PhD Position on Adversarial Robustness in Multi-Modal Foundation Models
Deadline: November 16, 2026 (2 PM – CET time) Research Title: Adversarial Robustness in Multi-Modal Foundation Models Topics: Cybersecurity, Data science, Computer vision and AI Funded by: The Italian Institute of Artificial Intelligence (AI4I), in collaboration with Politecnico di Torino The Italian Institute of Artificial Intelligence for Industry (AI4I), in collaboration with Politecnico di Torino, invites applications for a PhD position focused on Adversarial Robustness in Multi-Modal Foundation Models. Multi-modal AI models elaborating vision, language, and audio content are becoming increasingly prevalent in several applications. However, these systems introduce novel attack surfaces arising from cross-modal interactions, where adversarial inputs in one modality can exploit semantic inconsistencies or vulnerabilities when processed jointly with other modalities. This research aims to investigate these vulnerabilities and develop novel attacks exposing weaknesses in cross-modal processing. Research Objectives and Methods Large-scale multi-modal AI models enable richer understanding and generation of content across different modalities. However, the security implications of cross-modal interactions remain poorly understood. Recent evidence suggests that adversaries can craft inputs where, for example, benign visual content paired with carefully manipulated audio or text can cause model misclassification or unsafe outputs. Unlike single-modality adversarial attacks, multi-modal attacks exploit the complex fusion mechanisms that integrate information across modalities, creating attack vectors that are difficult to detect and defend against using existing techniques.
The main objective of the proposed research is to advance understanding of adversarial vulnerabilities in multi-modal AI systems by establishing theoretical foundations for attack surfaces and developing practical defense mechanisms that can be deployed in real-world applications. In this research work, the candidate will leverage expertise in adversarial machine learning, information theory, and secure system design to develop both theoretical insights and practical solutions for multi-modal AI security. The research activity will be organized in three phases:
- Phase 1 (1st year): The candidate will conduct a comprehensive study of the attack surface of multi-modal AI models, focusing on architectures that combine vision, language, and audio modalities. This phase involves analyzing state-of-the-art multi-modal fusion mechanisms to identify potential vulnerability points where cross-modal interactions can be exploited. The candidate will develop a taxonomy of attack vectors specific to multi-modal systems, categorizing them by the exploited modality interactions, attack objectives, and required adversary capabilities. The candidate will begin developing novel attack methods that exploit semantic inconsistencies between modalities. For example, attacks where visual and textual content appear individually benign but their combination triggers misclassification, or where subtle audio perturbations alter the interpretation of accompanying visual content. At this phase’s end, preliminary results are expected to be published,
including the attack taxonomy, initial attack methods, and theoretical characterizations of multi-modal vulnerability surfaces. During the first year, the candidate will also acquire necessary background through coursework in adversarial machine learning, information theory, and multi-modal AI architectures, supplemented by personal study.
- Phase 2 (2nd year): In the second phase, the candidate will build upon the knowledge acquired during the first year to create a dataset of synthetic adversarial attacks. The dataset will cover several attack techniques, including cross-modal perturbation, semantic inconsistency exploitation, modality-specific backdoors. The dataset will target different types vulnerabilities and it will cover different application contexts. This dataset will serve as a benchmark for evaluating defense mechanisms and will be made publicly available to support the research community. The dataset will be validated through an experimental campaign to demonstrate the effectiveness of the attack methods in exposing vulnerabilities. Applications in content analysis systems, customer service AI agents, and AI-assisted software development tools will serve as case studies.
- Phase 3 (3rd year): Building on previous results, the candidate will develop new attack techniques capable of automatically synthesizing attack samples. These techniques will be implemented as a framework of parameterized attack templates to generate diverse adversarial examples across different multi-modal architectures. The attack generation framework will incorporate the results from Phase 2 to prioritize attack strategies with higher success probabilities. The candidate will refine and validate the attack mechanisms through ext
The main objective of the proposed research is to advance understanding of adversarial vulnerabilities in multi-modal AI systems by establishing theoretical foundations for attack surfaces and developing practical defense mechanisms that can be deployed in real-world applications. In this research work, the candidate will leverage expertise in adversarial machine learning, information theory, and secure system design to develop both theoretical insights and practical solutions for multi-modal AI security. The research activity will be organized in three phases:
- Phase 1 (1st year): The candidate will conduct a comprehensive study of the attack surface of multi-modal AI models, focusing on architectures that combine vision, language, and audio modalities. This phase involves analyzing state-of-the-art multi-modal fusion mechanisms to identify potential vulnerability points where cross-modal interactions can be exploited. The candidate will develop a taxonomy of attack vectors specific to multi-modal systems, categorizing them by the exploited modality interactions, attack objectives, and required adversary capabilities. The candidate will begin developing novel attack methods that exploit semantic inconsistencies between modalities. For example, attacks where visual and textual content appear individually benign but their combination triggers misclassification, or where subtle audio perturbations alter the interpretation of accompanying visual content. At this phase’s end, preliminary results are expected to be published,
including the attack taxonomy, initial attack methods, and theoretical characterizations of multi-modal vulnerability surfaces. During the first year, the candidate will also acquire necessary background through coursework in adversarial machine learning, information theory, and multi-modal AI architectures, supplemented by personal study.
- Phase 2 (2nd year): In the second phase, the candidate will build upon the knowledge acquired during the first year to create a dataset of synthetic adversarial attacks. The dataset will cover several attack techniques, including cross-modal perturbation, semantic inconsistency exploitation, modality-specific backdoors. The dataset will target different types vulnerabilities and it will cover different application contexts. This dataset will serve as a benchmark for evaluating defense mechanisms and will be made publicly available to support the research community. The dataset will be validated through an experimental campaign to demonstrate the effectiveness of the attack methods in exposing vulnerabilities. Applications in content analysis systems, customer service AI agents, and AI-assisted software development tools will serve as case studies.
- Phase 3 (3rd year): Building on previous results, the candidate will develop new attack techniques capable of automatically synthesizing attack samples. These techniques will be implemented as a framework of parameterized attack templates to generate diverse adversarial examples across different multi-modal architectures. The attack generation framework will incorporate the results from Phase 2 to prioritize attack strategies with higher success probabilities. The candidate will refine and validate the attack mechanisms through ext