Text Color Changes Can Manipulate Qwen2-VL and Other VLMs
Researchers have discovered that altering font colors and contrast can silently manipulate the reasoning of vision-language models, exposing a critical security vulnerability.
A new study by researchers from institutions including Japans AIST, the University of Tsukuba, the University of Technology Nuremberg, and the University of Oxford reveals that subtle visual styling can hijack the reasoning of vision-language models. By testing models on the newly created VQA Stealth Set and sentiment datasets, the team demonstrated that changing text colors or contrast can alter an AIs semantic interpretation without modifying the actual words. The researchers evaluated four open-source models: LLaVA-v1.6-Mistral-7B, LLaVA-v1.6-Vicuna-7B, Qwen2-VL-7B-Instruct, and IDEFICS2-8B.
The experiments showed varying levels of susceptibility among the models. Qwen2-VL-7B-Instruct proved the most vulnerable, exhibiting a total color-induced bias range of 0.90. It showed a positive sentiment bias of up to +0.42 when positive words were colored green or blue, and a negative bias down to -0.48 when negative words were colored red. IDEFICS2-8B followed with a susceptibility range of 0.52, while the LLaVA variants remained highly robust, showing ranges between only 0.04 and 0.12. Using a CLIP representation probe, the researchers confirmed that rendering a word like bad in green physically shifted its internal semantic representation toward a positive valence.
In visual question answering tests, the researchers manipulated contrast to create a saliency competition. By rendering a decoy answer in high contrast while fading the correct text, they measured how often models were misled using a metric called the Induced Error Rate. As the surrounding text became harder to read, the error rates rose across most models, though Qwen2-VL-7B remained more resistant to this contrast-based manipulation than its peers.
For AI practitioners and developers, these findings expose a dangerous attack surface. Malicious actors could exploit this vulnerability by serving AI-specific stylesheets to web scrapers, altering text colors to manipulate search summaries or automated sentiment analysis while leaving the text unchanged for human readers. To mitigate these risks, the researchers suggest that developers normalize rendered text before inference, cross-check image-based answers with optical character recognition text, and integrate style-invariance checks into their evaluation pipelines.
This is our own summary of reporting by Unite.AI
