Vision language model image detectors fooled by text styles
Typographic Attack Against VLM-based AI-generated Image Detection
Computer Vision and Pattern Recognition
Summary
AI tools that detect whether images are real or computer-generated use models that read both pictures and text together. The paper finds that changing the style of text inside images, like fonts or arrangement, can trick these AI detectors into making mistakes. Bigger models are more accurate normally but can also be more easily fooled by these text changes. The researchers also tested how different image changes affect this trick and looked at whether adding hints about the true image type helps fix errors.
What this means in practice
- •For security teams: Identify weaknesses in AI image authentication tools to improve defenses against deceptive image manipulations involving text styles.
- •For digital content moderators: Enhance detection processes by recognizing how typographic changes in images can fool AI systems, increasing reliability in filtering AI-generated content.
Authors
Eunmin Lee, Jungwoo Kim, Jong-Seok Lee
Abstract
Vision-language models (VLMs) are increasingly used for AI-generated image (AIGI) detection, providing natural-language explanations for authenticity judgments. However, their ability to interpret text within images may also expose these judgments to misleading semantic cues. We systematically evaluate typographic attack strategies across detection-oriented, open-weight, and commercial VLMs, considering both real-to-fake and fake-to-real attacks. Our results show that reasoning modes generally exhibit greater vulnerability than direct modes and that attack effectiveness exhibits pronounced directional asymmetry. Moreover, larger models tend to exhibit higher clean detection accuracy but also higher attack success rates. We further examine attack robustness under image and text transformations and investigate whether overlays indicating the correct class can aid error correction. Together, these analyses characterize how typographic attacks influence authenticity judgments and expose limitations of current VLM-based AIGI detection systems.