On the Adversarial Robustness of Multimodal LLM Judges

2026-06-14

AI Summary

Multimodal large language models (MLLMs) are increasingly adopted as automated evaluators for image quality and safety, yet their adversarial robustness remains underexplored, raising concerns about fairness and reliability. This work proposes RobustMLLMJudge, the first general framework for evaluating the adversarial robustness of MLLM-based judges, and introduces a novel attack method, MGSIA, which generates transferable score-inflating perturbations through affirmative semantic induction and high-level manifold alignment. Experimental results demonstrate that MGSIA significantly outperforms existing approaches across diverse scenarios, effectively deceiving state-of-the-art MLLM evaluators and exposing their vulnerability in adversarial settings.

Abstract

Multimodal Large Language Models (MLLMs) are increasingly used as automated judges, e.g., for image quality and safety assessment. However, their adversarial robustness remains largely unexplored, threatening the fairness and reliability of automated judging. To bridge this gap, we introduce RobustMLLMJudge, the first general framework for evaluating the adversarial robustness of general-purpose MLLMs when functioning as judges. It covers diverse attacks against popular judge approaches across quality and safety evaluation scenarios. Using RobustMLLMJudge, we reveal that i) different MLLM judges are highly vulnerable to score-inflating adversarial attacks; and ii) although effective, these attack methods face a critical challenge due to unique constraints in the evaluation protocols of MLLM judges. We further propose MGSIA, namely Manifold-Guided Semantic Induction Attack, a novel method that bypasses these constraints to enable more effective and transferable attacks on MLLM judges. The core idea of MGSIA is to combine affirmative semantic induction with high-score manifold alignment: it maximizes the probability that judges yield affirmative responses (e.g., "Yes") to binary semantic queries, while regularizing adversarial representations toward high-score centers estimated from proxy protocols. Together, these objectives yield transferable score-inflating perturbations. Extensive experiments demonstrate the superiority and generalizability of MGSIA in deceiving advanced MLLM judges under different evaluation scenarios, highlighting the need for robust MLLM judges. Code and data will be made available at https://github.com/mala-lab/RobustMLLMJudge.

Problem

• Multimodal LLM Judges
• Adversarial Robustness
• Automated Judging
• Score-Inflating Attacks
• Evaluation Reliability

Innovation

• adversarial robustness
• multimodal LLM judges
• MGSIA
• manifold alignment
• semantic induction