Aligned multimodal attack
83.43%
On MMA-Bench audio questions for Qwen2.5-Omni-7B, aligned audio + visual perturbations outperform audio-only and visual-only attacks.
ArXiv preprint
Cross-Modal Typographic Attacks
We study how misleading speech, on-screen text, and text prompts change the predictions of audio-visual MLLMs. Multi-Modal Typography compares these attack channels across models and tasks, measures human perception of added speech, and tests fine-tuning as a defense.
Updated manuscript: September 30, 2026. The PDF includes newer Gemini models, a human study, offline robot-task selection, and fine-tuning results.
Overview
What we study
Multi-Modal Typography studies how semantically matched perturbations across audio, visual, and text channels can redirect audio-visual reasoning. The central question is whether MLLMs treat semantically similar signals consistently across modalities, or whether the delivery channel fundamentally changes model behavior.
Misleading speech can change visually grounded answers. We keep the visual stream unchanged and add speech that names or describes a wrong answer. We then compare speech with on-screen text and prompt-text attacks.
Audio as typography
The paper treats synthesized speech as a primary typographic modality and injects short spoken target cues while keeping the visual stream unchanged.
Cross-modal fragility
Attacks are evaluated across audio, visual, and text channels to measure how different delivery modalities propagate adversarial semantics.
Human perception
Sixteen participants rated whether they noticed the added voice and understood its words across seven volume levels.
Applications and defense
We test content moderation and offline robot-task selection, then examine whether training on attacked videos improves robustness.
Unimodal audio attack
Standalone spoken typography on WorldSense.
43.4%
On WorldSense, spoken typography raises Gemini 3.7 Flash's ASR from 9.53% to 43.41%.
Cross-modal impact
Visual questions can still be affected by speech.
12.85
On MMA-Bench visual questions, injected speech reduces Qwen2.5-Omni-7B accuracy by 12.85 percentage points even though the visual input is unchanged.
Aligned multi-modal attack
Coordinated audio and visual perturbations.
83%
Aligned audio-visual perturbations reach 83.43% ASR on MMA-Bench audio questions for Qwen2.5-Omni-7B.
Key findings
Attack strength depends on the model, modality, and spoken content.
The updated study connects attack success with human perception and evaluates fine-tuning on attacked videos.
Standalone audio typography
61.39%
On WorldSense, Qwen3-Omni-30B ASR rises from 14.35% on clean inputs to 61.39% with misleading speech.
Human perception
77.3%
At volume 0.05, the added speech went unnoticed in 77.3% of human ratings. Qwen2.5-Omni-7B ASR on WorldSense rose from 18.3% with muted speech to 21.9%.
Fine-tuning defense
52.0% ASR
Training Qwen2.5-Omni-7B on attacked AudioSet videos lowers WorldSense ASR from 60.6% to 52.0%, while attack-input accuracy rises from 24.1% to 28.1%.
Attack channels
Attack channels
The study compares semantically targeted perturbations delivered through three channels: spoken audio, on-screen visual text, and text prompts.
Audio typography
Synthesize a misleading phrase with text-to-speech and mix it into the soundtrack. The video frames stay unchanged.
TTS injection
Volume
Repetition
Timing
Visual typography
Overlay text naming a wrong class or answer on the video frames while preserving the original audio.
On-screen text
Prompt hijack
Scene override
Text prompt channel
Add a misleading target to the model's text prompt and compare its effect with the audio and visual channels.
Instruction text
Target semantics
Cross-modal conflict
Method
Method pipeline
The core experimental workflow starts from clean audio-video inputs, injects controlled target semantics, and measures both accuracy degradation and targeted steering.
1
Start from clean audio-video inputs
Evaluate each model on the original video and its question before adding an attack.
2
Inject spoken target cues
Choose a wrong target, synthesize the spoken cue, and control its volume, repetition, placement, and voice.
3
Compose cross-modal conflicts
For aligned attacks, speech and on-screen text suggest the same wrong answer. For conflicting attacks, they suggest different targets.
4
Evaluate ACC and ASR
Measure accuracy against the correct answer and attack success rate against the specified wrong target.
5
Test application settings
Test whether misleading cues change harmful-content detection or the task selected from robot-scene images and a spoken instruction.
Figures from the updated paper
Human perception and attack strength
Higher-volume speech produces stronger attacks and becomes easier to notice and understand.
Applications and mitigation
From task selection to fine-tuning
Offline robot-task selection
Across 200 LIBERO-Goal examples, Qwen2.5-Omni-7B selects the original task in 180 clean cases. With aligned misleading speech and text, it selects the original task in 41 cases and the attacker's task in 140. The inputs are front-view and wrist-view images with a spoken instruction; no robot action is executed.
Fine-tuning on attacked videos
We train Qwen2.5-Omni-7B on 998 AudioSet videos using their original sound labels. On 1,585 WorldSense questions, training on attacked videos lowers ASR from 60.6% to 52.0%. A prompt reminder asking the base model to ignore embedded instructions gives 58.8% ASR.
Training settings and release materials
Experimental matrix
Experimental scope
The paper evaluates multiple frontier MLLMs, multiple benchmarks, modality-specific question splits, and safety-oriented test settings.
Evaluated models
Qwen2.5-Omni-7B
Qwen3-Omni-30B
PandaGPT
ChatBridge
Gemini-2.5-Flash-Lite
Gemini-3.1-Flash-Lite-preview
Gemini 3.7 Flash
Gemini 3.1 Pro Preview
The evaluation includes open and closed frontier models with different multimodal architectures and varying levels of speech capability.
Benchmarks and slices
MMA-Bench
Music-AVQA
WorldSense
MetaHarm
I2P
LIBERO-Goal
Human perception
Visual questions
Audio questions
Audio-visual questions
Benchmarks include modality-partitioned QA settings, general audio-visual reasoning, and safety-oriented evaluations.
Safety and deployment
Safety implications
The paper concludes with content-moderation results showing that spoken benign cues can weaken harmful-content detection even when the harmful visual evidence remains present.
MetaHarm result
For Qwen2.5-Omni-7B, harmful-content detection on MetaHarm drops from 26.16% on clean inputs to 20.41% with a keyword-style benign cue and 8.04% with a stronger prompt-style benign cue.
26.16%
Clean harmful-content detection on the MetaHarm slice.
20.41%
After a keyword-style benign spoken cue.
8.04%
After a stronger prompt-style benign spoken cue.
Interpretation
These results show that spoken semantics can override grounded visual evidence in safety-sensitive settings, not only in standard benchmark classification.
Resources
Resources
Direct links to the paper and supplementary release materials.
Project links
Links to the paper and supplementary materials for the public release.
ArXiv preprint
arXiv record and version history.
Open preprint
Paper PDF
Latest manuscript, updated September 30, 2026.
Open PDF
Code
Attack-generation pipeline (audio, visual, multi-modal), reproduction, and evaluation scripts.
View on GitHub
Reproduction guideExisting attack code, benchmark manifests, and fine-tuning settings.
Read guide
SFT training annotationsSource segments, labels, and speech settings for 998 paired videos.
View annotations
SFT video archive1,996 clean and attacked MP4 files, annotations, and checksums. ZIP, 4.40 GB.
Download ZIP
Citation
If you use this work, please cite the paper.
BibTeX
@article{chen2026systematic,
title={A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoning},
author={Chen, Tianle and Ghadiyaram, Deepti},
journal={arXiv preprint arXiv:2604.03995},
year={2026}
}
Contact
Department of Computer Science, Boston University
Email
{tianle, dghadiya}@bu.edu