Search papers, labs, and topics across Lattice.
This paper addresses the vulnerability of CLIP models to Typographic Attacks (TA), which mislead visual representations by introducing irrelevant text within images. The authors introduce a training-free mechanistic interpretability method that quantitatively attributes semantic versus lexical focus in attention heads, enabling the identification of Vision Transformer components that encode lexical information. By applying targeted interventions to these components, the study achieves significant improvements in robustness against TAs in object classification and enhances Visual Question Answering accuracy across state-of-the-art LVLMs.
Targeted interventions can significantly enhance the robustness of CLIP models against Typographic Attacks without additional training, outperforming existing defense methods.
Models trained via Contrastive Language-Image Pretraining (CLIP) serve as the foundational vision encoders for most modern Large Vision Language Models (LVLMs). Despite their widespread adoption, CLIP models exhibit a critical yet underexplored failure mode: irrelevant text appearing within images confounds visual representations, biasing them toward lexical meaning rather than true visual semantics. This robustness issue, commonly described as a Typographic Attack (TA), exposes a vulnerability that poses a significant risk to safety-critical applications such as autonomous driving. To achieve interpretable and effective robustness against TA, we propose a novel, training-free mechanistic interpretability method. Our method provides sampling-based interpretations of hidden state representations and quantitatively attributes semantic versus lexical focus to individual attention heads. Through probabilistic analysis and circuit mining, we isolate specific Vision Transformer (ViT) components that disproportionately encode lexical information, thereby identifying the mechanistic source of TA. We further show that simple interventions applied directly to the identified circuits, without any additional training, can substantially improve robustness against Typographic Attacks in object classification. These interventions, such as selective adjustment of attention weights, also outperform both supervised and training-free defense methods. Our experiments demonstrate that applying the proposed intervention to the vision encoders of several state-of-the-art LVLMs yields substantial gains in Visual Question Answering accuracy under Typographic Attack interference on RIO-Bench. These results confirm both the efficacy and the generalizability of our mechanistic approach. Code is released at https://github.com/Liu-524/SamplingTAR.
