Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model

Abstract: Large Vision-LLMs (LVLMs) rely on vision encoders and LLMs to exhibit remarkable capabilities on various multi-modal tasks in the joint space of vision and language. However, typographic attacks, which disrupt Vision-LLMs (VLMs) such as Contrastive Language-Image Pretraining (CLIP), have also been expected to be a security threat to LVLMs. Firstly, we verify typographic attacks on current well-known commercial and open-source LVLMs and uncover the widespread existence of this threat. Secondly, to better assess this vulnerability, we propose the most comprehensive and largest-scale Typographic Dataset to date. The Typographic Dataset not only considers the evaluation of typographic attacks under various multi-modal tasks but also evaluates the effects of typographic attacks, influenced by texts generated with diverse factors. Based on the evaluation results, we investigate the causes why typographic attacks impacting VLMs and LVLMs, leading to three highly insightful discoveries. During the process of further validating the rationality of our discoveries, we can reduce the performance degradation caused by typographic attacks from 42.07\% to 13.90\%. Code and Dataset are available in \href{https://github.com/ChaduCheng/TypoDeceptions}

• The paper demonstrates that typographic modifications divert LVLM attention, leading to nearly a 30% reduction in model accuracy.
• It introduces the TypoD dataset, which evaluates typographic vulnerabilities across key multimodal tasks like object recognition and commonsense reasoning.
• Enhanced prompt design is shown to mitigate typographic attacks by refocusing model attention on genuine image content.

Unveiling Typographic Vulnerabilities in LVLMs

The paper "Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-LLMs" (arXiv ID: (2402.19150)) examines the susceptibility of Large Vision-LLMs (LVLMs) to typographic attacks. These attacks use typographic modifications within images to mislead models that integrate vision and language processing capabilities. The authors propose a comprehensive dataset to evaluate the extent of this vulnerability, providing insights into why LVLMs are affected by such attacks.

Typographic Attacks on LVLMs

Typographic attacks exploit the integration of LLMs and vision encoders in systems like CLIP and LLaVA, which are foundational to many LVLMs. The research demonstrates that typographic modifications can significantly redirect attention within these models, leading to incorrect inferences.

Figure 1: Typographic attacks on GPT-4V, Google Bard, LLaVA-v1.5, and MiniGPT-4.

The authors tested various LVLMs, including both commercial and open-source systems, confirming the widespread vulnerability to typographic interventions, which can degrade model accuracy by nearly 30%.

The Typographic Dataset

To quantify this threat, the authors introduce the Typographic Dataset (TypoD), devised to test LVLMs across four multi-modal tasks: object recognition, visual attribute detection, enumeration, and commonsense reasoning. TypoD spans various scales and typographic factors such as font size, color, and placement within images, providing an extensive evaluation platform.

Figure 2: Distractibility of LVLMs by typographic attacks in multi-modal tasks.

This dataset ascertains the extent to which typographic errors can divert attention in LVLMs, thus offering a foundation for understanding and mitigating such vulnerabilities.

Discoveries and Observations

The core discoveries from the research highlight the impact of typographic text on LVLM model attention:

1. Attention Diversion: Typographic text diverts model attention away from original visual content, a phenomenon corroborated by Grad-CAM visualizations revealing focal shifts toward typographic amendments.
2. Vulnerabilities Consistency: Models using the same vision architectures, such as CLIP, are similarly susceptible to typographic attacks, regardless of the underlying LLM used.

   Figure 3: The illustration of different typographic factors.

3. Impact of Prompt Design: Informative prompts can improve LVLM resilience against typographic attacks by guiding model focus towards genuine image content rather than the misleading text.

Conducting experiments with LLaVA and InstructBLIP, the results reveal that typographic effects can be mitigated if the models receive enriched prompts with detailed descriptive content of the target images.

Mitigation Strategies

To counter typographic vulnerabilities, the authors suggest leveraging enhanced prompts in both training and inference stages. By providing richer textual context that compels models to cross-reference visual data beyond primary image-text alignment, LVLMs achieve a substantive reduction in attention diversion due to typographic amendments.

Figure 4: (a) CLIP zero-shot classification results and LLaVA's response of a typographic image. (b) Grad-CAM of CLIP with various image-matching texts.

Conclusion

The study clarifies that typographic attacks constitute a formidable challenge to LVLMs, with substantial threats demonstrated across leading models. By introducing TypoD and highlighting effective countermeasures involving prompt enhancement and attention-redirection techniques, this research directs future focus towards reinforcing LVLM robustness against such perceptual adversarial attacks. Practical deployment of these models should integrate these insights to mitigate potential real-world exploitation.