Forced Deferral: Manipulating Routing Decisions in Multimodal LLM Cascades
Quick Answer
This paper shows that The Forced Deferral Attack (FDA) exploits vulnerabilities in multimodal large language model (MLLM) cascades by manipulating the confidence of a weaker model, causing queries to be rerouted to a stronger model.
Quick Take
The Forced Deferral Attack (FDA) exploits vulnerabilities in multimodal large language model (MLLM) cascades by manipulating the confidence of a weaker model, causing queries to be rerouted to a stronger model. This adversarial image attack consistently increases strong-model routing across various datasets, outperforming traditional methods like image perturbation. The findings highlight a significant security risk in MLLM systems, where compute allocation can be maliciously influenced without directly affecting answer correctness.
Key Points
- FDA reduces weak model confidence, forcing queries to strong models in MLLM cascades.
- The attack uses a temperature-flattened objective to optimize universal border triggers.
- FDA outperforms image perturbation and prompt injection methods across various benchmarks.
- MLLM cascades expose vulnerabilities that can be exploited to manipulate compute resources.
- This research highlights the need for improved security measures in systems.
Paper Resources
Article Content
From source RSS / original summaryarXiv:2606. 15308v1 Announce Type: new Abstract: While multimodal large language models (MLLMs) have shown strong visual reasoning abilities, serving a large model for every query is computationally expensive. MLLM cascades mitigate this cost by first querying a weak but cheaper model and deferring to a strong model when the weak model's output is unconfident.
However, since the weak model's confidence directly controls compute allocation, these systems expose a new attack surface: an adversary can manipulate confidence so that their queries are consistently deferred to the strong model. Motivated by this vulnerability, we introduce the Forced Deferral Attack (FDA), an adversarial image attack that lowers the weak model's confidence and causes cascades to route queries to the strong model.
FDA learns a universal border trigger by optimizing a temperature-flattened objective. This objective pushes the weak model's token distribution on triggered inputs toward less concentrated targets constructed from its clean responses. Across datasets, model families, and deferral metrics, FDA consistently increases strong-model routing while outperforming image-perturbation and prompt-injection baselines.
These results show that MLLM cascades are vulnerable to attacks that manipulate compute allocation, forcing unintended strong-model usage without directly targeting answer correctness.
Reader Mode unavailable (could not extract clean content).
Want this in your inbox every morning?
Daily brief at your local 8am — bilingual EN/中文, free.
More from arXiv cs.AI
See more →Arbor: Tree Search as a Cognition Layer for Autonomous Agents
Arbor introduces a multi-agent framework utilizing structured tree search for optimizing LLM inference, achieving up to 193% throughput-latency improvement compared to vendor-optimized systems. It employs an Orchestrator and Critic agent for stability and coordination, demonstrating hardware-agnostic performance with minimal variance.
