cs.CVOct 2, 2026

Corrupted but Correct: Why Vision-Language Models Lie to Themselves Internally

Authors: Arun Josephraj Arokiaraj, Zekun Wu, Adriano Koshiyama

Organizations: Department of Computer Science, University College London · Holistic AI

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

A targeted adversarial perturbation can drive a vision-language model's (VLM's) teacher-forced training loss for a fixed target caption to near zero, yet the same model, allowed to generate freely, produces the original, correct description with no trace of the target. We call this dissociation the train/inference gap, and give it a precise mechanistic account on Qwen2.5-VL-7B-Instruct using a controlled two-stage PGD attack on 200 held-out COCO images. First, we show that image-level pixel statistics, including a correctly re-implemented, texture-based attackability measure from the CNN robustness literature, have essentially no predictive power over which images are corrupted (best predictor r=-0.050, p=0.484; ridge regression R^2=0.069). Second, using the logit lens, we localise the gap to a single autoregressive step: the rank of the target token, conditioned on the correct first token already being generated, is fixed at exactly 3,488 out of 152,064 vocabulary entries for every image and every condition, with zero variance. Third, tracking target-token rank across all 28 LLM decoder layers reveals that the visual encoder corrupts every image's representation by a comparable margin regardless of eventual outcome, but the language model decoder then differentially arbitrates: amplifying the corrupted signal for susceptible images and actively suppressing it, past its clean-image baseline, for resistant ones (p<0.001, rank-biserial r=0.579). A linear probe on the merger hidden state separates these two outcomes with AUC=0.858, though we flag a circularity concern in this estimate. Together these results argue that adversarial robustness in autoregressive VLMs is substantially a property of the language decoder's prior, not the visual encoder, with direct implications for where faithfulness evaluations and defenses for deployed VLM systems should be targeted.

Figures & tables

FeaturerrppSignificant?
Correctly-implemented OTI ( Liang et al., 2026 )−0.050-0.0500.484no
Whole-image texture intensity (no object mask)−0.275-0.2750.0001yes (weak)
Frequency: high band−0.299-0.299<0.001<0.001yes (weak)
Structural regularity−0.033-0.0330.641no
Table 1: Pearson correlation of image-level features with Stage-1 loss ( n=200n=200 ). None reaches practically meaningful strength; ridge regression on all nine base features gives R5-fold CV2=0.069±0.060R^{2}_{\text{5-fold CV}}=0.069\pm 0.060 .
Figure 1: Per-token probability analysis across 200 images and all three outcome groups. The rank of the target token _coconut , conditioned on the correct preceding token A already appearing in context, is a flat line at exactly 3,488 with zero variance, for every image, every group, clean and adversarial alike.
GroupnnΔP(A)\Delta P(\text{A})T0 rateRank(_coconut ∣\mid A)T1 rate
A (susceptible)38−0.249-0.24923.7%3,4880.0%
B (gap)9−0.277-0.27711.1%3,4880.0%
C (resistant)153−0.328-0.32811.8%3,4880.0%
Table 2: Per-token probability analysis, all 200 images. ΔP(A)\Delta P(\text{A}) : mean change in probability of the correct first token under attack. T0/T1 rate: fraction of images where the model’s own greedy choice at that step matches the target.
Figure 2: Target-token rank shift (adversarial −- clean) across all 28 LLM decoder layers, by group. Group A (susceptible) maintains a positive shift toward the target throughout; Group C (resistant) crosses over to negative shift – active suppression, below the clean baseline – around layers 15–18.
  Merger outputFinal LLM layer
GroupnnAdv. rankΔ\Delta vs. cleanAdv. rankΔ\Delta vs. clean
A (susceptible)388,714−5,724-5{,}72415,224−3,754-3{,}754
B (gap)910,258−2,274-2{,}27417,172−3,232-3{,}232
C (resistant)50 *8,571−3,619-3{,}61919,787+1,580\mathbf{+1{,}580}
Table 3: The two-stage cascade: rank of _coconut at the vision-language merger output and at the final LLM decoder layer, by group. A negative Δ\Delta means the adversarial rank is lower (closer to the target) than clean; a positive Δ\Delta means the model has moved further from the target than its own clean baseline.

Explore similar work

CardsList
Sep 29, 2026cs.CV

It Takes Little to Rewrite Perception: Targeted Semantic Substitution in Vision-Language Models at ε≤4/255ε\leq 4/255

Vision Language Models (VLMs) are widely deployed in safety-critical scenarios, and understanding to which extent they can be controlled by adversarial perturbation is a prerequisite for evaluating their trustworthiness. Existing representation-alignment attacks, which make a VLM perceive a target image, achieve limited success at ε≤4/255\varepsilon \leq 4/255. Therefore, VLMs seems robust to perturbations in this range. We show that this robustness does not hold, as targeted semantic substitution succeeds within the same range. Specifically, we align each stream of the source image with its counterpart in the target image in the victim VLM's post-merger token space, operating under a white-box threat model. We evaluate under a strict success criterion, requiring the model to simultaneously name the target, confirm its presence, and deny the source. In images, target semantics appear at ε=2/255\varepsilon = 2/255 and complete replacement reaches 38% at ε=4/255\varepsilon = 4/255. On video, complete replacement reaches 35.9% at ε=1/255\varepsilon = 1/255. We also observe a phenomenon of semantic fusion, where Large Language Model (LLM) rationalizes contradictory visual signals into a coherent narrative.

Binchi Zhang, Apurva Narayan, Atrisha Sarkar

University of Western Ontario

VLM RobustnessAdversarial Attacks on VLMsVision-Language Models
AskPDF
Dec 11, 2024cs.CV

Exploiting Vision Encoder Vulnerabilities for Universal Adversarial Perturbations on Large Vision-Language Models

Large Vision-Language Models (LVLMs) have achieved remarkable performance on multimodal tasks but remain highly vulnerable to small adversarial perturbations in input images. Existing attacks typically target the vision encoder's final output embeddings, implicitly treating the encoder as a uniform attack surface, while a systematic analysis of which internal components are most vulnerable has remained largely unexplored. We show such analysis is essential, as adversarial vulnerability in LVLM vision encoders is structurally concentrated rather than uniformly distributed. Building on this, we propose Vision Encoder Vulnerable-Component-Targeted Universal Adversarial Perturbation (VEV-UAP), a task-agnostic and cost-efficient attack framework. Through a component- and layer-wise analysis of attention mechanisms, we identify the value components in middle layers as critical vulnerabilities that strongly influence downstream language model behavior. VEV-UAP selectively targets these components to generate a single universal perturbation shared across images, without involving textual inputs or the language model during optimization. Experiments across multiple LVLMs and tasks show VEV-UAP achieves state-of-the-art attack success rates with reduced computational overhead. Moreover, a single VEV-UAP transfers across LVLMs sharing the same vision encoder, even when paired with different language models, making it a practical framework for scalable robustness evaluation.

Hee-Seon Kim, Minbeom Kim, Seokil Ham +1

School of Electrical Engineering, KAIST, Daejeon 34141, Republic of Korea

VLM RobustnessAdversarial Attacks on VLMsLarge Vision-Language ModelsAdversarial PerturbationsTransfer-Based Adversarial Attacks
AskPDF
Sep 17, 2026cs.CV

Cross-Modal Attention Acts as a Frequency Filter: Why Verbose Prompts Improve Robustness in Vision-Language Models

Vision-language models (VLMs) are fragile under image corruption. We find that the wording of the question affects VLMs in two opposite ways. Verbose questions make VLMs substantially more robust---e.g., rephrasing "Is there a cat?" into "Please look carefully and answer: is there a cat?". Conversely, VLMs become more fragile under corruption when the question is semantically complex or finer-grained, e.g., "what colour is the cup left of the chair?" instead of "is there a cup?". Both effects stem from question-conditioned cross-modal attention, which induces a spectral filter over image patches: verbose questions broaden its frequency support, while fine-grained questions concentrate it onto fewer visual scales. The model's answer drifts most when this filter and the corruption sit on the same spatial frequencies. We test the filter view on Qwen3-VL and LLaVA-OneVision across GQA and CLEVR; verbose paraphrasing reduces drift variance by 70--81% on the 8B models. The practical recipe---pad the prompt---further yields measurable gains in accuracy, even under image corruption.

Farooq Ahmad Wani, Maria Sofia Bucarelli, Mujtaba Hussain Mirza +5

Sapienza University of Rome · Université Côte d’Azur · CNRS +3

VLM RobustnessPrompt SensitivityCross-Modal Attention
AskPDF