Multimodal Adversarial Robustness

The phenomenon where an adversarial perturbation crafted on one modality (e.g., a subtly altered image) successfully degrades the model's prediction even when the other modality (e.g., the paired text) remains clean. This reveals that the model has learned spurious correlations rather than robust, independent features. For example, adding imperceptible noise to an image of a 'stop sign' can cause a vision-language model to ignore the clean text 'a red octagon' and predict 'speed limit sign'.

Multimodal models often learn to over-rely on one dominant modality during training. An adversary can exploit this by attacking the weaker, less-defended modality to flip the joint prediction. For instance, in an audio-visual speech recognition system, a subtle inaudible perturbation to the audio stream can override the clean visual lip-reading data, causing a transcription error because the model's fusion layer is biased toward the auditory signal.

Unlike traditional imperceptible pixel attacks, these perturbations alter the high-level semantic meaning of one modality while keeping it physically realistic. The goal is to create a logical contradiction between modalities that the model cannot resolve. For example, pairing a clear image of a 'dog' with adversarial text that reads 'a cat sitting on a mat' forces the model to choose a conflicting cross-modal grounding, often resulting in a nonsensical or attacker-chosen output.

The fusion mechanism—where features from different modalities are combined—is a primary vulnerability surface. Adversaries target this bottleneck by injecting perturbations designed to maximize representation distortion at the point of fusion. A small perturbation in the visual encoder's output can be amplified by the fusion layer's attention mechanism, catastrophically corrupting the joint multimodal representation even if the unimodal encoders are individually robust.

A deceptive form of robustness where the model's gradients near the input are shattered or non-informative, preventing gradient-based attacks from finding an effective perturbation. However, this is not true robustness. An attacker can bypass this defense by crafting an attack using a surrogate multimodal model with smoother gradients or by using black-box transfer attacks from a separately trained vision-language model, exposing the original model's hidden brittleness.

A formal, mathematically proven guarantee that a model's prediction will not change for any input within a defined epsilon-ball around the original data point, across all modalities. Techniques like randomized smoothing are extended to the multimodal case by adding calibrated noise to the embeddings of each modality before fusion. This provides a lower bound on the attack budget required to change the output, offering a verifiable safety metric for high-stakes deployment.