On the Adversarial Robustness of Multimodal LLM Judges

A new preprint introduces RobustMLLMJudge, a framework designed to test the adversarial robustness of multimodal large language models when they are deployed as automated judges for tasks such as image quality and safety assessment [1]. The work, submitted to arXiv in 2026, addresses a gap in the evaluation of these systems. While multimodal large language models, or MLLMs, are increasingly used to score or assess content, their vulnerability to deliberate manipulation has remained largely unexamined, a condition the authors argue threatens the fairness and reliability of automated judging [1][2]. Large language models are neural networks trained on vast text corpora for tasks including generation and analysis, and their reliability can be compromised by biased training data [3]. The RobustMLLMJudge framework is described as the first general-purpose tool for evaluating this specific vulnerability across different MLLM judge approaches and scenarios [1][2]. In tests using the framework, researchers found that various MLLM judges are highly susceptible to score-inflating adversarial attacks [1]. These attacks are designed to trick the model into assigning a higher score than warranted. A key challenge identified is that existing attack methods are constrained by the unique evaluation protocols used by MLLM judges [2]. To overcome this, the paper proposes a novel attack method called MGSIA, or Manifold-Guided Semantic Induction Attack [1]. The technique works by maximizing the probability that a judge produces an affirmative response, such as “Yes,” to binary semantic queries, while simultaneously aligning adversarial representations with high-score patterns estimated from proxy protocols [2]. The combined effect produces score-inflating perturbations that the authors report are transferable and effective at deceiving advanced MLLM judges across different evaluation scenarios [1][2]. Benchmarks for language models are standardized tests that measure capabilities like reasoning and factual accuracy using specific datasets and metrics [4]. The RobustMLLMJudge framework adds a security dimension to this evaluation landscape by quantifying how easily an automated judge’s scoring can be corrupted. The broader field of artificial intelligence has seen cycles of optimism and concern since its founding as an academic discipline in 1956, with recent years marked by an AI boom and parallel discussions around safety and regulation [5]. The paper’s findings contribute to those safety discussions by highlighting a concrete vulnerability in a growing application of MLLMs. The authors have indicated that the code and data for RobustMLLMJudge will be made publicly available on GitHub [1][2].