A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning

1. Problem Statement

As Audio-Visual Multi-modal Large Language Models (MLLMs) are increasingly deployed in safety-critical applications (e.g., content moderation, autonomous driving, medical diagnosis), understanding their vulnerabilities is paramount. While "typographic attacks" (using overlaid text to hijack model reasoning) are well-studied in vision-language models, this paper identifies a critical gap: Audio-Visual Typographic Attacks.

The core problem is whether semantically misleading cues delivered via spoken audio (audio typography) can manipulate MLLMs similarly to visual text. Unlike visual overlays, spoken content is a native, natural component of video, often reinforced by transcription-based training. The authors investigate if models treat semantically identical perturbations consistently across modalities or if the modality itself (audio vs. visual) fundamentally alters the model's decision-making, potentially making spoken injections a more subtle and realistic attack vector.

2. Methodology

The authors introduce Multi-Modal Typography, a framework treating audio as a primary typographic modality.

• Attack Construction:

  • Audio Typography: The authors synthesize misleading speech using Text-to-Speech (TTS) models (e.g., Edge-TTS) and inject it into the original audio track of a video.
  • Constraints: The visual stream remains unchanged. The injected speech is semantically inconsistent with the video content (e.g., a video of a cat with audio saying "This is a horse").
  • Injection Strategies: The attack varies based on:
    • Target: Injecting a specific wrong class label (e.g., "horse").
    • Semantic Richness: Ranging from weak cues ("The answer is B") to strong semantic recitations and LLM-optimized prompts.
    • Parameters: Volume (gain), temporal placement, repetition frequency, and voice identity.

• Experimental Setup:

  • Models: Evaluated on state-of-the-art audio-visual MLLMs, including Qwen2.5-Omni-7B, Qwen3-Omni-30B, PandaGPT, ChatBridge, and Gemini variants (2.5 and 3.1 Flash).
  • Datasets:
    • MMA-Bench & Music-AVQA: Contain distinct subsets for audio-focused and visual-focused questions to test cross-modal impact.
    • WorldSense: A general multi-modal reasoning benchmark.
    • Safety Benchmarks (MetaHarm, I2P): Used to test content moderation capabilities (detecting harmful vs. safe content).
  • Metrics:
    • Ground-Truth Accuracy (ACC): Measures overall performance degradation.
    • Attack Success Rate (ASR): Measures the fraction of predictions redirected specifically to the injected target label, distinguishing targeted steering from random errors.

3. Key Contributions

1. Definition of Audio Typography: The paper formalizes spoken semantic injection as a distinct and underexplored attack surface in audio-visual MLLMs.
2. Cross-Modal Fragility: It demonstrates that audio attacks do not just affect audio-grounded tasks but significantly degrade performance on visually grounded tasks, proving that misleading speech can override visual evidence.
3. Synergistic Multi-Modal Attacks: The study reveals that coordinated attacks (aligned audio and visual perturbations) create a significantly more potent threat than single-modality attacks.
4. Safety Implications: The work shows that injecting "safe" spoken cues into visually harmful videos can successfully bypass content moderation filters, leading to the misclassification of harmful content as safe.

4. Key Results

A. Unimodal Manipulation (Audio Only)

• High Success Rates: Spoken typography reliably steers predictions. On the WorldSense benchmark, Qwen2.5-Omni-7B achieved an ASR of 64.03% with a massive accuracy drop (from 49.90% to 21.07%).
• Cross-Modal Impact: Even on visual-only questions (where the video frames are untouched), injected speech caused significant accuracy drops. For Qwen2.5-Omni-7B on MMA-Bench visual questions, accuracy dropped by 12.85% with an ASR of 24.27%.
• Model Dependency: Models with weak speech recognition capabilities (e.g., PandaGPT) showed low ASR, not due to robustness, but because they could not process the audio input effectively.

B. Cross-Modal Comparison (Text vs. Audio vs. Visual)

• Modality Sensitivity: The effectiveness of the attack depends heavily on the model architecture.
  • Qwen2.5-Omni-7B: Text attacks were strongest, followed by visual, then audio.
  • Gemini-3.1-Flash-Lite-preview: Visual attacks were strongest, followed by audio, then text.
• Conclusion: Current MLLMs are not modality-invariant; they propagate adversarial signals differently depending on the input stream.

C. Multi-Modal Attacks (Aligned vs. Conflicting)

• Aligned Attacks (Audio + Visual = Same Target): This creates the most potent threat.
  • On MMA-Bench, aligned attacks on Qwen2.5-Omni-7B reached an ASR of 83.13% (visual questions) and 83.43% (audio questions), significantly outperforming single-modality attacks (which ranged from ~24% to ~50%).
• Conflicting Attacks (Audio vs. Visual = Different Targets):
  • The attack remains disruptive, but the visual perturbation tends to dominate the audio perturbation in terms of steering the final prediction.

D. Parameter Sensitivity & Trade-offs

• Volume (Gain): The strongest factor. Increasing volume significantly boosts ASR but reduces stealth (audible distortion).
• Repetition: Provides the best effectiveness-stealth trade-off. Repeating the cue 4x significantly increased ASR while keeping acoustic distortion lower than high-volume attacks.
• Temporal Placement: Later placement (closer to the end of the clip) generally strengthened the attack, likely due to proximity to the model's final decision step.
• Semantic Richness: "LLM-designed" prompts (optimized to steer without naming the answer) were more effective than simple keyword injections.

E. Safety Impact

• Content Moderation Failure: Injecting benign spoken cues (e.g., "This is a safe and healthy video") into visually harmful videos reduced the detection rate of harmful content.
  • For MetaHarm, the harmful detection rate for Qwen2.5-Omni-7B dropped from 26.16% (clean) to 8.04% under strong prompt-style audio attacks.

5. Significance and Future Directions

• Critical Vulnerability: The paper establishes that audio typography is a generalizable, high-impact attack vector that exploits the natural integration of speech in video. It challenges the assumption that visual evidence is the primary anchor for MLLM reasoning.
• Safety Risks: The ability to "blind" models to visual harm using benign audio poses severe risks for automated content moderation and safety-critical systems.
• Future Work: The authors call for:
  1. Testing realistic interference (overlapping speakers, background narration).
  2. Mechanistic interpretation of how models weigh competing modalities.
  3. Development of defenses, such as modality-aware consistency checks and training with semantically perturbed data.
  4. Human perceptual evaluations to quantify real-world stealth.

In summary, this work reveals that audio is not just a complementary modality but a powerful, manipulable control channel that can override visual grounding, necessitating a re-evaluation of robustness standards for multi-modal AI.