Source-linked AI summary
Search-Based Testing of Modality Sensitivity in Vision Language Models
Oliver Weißl, Eduardo Breitembach, Andrea Stocco
TL;DR
Robustness evaluations often perturb modalities separately or use predefined corruption levels, offering limited evidence about modality-specific susceptibility and joint failure-inducing changes. MoST uses black-box search across image-only, text-only, and joint perturbations; four evaluated VLMs show distinct profiles, with joint perturbations sometimes matching or exceeding single-modality failure rates with smaller changes to each input.
Problem
Existing robustness evaluations commonly use predefined corruption levels or perturb individual modalities, limiting evidence about modality-specific susceptibility and perturbation requirements.
Source: §1 · p. 2Method
MoST is a black-box framework that searches image-only, text-only, and joint perturbations, adjusting their severity to degrade predictions while limiting input changes.
Source: §1 · p. 2Results
The evaluated VLMs show distinct modality-sensitivity profiles, and joint perturbations sometimes match or exceed single-modality failure rates with smaller changes to each input.
Source: §1 · p. 2Takeaways & Limitations
Aggregate robustness scores can obscure modality-specific weaknesses, while joint degradation can reveal failure-inducing configurations not apparent from evaluating each modality independently.
Source: §7 · p. 18The evaluation covers four open-source VLMs performing object localization on ImageNet-derived scene types and driving scenes, so observed profiles may not generalize to other datasets, tasks, proprietary models, or future architectures.
Source: §4.8 · p. 16
Abstract
from arXiv · showhide
Vision-language models (VLMs) process images and text jointly, yet robustness evaluations often perturb these inputs separately or assess only predefined corruption levels. Such evaluations provide limited evidence of which modality is more susceptible to perturbations and whether smaller changes across both modalities can jointly expose failures. We present MoST, a black-box testing framework that characterizes modality sensitivity by comparing image-only, text-only, and joint perturbations. MoST uses multi-objective search to select and combine perturbations and adjust their severity, seeking prediction degradation while limiting changes to images and prompts. We evaluate MoST on four VLMs performing object localization on ImageNet and driving images. The models exhibit distinct sensitivities: textual perturbations dominate for some, whereas others are susceptible across both modalities. In several configurations, joint perturbations match or exceed the effectiveness of single-modality perturbations with smaller modifications to each input. In a human study, 60-76% of assessments across models judge the perturbed inputs sufficiently understandable to perform the task, and human localization is more accurate than that of the corresponding VLMs. These results show that evaluating modalities separately can overlook failure-inducing combinations and that modality sensitivity provides a more detailed account of VLM robustness than aggregate failure rates alone.
1 Introduction
Robustness evaluations often use predefined corruption levels or perturb one modality at a time, limiting evidence about modality-specific susceptibility and perturbation requirements. MoST searches image-only, text-only, and joint perturbations; evaluations across four VLMs find distinct sensitivity profiles and cases where joint perturbations induce failures with smaller changes to each input.
1 Introduction
- Distinguishing visual, textual, and joint susceptibility can help developers identify input conditions needing additional testing and mitigation.Visual inputs can degrade through weather, sensor noise, motion blur, or compression; text can be affected by transcription or user errors.Source: §1 · pp. 1–2
- Existing evaluations commonly use predefined corruption levels or perturb individual modalities, while aggregate scores can conceal differences in failure-inducing perturbation requirements.Two models with similar failure rates may differ substantially in susceptibility to image and text modifications.Source: §1 · p. 2
- Modality sensitivity compares susceptibility to visual, textual, and joint degradation while considering both prediction degradation and the extent of perturbations.The required modifications to expose a failure may differ across models and inputs.Source: §1 · p. 2
- MoST searches image-only, text-only, and joint perturbations, adjusting severity to degrade predictions while limiting visual and textual changes.The black-box framework requires no access to model parameters or gradients.Source: §1 · p. 2
- The four evaluated VLMs show distinct modality-sensitivity profiles, and joint perturbations sometimes match or exceed single-modality failure rates with smaller changes to each input.Qwen is more susceptible to textual than visual perturbations; Kimi fails across all three regimes, while InternVL and Nemotron vary by scene type and failure criterion.Source: §1 · p. 2
- MoST’s evaluation covers four VLMs on ImageNet and driving images, examining failure rates, localization degradation, perturbation requirements, computational cost, and human-rated interpretability.A human study further compares interpretability judgments with localization accuracy by the corresponding VLMs.Source: §1 · p. 2
2 Background
The background defines modality sensitivity as susceptibility to visual, textual, and joint degradation, assessed by prediction loss and perturbation effort. Modality-sensitivity testing compares these regimes because aggregate robustness scores may hide different model-specific weaknesses, and the large search space makes exhaustive evaluation infeasible.
2.1 Modality Sensitivity in Vision-Language Models
- Vision-language models combine visual and textual inputs, so degradation in either or both modalities can affect predictions differently.The inputs are complementary sources processed through cross-modal fusion.Source: §2.1 · pp. 2–3
- Modality sensitivity assesses relative prediction degradation and perturbation effort across image-only, text-only, and joint input perturbations.The three cases distinguish visual sensitivity, textual sensitivity, and cross-modal sensitivity, where joint perturbations reveal failures not equivalently exposed by either single-modality regime.Source: §2.1 · p. 3
2.2 Modality Sensitivity Testing
- Aggregate robustness scores may conceal different modality-sensitivity profiles in models performing the same task.The background motivates comparing modalities to distinguish these profiles.Source: §2.2 · p. 3
- Modality-sensitivity testing compares failure rates, degradation severity, and perturbation requirements across visual, textual, and joint regimes rather than producing one robustness score.This comparison provides model-specific weakness information unavailable from unimodal robustness measurements alone.Source: §2.2 · p. 3
- Exhaustive evaluation becomes infeasible because image perturbations, text perturbations, and their continuous severity combinations form a large joint search space.This motivates the search-based methodology.Source: §2.2 · p. 3
3 Methodology
MoST characterizes VLM modality sensitivity by searching for failure-inducing image-only, text-only, and joint perturbations while limiting changes to the inputs. Its workflow combines controlled perturbations, competing degradation and fidelity objectives, and search across perturbation combinations and severities.
3 Methodology
- MoST compares failures under image-only, text-only, and joint perturbations to characterize a VLM’s susceptibility to each modality and their interaction.The workflow evaluates perturbed inputs and searches for failure-inducing test cases.Source: §3 · pp. 3–4
3.1 System Under Test
- The system under test is a VLM that jointly processes an image and task prompt to produce textual output.For this evaluation, the prompt requests structured object-localization results.Source: §3.1 · p. 4
3.2 Manipulator
- The manipulator applies perturbations to the image, prompt, or both, parameterized by a strategy that can represent no change or progressively stronger modifications.The strategy vector initializes near zero, allowing gradual adaptation during optimization.Source: §3.2 · p. 4
3.2.1 Image-based component.
- Visual transformations cover degradations such as compression, blur, noise, hue shifts, geometric distortions, and environmental overlays, with continuous severity parameters.Severity ranges from 0 to 1 and controls transformation-specific properties.Source: §3.2.1 · pp. 4–5
3.2.2 Textual component.
- Text perturbations alter orthography, semantics, or instruction context, with severity controlling how frequently and strongly tokens are modified.The severity parameter maps to a token-modification probability of P = 0.1 + 0.8S.Source: §3.2.2 · p. 5
3.3 Objectives
- The search balances prediction degradation against visual realism and semantic consistency using three competing objectives.Image fidelity is measured by normalized Frobenius distance, while prompt semantic deviation uses cosine distance between text embeddings.Source: §3.3 · pp. 5–6
3.3.1 Early stopping.
- Search stops when a candidate meets all degradation and fidelity thresholds, yielding a Pareto-optimal failure-inducing test case.The stopping rule is intended to reduce computational cost.Source: §3.3.1 · p. 6
3.4 Optimizer
- The optimizer jointly parameterizes perturbation severities and composes transformations, enabling it to explore interactions between perturbation types.It searches separately under image-only, text-only, and joint regimes to produce complementary test cases for a modality-sensitivity profile.Source: §3.4 · pp. 6–7
4 Empirical Study
The empirical study examines MoST’s effectiveness, efficiency, validity, and modality-sensitivity profiles. It evaluates four VLMs on ImageNet-based and driving-scene object localization, while excluding two preliminary models from certain analyses because of high baseline failure rates.
4.1 Research Questions
- Effectiveness is assessed by whether MoST generates failure-inducing cases under image-only, text-only, and joint perturbations, considering degradation and input changes.Source: §4.1 · p. 7
- Efficiency is assessed through search effort, runtime, and the perturbation budgets used by each regime.Source: §4.1 · p. 7
- Validity is assessed by whether human evaluators can localize objects in perturbed inputs and how their accuracy compares with the corresponding VLMs.Source: §4.1 · p. 7
- Modality sensitivity is compared across models and regimes using attack success, localization degradation, and perturbation requirements.Source: §4.1 · p. 7
4.2 Objects of Study
- The final analysis evaluates four VLMs on bounding-box detection using ILSVRC 2012 validation images and Udacity driving scenes.The models are Qwen3-VL-4B-Instruct, Kimi-VL-A3B-Instruct, Nemotron3 Nano Omni-30B, and InternVL3.5-8B.Source: §4.2 · p. 7
- Gemma-3-4B-IT and DeepSeek-VL2-Tiny were excluded from certain analyses because baseline failure rates of at least 0.95 left too few baseline-valid inputs.Experiments used one NVIDIA L40S GPU with 48 GB of VRAM.Source: §4.2 · p. 7
4.3 Metrics and Measurements
The section measures attack effectiveness, perturbation magnitude, efficiency, validity, and modality sensitivity. It also introduces SWTD to compare task degradation and perturbation unobtrusiveness across single- and joint-modality tests.
4.3.1 Effectiveness Metrics (RQ1).
- Attack success rate (ASR) measures the share of evaluated test cases meeting a selected failure criterion at threshold τ.The reported criteria become increasingly permissive: bounding-box degradation; degradation or empty output; and additionally malformed output.Source: §4.3.1 · p. 8
- Image perturbation magnitude is measured with MS-SSIM and text perturbation magnitude with normalized edit distance (NED).Higher MS-SSIM and lower NED indicate smaller modifications; both are reported as mean ± standard deviation over runs terminated with bounding boxes.Source: §4.3.1 · p. 8
- SWTD combines task degradation with normalized perturbation aggressiveness, enabling image-only, text-only, and joint test cases to be ranked on one scale.Regimes are paired by seed and compared using exact McNemar tests for ASR and Wilcoxon signed-rank tests for MS-SSIM, NED, and SWTD, with Holm correction per metric.Source: §4.3.1 · p. 8
4.3.2 Efficiency Metrics (RQ2).
- Efficiency measurements include final image and text perturbation budgets, their sum, SUT evaluations, and end-to-end runtime.Runtime includes perturbation generation and SUT inference; each SUT evaluation is one candidate test case.Source: §4.3.2 · pp. 8–9
4.3.3 Validity Metrics (RQ3).
- Validity is assessed by whether people can understand perturbed images and prompts well enough to localize objects, with human IoU compared against VLM IoU on the same accepted cases.Inter-rater agreement uses Randolph’s free-marginal multi-rater κ for boxes drawn versus task rejected.Source: §4.3.3 · p. 9
4.3.4 Modality-sensitivity Metrics (RQ4).
- Modality sensitivity reflects whether high attack success and large IoU reductions require comparatively small perturbation budgets within each modality.Image and text budgets are interpreted within their respective perturbation spaces, not as directly equivalent values; SWTD provides a complementary single-score view.Source: §4.3.4 · p. 9
4.4 Optimizer Configuration
The study configures a bounded multi-objective search and prepares annotated image sets, label substitutions, and run-outcome criteria. Baseline filtering and a model-retention rule determine which generated cases enter downstream analyses.
4.4 Optimizer Configuration
- NSGA-II uses a population of 50 and up to 100 generations with total perturbation budget B = 1 shared across active modalities.Search can stop early when the IoU, normalized Frobenius image-distance, and cosine embedding-distance objectives meet their specified thresholds; the returned case is Pareto-optimal.Source: §4.4 · p. 9
- The nominal design includes 4 retained VLMs, 4 scene types, 3 regimes, and 100 seed images per scene type, totaling 4,800 optimization runs before filtering.Without early termination, each run evaluates up to 5,050 candidate solutions.Source: §4.4 · p. 9
4.5 Data Preprocessing
- ImageNet-1K detection validation images and Udacity driving images form the study corpus.ImageNet images are stratified into three scene types, with 100 sampled per stratum; another 100 driving scenes are sampled, and all use annotated bounding boxes and the same structured prompt template.Source: §4.5 · p. 9, §4.5.1 · p. 9
4.5.1 Image selection.
- Optimization retains an image for a target VLM only when its unperturbed prediction has IoU of at least 0.5 against ground truth.This eligibility decision is made separately for each VLM.Source: §4.5.1 · p. 10
4.5.2 Semantic corruption pre-computation.
- Per-label homophone and synonym substitution tables are generated by gpt-oss:120b, cached, and reused by the corresponding text-corruption operators.The tables cover unique class-label strings from the selected images.Source: §4.5.2 · p. 10
4.5.3 Generation Outcomes and Model Retention.
- Runs are classified by baseline failure, valid-box termination, malformed JSON, or no objects found; models are retained if at least 5% of runs terminate with valid boxes.InternVL, Kimi, Nemotron, and Qwen meet the rule, and RQ1/RQ2 analyses use the resulting IoU-degraded cases; Fig. 3 presents the outcome distributions.Source: §4.5.3 · p. 10, Figure 3 · p. 10
4.6 Human Study Setup
The human study samples generated cases across models, scene types, and perturbation regimes. Participants inspect the exact perturbed image and prompt, then draw boxes or reject tasks they cannot understand.
4.6 Human Study Setup
- Three stratified human-evaluation subsets each contain 48 generated cases, with 12 per VLM and three per scene type—one per perturbation regime—plus two attention checks.At least 20 valid MTurk HITs were collected per subset, yielding 62 accepted HITs and 2,976 assessments overall.Source: §4.6 · p. 10
- For each task, participants see the perturbed image and exact VLM prompt, then draw zero or more boxes or reject the task for image or prompt clarity or another reason.Rejections are included as an available response rather than forcing a localization judgment.Source: §4.6 · p. 10
4.7 Results
Across effectiveness, efficiency, validity, and modality-sensitivity analyses, MoST reveals model- and regime-dependent behavior. Joint perturbations often match or exceed single-modality effectiveness while distributing changes across both inputs, and most human assessments find the cases interpretable.
4.7.1 Effectiveness (RQ1).
- Joint manipulation matches text-only attack success while requiring significantly smaller text edits in 12 of 16 configurations, and it is never significantly worse in SWTD.Prompt-only or joint manipulation significantly outperforms image-only for Qwen and, under a permissive criterion, Nemotron; Kimi frequently produces malformed outputs.Source: Table 3 · p. 11, §4.7.1 · p. 12
4.7.2 Efficiency (RQ2).
- Image-only search is the most expensive regime, while text-only and joint search use comparable evaluation counts and text-only is usually fastest in wall-clock time.Joint search significantly reduces text budgets versus text-only in 13 of 16 configurations, but its aggregate budget is not consistently lower; Kimi shows no consistently cheaper regime.Source: §4.7.2 · pp. 12–13, Table 4 · p. 13
4.7.3 Validity (RQ3).
- Human assessments accepted 60.2%–75.9% of cases, and humans localized objects more accurately than the corresponding VLMs even under the conservative Human* measure.Inter-rater agreement was only slight to fair (Randolph’s κ=0.2 overall).Source: Figure 5 · p. 13, §4.7.3 · p. 14
4.7.4 Modality Sensitivity (RQ4).
- The evaluated VLMs show distinct modality-sensitivity profiles: Qwen is most text-susceptible, Kimi is broadly susceptible, and InternVL and Nemotron have more mixed patterns.Budget-allocation patterns also differ: Qwen’s strongest reductions occur mainly at low image and moderate-to-high text budgets, while Kimi shows strong reductions at low allocations in both modalities.Source: §4.7.4 · pp. 14–15, Figure 6 · p. 15, Figure 7 · p. 15
- Joint perturbations reveal failure-inducing configurations that unimodal evaluation alone does not fully characterize.In several model–scene configurations, joint perturbations achieve attack success comparable to or higher than the strongest unimodal regime while distributing modifications across both modalities.Source: §4.7.4 · p. 15
4.8 Threats to Validity
The reported validity and modality-sensitivity profiles are bounded by the study’s measurement choices, search configuration, eligible subsets, and evaluation scope.
Construct Validity
- Profiles describe susceptibility under the evaluated conditions, not how models internally combine visual and textual information; other perturbation families or severity settings may yield different patterns.Source: §4.8 · pp. 15–16
Internal Validity
- Fidelity measures approximate rather than guarantee semantic preservation, and equal SWTD weights or a shared search configuration may affect comparisons across regimes and models.Baseline filtering and valid-box-only analyses also create eligible subsets that may differ in difficulty and exclude empty or malformed outputs.Source: §4.8 · p. 16
External Validity
- The evaluation covers four open-source VLMs performing object localization on ImageNet-derived and driving scenes, so profiles may not generalize to other tasks, datasets, models, or architectures.The human study samples generated inputs rather than establishing interpretability across the complete test set, and judgments remain subjective.Source: §4.8 · p. 16
5 Discussion
The discussion frames modality-sensitivity profiles as complements to aggregate robustness and relates them to testing priorities, while cautioning that architectural explanations remain unestablished.
5 Discussion
- Qwen shows pronounced textual susceptibility, Kimi fails across all regimes, and InternVL and Nemotron vary across modalities and scenes; these behavioral profiles do not establish internal modality reliance.InternVL3.5-8B and Qwen3-VL differ in textual susceptibility despite sharing language-model lineage and tokenizer; controlled study is needed to explain the difference.Source: §5 · p. 16
- Kimi and Nemotron’s MoE backbones motivate hypotheses about routing or specialization, but the small, heterogeneous model set cannot support an MoE-specific conclusion.Controlled comparisons and analysis of representations, routing decisions, and expert activations are needed to assess the hypothesis.Source: §5 · pp. 16–17
- Joint perturbations match or exceed single-modality failure rates in several configurations with smaller changes to each input, motivating evaluation of all three regimes and perturbation magnitude.Profiles can guide prompt-corruption, image-degradation, and joint tests.Source: §5 · p. 17
- Kimi’s high failure rates frequently reflect malformed structured outputs, while other configurations primarily show localization degradation or empty responses.Reporting these categories separately can support more targeted debugging and mitigation.Source: §5 · p. 17
- Most human-study assessments judged sampled inputs sufficiently clear, and mean human localization accuracy exceeded that of corresponding VLMs, though limited assessor agreement constrains validity.Gemma-3-4B-IT and DeepSeek-VL2-Tiny had high baseline failure rates under the evaluation protocol, limiting their subsequent analysis.Source: §5 · p. 17
- Model-specific prompts, output parsing, and coordinate conventions complicate comparative VLM evaluation; standardized interfaces and documented requirements could improve reproducibility.The evaluated models used differing pixel and normalized coordinate representations.Source: §5 · p. 17
6 Related Work
Related work covers uni-modal testing, multi-modal robustness evaluation, and the distinct question of how failure susceptibility and perturbation effort vary across modalities.
6.1 Testing Methods for Uni-modal DL Systems
- Uni-modal testing spans structured or generative input generation and robustness perturbations, but does not characterize how failures depend on the relative contribution of multiple modalities.Methods include metamorphic transformations, white- and black-box perturbations, and generative approaches.Source: §6.1 · pp. 17–18
6.2 Testing Methods for Multi-modal DL Systems
- Multi-modal benchmarks and generative methods broaden test diversity, while robustness studies examine corruptions, adversarial attacks, prompt injection, and output behavior, often emphasizing aggregate performance or whether models fail.Some prior work reports larger degradation from jointly corrupting modalities, while evaluations commonly use predefined levels or modality-specific perturbations.Source: §6.2 · p. 18
- MoST complements these evaluations by continuously searching image-only, text-only, and joint perturbation severities and profiling effectiveness, degradation, and modality-specific perturbation requirements.The resulting profile is summarized through SWTD and distinguishes model-specific visual, textual, and joint vulnerabilities.Source: §6.2 · p. 18
7 Conclusion
The conclusion presents MoST as a way to profile VLM susceptibility under visual, textual, and joint degradation. The findings motivate complementary modality-sensitivity evaluation and further study of richer perturbations and model mechanisms.
7 Conclusion
- MoST systematically explores visual, textual, and joint input degradation to generate failure-inducing cases and characterize model-specific modality-sensitivity profiles.The work presents the framework as a search-based approach for testing VLMs.Source: §7 · p. 18
- Aggregate robustness scores can obscure modality-specific susceptibility and perturbation effort, while joint degradation reveals failure-inducing configurations not apparent from either modality alone.Human evaluation indicates that many generated inputs remain interpretable despite inducing VLM failures.Source: §7 · p. 18
- Future work includes richer generative image and text manipulations and controlled white-box studies of architectural and training factors behind the observed profiles.The paper specifically motivates investigation of multimodal integration, grounding adaptation, MoE routing, and expert specialization.Source: §7 · pp. 18–19
Data Availability
- The authors provide code, human survey artifacts, and evaluation scripts in a replication package.The package is linked in the paper.Source: Data Availability · p. 19