ChimeraBreak: Tri-Modal Adversarial Attack

• ChimeraBreak is a tri-modal adversarial strategy that uses aligned textual prompts to manipulate multimodal safety judgments in short-form video moderation.
• It targets visual, auditory, and semantic reasoning pathways to achieve high attack success rates, with empirical tests showing over 90% misclassification in many models.
• The framework highlights vulnerabilities in cross-modal fusion and challenges existing approaches to content moderation by inducing coherent but misleading narrative flips.

Searching arXiv for ChimeraBreak and related multimodal adversarial attack work. ChimeraBreak is a coordinated tri-modal adversarial attack strategy for short-form video content moderation that targets the visual, auditory, and semantic reasoning pathways of Multimodal LLMs (MLLMs) using aligned textual prompts rather than pixel- or waveform-level perturbations. It was introduced together with the Short-Video Multimodal Adversarial (SVMA) dataset as a framework for evaluating cross-modal safety robustness in short-form video moderation, with the central objective of inducing semantically plausible but misleading interpretations that produce incorrect binary appropriateness judgments on unmodified videos (Mustakim et al., 16 Jul 2025).

1. Definition and Scope

ChimeraBreak is designed for the content appropriateness evaluation setting in which an input sample is represented as $c_i=(v_i,a_i,t_i)$, where $v_i$ denotes video frames, $a_i$ the audio track, and $t_i$ any overlay text, and an MLLM produces both a rationale $R'_i$ and a binary safety label $y'_i \in \{0,1\}$ (Mustakim et al., 16 Jul 2025). Its adversarial input is the tri-modal tuple $adv_i=(adv^v_i,adv^a_i,adv^p_i)$, with separate prompt components targeting visual interpretation, audio interpretation, and high-level perception or policy reasoning (Mustakim et al., 16 Jul 2025).

The attack is explicitly black-box. It assumes API- or inference-level access to open- or closed-source MLLMs, but no model weights, gradients, or safety-filter internals. It is also constrained to single-turn, non-interactive prompting per stage, with a two-stage pipeline rather than an iterative dialogue or reinforcement loop (Mustakim et al., 16 Jul 2025). A defining property is that the original video and audio streams are left unmodified; the perturbation surface is textual and cross-modal rather than signal-level (Mustakim et al., 16 Jul 2025).

This placement differentiates ChimeraBreak from gradient-based or norm-bounded adversarial paradigms. The paper states that ChimeraBreak does not perform gradient-based optimization or $p/q$-norm-bounded perturbations on $v$ or $a$, and instead attempts to defeat cross-modal grounding and safety alignment through coherent, context-preserving, but narrative-flipping descriptions (Mustakim et al., 16 Jul 2025).

2. Threat Model and Adversarial Objective

The threat model assumes that an attacker can construct modality-aligned textual prompts for a given short video. Specifically, $v_i$0 targets visual interpretation through frame-level descriptions, $v_i$1 targets audio interpretation via transcript- and description-level manipulation, and $v_i$2 targets cross-modal narrative and policy interpretation (Mustakim et al., 16 Jul 2025). Access remains black-box, and the query budget is fixed to one query for rationale elicitation and a second query for forced binary decision making (Mustakim et al., 16 Jul 2025).

The adversarial objective is formally given as eliciting $v_i$3 such that $v_i$4 deviates semantically from the true interpretation of $v_i$5 and $v_i$6, without altering $v_i$7 (Mustakim et al., 16 Jul 2025). The two-step inference pattern is summarized in the paper as

$v_i$8

Attack success is measured by the Attack Success Rate (ASR),

$v_i$9

where $a_i$0 is the number of evaluated samples (Mustakim et al., 16 Jul 2025).

A central motivation for the tri-modal setting is the claim that unimodal attacks underperform in short-form moderation because robust models can cross-check contradictions in one modality against the others. ChimeraBreak therefore seeks a coordinated “narrative flip” across video, audio, and perception-level prompts so that the model’s multimodal fusion process supports a coherent but false interpretation rather than rejecting a direct contradiction (Mustakim et al., 16 Jul 2025). This suggests that the framework is primarily a test of cross-modal grounding failure rather than of low-level perceptual brittleness.

3. Two-Stage Attack Pipeline

ChimeraBreak uses a two-stage pipeline in which rationale generation and final classification are decoupled. In Stage 1, the model is primed to identify meanings and hidden implications from the provided frames and audio representations, warned that “internet content can be misleading,” and then presented with tri-modal adversarial prompts $a_i$1 before being instructed to produce a definitive rationale $a_i$2 (Mustakim et al., 16 Jul 2025). In Stage 2, the model is re-prompted using $a_i$3 only, with no frames or audio, to predict $a_i$4 (Mustakim et al., 16 Jul 2025).

The paper argues that this decoupling reduces cognitive overload and inconsistencies between reasoning and final judgment, and that it amplifies label-flip success (Mustakim et al., 16 Jul 2025). Within the attack itself, the visual and audio manipulations are scene-wise, whereas the perception-level manipulation remains holistic. This division reflects an empirical design choice: rapid scene changes and modality switches hindered holistic misdirection, while scene-segregated prompts improved fine-grained control over local reinterpretation (Mustakim et al., 16 Jul 2025).

Three prompt classes define the attack mechanics. Video prompts provide scene-wise, contextually aligned descriptions that reframe visual events; audio prompts reinterpret speech content, intent, sarcasm, or background tone using transcript-aligned manipulations; perception prompts perform a holistic reinterpretation of the video’s intent and policy relevance, aiming to flip the moral or ethical reading without contradicting raw facts (Mustakim et al., 16 Jul 2025). The paper reports that direct contradictions such as denying the presence of an object often failed because models identified conflicts with observed frames or audio, whereas narrative flipping while preserving factual elements was markedly more effective (Mustakim et al., 16 Jul 2025).

The framework also fixes concrete operational constraints. It uses five uniformly sampled keyframes per video because of LLaMA-4 frame limits, incorporates audio both as transcription and as high-level description, and bounds prompt lengths by model context, with mean lengths of 660.64 characters for video prompts, 680.75 for audio prompts, and 618.14 for perception prompts (Mustakim et al., 16 Jul 2025).

4. SVMA Dataset and Experimental Configuration

ChimeraBreak was introduced together with the SVMA dataset, a 1,009-video benchmark whose dataset structure is

$a_i$5

where $a_i$6 is content, $a_i$7 is a video description, $a_i$8 is audio description and transcription, $a_i$9 is a perception description, $t_i$0 is a ground-truth rationale, $t_i$1 are adversarial prompts, $t_i$2, and $t_i$3 (Mustakim et al., 16 Jul 2025).

The videos are sourced from YouTube Shorts via APIs and span roughly 10–90 seconds. The dataset includes diverse cultural and thematic content, including satire, social commentary, storytelling, and synthetic misinformation (Mustakim et al., 16 Jul 2025). Labels were assigned by four human annotators, with disagreements resolved by majority vote and Fleiss’ Kappa reported as 0.911; the label distribution is 54.9% inappropriate and 45.1% appropriate (Mustakim et al., 16 Jul 2025).

Adversarial prompts were generated using Gemini 2.5-Flash with safety filters disabled and then refined by the authors for potency and precision under context limits (Mustakim et al., 16 Jul 2025). The paper also notes a semantic separation between original descriptions and attack prompts using BERT embedding t-SNE (Mustakim et al., 16 Jul 2025). This suggests that the prompts are not merely paraphrases of source annotations but are constructed to occupy a distinct semantic region corresponding to adversarial reinterpretation.

Evaluation covered both baseline and larger model variants. The baseline set consisted of GPT-4o mini, LLaMA-4 Scout, Qwen2.5-VL 3B, Gemma 3 4B, and LLaVA 7B; larger or more complex variants included GPT-4.1 mini, LLaMA-4 Maverick, Qwen2.5-VL 7B, Gemma 3 12B, and LLaVA 13B (Mustakim et al., 16 Jul 2025). Gemini was excluded because it was used in dataset generation (Mustakim et al., 16 Jul 2025). Inference was run in Kaggle using Groq API for LLaMA-4, Ollama for Qwen, LLaVA, and Gemma, on a single NVIDIA P100 with deterministic decoding parameters $t_i$4, $t_i$5, and $t_i$6 (Mustakim et al., 16 Jul 2025).

5. Empirical Performance and Failure Modes

The paper reports overall tri-modal ASR above 90% for most baseline models. Specifically, the overall tri-modal ASR values are 95.30% for Gemma 3 4B, 94.15% for LLaMA-4 Scout, 92.37% for Qwen2.5-VL 3B, 90.79% for GPT-4o mini, and 88.51% for LLaVA 7B, which is identified as the most resistant among the baselines (Mustakim et al., 16 Jul 2025). Among larger variants, Qwen2.5-VL 7B is reported as the most resistant overall at 77.03%, while GPT-4.1 mini reaches 89.89%, LLaMA-4 Maverick 93.47%, Gemma 3 12B 95.04%, and LLaVA 13B 93.46% (Mustakim et al., 16 Jul 2025).

Unimodal attack baselines are substantially weaker or at least less consistently effective. The reported ASR ranges are 45.98–98.59% for video-only, 21.25–85.31% for audio-only, and 48.75–98.39% for perception-only attacks, while tri-modal attacks consistently exceed unimodal variants across most models (Mustakim et al., 16 Jul 2025). The paper interprets this as evidence of vulnerabilities in shared embeddings and cross-modal attention fusion, where a coordinated adversarial narrative can implant a consistent false story that survives modality cross-checking (Mustakim et al., 16 Jul 2025).

The study also reports content-type-specific asymmetries. GPT-4o mini shows 98.02% ASR on positive or appropriate content versus 84.74% on negative or inappropriate content, and the Qwen2.5-VL series exhibits a similar bias toward misclassifying benign content as harmful, with Qwen2.5-VL 3B at 99.56% versus 86.44% and Qwen2.5-VL 7B at 98.90% versus 59.10% (Mustakim et al., 16 Jul 2025). By contrast, GPT-4.1 mini and Gemma 3 12B are reported as biased toward accepting harmful content as appropriate, with GPT-4.1 mini at 81.10% on positive content versus 97.11% on negative content and Gemma 3 12B at 91.21% versus 98.19% (Mustakim et al., 16 Jul 2025). These results indicate that ChimeraBreak does not induce a single generic failure mode; rather, it exposes differing safety calibration tendencies such as over-caution and under-caution.

Agreement statistics reinforce the claim of attack universality. Overall Fleiss’ Kappa across models is 0.717, with 0.770 for smaller baseline models and 0.630 for larger or more complex variants (Mustakim et al., 16 Jul 2025). A plausible implication is that different architectures frequently fail on the same samples, even when their robustness levels differ.

6. Reasoning Quality, Evaluation Methodology, and Interpretive Significance

The evaluation includes an LLM-as-a-judge protocol using Mistral 7B as the judge model (Mustakim et al., 16 Jul 2025). Ethical reasoning is scored using four rubric dimensions, each on a 0–3 scale: Harm Recognition (D1), Contextual Sensitivity (D2), Precautionary Approach (D3), and Vulnerable Population Awareness (D4). Two additional diagnostics are reported: a hallucination-resistance metric from 0 to 1 measuring alignment between reasoning and label, and a confidence rating from 1 to 3 measuring judged tone and certainty (Mustakim et al., 16 Jul 2025).

The hallucination factor is extremely high for most baseline models under attack: GPT-4o mini 1.00, LLaMA-4 Scout 1.00, Gemma 3 4B 1.00, Qwen2.5-VL 3B 0.99, and LLaVA 7B 0.97 (Mustakim et al., 16 Jul 2025). Confidence is likewise near maximal, with GPT-4o mini at 2.98, LLaMA-4 Scout 3.00, Gemma 3 4B 3.00, Qwen2.5-VL 3B 2.94, and LLaVA 7B 2.92 (Mustakim et al., 16 Jul 2025). These results matter because they show that attack success is not primarily driven by visibly incoherent or low-confidence rationales. Instead, the induced rationales are internally consistent enough that the final classification aligns with them, which is exactly the behavior the two-stage design is meant to exploit.

Ethical reasoning degrades under attack. LLaVA 7B preserves the highest total ethical score at 6.78, with $t_i$7, $t_i$8, $t_i$9, and $R'_i$0, while LLaMA-4 Scout records the lowest total at 3.31, with $R'_i$1, $R'_i$2, $R'_i$3, and $R'_i$4 (Mustakim et al., 16 Jul 2025). The paper highlights a universal weakness in D4, Vulnerable Population Awareness, under adversarial narratives (Mustakim et al., 16 Jul 2025). This suggests that tri-modal attacks compromise not only coarse label prediction but also higher-order normative sensitivity.

The explanation offered for ChimeraBreak’s effectiveness centers on three factors: attention fusion vulnerabilities in shared multimodal embedding spaces, safety filter gaps that focus on contradiction detection rather than narrative reinterpretation, and synchronization effects whereby scene-wise visual and audio control plus holistic perception-level framing defeat robustness to rapid scene changes (Mustakim et al., 16 Jul 2025). Within this framing, ChimeraBreak is best understood as a structured attack on multimodal interpretive coherence.

7. Defenses, Limitations, and Position in the Research Landscape

The paper does not present empirical defense evaluations, but it identifies several mitigation directions. These include training with tri-modal adversarial data, improved cross-modal consistency checks, explicit audio-visual-text sanity checks that verify whether perception-level rationales reflect factual multimodal evidence, temporal robustness mechanisms that assess scene-by-scene reasoning alignment, and perceptual constraints that challenge narrative claims with evidence-seeking steps even when streams are unmodified (Mustakim et al., 16 Jul 2025). The core claim is that unimodal safety evaluations are insufficient for short-video moderation and that robustness requires tri-modal safety alignment (Mustakim et al., 16 Jul 2025).

Several limitations are also stated. SVMA content is sourced solely from YouTube via API because of regional access constraints, which may introduce content bias (Mustakim et al., 16 Jul 2025). The framework relies on MLLMs and on LLM-as-a-judge evaluation, and both are susceptible to hallucination and subjective judgments, although the paper argues that the two-step decoupling and hallucination-factor measurement partially mitigate these issues (Mustakim et al., 16 Jul 2025).

In the broader adversarial-robustness literature, ChimeraBreak occupies a distinct niche as a prompt-based attack on multimodal moderation rather than a vision-only perturbation attack or a text-only jailbreak. Its contribution is to demonstrate that unmodified short videos can be systematically misclassified when their visual, auditory, and interpretive channels are jointly reframed through carefully coordinated prompts (Mustakim et al., 16 Jul 2025). This suggests that moderation systems relying on MLLMs must be evaluated not only for perceptual fidelity but also for resistance to adversarial semantic coupling across modalities.