FlowGuard slashes multimodal AI attack success from 90% to 15%
New defense monitors cross-modal consistency to catch adversarial inputs with 6x speedup.
Multimodal large language models introduce new attack surfaces: adversaries can split malicious intent across text and image modalities, bypassing unimodal safeguards. Existing defenses that inspect raw inputs or outputs overlook the internal fusion process, making them brittle and computationally expensive. In response, researchers from the University of Illinois Urbana-Champaign (Jehyeok Yeon, Hyeonjeong Ha, Qiusi Zhan, Heng Ji) propose FlowGuard, a framework that monitors internal multimodal consistency at inference time.
FlowGuard derives FlowVectors inspired by Partial Information Decomposition to quantify cross-modal redundancy, synergy, and modality-specific dominance. It checks whether fused multimodal predictions remain aligned with unimodal semantic evidence, using a one-class classifier trained solely on benign data. Results show Attack Success Rates drop from >90% to <15% on unseen attacks, with <3% utility loss and up to 6× latency reduction. The work, accepted as a Spotlight Paper at ICML 2026, demonstrates that monitoring cross-modal consistency is an efficient and effective defense for multimodal reasoning systems.
- FlowGuard reduces Attack Success Rates from >90% to <15% on unseen adversarial attacks.
- Achieves <3% utility loss and up to 6× latency reduction compared to prior defenses.
- Uses FlowVectors based on Partial Information Decomposition to measure cross-modal redundancy and synergy.
Why It Matters
As multimodal AI adoption grows, FlowGuard offers a practical, efficient defense against cross-modal attacks with minimal performance impact.