Adversarial Attacks on Deep OCR Systems

2026-08-07

AI Summary

This work addresses the challenging black-box setting of deep OCR systems where only output strings are accessible, and proposes the first string-level adversarial attack tailored for generative OCR vision-language models. The attack is formulated as a zeroth-order optimization problem based on sequence similarity, estimating gradients via random-direction finite differences and leveraging Adam optimization with ℓ∞-norm projection to generate imperceptible perturbations whose query complexity is independent of image dimensionality. Experiments on Deep-OCR demonstrate the method’s effectiveness, revealing critical failure modes in the decoder—including repetition, truncation, and prompt leakage—and showing that untargeted attacks significantly outperform targeted ones in this setting.

Abstract

Deep-OCR (DeepSeek-OCR) advances document recognition by treating the visual modality as an optical compression medium, enabling long-context OCR at low token cost. However, its increased complexity may introduce new security vulnerabilities. In this paper, we present, to the best of our knowledge, the first pure black-box adversarial attack against a generative OCR vision-language model, where only the decoded string can be queried and no gradients, logits, or model internals are available. We recast the attack as a zeroth-order optimization problem driven by a bounded scalar loss defined directly on the string output via sequence similarity, and estimate the gradient with a random-direction finite-difference scheme whose query cost is independent of the image dimension. An Adam update with ell_infinity projection yields imperceptible perturbations for both untargeted and targeted objectives. Pilot experiments on Deep-OCR validate the string-only attack and evaluation pipeline and expose severe qualitative decoder failures, including repetition, truncation, and prompt leakage. They also show that controlled targeted rewriting remains substantially harder than untargeted degradation; we avoid claiming targeted success until the pre-registered evaluation is complete.

Problem

• Adversarial Attacks
• Deep OCR
• Black-box Attack
• Vision-Language Model
• String-only Query

Innovation

• black-box adversarial attack
• zeroth-order optimization
• generative OCR
• string-only feedback
• vision-language model