22.4.4 Cross-modal exploits

Moving beyond attacks on individual modalities, cross-modal exploits represent a more sophisticated threat vector targeting the fusion points within a multimodal system. These attacks leverage a vulnerability in one modality to corrupt the system’s interpretation of another, often leading to unexpected and complete system failure. Your role as a red teamer is to identify and exploit these seams where different data streams converge.

A multimodal system’s strength—its ability to synthesize information from diverse sources—is also its Achilles’ heel. An attacker doesn’t need to compromise every input channel. Instead, they can inject a carefully crafted adversarial signal into one modality (e.g., audio) to poison the model’s final, integrated perception (e.g., its understanding of a video).

Attack Vector 1: Cross-Modal Data Poisoning

This is a training-time attack where you corrupt the fundamental associations a model learns between modalities. By injecting seemingly benign but maliciously paired data into the training set, you can create hidden backdoors or systemic biases that are extremely difficult to detect post-deployment.

Imagine a dataset for training a visual question-answering (VQA) system. The goal is to poison the model to respond with a malicious payload whenever it sees a specific, innocuous object in an image, regardless of the actual question asked.

The poisoned model now contains a latent vulnerability. During inference, if the model is shown any image containing a traffic light, it will be heavily biased to output “Access granted,” ignoring the actual text query. This is a powerful attack because the trigger (traffic light) and payload (“Access granted”) have no logical connection, making it non-obvious during standard testing.

Attack Vector 2: Typographic Attacks on Vision Models

This is a fascinating inference-time attack that exploits the tight coupling between vision and language understanding in models like CLIP. By rendering text directly onto an image, you can force the model to misclassify the image content entirely. The model’s text-processing capability overrides its visual analysis.

Consider a model tasked with identifying objects. You present it with a clear photo of a golden retriever. Normally, it would classify it correctly. However, if you overlay the word “ostrich” on the image, the model’s output can be skewed towards the text it reads, ignoring the visual evidence.

Execution Steps

1. Identify Target Model: This works best on models with strong text-image feature space alignment (e.g., CLIP, LLaVA).
2. Select a Benign Image: Choose an image that the model classifies correctly and with high confidence.
3. Craft Adversarial Text: Select a target label that is semantically distant from the image content.
4. Generate the Attack Image: Using a library like Pillow in Python, render the adversarial text onto the benign image. Experiment with fonts, sizes, and positions to maximize the effect.
5. Test the Exploit: Feed the modified image to the model and observe the classification shift.

# Pseudocode for generating a typographic attack image
from PIL import Image, ImageDraw, ImageFont

image_path = './images/golden_retriever.jpg'
adversarial_text = 'A photo of a toaster'
output_path = './outputs/attack_image.jpg'

# Load the benign image
image = Image.open(image_path)
draw = ImageDraw.Draw(image)

# Select font and position for the text
font = ImageFont.truetype('arial.ttf', size=40)
text_position = (50, 50) # Top-left corner

# Draw the text onto the image
draw.text(text_position, adversarial_text, font=font, fill=(0, 0, 0))

# Save the compromised image
image.save(output_path)
print(f"Adversarial image saved to {output_path}")

Attack Vector 3: Adversarial Audio Perturbations

In systems that process synchronized audio and video, you can inject subtle, often imperceptible noise into the audio stream to cause a misclassification of the visual content. The model’s fusion mechanism incorrectly associates the audio perturbation with a different visual class.

For example, a security system analyzing CCTV footage with audio might correctly identify “person walking”. By playing a specific, calculated audio noise through a nearby speaker, you could force the system to classify the same video feed as “scenery” or “empty room,” effectively blinding the system to the person’s presence.

Conceptual Attack Logic

# Pseudocode for finding an audio perturbation
def generate_adversarial_audio(model, video_frames, original_audio, target_class):
    # Initialize a small random noise tensor with the same shape as audio
    audio_perturbation = torch.randn_like(original_audio, requires_grad=True)

    # Define optimizer (e.g., Adam) to update the perturbation
    optimizer = optim.Adam([audio_perturbation], lr=0.01)

    for step in range(100): # Optimization loop
        optimizer.zero_grad()
        perturbed_audio = original_audio + audio_perturbation

        # Get model's prediction with the perturbed audio
        output = model(video_frames, perturbed_audio)
        
        # Calculate loss against the incorrect target class
        loss = loss_function(output, target_class)
        
        # Backpropagate to update the audio perturbation
        loss.backward()
        optimizer.step()

    return original_audio + audio_perturbation

This process iteratively refines the noise to be maximally effective at fooling the model. The final `perturbed_audio` may sound nearly identical to the original to a human but will contain the precise frequencies needed to trigger the misclassification.