FusionAudit: Pathway-Conditioned Robustness Auditing for Native Multimodal Models

AI summary

Overview

Research area: Computer vision and multimodal machine learning security — specifically, adversarial robustness auditing of vision-language models (VLMs).

Technical level: Advanced. The paper assumes familiarity with adversarial attacks (PGD), transformer attention analysis, activation patching, and VLM architecture families.

Scope (one sentence): The paper proposes PaRMA, a diagnostic-driven auditing framework instantiated as FusionAudit, which measures visual-channel failure risk in native multimodal VLMs across two pathways — pixel perturbation and rendered-text insertion — using two new attacks (MANTIS and Nat-Evid) motivated by observed architectural blind spots.

What This Paper Is About

Robustness testing for vision-language models has been split between pixel-level adversarial attacks and typographic (text-in-image) overlays, and each is evaluated in isolation with a single headline number. The authors argue this is inadequate now that models have moved from "frozen encoder plus projection layer" designs to native architectures where visual tokens are injected at many layers or fused with text from the very first layer. Their goal is to replace static single-attack benchmarks with an evidence-based audit that diagnoses why a model fails on each visual pathway, then designs stronger attacks from those diagnostics to produce a more honest lower bound on real risk.

Key Contributions

1. A graded "nativeness taxonomy" (L1–L3) that organizes audit targets by fusion depth: L1 alignment-era projection models, L2 shallow-fusion models with a fixed visual prefix, and L3 deep-stack or early-fusion models. A theoretical L4 (a single shared backbone with no separate vision tower) completes the continuum, though no audited open-weight model meets it.

2. PaRMA and FusionAudit, a pathway-conditioned auditing methodology that decomposes the visual attack surface into pixel perturbation and rendered-text insertion, and reports a "pathway-complete risk" — the union failure rate over the clean-correct set — as an empirical lower bound that is strengthened by diagnostics rather than fixed in advance.

3. Two diagnostic discoveries: a "see-but-not-deceived" signature in native VLMs (they attend heavily to overlaid text but do not adopt it as an answer), and an objective mismatch between encoder-level and answer-level attacks in deep-fusion models.

4. Two diagnostic-motivated attacks: MANTIS (Margin-Aware Native Token Intervention Strategy), which concentrates gradient pressure at the first token where the correct and a canonical wrong continuation diverge; and Nat-Evid, which renders the wrong answer as host-congruent image content (e.g., a chart annotation) instead of an extrinsic banner.

Main Findings

• Diagnostics raise the estimated risk at every fusion level. Moving from the baseline suite (Vis-PGD, End-PGD, Typo-Evid) to the strengthened suite (MANTIS, Nat-Evid), level-mean pathway-complete risk rises by +10.6% in L1, +16.9% in L2, and +25.1% in L3, with 95% fixed-model paired bootstrap CIs of [9.2, 12.0], [16.1, 17.8], and [24.2, 26.0] percentage points — all excluding zero.

• MANTIS finds failures both PGD baselines miss, increasingly so with fusion depth. The MANTIS-exclusive flip rate (examples broken by MANTIS that survived both Vis-PGD and End-PGD) is 15.2% in L1, 17.6% in L2, and peaks at 24.6% in L3. MANTIS level-mean ASR reaches 88.8%, 73.7%, and 56.8% across L1–L3, against End-PGD's 69.0%, 54.2%, and 39.8%.

• The "see-but-not-deceived" signature is quantified. The Read–Use Gap (RUG) widens from +16.5% in L1 to +52.7% in L2 and +69.5% in L3: P_read rises from 38.9 to 68.6 to 81.0 while P_use falls from 22.4 to 15.9 to 11.6. Attention evidence agrees — mean Overlay Attention Ratio increases by +138% in L2 and +135% in L3 (versus +13% in L1) even as Typo-Evid ASR drops from 20.9% to 13.2%. On one MME example, Qwen3.5-2B's OAR rises from 2.49 to 4.85 on an injected "The correct answer is: yes" banner but the model still outputs "no".

• Host-congruent rendering beats direct typographic overlays in native models. Nat-Evid outperforms Typo-Evid by 13.6% in L2 and 15.0% in L3 (level means: 34.5% vs 20.9%, and 28.2% vs 13.2%), while Typo-Evid is strongest in L1 (26.5%). The Nat-Evid exclusive-flip rates are 10.4%, 23.7%, and 20.6% across L1–L3 — non-monotone.

• Legacy single-attack rankings are unstable. Comparing End-PGD ranking to the pathway-complete ranking gives Spearman ρ = 0.837 and Kendall τ_b = 0.634; 8 of 18 models shift by at least three ranks. Gemma3-12B ranks 2nd under End-PGD but 7th under the strengthened risk.

• Newer models are less vulnerable in absolute terms, but the diagnostic gap persists. Level-mean residual risk falls from 97.0% (L1) to 88.4% (L2) to 75.6% (L3). Within the controlled Qwen family the same pattern holds: Qwen2.5-VL-3B 85.7% → Qwen3-VL-2B/4B 82.7/78.9% → Qwen3.5-2B/4B 78.0/68.1%, and Qwen2.5-VL-7B 79.5% → Qwen3-VL-8B 73.1% → Qwen3.5-9B 59.5%.

• Layer restoration shows deep-fusion failures are not encoder-local. Restoring clean decoder activations undoes End-PGD flips in 92.2% of cases in L1 but only 62.6% in L2 and 25.6% in L3 (16 models; Qwen-VL-Chat and DeepSeek-VL-7B excluded for lacking activation hooks). Within the Qwen family the recovery rate falls from 70.4% to 21.3%.

Methodology in Plain English

The authors fix the text prompt and only manipulate the image, so any failure they measure can be attributed to the visual channel rather than to text-only jailbreaking. Every success rate is computed only over examples the model originally answered correctly, so a model that is simply bad at the task does not look artificially robust or fragile.

They define two intervention families. The pixel pathway adds a small perturbation bounded by an ℓ∞ radius of 8/255, optimized with 40 PGD steps. The text pathway renders a string of text onto the image at some placement.

For each pathway they first run standard baselines. On pixels, one attack pushes the vision encoder's features away from their clean values, and one maximizes cross-entropy over the whole correct answer sequence. On rendered text, they superimpose a wrong answer directly as a banner.

Then comes the diagnostic step, which is what distinguishes the method. They measure whether the model can read the injected text under an explicit reading prompt versus whether it uses it in its actual answer (the Read–Use Gap), and they measure how much image-directed attention lands on the overlay relative to its area (the Overlay Attention Ratio). These two readouts reveal that native models see the overlay but reject it, and that whole-sequence pixel attacks dilute their gradient across many tokens.

The two new attacks are direct responses. MANTIS first identifies the earliest token at which the correct answer and a fixed wrong answer differ, then optimizes only the margin between those two tokens at that single position, instead of spreading gradient over every token. Nat-Evid uses a generative image editor to insert the wrong answer as content that fits the scene — a chart label or embedded scene text — with instructions to add text only and not alter existing content. Finally, the risk estimate is recomputed as the union of failures over all four attacks, and the increase over the baseline union is reported as the diagnostic-driven risk gap.

Why This Matters

Research impact. The paper reframes VLM robustness evaluation from "run a fixed attack suite and report a number" to "use diagnostics to discover where a specific architecture is blind, then attack there." It also gives a reusable vocabulary — pathway-conditioned risk, exclusive-flip rate, RUG, OAR — and shows empirically that the field's default proxy (End-PGD ASR) produces rankings unstable enough to change model-selection conclusions. The layer-restoration result challenges the assumption, inherited from modular pipelines, that visual vulnerabilities live in the encoder.

Real-world applications:

• Pre-deployment auditing of document and chart assistants, where the images are text-heavy and an injected label could be read as a legitimate data annotation — the exact ChartQA/DocVQA settings used here.
• Screenshot and scanned-document pipelines in which users upload images containing rendered text that the model must not mistake for instructions or answers.
• Model procurement and benchmark design, where buyers currently compare models on a single attack number that this work shows can move a model three or more ranks.
• Red-teaming for multimodal agents, since the authors note the same attacks could be used to mislead deployed VLMs, and that MANTIS requires white-box gradient access — they release the audit pipeline rather than precomputed adversarial images.

Industry relevance. Any team shipping a VLM that ingests user-supplied images needs a defensible robustness number. FusionAudit provides a protocol that reports a falsifiable lower bound and explicitly measures what a fixed benchmark misses; the finding that absolute risk falls in newer models while the diagnostic gap persists is directly useful for deciding whether a newer architecture is genuinely safer or merely better at the attacks you happen to run.

Future Directions

• Auditing the L4 endpoint. Strict single-backbone, shared-tokenizer designs sit outside the empirical audit; the authors note that Chameleon points toward this design but reports image-tokenizer limitations on text-heavy images, which are central to their ChartQA/DocVQA and rendered-text settings.
• Adding pathways beyond pixels and rendered text. The framework is explicitly designed to be extensible to audio, video, and embodied tool-use. Command-following visual prompt injection (jailbreaks) is called out as a distinct risk needing compliance-based metrics rather than correctness-based ASR.
• Separating fusion depth from confounders. The L1–L3 taxonomy is observational, not a causal ladder: adjacent levels differ in training data and scale alongside fusion depth. The Qwen controlled chain mitigates but does not eliminate this, so larger same-family controlled comparisons are an open need.
• Reducing dependence on white-box access and on a single image generator. MANTIS requires gradients, which limits black-box use, and Nat-Evid's strength varied across the four generators tested (the Gemini-backed variant was strongest, while the three exact-text generators clustered near 19% average ASR), so transferability and generator robustness remain open.

Target Audience

Researchers and engineers working on multimodal model safety, adversarial robustness, and VLM evaluation; benchmark and red-team designers who need to justify why a single attack number is insufficient; and model developers preparing a VLM for deployment in document, chart, or screenshot-heavy products. Readers without a background in adversarial optimization or transformer internals will find the diagnostic sections accessible but the attack formulations and layer-restoration analysis demanding.

Authors’ abstract

As vision-language models (VLMs) transition from frozen-encoder pipelines to native multimodal architectures, the visual channel increasingly serves as both a perceptual input and a carrier of rendered text that competes with user prompts. Current single-attack, pixel-centric evaluations fail to capture this complexity: they collapse distinct visual attack surfaces into a single scalar and ignore how architectural shifts alter vulnerability. We introduce PaRMA, an evidence-based auditing framework that defines pathway-conditioned risk over two primary image-level interventions: pixel perturbation and rendered-text insertion. Instead of arbitrary attack enumeration, PaRMA uses pathway-specific diagnostics to expose architecture-specific blind spots. Notably, we uncover a see-but-not-deceived signature where native VLMs attend heavily to typographic overlays but visually reject them, and we identify an objective mismatch between encoder-level and answer-level attacks in deep-fusion models. To exploit these findings, we instantiate FusionAudit, introducing two diagnostic-motivated attacks: MANTIS (margin-aware pixel perturbation) and Nat-Evid (host-congruent semantic insertion). Evaluating 18 open-weight VLMs across a novel nativeness taxonomy, we demonstrate that legacy single-attack rankings (e.g., PGD) are unstable for native models. Our diagnostic-driven attacks substantially raise the estimated residual risk, showing that PaRMA provides a falsifiable, evidence-driven auditing methodology for uncovering vulnerabilities missed by standard benchmarks.