Counterfeit Answers: Adversarial Forgery against OCR-Free Document Visual Question Answering

TL;DR

This paper introduces a novel adversarial attack method that forges document content in a visually imperceptible way to induce incorrect answers in DocVQA models, revealing critical vulnerabilities.

Contribution

It presents specialized algorithms for creating visually imperceptible, semantically targeted document forgeries to test and expose vulnerabilities in state-of-the-art DocVQA models.

Findings

Effective attacks against Pix2Struct and Donut models

Vulnerabilities enable targeted misinformation and systematic failures

Highlights need for more robust DocVQA defenses

Abstract

Document Visual Question Answering (DocVQA) enables end-to-end reasoning grounded on information present in a document input. While recent models have shown impressive capabilities, they remain vulnerable to adversarial attacks. In this work, we introduce a novel attack scenario that aims to forge document content in a visually imperceptible yet semantically targeted manner, allowing an adversary to induce specific or generally incorrect answers from a DocVQA model. We develop specialized attack algorithms that can produce adversarially forged documents tailored to different attackers' goals, ranging from targeted misinformation to systematic model failure scenarios. We demonstrate the effectiveness of our approach against two end-to-end state-of-the-art models: Pix2Struct, a vision-language transformer that jointly processes image and text through sequence-to-sequence modeling, and Donut, a transformer-based model that directly extracts text and answers questions from document images. Our findings highlight critical vulnerabilities in current DocVQA systems and call for the development of more robust defenses.