PaperGuard reveals AI peer reviewers can be manipulated via images

As AI systems like LLMs and multimodal LLMs (MLLMs) are increasingly used to assist scientific peer review, a new study reveals a critical blind spot: these models can be easily manipulated through both text and figures. Researchers from multiple institutions introduce PaperGuard, the first comprehensive benchmark designed to attack and defend multimodal AI peer review. The work, accepted to ICML 2026, addresses a gap where prior robustness studies focused only on text-based attacks. PaperGuard is built on three pillars: a new multimodal peer-review dataset spanning scientific domains, a unified suite of attacks including GCG (greedy coordinate gradient) for text and PGD (projected gradient descent) for figures, and a practical chunk-based embedding search defense that localizes and mitigates harmful instructions in long academic papers.

The key finding is that AI reviewers are “pervasively vulnerable” to adversarial manipulation – an attacker can inflate scores or alter reviews by injecting adversarial content in figures or text. This goes beyond standard jailbreaking because the attack targets domain-specific, targeted failures like “inflate this score” rather than general safety violations. PaperGuard provides the foundational benchmarks, protocols, and an actionable defense (using chunked embedding search to efficiently identify malicious instructions) to enable trustworthy, attack-resilient AI-assisted scholarly reviewing. As AI becomes more integrated into the scientific process, this work offers essential tools for maintaining integrity.