A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning

arXiv:2604.03995 · cs.CV, cs.SD · Submitted 2026-04-05 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning".

Jane: The gist The systematic study examines how typographic attacks across multiple modalities adversely influence audio-visual MLLMs, revealing that coordinated multi-modal attack creates a significantly more potent threat than single-modality attacks.

Tom: First, who's behind it and why it matters.

Title and authors: Tom: Okay, so let’s talk about the title and who wrote this. The paper is called "A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning." It clearly sets up the whole thing as a systematic investigation into these attacks across different types of media.

Jane: And it’s written by Tianle Chen and Deepti Ghadiyaram from Boston University. The title tells you right away that this isn't just about one type of attack, but about how typography works when it crosses the lines between audio, video, and language.

Lu: The implication here is pretty big because they are moving beyond just looking at single-modality attacks where you only have text or only have audio. They are looking at the coordinated threat of using text across these different streams simultaneously to confuse the model.

Meng: That coordinated threat is what gets me. If a model can be fooled by a combination of audio and visual text, that means the safety checks on those systems are really weak in those specific areas.

Lalam: It suggests that we need to think about these multimodal vulnerabilities as interconnected problems rather than isolated ones, which is something I find really interesting for how we build better models.

The paper's summary: Tom: So what’s the core of the research? They introduce a framework they call Multi-Modal Typography. The main idea is treating audio as a primary typographic modality in this study. They inject misleading spoken text into an existing video while leaving the visual stream exactly as it is.

Jane: By doing that, they create controlled conflicts to see if those spoken cues can actually manipulate the model’s final prediction, even when the visual information seems correct. It tests whether spoken semantics can override what the model sees on screen.

Lu: They are asking a deep question there: does the underlying modality—is it audio or text—fundamentally change how the AI makes its decision? The paper is specifically interested in whether semantically similar perturbations are treated consistently across those different streams, or if one modality inherently alters the model’s response.

Meng: I see why that matters for practical deployment. If speech can override visual evidence, then systems relying on both streams to make decisions, like analyzing a video for safety reasons, could be easily tricked by just a well-placed piece of spoken text.

Lalam: It really highlights the idea that speech is especially compelling here because it's native to the video and usually supported by transcription supervision, making it a very realistic way to introduce adversarial content into the system.

The paper's improvements: Tom: Now they look at how they improve things. They go beyond just showing a simple attack and they analyze what happens when you stack these attacks together. They specifically study how attacks from multiple modalities have a compounded effect on the model’s performance.

Jane: They use two main metrics for this: Ground-Truth Accuracy, or ACC, which tells you if the correct scene-grounded reasoning is disrupted, and Attack Success Rate, or ASR, which tracks if the perturbation actually steered the prediction to a specific target label.

Lu: The finding here is pretty strong: aligned audio-visual attacks produce substantially stronger failures than either modality alone. For example, they report an ASR of eighty-three point one three percent on visual questions for the Qwen2 point 5-Omni-7B model when using these combined perturbations, which is a lot more than what you’d expect from just the audio part or just the text part alone.

Meng: That’s a big jump in performance degradation, and it shows that combining modalities creates a much more potent threat for the AI system overall. It suggests that defense strategies can't focus on one stream in isolation.

Lalam: And they also look at how semantic richness matters; they compare random noise versus strong target cues, finding that stronger target semantics lead to stronger attacks, which means the attack doesn't just need to be random noise to work.

Conclusion: Tom: So wrapping things up on this paper, the main point is that audio typography is a very effective semantic and highly potent attack because of how naturally it fits into the video’s audio track. It confirms our suspicion that MLLMs have a critical robustness gap when dealing with these cross-modal interactions.

Jane: They show that even when you look at visually focused questions, injecting speech causes a twelve point eight five percent accuracy drop on MMA-Bench for Qwen2 point 5-Omni-7B, which proves the impact isn't just limited to audio tasks either.

Lu: The implication is that we need better ways to understand how models process these competing modality cues because right now, they often rely unevenly on different streams and can behave brittlely when those streams disagree.

Meng: From an engineering standpoint, this means we might need to build checks where conflicting modalities are cross-referenced; if the audio typography injects a cue that contradicts the visual evidence, that input should flag as potentially adversarial based on this observed sensitivity.

Lalam: I think for culture and safety applications, understanding how speech can subvert content moderation by thirteen percent shows we have to be much more careful about what we let these systems process without deep testing.

Tom: Exactly. So that’s the rundown on "A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning." It really hammers home the danger of coordinated attacks in this space, and it makes you wonder what’s next for defending these complex models.

Department of Computer Science, Boston University

cs.CV, cs.SD

Submitted: 2026-04-05

Updated: 2026-10-08

Code: https://github.com/rany2/edge-tts

Project page: https://cskyl.github.io/MLLM-Typography

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 88/100

The gist: The gist The systematic study examines how typographic attacks across multiple modalities adversely influence audio-visual MLLMs, revealing that coordinated multi-modal attack creates a significantly

Key concepts

Multi-Modal Typography: This framework treats speech as a typographic modality by injecting synthesized audio into a video while keeping the visuals the same. It tests if these spoken cues can steer or mislead an AI model's predictions, revealing how audio and visual streams interact.
Attack Success Rate (ASR): ASR measures how often an attack successfully redirects the model's prediction to a specific target label rather than causing random errors. A high ASR indicates that the semantic perturbation has successfully steered the model toward a desired, incorrect outcome.
Cross-Modal Impact: This concept examines whether perturbations in one modality (like audio) affect reasoning tasks in another modality (like vision). The study shows that spoken typography causes accuracy drops even when the task is primarily visual, proving that different modalities process information through distinct pathways.

Terminology

Benchmark — 1× in this paper · explained in 2 episodes

Summary

The gist The systematic study examines how typographic attacks across multiple modalities adversely influence audio-visual MLLMs, revealing that coordinated multi-modal attack creates a significantly more potent threat than single-modality attacks.

Introduction and Motivation

Typographic attacks have shown that vision-language models can be misled by small semantic cues <ref:2604.03995#pg2> It has been shown that overlaid text or logos Qraitem et al. (2024a) can disproportionately override dominant, highly relevant visual content indicating model’s high sensitivity to textual information, and thus its lack of robustness <ref:2604.03995#pg2>. Modern audiovisual multi-modal Large Language Models (MLLMs) process semantic information via three different modality streams: text prompts, spoken audio, or on-screen visual text <ref:2604.03995#pg2>. While these modalities may convey identical semantic content, they are processed through distinct perceptual pathways <ref:2604.03995#pg2>. This raises a critical question: are semantically similar perturbations treated consistently across different modalities? Or does underlying modality fundamentally alter a model’s response and decision-making process <ref:2604.03995#pg2>? Among these modalities, we believe that speech is particularly compelling <ref:2604.03995#pg2>. Unlike visual typography, which often appears externally overlaid and sometimes visually unnatural, spoken content is a native component of video and is heavily reinforced through transcription-based supervision (Ma et al., 2026; Liu et al., 2025; Cheng et al., 2025a) <ref:2604.03995#pg2>.

Our Approach to Multi-Modal Typography

We introduce Multi-Modal Typography, a framework that treats audio as a primary typographic modality <ref:2604.03995#pg2>. By injecting synthesized speech into the original audio track of a video while keeping the visual stream unchanged, we create controlled modality conflicts to test if spoken cues can attack and steer the model predictions <ref:2604.03995#pg2>. We further study how attacks from multiple modalities have a compounded effect on the model performance <ref:2604.03995#pg2>.

The evaluation metrics used are:

• Ground-Truth Accuracy (ACC): the model’s prediction accuracy under clean and attacked inputs, where a decrease in ACC indicates that the semantic perturbation disrupts correct scene-grounded reasoning <ref:2604.03995#pg2>.

• Attack Success Rate (ASR): the fraction of examples for which the model’s prediction is redirected to the injected target label c∗, which captures whether the perturbation induces targeted semantic steering, rather than merely causing random errors <ref:2604.03995#pg2>.

Experimental Setup and Findings

We evaluate multiple state-of-the-art audio-visual MLLMs, including Qwen2.5-Omni-7B, Qwen3-Omni-30B, PandaGPT, ChatBridge, Gemini-2.5-Flash-Lite, and Gemini3.1-Flash-Lite (Table 1) <ref:2604.03995#pg2>. We study MMA-Bench Chen et al. (2025) and Music-AVQA Li et al. (2022) as they both contain audio-focused and visual-focused question subsets enabling controlled cross-modal analysis <ref:2604.03995#pg2>.

Key findings include:

• Unimodal Manipulation (Sec. 4.2): Spoken typography reliably steers predictions toward injected targets, leading to 64.03% ASR on WorldSense for Qwen2.5-Omni-7B <ref:2604.03995#pg2>.

• Cross-Modal Impact (Sec. 4.3): These perturbations are not confined to audiogrounded tasks; even on visually focused questions, injected speech causes a 12.85% accuracy drop on MMA-Bench for Qwen2.5-Omni-7B <ref:2604.03995#pg2>.

• Multiple Modality Attacks (Sec. 4.4): Aligned audio-visual attacks produce substantially stronger failures than either modality alone, reaching 83.13% ASR on visual and 83.43% on audio questions on MMA-Bench for Qwen2.5-Omni-7B <ref:2604.03995#pg2>.

• Impact on content moderation (Sec. 6): We show that injecting safe speech into a visually harmful video leads to successful hijacking of MLLM’s content moderation capability, e.g., a decrease in detection capability by ∼ 13% <ref:2604.03995#pg2>.

Per-Modality Attacks and Cross-Modal Interactions

We compare targeted attacks independently delivered through text, audio, and visual modalities (Table 2) <ref:2604.03995#pg2>. For Qwen2.5-Omni-7B, text attack is consistently strongest, reaching 76.90% ASR on MMA-Bench visual questions <ref:2604.03995#pg2>. For Gemini-3.1-Flash-Lite-preview, visual attack is the strongest on MMA-Bench for visual questions at 5.80% ASR <ref:2604.03995#pg2>.

We also study how audio and visual perturbations interact when both modalities are manipulated simultaneously (Table 3) <ref:2604.03995#pg2>. Aligned audio–visual perturbation is consistently stronger than either single-modality attack on MMA-Bench, reaching 83.13% ASR on visual questions for Qwen2.5-Omni-7B <ref:2604.03995#pg2>. Conflicting attacks remain highly disruptive for Qwen2.5-Omni-7B, with large accuracy drops on both visual (56.12%) and audio (29.89%) questions <ref:2604.03995#pg2>.

Effect of Audio Typography Parameters

We study how specific audio typography parameters affect attack effectiveness using Figure 3 <ref:2604.03995#pg2>. Volume has a strong effect on audio and visual questions, with ASR rising from 15.59% at a volume multiplier 0.5 to 34.72% at multiplier 8.0 for audio questions <ref:2604.03995#pg2>. Temporal placement of the typography also affects attack strength, with later placement generally producing stronger attacks, especially on visual questions <ref:2604.03995#pg2>. High Repetition Frequency also strengthens the attack for both audio and visual questions <ref:2604.03995#pg2>.

Effect of Semantic Richness and Safety

We investigate the effect of the semantic richness of the spoken injection on model vulnerability using WorldSense, comparing random noise, random speech, weak target cues, strong target cues, and LLM-designed target cues (Table 4a) <ref:2604.03995#pg2>. Stronger target-relevant semantics lead to stronger attacks <ref:2604.03995#pg2>. Furthermore, we test if audio typography can subvert safety-sensitive tasks like content moderation on MetaHarm (Table 4b) <ref:2604.03995#pg2>. Stronger spoken manipulation increasingly blinds the model to visual harm <ref:2604.03995#pg2>.

Conclusion and Future Work

Our study reveals a critical robustness gap in audio-visual MLLMs: audio typography is a semantic and highly effective attack due to its natural integration into the video’s audio <ref:2604.03995#pg2>. Future research should prioritize testing realistic interference vulnerabilities like overlapping speakers and background narration, mechanistic interpretation of how models process competing modality cues, developing defense strategies such as modality-aware consistency checks, training models with semantically perturbed data, and investigating perceptual stealth effectiveness through human perceptual evaluations <ref:2604.03995#pg2>.

Improvements for AI systems

Bold header: Robustness to Cross-Modal Semantic Steering

The improved AI system can reliably maintain its intended prediction even when subjected to coordinated audio, visual, and text perturbations that aim to steer it toward a target class, as demonstrated by the finding that Aligned multimodal-modal typography amplifies attack effectiveness than uni-modal attacks.

Bold header: Modality-Aware Consistency Checks

The system can implement checks where conflicting modalities are cross-referenced; for instance, if audio typography injects a semantic cue contradicting the visual evidence, the system should flag the input as potentially adversarial based on cross-modal disagreement and the observed sensitivity of MLLMs to such conflicts.

Bold header: Parameterized Effectiveness–Stealth Trade-off Control

The system can dynamically adjust its attack parameters (volume, repetition) to operate on a desired frontier, leveraging the controllable effectiveness–stealth trade-off frontier where repetition provides the most favorable balance by selecting settings that maximize accuracy drop while keeping low-level distortion minimal.

Bold header: Semantic Richness Filtering for Safety

The system can employ a mechanism to filter or de-emphasize inputs containing Strong target cue[s] when performing harmful-content detection, as the paper shows that Stronger target cues consistently produce larger accuracy drops and ASR in safety contexts.

Bold header: Contextual Grounding Objectives

The AI system's grounding objectives should be strengthened to reduce reliance on spurious semantic cues by focusing on grounding-based reasoning, moving beyond simple pattern matching to ensure that misleading speech can override visual evidence even in primarily visually grounded tasks.

Abstract

As audio-visual multi-modal large language models (MLLMs) are increasingly deployed in safety-critical applications, understanding their cross-modal vulnerabilities is essential. To this end, we introduce Multi-Modal Typography, a systematic study examining how perturbations added to speech and on-screen text impact audio-visual reasoning of closed- and open-source models. For instance, on the WorldSense benchmark, the attack success rate (ASR) against Gemini 3.7 Flash increased from 9.53% to 43.41%, highlighting its vulnerability. We analyze the cross-modal effects of unimodal and multimodal attacks and evaluate how specific properties of the attacks impact the overall multi-modal reasoning. By applying fine-tuning as a mitigation, we lower the ASR of Qwen2.5-Omni-7B on WorldSense from 60.6% to 52.0%. Our findings across multi-modal reasoning tasks, content moderation, and offline robot task selection benchmarks establish multi-modal typography as a critical and underexplored attack strategy in multi-modal reasoning. Code and data will be made publicly available.