Source-linked AI summary
Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domain
Daizong Liu, Junhao Dong, Zhiyuan Ma, Xiaoye Qu, Xiang Fang, Runwei Guan, Keke Tang, Jianfeng Dong, Yew-Soon Ong
TL;DR
MLLMs are vulnerable to visual adversarial inputs, and existing attacks largely lack insight into the visual structures these models internally prioritize. The paper identifies sensitivity to phase-encoded structure, proposes a phase-aware attack with auxiliary adversarial prompt learning, and reports stronger effectiveness than prior attacks across multiple MLLMs and tasks.
Problem
MLLM attacks often use global perturbations without understanding the intrinsic visual focus underlying multimodal semantic grounding and reasoning.
Method
The framework reconstructs phase-only images, extracts phase-aware structural masks, confines perturbations to those regions, and adds auxiliary adversarial prompt learning.
Results
Experiments across multiple MLLMs and tasks demonstrate the method’s effectiveness and interpretability, with significantly higher attack success rates than previous state-of-the-art methods.
Takeaways & Limitations
The findings highlight frequency-domain behavior as a basis for more principled, structure-aware MLLM attacks and motivate future work on defense, detection, and robustness.
Takeaways & Limitations
Effectiveness depends on phase components consistently encoding meaningful structural cues, which may fail in cluttered, weak-contrast, blurred, or small-object scenes.
Abstract
from arXiv · showhide
Multimodal large language models (MLLMs) have extended the capability of large language models (LLMs) to process more contextual multimodal information, showing remarkable progress in diverse realistic multimodal applications. Despite their strong perception and reasoning abilities, recent studies reveal that MLLMs remain highly vulnerable to adversarial inputs, especially those targeting visual components. However, existing attacks mainly focus on global perturbations, lacking an understanding of how MLLMs internally interpret visual structures. In this paper, we make the attempt to investigate the intrinsic focus of MLLMs in the frequency domain and discover that their predictions are particularly sensitive to phase information, which encodes essential structural and semantic cues. Based on this observation, we propose a novel phase-aware adversarial attack framework that explicitly restricts adversarial perturbations to structure-relevant phase regions to suppress the MLLMs' focus for effective and imperceptible attacks. To further amplify the structural influence, we also introduce an auxiliary adversarial prompt learning module to guide multimodal misalignment around phase-sensitive regions, misleading the MLLM's attention toward targeted structural patterns. Extensive experiments on multiple representative MLLM models and datasets demonstrate the superior effectiveness of our method compared to existing attacks.
I. INTRODUCTION
MLLMs perform multimodal reasoning but remain vulnerable to visual adversarial inputs, while existing attacks often perturb images globally without modeling intrinsic visual focus. This work identifies phase-sensitive structural cues and uses them to design a targeted phase-aware attack with auxiliary adversarial prompting.
- I. INTRODUCTION: MLLMs support visual question answering, image captioning, and multimodal dialogue, yet remain vulnerable to adversarial inputs in real-world applications.
- I. INTRODUCTION: Existing MLLM attacks mainly apply global pixel-level noise or optimize representations against predefined adversarial objectives.
- I. INTRODUCTION: The intrinsic visual patterns that MLLMs attend to during inference remain underexplored, limiting understanding of how to craft interpretable and effective attacks.
- I. INTRODUCTION: The study finds that MLLMs are intrinsically sensitive to phase-spectrum information associated with semantic structure understanding.
- I. INTRODUCTION: The proposed phase-aware framework restricts perturbations to structurally meaningful regions and enforces spectrum-level variation for more effective, interpretable attacks.
- I. INTRODUCTION: An auxiliary adversarial prompt-learning module cooperates with phase perturbation to guide attention toward phase-sensitive regions and enhance semantic disruption.
II. RELATED WORK
Prior MLLM attacks largely use global pixel perturbations or encoder-dependent objectives, while this work examines whether phase information governs semantic grounding. Controlled analyses and attack decompositions indicate that MLLMs are more sensitive to phase than amplitude, motivating phase-aware attacks.
- Existing MLLM attacks: Most MLLM attacks apply pixel-level noise globally or optimize encoder-dependent adversarial objectives to disrupt multimodal reasoning.HardPatch instead concentrates perturbations on patches dominating perceptual focus, making model prioritization an explicit attack surface.
- Phase sensitivity: Phase-perturbed images achieve performance similar to whole adversarial examples, whereas amplitude-perturbed images perform much worse.This comparison supports greater MLLM sensitivity to phase patterns than amplitude patterns.
- Controlled analysis: Controlled analyses combine phase-amplitude swapping, encoder representations, and cross-modal attention similarity to test phase sensitivity from complementary perspectives.These analyses examine semantic donors, phase-only versus amplitude-only representations, and attention similarity under preserved spectra.
- Controlled analysis: The controlled results suggest that phase information plays a dominant role in semantic grounding and multimodal reasoning.The finding provides evidence beyond attack performance alone and motivates selectively suppressing intrinsic focus on phase-encoded structures.
A. Overview
The attack extracts phase-dominant structural regions and confines imperceptible perturbations to those regions. A phase-only reconstruction, edge detection, and adaptive thresholding produce the mask guiding perturbation localization.
- A. Overview: The attack optimizes an imperceptible perturbation δ within a phase-aware structure region m to induce an incorrect MLLM response.The perturbed input is x + m ⊙δ, while the prompt remains part of the model input.
- A. Overview: The pipeline uses DFT to obtain MLLM-sensitive phase-aware regions before perturbing benign images.The method avoids replacing the image outside the mask because that would introduce noticeable noise.
- B. Perceiving Phase-aware Structure: Phase information preserves geometric and semantic structure, including object edges, contours, and spatial layouts.These structural priors motivate localizing perturbations to phase-dominant regions.
- B. Perceiving Phase-aware Structure: A phase-only image is reconstructed by discarding amplitude information and applying inverse DFT to the input phase spectrum.Using an all-one amplitude matrix makes the reconstruction rely solely on phase features.
- B. Perceiving Phase-aware Structure: Sobel gradient detection followed by adaptive thresholding converts the phase-only reconstruction into a binary structure mask m.The mask isolates high-gradient structural areas such as contours and semantic boundaries.
- B. Perceiving Phase-aware Structure: The resulting mask guides perturbation localization toward phase-dominant regions used for semantic alignment and reasoning.The stated aim is to disrupt visual cues within m while retaining imperceptibility.
C. Optimizing Phase-aware Perturbation
The method constrains adversarial perturbations to phase-aware structural regions and jointly optimizes task deception with phase-spectrum variation. This design aligns perturbations with structural semantics to increase attack success while preserving perceptual similarity.
- Masked perturbation design: The adversarial example x′ = x + δ ⊙m applies perturbations only within structurally salient regions identified by the phase-aware mask m.The optimization seeks to preserve perceptual similarity while misleading the target MLLM for prompt p.
- Task-oriented objective: A task-oriented adversarial loss drives incorrect but plausible responses across VQA, image captioning, and image classification.
- Phase-domain regularization: The phase variation loss measures masked deviations between original and perturbed phase spectra to enforce structural changes in frequency space.P(·) denotes the pixel-wise phase spectrum.
- Optimization pipeline: The pipeline first generates sensitive phase-aware perturbations, then learns trainable auxiliary prompts to enhance their effectiveness.
- Joint optimization: Joint optimization of adversarial effectiveness and phase-domain variation makes perturbations more aligned with MLLMs’ reliance on structural semantics, increasing attack success.
D. Adversarial Prompt Enhancement
The adversarial prompt module enhances phase-aware attacks by directing image-prompt interactions toward phase-sensitive structures. The auxiliary prompt is optimized during attack construction and omitted at inference.
- Prompt enhancement: A trainable auxiliary prompt paux highlights phase-sensitive structures and amplifies the MLLM’s reliance on masked structural regions.It is jointly optimized with the visual phase perturbations as an auxiliary mechanism.
- Algorithm: The algorithm initializes paux from random vocabulary and produces x′ = x + δ ⊙m through iterative optimization.The inputs include image x, prompt p, MLLM M, target response, step size α, and iteration counts.
- Algorithm: The auxiliary prompt is concatenated with the original prompt, while paux is frozen during adversarial-image optimization.
- Prompt enhancement: The auxiliary prompt is optimized as a semantic lens, guiding attack optimization toward structural components heavily used by the model.
- Deployment behavior: The auxiliary prompt is used only during attack optimization and is not used at inference.
E. Discussion on Novelty and Design Choice
The paper distinguishes its framework from prior frequency-domain attacks by studying spectral information as part of multimodal semantic grounding rather than merely as a perturbation constraint. It positions the work among early systematic efforts connecting spectral sensitivity, semantic grounding, and adversarial robustness in MLLMs.
- Prior frequency-domain attacks: Prior frequency-based attacks mainly target conventional classifiers by perturbing predefined frequency bands for imperceptibility, transferability, or robustness.
- Design choice: This framework instead analyzes how spectral components contribute to MLLM perception and designs attacks around observed semantic sensitivity.
- Novelty: The paper reports that whether phase information preserves structural content for multimodal semantic understanding had not been systematically investigated in MLLMs.
- Novelty: The work is described as among the first studies systematically connecting spectral sensitivity, semantic grounding, and adversarial robustness in MLLMs.
V. EXPERIMENTS
Experiments evaluate targeted attacks across multiple datasets and open- and closed-source MLLMs using task-specific success and similarity metrics. The proposed method consistently achieves the highest success rates in open-source settings and significantly outperforms black-box baselines.
- Experimental setup: The evaluation uses ImageNet, SVIT, and DALLE for image captioning, image classification, and VQA, respectively.
- Experimental setup: The experiments measure semantic similarity, ExactMatch attack success rate, and Conditional-Contain success rate.These metrics assess answer similarity and exact or flexible word overlap with target texts.
- Evaluation protocol: Experiments use deterministic decoding for closed-source MLLMs, a maximum budget of 100 queries per image, matched perturbation protocols, and three random seeds.
- Open-source evaluation: Across all configurations, the proposed method achieves the highest attack success rates on all evaluation metrics against five baselines and six open-source MLLMs.
- Black-box evaluation: The black-box extension accesses only final textual responses through official APIs, without model internals, confidence scores, token probabilities, or gradients.
- Black-box evaluation: The method significantly outperforms state-of-the-art black-box attack baselines in targeted attack performance.
C. Ablation Study
The ablations identify phase-region localization as the strongest component, while additional consistency and adversarial-learning modules improve coherence and transferability. Further evaluations report robustness across targets, prompts, defenses, transfer settings, and imperceptibility, with a stated efficiency–performance balance.
- Component effectiveness: The phase region module produces the most notable improvement over the task-loss baseline, showing that restricting perturbations to important frequency regions is crucial for attack success.Pattern consistency further aligns perturbations with desired structural semantics, while adversarial learning strengthens transferability.
- Detailed designs: DFT outperforms DWT and DCT because it explicitly represents phase-aware patterns corresponding to visual structural contexts.The comparison replaces DFT with alternative spectral tools and uses their low- and high-frequency bands to represent phase and amplitude.
- Prompt stability: Removing the auxiliary prompt during inference causes only a minor decrease in attack success rate, supporting cross-prompt stability.The evaluation includes original, paraphrased, and template-rewritten prompts after generation with the combined prompt.
- Defense robustness: The attack remains more robust than compared baselines under fine-tuning, image purification, resizing, smoothing, JPEG compression, and stronger adaptive defenses.Under adaptive defenses, all methods lose attack success rates, but the proposed method retains the highest E-ASR and C-ASR.
- Practicality and imperceptibility: With L∞=8/255, phase-aware localization reduces the perturbed area ratio from 100% to 21.3%, improving LPIPS, SSIM, and PSNR while retaining stronger attack performance and transfer results.The paper also reports better performance in transfer attacks generated on BLIP-2 and tested on other MLLM models, alongside an efficiency–complexity comparison.
E. Visualization
The visualization presents how the phase-aware attack transforms an input into a structural, localized adversarial example that suppresses the MLLM’s intrinsic phase focus.
- Visualization: Figure 7 juxtaposes the benign image, decomposed phase pattern, phase-aware edge region, and final adversarial image.The visualization shows the successive representations used by the proposed phase-aware attack.
- Visualization: The final adversarial images demonstrate that the attack can fool MLLMs by suppressing their intrinsic phase focus.
F. Discussion on Limitations and Failure Cases
The method’s effectiveness depends on phase components providing stable, semantically meaningful structural cues, which can fail in several visual settings. The same phase-aware structural principle may also extend beyond adversarial MLLM attacks to broader vision and multimodal learning problems.
- Core limitation: The method assumes that phase components consistently encode semantically meaningful structural cues, an assumption that may fail under some visual conditions.The paper identifies this assumption as a source of degraded attack performance.
- Failure cases: Cluttered scenes can mix overlapping structural patterns, making phase-dominant regions less localized and weakening perturbation allocation.
- Failure cases: Weak edges, motion blur, low contrast, small objects, and text-rich OCR scenarios can limit the mask’s ability to capture semantically meaningful regions.These conditions reduce discriminative phase cues or the available phase-sensitive attack budget.
- Broader applicability: Phase-aware structural representations may complement robust structural reasoning in group activity recognition and compositional action recognition by providing geometric cues.The paper frames these extensions as potential applications rather than demonstrated results.
- Implications and future work: The conclusion positions frequency-domain behavior as relevant to more principled, structure-aware attacks and identifies defense, detection, and robust training as future directions.