towards Large-scale Self-supervised Adversarial Attacks on Vision-language Models*, CVPR 2025.
 
+### v1.3 Methodology
+Attack success is now scored by a **dual-axis LLM judge** (DeepSeek-V4-Pro,
+thinking mode, calibrated against Claude Opus 4.7 with Cohen's κ = 0.79 on
+injection axis). Both axes — **Influence** (did the response change?) and
+**Precise Injection** (did the target concept come through?) — are reported
+separately. See the [paper](https://github.com/jeffliulab/VisInject/blob/main/report/pdf/main.pdf)
+§3.4 for full methodology and the dataset README for reproducibility manifest
+(cache replay path: no API key required to reproduce paper numbers).
+
 VisInject is released for **defensive security research**. Do not use it to target production systems without authorization.
 """
         )