Visual textual triggers control poisoned inputs in vision language models
ViTeGate: Visual-Textual Triggered Knowledge Poisoning for Vision-Language Retrieval-Augmented Generation
Cryptography and Security
Summary
Some computer systems that combine pictures and words to answer questions rely on retrieving related images and texts from a big collection. This paper shows that bad actors could sneak in harmful image-text pairs to trick these systems into giving false answers. The authors designed a method, ViTeGate, to hide these attacks behind special visual and text signals, so the system is only fooled when both signals appear together. This makes the attack more precise, harder to detect, and effective only when intended.
What this means in practice
- •For security teams: Detect and defend against selective poisoning attacks that use visual and textual triggers to manipulate vision-language model outputs.
- •For nlp developers: Test vision-language retrieval systems for vulnerabilities to triggered poisoning, improving model robustness in multimodal generation.
Authors
Xue Tan, Xuandi Zeng, Yu Shao, Zhongli Fang, Mingyu Luo, Xiaoyan Sun, Ping Chen, Jun Dai
Abstract
Modern Vision-Language Retrieval-Augmented Generation (VLRAG) systems augment Large Vision-Language Models (LVLMs) with retrieved visual and textual evidence, enabling responses grounded in external knowledge. However, the retrieval pipeline also creates an attack surface: adversaries can inject poisoned image-text pairs into the knowledge corpus to influence model outputs. Existing knowledge poisoning attacks are typically always-on, allowing poisoned evidence to affect generation whenever it is retrieved. This lack of precise activation control makes it difficult to confine malicious behavior to intended inputs, reducing both attack stealth and effectiveness. In this paper, we propose ViTeGate, a visual-textual triggered knowledge poisoning attack for VLRAG systems. ViTeGate uses a visual trigger to conditionally promote poisoned evidence into retrieval results and a textual trigger to induce an attacker-specified response from the retrieved evidence. By coordinating retrieval and generation, ViTeGate reduces poison exposure when the visual trigger is absent and preserves normal responses when the textual trigger is absent. The two-trigger design enables selective attack activation and reduces unintended single-trigger activation. Experiments across multiple query datasets, retrievers, and LVLMs validate the effectiveness of ViTeGate. On InfoSeek, ViTeGate achieves an attack success rate of up to 0.98 while maintaining a clean answer accuracy of up to 0.93.