Benchmarking Gaslighting Negation Attacks Against Multimodal Large Language Models

TL;DR

This paper evaluates the vulnerability of multimodal large language models to gaslighting negation attacks, revealing significant robustness gaps and introducing a new benchmark for assessing model resilience to such adversarial inputs.

Contribution

It introduces GaslightingBench, the first benchmark specifically designed to evaluate MLLMs' susceptibility to negation-based adversarial attacks, and provides comprehensive analysis across multiple models and domains.

Findings

Proprietary models like GPT-4o show better resilience than open-source models.

All models tested are vulnerable to negation attacks, especially in subjective domains.

Objective domains exhibit smaller performance drops under negation attacks.

Abstract

Multimodal Large Language Models (MLLMs) have exhibited remarkable advancements in integrating different modalities, excelling in complex understanding and generation tasks. Despite their success, MLLMs remain vulnerable to conversational adversarial inputs. In this paper, we systematically study gaslighting negation attacks: a phenomenon where models, despite initially providing correct answers, are persuaded by user-provided negations to reverse their outputs, often fabricating justifications. We conduct extensive evaluations of state-of-the-art MLLMs across diverse benchmarks and observe substantial performance drops when negation is introduced. Notably, we introduce the first benchmark GaslightingBench, specifically designed to evaluate the vulnerability of MLLMs to negation arguments. GaslightingBench consists of multiple-choice questions curated from existing datasets, along with generated negation prompts across 20 diverse categories. Throughout extensive evaluation, we find that proprietary models such as Gemini-1.5-flash and GPT-4o demonstrate better resilience compared to open-source counterparts like Qwen2-VL and LLaVA, though even advanced reasoning-oriented models like Gemini-2.5-Pro remain susceptible. Our category-level analysis further shows that subjective or socially nuanced domains (e.g., Social Relation, Image Emotion) are especially fragile, while more objective domains (e.g., Geography) exhibit relatively smaller but still notable drops. Overall, all evaluated MLLMs struggle to maintain logical consistency under gaslighting negation attack. These findings highlight a fundamental robustness gap and provide insights for developing more reliable and trustworthy multimodal AI systems. Project website: https://yxg1005.github.io/GaslightingNegationAttacks/.