Adversarial Attack Manipulates MLLM Cascade Routing Decisions

Multimodal Large Language Model (MLLM) cascades are designed to optimize computational costs by initially querying a less powerful but cheaper model, deferring to a stronger model only when the weaker one expresses low confidence. This cost-saving mechanism, however, introduces a new security vulnerability: the weak model's confidence directly dictates compute allocation, creating an attack surface. An adversary could manipulate this confidence to ensure their queries are consistently processed by the more expensive, stronger model. Motivated by this, researchers have developed the Forced Deferral Attack (FDA). This adversarial image attack specifically aims to reduce the weak model's confidence, thereby compelling the cascade system to route queries to the strong model. The FDA learns a universal border trigger by optimizing an objective that pushes the weak model's token distribution on triggered inputs toward less concentrated targets, derived from its clean responses. Across various datasets, model families, and deferral metrics, FDA consistently increases strong-model routing. It also outperforms baseline attacks like image perturbation and prompt injection. These findings underscore a significant vulnerability in MLLM cascades, demonstrating that compute allocation can be manipulated to force unintended strong-model usage, even without directly compromising answer accuracy.