Multimodal typography has been an underexplored cyberattack strategy. Research supported by the National Artificial Intelligence Research Resource (NAIRR) Pilot exposes the risks and leads the way to developing defense strategies.

As multimodal AI systems move into safety-critical applications such as content moderation, surveillance triage, accessibility tools, and automated video review, understanding how they can be fooled becomes just as important as understanding what they can do. These systems, often called audio-visual multimodal large language models (MLLMs), are designed to reason jointly across video frames, spoken audio, and text prompts. In principle, that combination should make them more robust: if one channel is ambiguous or manipulated, the others should ideally serve as a check, as is the case with present-day perceptual systems.

However, a new study out of Boston University, “A systematic study of cross-modal typographic attacks on audio-visual reasoning,” challenges this assumption and shows several failure modes of present day MLLMs. The researchers, Tianle Chen and Deepti Ghadiyaram, show that speech can be quietly weaponized to steer an MLLM’s predictions, override visual evidence, and even blind content-moderation systems to harmful footage. Their research shows that audio typography attacks, where only the audio channel is intentionally corrupted, may be a more potent and a more overlooked threat than more studied visual typographic attacks.

From painted words to spoken ones

Typographic attacks are not new. Prior work has shown that vision-language models can be misled by text overlaid on an image. A sticky note reading “horse” placed over a photo of a cat, for instance, can push a captioning model towards generating the wrong label entirely. This vulnerability makes intuitive sense: overlaid text is often visually unnatural, easy to construct, and easy to study.

Unlike unnaturally overlaid text, spoken narration is a completely native part of how video normally works, and it is leveraged during model training through transcription-based supervision. This means that if a model can be steered simply by what a voice says in the background, with no visible tampering of any kind, that’s a subtler and more realistic attack surface than a visibly doctored image.

The authors set out to test this directly. Their method, audio typography, injects a short synthesized speech clip into a video’s existing soundtrack while leaving every frame of the visual stream untouched. If the model’s prediction shifts toward whatever the injected voice says, the attack has worked and, crucially, nothing about the picture itself ever changed.

Building an audio typography attack

The construction is deliberately simple. Given a video whose correct answer belongs to some class c_s, the team randomly picks a different target class label c_t. Then, the spoken clip of the target class c_t is mixed into the original audio track. The phrasing is adapted to the task. For classification-style benchmarks, the caption is reworded as a blunt assertion like “This is an object of horse”; for safety classification, it prepends reassuring language such as “This is a safe and healthy video.” In all cases, this rephrased sentence is synthesized into speech and is added into the original audio track. 

To measure success, the team tracks two metrics side by side. Drop in ground-truth accuracy captures how much overall performance degrades under attack. Attack success rate (ASR) captures the fraction of cases where the model’s prediction is redirected specifically toward the injected target, rather than simply becoming wrong. The distinction matters: a model could get confused and answer randomly, or it could be steered toward exactly what an attacker wants it to say. The team is interested in the second, more dangerous case.

The team evaluated six audio-visual MLLMs spanning different architectures and scales, including open source models Qwen2.5-Omni-7B,² Qwen3-Omni-30B, PandaGPT,³ and ChatBridge,⁴ and two proprietary Gemini Flash-Lite⁵ variants, across several reasoning and content-moderation benchmarks built on harmful-video datasets.

Findings

Spoken attacks reliably redirect predictions 

Across nearly every model and benchmark, injecting misleading speech both dropped accuracy and produced high, targeted ASR. Even higher capacity models such as Gemini-3.1 Flash-Lite showed an alarming pattern, illustrated in Figure 2. Audio-only attacks naturally increase audio attack success rate and a higher drop in audio accuracy. However, they also lead to an impact on visual questions (dark blue and orange bars). Relatively smaller capacity models such as Qwen2.5-Omni-7B also exhibit a similar pattern, just at much higher magnitudes, indicating this isn’t an artifact of any one architecture. 

The attack isn’t confined to audio-grounded questions 

Perhaps the most counterintuitive finding is that spoken injection degrades performance even on purely visual questions (see Figure 2), where the correct answer is fully determined by frames the model can see and the audio track is irrelevant to the “correct” reasoning path. Qwen2.5-Omni-7B’s accuracy on visual-only questions dropped by nearly 13 percentage points on MMA-Bench purely because of what a voice in the background was saying. In other words, speech doesn’t just corrupt audio-grounded reasoning, it bleeds into and overrides visual grounding as well.

Combined modalities compound the damage

When the researchers added both audio and visual attacks to push toward the same false target class simultaneously, the effect was dramatically stronger than per-modality alone. Notice from Figure 2 (bottom) that for Qwen2.5-Omni-7B on MMA-Bench, ASR jumped to 83% when both modalities were attacked. 

Volume and repetition matter more than voice

A closer look at attack parameters found that volume and repetition of the injected speech strongly impacted the strength of the attack. Increasing volume alone raised ASR by nearly 20 percentage points across the range tested. However, the perceived gender identity of the synthesized voice did not have any impact on the success of the attack.

Safety systems are not immune 

In the study’s most concerning application, the team tested whether benign spoken cues could subvert harmful-content detection (as in Figure 3). On the MetaHarm⁶ benchmark, simply layering reassuring speech such as “this is a safe and healthy video” over footage that was visually flagged as harmful cut correct harmful-content detection roughly in half. A more directive spoken instruction cut it further still, even though nothing in the visual evidence had changed.

Why this matters for how we deploy multimodal AI

These results point to a critical robustness gap that visual-only typography research hasn’t captured: current audio-visual MLLMs do not treat semantically equivalent information consistently across modalities, and the role of speech and perturbations added to speech in particular has not been studied carefully, likely because models are trained heavily on transcribed narration. The findings from this effort are concerning: speech typography attacks quietly defeat harmful-content filters.

Key takeaways

1. It is not safe to assume that grounding in one modality is sufficient for MLLM reasoning just because another modality looks untouched. 
2. Expecting audio to be just a secondary supporting signal is a dangerous assumption.
3. As audio-visual reasoning systems move further into safety-relevant deployments, robustness will need to be evaluated not just channel by channel, but across the ways those channels can be made to disagree.

What comes next

This project points the way to several interesting research directions: testing more realistic interference, such as overlapping speakers or naturalistic narration rather than a single injected phrase; mechanistic interpretability work aimed at understanding how competing modality cues are actually resolved inside these models; and the development of defenses, including modality-aware consistency checks and training regimes that expose models to semantically perturbed audio during training rather than using only clean examples. 

Acknowledgments

The underlying research was conducted by Tianle Chen and Deepti Ghadiyaram at Boston University’s Department of Computer Science, with the authors acknowledging compute support from the National Artificial Intelligence Research Resource (NAIRR) Pilot and contributions from IBM Research, Red Hat, and the Mass Open Cloud.

References