PaperlayerView exact revision on arXiv

Source-linked AI summary

Forbid Your Attention: Fooling Multimodal Large Language Models by Selectively Removing Intrinsic Focus in Spectral Domain

Daizong Liu, Junhao Dong, Zhiyuan Ma, Xiaoye Qu, Xiang Fang, Runwei Guan, Keke Tang, Jianfeng Dong, Yew-Soon Ong

arXiv:2609.00788v1cs.CV

TL;DR

Existing MLLM attacks largely use global perturbations, while how models focus on visual structure remains underexplored. This paper proposes a phase-aware attack that restricts perturbations to structure-relevant regions and uses auxiliary prompt learning to guide attention. Experiments across multiple MLLMs and tasks demonstrate the method’s effectiveness and interpretability.

  • Problem

    How MLLMs focus on visual patterns during inference remains underexplored, limiting evidence for interpretable and effective adversarial strategies.

    Source: §I · p. 2

  • Method

    The framework restricts adversarial perturbations to phase-aware structural regions and uses auxiliary adversarial prompt learning to guide model attention toward those regions.

    Source: §I · p. 2, C. Optimizing Phase-aware Perturbation · p. 4, §VI · p. 11

  • Results

    Experiments across multiple MLLMs and tasks demonstrate the method’s effectiveness and interpretability.

    Source: §VI · p. 11

  • Takeaways & Limitations

    The work highlights the importance of understanding MLLMs’ frequency-domain behavior for developing more principled, structure-aware adversarial strategies.

    Source: §VI · p. 11

    The attack may weaken when phase components do not provide localized, discriminative structural cues, such as in cluttered or low-contrast images.

    Source: F. Discussion on Limitations and… · p. 10

Abstract

from arXiv · show

Multimodal large language models (MLLMs) have extended the capability of large language models (LLMs) to process more contextual multimodal information, showing remarkable progress in diverse realistic multimodal applications. Despite their strong perception and reasoning abilities, recent studies reveal that MLLMs remain highly vulnerable to adversarial inputs, especially those targeting visual components. However, existing attacks mainly focus on global perturbations, lacking an understanding of how MLLMs internally interpret visual structures. In this paper, we make the attempt to investigate the intrinsic focus of MLLMs in the frequency domain and discover that their predictions are particularly sensitive to phase information, which encodes essential structural and semantic cues. Based on this observation, we propose a novel phase-aware adversarial attack framework that explicitly restricts adversarial perturbations to structure-relevant phase regions to suppress the MLLMs' focus for effective and imperceptible attacks. To further amplify the structural influence, we also introduce an auxiliary adversarial prompt learning module to guide multimodal misalignment around phase-sensitive regions, misleading the MLLM's attention toward targeted structural patterns. Extensive experiments on multiple representative MLLM models and datasets demonstrate the superior effectiveness of our method compared to existing attacks.

I. INTRODUCTION

MLLMs perform diverse multimodal tasks but remain vulnerable to adversarial inputs, while their intrinsic visual focus is underexplored. The paper finds that MLLMs rely on phase-encoded structure and proposes a phase-aware attack with adversarial prompt learning.

I. INTRODUCTION

  • Existing MLLM attacks often use global pixel noise or encoder-dependent objectives, leaving intrinsic visual representations and model focus underexplored.The introduction frames understanding which visual patterns MLLMs attend to during inference as important for more interpretable and effective attacks.Source: §I · pp. 1–2
  • Phase-spectrum perturbations alone can fool MLLMs, whereas amplitude perturbations have significantly weaker or no adversarial effects.The authors associate phase with geometric structure and spatial semantics, and amplitude with stylistic and texture-related signals.Source: Figure 1 · p. 1, §I · p. 2
  • The proposed phase-aware framework confines adversarial perturbations to structurally meaningful regions and combines task loss with spectral and spatial constraints.It extracts a binary structure mask from a phase-only image using edge detection and adaptive thresholding.Source: §I · p. 2
  • An auxiliary adversarial prompt-learning module directs MLLM attention toward phase-sensitive regions to strengthen semantic disruption.The prompt optimization cooperates with phase perturbation; experiments across multiple MLLMs report significantly higher attack success rates than previous state-of-the-art methods.Source: §I · p. 2

II. RELATED WORK · III. INVESTIGATION ON MLLMS’ INTRINSIC FOCUS IN SPECTRAL DOMAIN

The paper argues that MLLMs’ intrinsic focus is more sensitive to phase patterns than amplitude, and uses this finding to motivate attacks that suppress focus on structure-relevant phase regions. It situates this investigation against prior MLLM attacks and frequency-based analyses that had not examined MLLM phase sensitivity.

II. RELATED WORK

  • Prior MLLM attacks use global pixel noise, salient-patch perturbations, or semantic, attention, and feature manipulation, while often overlooking intrinsic visual perception.Some representation-based approaches require access to visual or textual encoders such as CLIP.Source: §II · p. 2
  • Prior frequency analyses associate phase with semantic and structural content and amplitude with style or texture, but MLLM frequency sensitivity remained underexplored.The paper contrasts its amplitude-phase approach with prior work that separately constrained perturbations in low, middle, and high frequency bands.Source: §II · p. 2

III. INVESTIGATION ON MLLMS’ INTRINSIC FOCUS IN SPECTRAL DOMAIN

  • Phase-perturbed examples perform similarly to full adversarial examples, while amplitude-perturbed examples perform much worse across four MLLMs, indicating greater phase sensitivity.The full adversarial examples effectively fool all four models under each of the three attacks.Source: Figure 2 · p. 3, §III · p. 3
  • Three controlled analyses—phase-amplitude swapping, encoder representations, and cross-modal attention similarity—further support phase information’s dominant role in semantic grounding and multimodal reasoning.The analyses compare phase-only and amplitude-only reconstructions and settings that preserve either phase or amplitude.Source: Table I · p. 3, §III · p. 4
  • Text-conditioned tasks such as VQA require special text-guided visual focus, so the paper frames its intrinsic-focus findings as specific to MLLMs.The investigation is motivated by MLLMs’ need to comprehend image semantics in response to prompts that may be relevant or irrelevant to the image.Source: §II · p. 3, §III · p. 3
  • The investigation draws on the view that amplitude captures stylistic information while phase carries richer semantics, and proposes that MLLMs attend to frequencies aligned with textual semantics.This framing is inspired by hierarchical human visual perception, from low-level features to high-level concepts.Source: §III · p. 3
  • To test spectral sensitivity, the study applies APGD, MF-Att, and CroPA, then uses DFT and recombination to create phase- and amplitude-perturbed images.Each reconstruction combines an adversarial phase or amplitude with the corresponding benign component.Source: §III · p. 3
  • The authors motivate phase-aware structural perturbations to suppress MLLMs’ focus on phase patterns, which they identify as informative structural features.They suggest reducing phase focus can further improve attack performance.Source: §III · pp. 3–4

IV. THE PROPOSED ATTACK · A. Overview · B. Perceiving Phase-aware Structure

The attack localizes imperceptible perturbations to phase-aware image structures and uses trainable adversarial prompts to reduce MLLMs’ focus on those perturbations while making the attack robust.

A. Overview

  • The attack seeks an imperceptible perturbation within a phase-guided structure mask that changes the MLLM’s response.It formulates this as constrained adversarial generation over the input image and prompt.Source: A. Overview · p. 4
  • The pipeline extracts MLLM-sensitive phase-aware regions with DFT, then jointly learns auxiliary prompts and updates perturbations to achieve robust attacks.Prompts guide the model to focus less on phase-aware perturbations, which are then updated to bypass the prompts.Source: A. Overview · p. 4
  • The method avoids replacing the image outside the mask with the perturbation because that would introduce noticeable noise.Source: A. Overview · p. 4

B. Perceiving Phase-aware Structure

  • Phase information preserves most image geometry and semantics, including object edges, contours, and spatial layouts,.Source: B. Perceiving Phase-aware Structure · p. 4
  • The method applies DFT to obtain the phase spectrum and reconstructs a phase-only image by discarding amplitude and applying inverse DFT.This reconstruction highlights spatial discontinuities such as edges and contours.Source: B. Perceiving Phase-aware Structure · p. 4
  • It converts the phase-only reconstruction into a binary structural mask using Sobel gradient magnitudes and adaptive thresholding to isolate high-gradient areas.Source: B. Perceiving Phase-aware Structure · p. 4
  • The mask marks phase-dominant regions such as object contours and semantic boundaries, localizing perturbations to cues used for semantic alignment and reasoning.Source: B. Perceiving Phase-aware Structure · p. 4

C. Optimizing Phase-aware Perturbation

The method optimizes perturbations within phase-aware structural regions to fool an MLLM while preserving perceptual similarity, combining task-oriented and phase-based objectives.

C. Optimizing Phase-aware Perturbation

  • The attack adds a mask-guided perturbation to structurally salient regions, aiming to mislead the target MLLM while preserving similarity to the original image.Its task-oriented loss targets incorrect but plausible responses across tasks such as VQA, image captioning, and image classification.Source: C. Optimizing Phase-aware Perturbation · p. 4
  • A phase variation loss measures changes between original and perturbed phase spectra in masked regions to encourage meaningful structural changes.P(·) denotes the pixel-wise phase spectrum.Source: C. Optimizing Phase-aware Perturbation · p. 4
  • The spatial-domain phase pattern regularizer moves the adversarial example’s phase pattern away from the benign one to disrupt accurate structural-semantic reasoning.The passage describes this as a further means of misleading MLLM focus on the phase spectrum.Source: C. Optimizing Phase-aware Perturbation · pp. 4–5
  • Jointly optimizing adversarial effectiveness and phase-domain variation aligns perturbations with MLLMs’ reliance on structural semantics and increases attack success rate.Source: C. Optimizing Phase-aware Perturbation · p. 5

D. Adversarial Prompt Enhancement

The module adds a jointly optimized textual prompt to direct attack optimization toward phase-sensitive image structures. The prompt is auxiliary rather than adversarial and is removed at inference.

D. Adversarial Prompt Enhancement

  • A trainable auxiliary prompt highlights phase-sensitive structures and amplifies the MLLM’s reliance on masked regions during image-prompt interaction.A distortion loss is defined to encourage grounding semantic understanding away from masked phase regions while producing an accurate response.Source: D. Adversarial Prompt Enhancement · p. 5
  • During adversarial-image optimization, the method freezes the auxiliary prompt and attacks the MLLM using the prompt combined with the original prompt.The auxiliary prompt acts as a semantic lens to focus optimization on structural components the model relies on.Source: D. Adversarial Prompt Enhancement · p. 5
  • The auxiliary prompt is used only during attack optimization, not inference, and the design aims to preserve semantic plausibility and imperceptibility from the language side.The paper contrasts this with global attacks, describing its approach as more effective from the vision side.Source: D. Adversarial Prompt Enhancement · p. 6

E. Discussion on Novelty and Design Choice

The paper distinguishes its work from conventional frequency-domain attacks by studying spectral contributions to multimodal semantic grounding and language reasoning. Its novelty is a phase-aware semantic-grounding perspective for MLLM attacks, motivated by analyses showing stronger dependence on phase than amplitude.

E. Discussion on Novelty and Design Choice

  • The framework’s novelty is a phase-aware semantic-grounding perspective for MLLM attacks, integrating frequency-domain analysis with multimodal semantic optimization rather than relying on an individual optimization component.Source: E. Discussion on Novelty and Design… · p. 6
  • Unlike prior frequency-based attacks focused mainly on conventional image classifiers and predefined frequency bands, this work studies spectral contributions to MLLM semantic grounding and language reasoning.Source: E. Discussion on Novelty and Design… · p. 6
  • Controlled analyses show MLLMs depend substantially more on phase than amplitude at prediction, representation, and cross-modal-attention levels.Source: E. Discussion on Novelty and Design… · p. 6
  • The study is described as among the first to systematically connect spectral sensitivity, semantic grounding, and adversarial robustness in MLLMs.Source: E. Discussion on Novelty and Design… · p. 6

V. EXPERIMENTS · A. Experimental Setup · B. Main Attack Performance

The experiments report that the proposed attack achieves the highest success rates across white-box configurations and outperforms black-box baselines. Evaluation spans three datasets and eleven MLLMs under shared attack budgets and protocols.

A. Experimental Setup

  • ImageNet, SVIT [74], and DALLE support image classification, image captioning, and VQA evaluation using SS, E-ASR, and C-ASR metrics.The metrics measure semantic similarity between raw and adversarial answers, exact word overlap with targets, and flexible word-level target overlap, respectively.Source: A. Experimental Setup · p. 6
  • Evaluation covers six open-source MLLMs—BLIP-2, LLaVA-1.5, Flamingo, MiniGPT-4 [68], Qwen2-VL [69], and Intern-VL —and five closed-source models.The closed-source models are Claude-3.5, Claude-3.7, GPT-4o, GPT-4.1, and Gemini-2.0.Source: A. Experimental Setup · p. 6
  • The attack uses a perturbation budget ϵ = 8, up to T1 = 100 optimization epochs, decay factor µ = 0.9, and T2 = 30 and T3 = 20 adversarial-learning steps.Phase-dominant regions are extracted from a Fourier-domain phase-only reconstruction by selecting the top 20% highest-response pixels.Source: A. Experimental Setup · p. 6
  • Each benchmark uses 1,000 randomly sampled 224 × 224 images, shared target assignments and evaluation subsets, and three random seeds; closed-source APIs use temperature 0 and at most 100 queries per image.Baselines use official releases when available and share the perturbation budget and protocol; experiments run on one NVIDIA H100 Tensor Core GPU.Source: A. Experimental Setup · pp. 6–7

B. Main Attack Performance

  • The Monte Carlo extension significantly outperforms five black-box baselines across three datasets and five MLLMs using only final textual responses.Black-box evaluation excludes access to model internals, confidence scores, token probabilities, and gradients.Source: Table III · p. 7, B. Main Attack Performance · p. 7
  • Across three datasets and six open-source MLLMs, the method achieves the highest attack success rates on all evaluation metrics against five competitive baselines.The attacker has access to gradients, logits, probabilities, internal activations, visual encoder parameters, and tokenizer information.Source: B. Main Attack Performance · p. 7

C. Ablation Study · D. More Analysis

The analyses show that the attack remains effective under multiple defenses and prompts, while phase-aware design and localization contribute to attack performance and perceptual quality.

C. Ablation Study

  • The phase-region module yields the largest ablation improvement; pattern consistency improves structural alignment, adversarial learning strengthens transferability, and phase regularization slightly hampers performance.The paper attributes the regularization cost to its perturbation-magnitude constraint limiting attack expressiveness.Source: C. Ablation Study · p. 7
  • The attack performs across refusal, irrelevant-semantic, misleading-prefix, and toxic-language targets, suggesting it is not sensitive to the attacker’s goal.The paper describes the results as demonstrating generalization, stability, and potential for broad deployment.Source: C. Ablation Study · pp. 7–8, Figure 4 · p. 8
  • DFT outperforms DWT and DCT for phase-aware perturbations, auxiliary learnable prompts improve attacks, and the chosen iteration counts are T1 = 100, T2 = 30, and T3 = 20.The iteration counts balance attack performance and resource cost; DFT explicitly represents phase-aware patterns associated with visual structure.Source: C. Ablation Study · p. 8, Table V · p. 8, Figure 5 · p. 8
  • Perturbations remain effective with original, paraphrased, and template-rewritten inference prompts, indicating auxiliary prompts guide optimization but are not required at deployment.Removing the auxiliary prompt at inference causes only a minor decrease in attack success rate.Source: C. Ablation Study · p. 8, Table VI · p. 8

D. More Analysis

  • Against four adaptive defenses, the attack achieves the highest E-ASR and C-ASR among baselines, although the defenses reduce success rates for all methods.The findings link effectiveness to phase-sensitive semantic structures rather than solely to removable high-frequency artifacts.Source: Table VII · p. 9, D. More Analysis · p. 9
  • Against fine-tuning, image purification, resizing, smoothing, and JPEG compression, the attack performs better than compared baselines and is described as more robust.The comparisons cover open- and closed-source MLLMs and additional image-processing defenses.Source: D. More Analysis · p. 9, Table VIII · p. 9, Table IX · p. 9
  • The attack is reported as competitive in efficiency and complexity while achieving better performance; BLIP-2 examples transfer better, and GPT-4o is used for semantic target-response similarity evaluation.GPT-4o assessment uses deterministic decoding at temperature 0 and a fixed prompt template.Source: D. More Analysis · p. 9, Figure 6 · p. 9, Table XI · p. 9
  • At L∞ = 8/255, the proposed phase-aware localization strategy significantly reduces the perturbed area ratio from 100% to 21.3%, leading to substantially better perceptual quality in LPIPS, SSIM, and PSNR.Source: D. More Analysis · p. 10

E. Visualization

Figure 7 presents benign images, decomposed phase patterns, phase-aware edge regions, and final adversarial images; the visualizations show the attack fooling MLLMs by suppressing their intrinsic phase focus.

E. Visualization

  • The visualizations show that the attack can fool MLLMs by suppressing their intrinsic phase focus.Figure 7 includes benign images, decomposed phase patterns, phase-aware edge regions, and final adversarial images.Source: E. Visualization · p. 10

F. Discussion on Limitations and Failure Cases · G. Broader Applicability of Phase-aware Structural Modeling · VI. CONCLUSION

The sections frame phase-aware structural modeling as a useful but conditional approach: it can exploit MLLMs’ phase sensitivity, may transfer beyond adversarial attacks, and can fail when phase cues do not align reliably with semantic information.

F. Discussion on Limitations and Failure Cases

  • Attack effectiveness can weaken when clutter mixes phase patterns or weak edges, blur, and low contrast make phase masks poorly aligned with semantic regions.In cluttered scenes, masks may include redundant structures and allocate perturbations suboptimally; object-level segmentation is suggested as a future direction.Source: F. Discussion on Limitations and… · p. 10
  • Small targets restrict the effective masked perturbation budget, while text/OCR and fine-grained reasoning may depend on details that phase-based structural priors do not capture.The passage suggests text-aware modeling and hybrid frequency–spatial representations as possible ways to address these limitations.Source: F. Discussion on Limitations and… · p. 10

G. Broader Applicability of Phase-aware Structural Modeling

  • Phase-aware structural priors may complement group-activity and compositional-action recognition by supplying geometric cues about object interactions and spatial configurations.The passage presents frequency-domain structural modeling as a broader visual representation principle, not only an adversarial strategy.Source: G. Broader Applicability of… · p. 11
  • Phase-guided localization could provide an interpretable basis for adaptive visual-token pruning and allocation in large vision-language models.The proposed masks identify structure-sensitive regions that the passage suggests could help preserve semantically important tokens while reducing computational overhead.Source: G. Broader Applicability of… · p. 11
  • Phase-aware representations may add structural consistency constraints to dense audio-visual event localization and other fine-grained cross-modal correspondence tasks.The passage frames this as a potential extension for improving multimodal correspondence under challenging scenarios.Source: G. Broader Applicability of… · p. 11
  • Phase-aware structural modeling may improve few-shot visual recognition by supporting transferable features relatively invariant to texture and illumination changes.The passage proposes incorporating phase information to improve feature transferability under limited supervision.Source: G. Broader Applicability of… · p. 11

VI. CONCLUSION

  • MLLMs rely heavily on phase spectra, and the proposed attack localizes perturbations to phase-dominant regions while using adversarial prompt learning; experiments demonstrate effectiveness and interpretability.The conclusion identifies phase spectra as encoding structural and semantic information and suggests future work on defense, detection, and robust training.Source: §VI · p. 11

Related papers

Loading 2609.00788v1…