PhD Position on Adversarial Robustness in Multi-Modal Foundation Models
Deadline: November 16, 2026 (2 PM – CET time) Research Title: Adversarial Robustness in Multi-Modal Foundation Models Supervisors: Luca Cagliero, Danilo Giordano, Nicola Franco Topics: Cybersecurity, Data science, Computer vision and AI Funded by: The Italian Institute of Artificial Intelligence (AI4I), in collaboration with Politecnico di Torino Group Website: https://ai4i.it/ https://dbdmg.polito.it/ https://smartdata.polito.it The Italian Institute of Artificial Intelligence for Industry (AI4I), in collaboration with Politecnico di Torino, invites applications for a PhD position focused on Adversarial Robustness in Multi-Modal Foundation Models. Multi-modal AI models elaborating vision, language, and audio content are becoming increasingly prevalent in several applications. However, these systems introduce novel attack surfaces arising from cross-modal interactions, where adversarial inputs in one modality can exploit semantic inconsistencies or vulnerabilities when processed jointly with other modalities. This research aims to investigate these vulnerabilities and develop novel attacks exposing weaknesses in cross-modal processing. Research Objectives and Methods Large-scale multi-modal AI models enable richer understanding and generation of content across different modalities. However, the security implications of cross-modal interactions remain poorly understood. Recent evidence suggests that adversaries can craft inputs where, for example, benign visual content paired with carefully manipulated audio or text can cause model misclassification or unsafe outputs. Unlike single-modality adversarial attacks, multi-modal attacks exploit the complex fusion mechanisms that integrate information across modalities, creating attack vectors that are difficult to detect and defend against using existing techniques. The main objective of the proposed research is to advance understanding of adversarial vulnerabilities in multi-modal AI systems by establishing theoretical foundations for attack surfaces and developing practical defense mechanisms that can be deployed in real-world applications. In this research work, the candidate will leverage expertise in adversarial machine learning, information theory, and secure system design to develop both theoretical insights and practical solutions for multi-modal AI security. The research activity will be organized in three phases:
• Phase 1 (1st year): The candidate will conduct a comprehensive study of the attack surface of multi-modal AI models, focusing on architectures that combine vision, language, and audio modalities. This phase involves analyzing state-of-the-art multi-modal fusion mechanisms to identify potential vulnerability points where cross-modal interactions can be exploited. The candidate will develop a taxonomy of attack vectors specific to multi-modal systems, categorizing them by the exploited modality interactions, attack objectives, and required adversary capabilities.
• The candidate will begin developing novel attack methods that exploit semantic inconsistencies between modalities.
For example, attacks where visual and textual content appear individually benign but their combination triggers misclassification, or where subtle audio perturbations alter the interpretation of accompanying visual content. At this phase’s end, preliminary results are expected to be published, including the attack taxonomy, initial attack methods, and theoretical characterizations of multi-modal vulnerability surfaces. During the first year, the candidate will also acquire necessary background through coursework in adversarial machine learning, information theory, and multi-modal AI architectures, supplemented by personal study.
• Phase 2 (2nd year): In the second phase, the candidate will build upon the knowledge acquired during the first year to create a dataset of synthetic adversarial attacks. The dataset will cover several attack techniques, including cross-modal perturbation, semantic inconsistency exploitation, modality-specific backdoors. The dataset will target different types vulnerabilities and it will cover different application contexts. This dataset will serve as a benchmark for evaluating defense mechanisms and will be made publicly available to support the research community.
• The dataset will be validated through an experimental campaign to demonstrate the effectiveness of the attack methods in exposing vulnerabilities. Applications in content analysis systems, customer service AI agents, and AI-assisted software development tools will serve as case studies.
• Phase 3 (3rd year): Building on previous results, the candidate will develop new attack techniques capable of automatically synthesizing attack samples. These techniques will be implemented as a framework of parameterized attack templates to generate diverse adversarial examples across different multi-modal architectures. The attack generation framework will incorporate the results from Phase 2 to prioritize attack strategies with higher success probabilities. The candidate will refine and validate the attack mechanisms through extensive testing on multimodal models. The final phase will produce comprehensive documentation, open-source implementations of attack tools, and best practices guidelines for developing robust multi-modal AI systems. Dissemination activities will include publications, software releases, and potentially workshops or tutorials to transfer knowledge to practitioners. The work may be conducted in collaboration with industry partners deploying multi-modal AI systems or relevant research initiatives focusing on AI safety and security.
The contributions produced by the proposed research can be published in conferences and journals belonging to the areas of Machine Learning and AI (e.g., NeurIPS, ICML, ICLR, CVPR, ACL, AAAI, JMLR, IEEE TPAMI), Cybersecurity (e.g., IEEE S&P;, ACM CCS, USENIX Security, NDSS, ACM Transactions on Privacy and Security), and AI safety (e.g., AIES, FAccT). The activities will be carried out within the scope of a research collaboration between the Italian Institute of Artificial Intelligence for Industry and Politecnico di Torino. Required Skills The candidate should have a strong background in ML and AI, with particular emphasis on deep learning architectures. Familiarity with multi-modal AI models, computer vision, NLP, or audio processing is desirable. Strong programming skills and experience with deep learning frameworks are essential. The candidate can acquire specialized knowledge in adversarial robustness and multi-modal architectures as part of the PhD Program, by exploiting specialized courses and the research group’s expertise. Start Date: March 1st,2027
How to Apply
Applications for this position are managed by Politecnico di Torino. Please apply via the university’s official PhD portal: PhD Admissions
- Politecnico di Torino PhD Application Registration Portal For more information: Research Proposal – 42nd PhD Cycle PhD Research Topics
- Computer Engineering and Systems
About Us
The Italian Institute for Artificial Intelligence (AI4I) was founded as a research institute to perform transformative, application-oriented research in Artificial Intelligence, driving innovation and industrial progress. The Institute is designed to engage and empower gifted, entrepreneurial, and ambitious researchers who are committed to generating real-world impact at the intersection of science, technology, and industrial transformation. Competitive salaries, performance-based incentives, access to dedicated high-performance computing resources, state-of-the-art laboratories, and strong industrial collaborations are among the distinctive features that define AI4I. The Institute fosters a dynamic international environment and an ecosystem that supports the creation and growth of innovative startups. AI4I’s mission is to advance scientific research, technology transfer, and, more broadly, Italy’s innovation capacity, promoting positive impact across industry, services, and public administration. To achieve this, the Institute contributes to building a research and innovation infrastructure that leverages AI methods, with a special focus on manufacturing processes and the broader Industry 4.0 value chain. AI4I also maintains strategic relationships with leading organizations in Italy and abroad, including Competence Centers and European Digital Innovation Hubs (EDIHs), positioning itself as an attractive destination for researchers, companies, and startups seeking collaboration and impact. AI4I is an equal opportunity employer and welcomes applications from all qualified candidates regardless of gender, nationality, ethnicity, religion, disability, age, or sexual orientation.
• Phase 1 (1st year): The candidate will conduct a comprehensive study of the attack surface of multi-modal AI models, focusing on architectures that combine vision, language, and audio modalities. This phase involves analyzing state-of-the-art multi-modal fusion mechanisms to identify potential vulnerability points where cross-modal interactions can be exploited. The candidate will develop a taxonomy of attack vectors specific to multi-modal systems, categorizing them by the exploited modality interactions, attack objectives, and required adversary capabilities.
• The candidate will begin developing novel attack methods that exploit semantic inconsistencies between modalities.
For example, attacks where visual and textual content appear individually benign but their combination triggers misclassification, or where subtle audio perturbations alter the interpretation of accompanying visual content. At this phase’s end, preliminary results are expected to be published, including the attack taxonomy, initial attack methods, and theoretical characterizations of multi-modal vulnerability surfaces. During the first year, the candidate will also acquire necessary background through coursework in adversarial machine learning, information theory, and multi-modal AI architectures, supplemented by personal study.
• Phase 2 (2nd year): In the second phase, the candidate will build upon the knowledge acquired during the first year to create a dataset of synthetic adversarial attacks. The dataset will cover several attack techniques, including cross-modal perturbation, semantic inconsistency exploitation, modality-specific backdoors. The dataset will target different types vulnerabilities and it will cover different application contexts. This dataset will serve as a benchmark for evaluating defense mechanisms and will be made publicly available to support the research community.
• The dataset will be validated through an experimental campaign to demonstrate the effectiveness of the attack methods in exposing vulnerabilities. Applications in content analysis systems, customer service AI agents, and AI-assisted software development tools will serve as case studies.
• Phase 3 (3rd year): Building on previous results, the candidate will develop new attack techniques capable of automatically synthesizing attack samples. These techniques will be implemented as a framework of parameterized attack templates to generate diverse adversarial examples across different multi-modal architectures. The attack generation framework will incorporate the results from Phase 2 to prioritize attack strategies with higher success probabilities. The candidate will refine and validate the attack mechanisms through extensive testing on multimodal models. The final phase will produce comprehensive documentation, open-source implementations of attack tools, and best practices guidelines for developing robust multi-modal AI systems. Dissemination activities will include publications, software releases, and potentially workshops or tutorials to transfer knowledge to practitioners. The work may be conducted in collaboration with industry partners deploying multi-modal AI systems or relevant research initiatives focusing on AI safety and security.
The contributions produced by the proposed research can be published in conferences and journals belonging to the areas of Machine Learning and AI (e.g., NeurIPS, ICML, ICLR, CVPR, ACL, AAAI, JMLR, IEEE TPAMI), Cybersecurity (e.g., IEEE S&P;, ACM CCS, USENIX Security, NDSS, ACM Transactions on Privacy and Security), and AI safety (e.g., AIES, FAccT). The activities will be carried out within the scope of a research collaboration between the Italian Institute of Artificial Intelligence for Industry and Politecnico di Torino. Required Skills The candidate should have a strong background in ML and AI, with particular emphasis on deep learning architectures. Familiarity with multi-modal AI models, computer vision, NLP, or audio processing is desirable. Strong programming skills and experience with deep learning frameworks are essential. The candidate can acquire specialized knowledge in adversarial robustness and multi-modal architectures as part of the PhD Program, by exploiting specialized courses and the research group’s expertise. Start Date: March 1st,2027
How to Apply
Applications for this position are managed by Politecnico di Torino. Please apply via the university’s official PhD portal: PhD Admissions
- Politecnico di Torino PhD Application Registration Portal For more information: Research Proposal – 42nd PhD Cycle PhD Research Topics
- Computer Engineering and Systems
About Us
The Italian Institute for Artificial Intelligence (AI4I) was founded as a research institute to perform transformative, application-oriented research in Artificial Intelligence, driving innovation and industrial progress. The Institute is designed to engage and empower gifted, entrepreneurial, and ambitious researchers who are committed to generating real-world impact at the intersection of science, technology, and industrial transformation. Competitive salaries, performance-based incentives, access to dedicated high-performance computing resources, state-of-the-art laboratories, and strong industrial collaborations are among the distinctive features that define AI4I. The Institute fosters a dynamic international environment and an ecosystem that supports the creation and growth of innovative startups. AI4I’s mission is to advance scientific research, technology transfer, and, more broadly, Italy’s innovation capacity, promoting positive impact across industry, services, and public administration. To achieve this, the Institute contributes to building a research and innovation infrastructure that leverages AI methods, with a special focus on manufacturing processes and the broader Industry 4.0 value chain. AI4I also maintains strategic relationships with leading organizations in Italy and abroad, including Competence Centers and European Digital Innovation Hubs (EDIHs), positioning itself as an attractive destination for researchers, companies, and startups seeking collaboration and impact. AI4I is an equal opportunity employer and welcomes applications from all qualified candidates regardless of gender, nationality, ethnicity, religion, disability, age, or sexual orientation.