Vision language models reveal hidden weaknesses in visual text processing
FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models
Computer Vision and Pattern Recognition
Summary
Vision-language models that combine images and text are changing how AI understands information. The authors found that existing ways to test these models miss important weaknesses because they focus only on pixel changes and not how models handle text shown inside images. They created a new testing method that looks separately at how models react to picture changes and inserted text, revealing blind spots that older tests overlooked. Their new attacks show that some models pay attention to text overlays but then ignore them, uncovering vulnerabilities invisible before.
What this means in practice
- •For ai safety engineers: Audit multimodal AI models for hidden vulnerabilities in how they process images with overlaid text using the new pathway-conditioned testing framework.
- •For ai model developers: Improve training and evaluation of native vision-language models by incorporating attacks that separately target pixel and text processing pathways to strengthen robustness.
Authors
Jiaming Zhang, Zherui Li, Siqi Guo, Junhao Dong, Kun Wang, Wei Yang Bryan Lim
Abstract
As vision-language models (VLMs) transition from frozen-encoder pipelines to native multimodal architectures, the visual channel increasingly serves as both a perceptual input and a carrier of rendered text that competes with user prompts. Current single-attack, pixel-centric evaluations fail to capture this complexity: they collapse distinct visual attack surfaces into a single scalar and ignore how architectural shifts alter vulnerability. We introduce PaRMA, an evidence-based auditing framework that defines pathway-conditioned risk over two primary image-level interventions: pixel perturbation and rendered-text insertion. Instead of arbitrary attack enumeration, PaRMA uses pathway-specific diagnostics to expose architecture-specific blind spots. Notably, we uncover a see-but-not-deceived signature where native VLMs attend heavily to typographic overlays but visually reject them, and we identify an objective mismatch between encoder-level and answer-level attacks in deep-fusion models. To exploit these findings, we instantiate FusionAudit, introducing two diagnostic-motivated attacks: MANTIS (margin-aware pixel perturbation) and Nat-Evid (host-congruent semantic insertion). Evaluating 18 open-weight VLMs across a novel nativeness taxonomy, we demonstrate that legacy single-attack rankings (e.g., PGD) are unstable for native models. Our diagnostic-driven attacks substantially raise the estimated residual risk, showing that PaRMA provides a falsifiable, evidence-driven auditing methodology for uncovering vulnerabilities missed by standard benchmarks.