Induced Numerical Instability: Hidden Costs in Multimodal Large Language Models
Authors: Wai Tuck Wong, Jun Sun, Arunesh Sinha
Organizations: School of Computing and Information Systems, Singapore Management University, Singapore · Management Science and Information Systems Department, Rutgers Business School, New Jersey, USA
The use of multimodal large language models has become widespread, and as such the study of these models and their failure points has become of utmost importance. We study a novel mode of failure that causes degradation in performance indirectly by optimizing a loss term that seeks to maximize numerical instability in the inference stage of these models. We apply this loss term as the optimization target to construct images that, when used on multimodal large language models, cause significant degradation in the output. We validate our hypothesis on state of the art models large vision language models (LLaVa-v1.5-7B, Idefics3-8B, SmolVLM-2B-Instruct) against standard datasets (Flickr30k, MMVet, TextVQA, VQAv2, POPE, COCO) and show that performance degrades significantly, even with a very small change to the input image, compared to baselines. Our results uncover a fundamentally different vector of performance degradation, highlighting a failure mode not captured by adversarial perturbations.
Figures & tables
Figure 1: We sample 300 input pairs, drawn uniformly from logarithmic space for multiplication and from linear space for addition, respectively, starting from the minimum and to the maximum positive values of a half-precision ( float16 ) number. We compare the absolute differences when we perform operations with both full and half precision as the data type We see that numerical imprecision generally increases as values increase for multiplication, meaning larger inputs values yield more numerical errors.
Figure 2: A two-layer tanh network illustrating how a small input perturbation δ produces amplified change at the output due to asymmetric activation saturation. When x1=x2=0 and x2 is perturbed slightly by δ , the output becomes y=−2tanh(4δ) . In this example the output around this region is around 8x the initial magnitude of the input perturbation, demonstrating local sensitivity at that region that is inherent within the network that cannot be resolved by increasing floating point precision.
Figure 3: Qualitative comparison of different perturbation types and their corresponding activation responses. The first row shows input images under four settings—clean, FGSM, PGD, and numerically unstable (ours) . The second row presents activation maps extracted from the first vision encoder layer of LLaVA-v1.5-7B. While adversarial perturbations (FGSM, PGD) introduce localized distortions, our numerically unstable input induces diffuse and misaligned attention, indicating degradation through a fundamentally different mechanism.
Figure 4: Examples of outputs under clean and numerically unstable inputs ( ε=16/255 ) for the Idefics3-8B model. Each column shows the perturbed input image, the associated question, and corresponding responses. The perturbed responses deviate semantically from both the ground truth and the model’s original answers on the clean image, despite nearly identical inputs. Additional examples for other models can be found in Appendix B .
Figure 5: Implementation-level numerical error on MSCOCO for Idefics3-8B. We plot accumulated absolute differences between float32 and float16 forward passes (summed over operations and samples) versus training epoch (optimizing Eqn. 9 ). Numerical error increases over epochs under our proxy loss.
Appendix figures & tables4 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 6: Examples of outputs under clean and numerically unstable inputs ( ϵ=16/255 ) for the Janus-Pro-1B model. Each column shows the perturbed input image, the associated question, and corresponding responses. The perturbed responses deviate semantically from both the ground truth and the model’s original answers on the clean image, despite nearly identical inputs.
Figure 7: Examples of outputs under clean and numerically unstable inputs ( ϵ=16/255 ) for the LLaVa-1.5-7B model. Each column shows the perturbed input image, the associated question, and corresponding responses. The perturbed responses deviate semantically from both the ground truth and the model’s original answers on the clean image, despite nearly identical inputs.
Figure 8: Examples of outputs under clean and numerically unstable inputs ( ϵ=16/255 ) for the SmolVLM2-2.2B model. Each column shows the perturbed input image, the associated question, and corresponding responses. The perturbed responses deviate semantically from both the ground truth and the model’s original answers on the clean image, despite nearly identical inputs.
Figure 9: Training dynamics on the Numerical-COCO dataset across four multimodal models: LLaVA-v1.5-7B, Idefics3-8B, SmolVLM2-2.2B-Instruct, and Janus-Pro-1B. For each model, the left plot shows the supervised proxy loss used on the MSCOCO dataset, while the right plot shows the corresponding accumulated numerical-difference metric computed from forward-pass deviations against a high-precision reference.
Multimodal large language models (MLLMs) can process text presented as images, yet they often perform worse than when the same content is provided as textual tokens. We systematically diagnose this "modality gap" by evaluating seven MLLMs across seven benchmarks in five input modes, spanning both synthetically rendered text and realistic document images from arXiv PDFs to Wikipedia pages. We find that the gap is highly sensitive to rendering choices such as font and resolution, and that natural document images often exhibit much smaller gaps, suggesting the performance difference partly reflects evaluation artifacts rather than fundamental limitations. Through a grounded-theory error analysis of over 4,000 examples, we identify the primary cause: image input alone suppresses reasoning effort, with models producing 5--19x shorter outputs that skip step-by-step computation or reasoning. The reluctance to reason, not a failure of perception or knowledge retrieval, drives the performance gap, particularly on tasks requiring multi-step reasoning. We show that a simple, lightweight on-policy self-distillation method by fine-tuning models on their own text-mode reasoning traces paired with image inputs closes this gap, raising image-mode accuracy to match or exceed text-mode performance with over 50% improvement, and the gains transfer to unseen benchmarks without catastrophic forgetting. Overall, our results and analyses provide a systematic understanding of the modality gap and suggest a practical path toward improving visual text understanding in multimodal language models.
Kaiser Sun, Xiaochuang Yuan, Hongjun Liu +4
Johns Hopkins University · Amazon · New York University +1
Multi-modal Large Language Models (MLLMs) achieve strong performance on vision-language tasks, but incorporating visual inputs through a vision encoder (e.g., CLIP) substantially expands the attack surface, making these models vulnerable to visual adversarial perturbations. Prior defenses typically preserve compatibility with pretrained MLLMs by enforcing strict alignment to CLIP's original embedding space during adversarial fine-tuning; while practical, this constraint fundamentally limits achievable robustness. We present a systematic investigation of adversarial robustness in MLLMs. We first introduce a diagnostic CLIP-alignment protocol that predicts, prior to full MLLM training, which robust vision encoders will transfer effectively to the multimodal setting, revealing that large-scale multimodal adversarial pretraining, rather than unimodal scale alone, is the critical factor for strong robustness transfer. Integrating such encoders into MLLMs via end-to-end multimodal training yields average gains of 28 CIDEr points on captioning and 11.7% VQA accuracy under strong adversarial attacks compared to constrained plug-and-play baselines. We further show that adversarial training applied directly to a standard non-robust MLLM degrades both clean and adversarial performance, establishing robust visual representations as a strict prerequisite, while end-to-end adversarial training from a robust backbone delivers additional gains of 1.9 CIDEr points and 4.3% VQA accuracy. Beyond training-time defenses, lightweight test-time visual stochastic transformations serve as an effective black-box defense for non-robust MLLMs, elevating adversarial performance from near-zero to levels comparable with robust models. Finally, we show that our robust models substantially reduce toxic generation under white-box visual jailbreak attacks. Code and pretrained weights will be released publicly.
Multimodal Large Language Models integrate visual perception into language reasoning, introducing a continuous attack surface susceptible to adversarial attacks. Prior work on MLLM robustness has focused largely on English-centric tasks, leaving multilingual behaviour unexplored. We address this gap through a systematic study of adversarial robustness and multimodal safety across 12 diverse languages, evaluating open-source MLLMs that acquire multilingual capability through instruction tuning. Gradient-based attacks reveal a transferable multilingual vulnerability: adversarial images optimized in one language continue to induce failure in others, demonstrating strong cross-lingual transferability. Multilingual safety further varies with how effectively a model retrieves or interprets harmful instructions. When harmful intent is issued through text, languages with stronger linguistic grounding more often elicit misuse-enabling responses, while weaker languages produce fewer unsafe outputs. When embedded in the image as typographic content, English scripts are reliably recognised and followed, whereas non-English scripts are rarely parsed by the vision encoder. Lower-resource languages may therefore appear safer, but this is an artefact of comprehension and visual-grounding failures rather than genuine alignment, a phenomenon we term safety-by-failure. In contrast, MLLMs that build multilingual capability throughout their training stages rather than only at instruction tuning, such as Qwen3-VL, exhibit genuine cross-lingual safety, maintaining active refusal across languages rather than masking comprehension failure. Shallow multilingual adaptation, such as fine-tuning on translated instruction data, may produce surface-level understanding that creates illusory safety in low-resource languages; deeper integration across training stages leads to genuine multilingual safety alignment.