Naturalistic Typographic Attacks on VLM-Based Image Quality Assessment

Vision-language models (VLMs) have recently been adapted to image quality assessment (IQA), using language-defined quality levels to produce interpretable scores. This design introduces a new attack surface: readable text inside an image may be interpreted as evidence about quality rather than as ordinary scene content. However, the standard typographic attack paradigm, which pastes deceptive text directly onto an image, is poorly suited to IQA. A pasted overlay injects a positive semantic cue but simultaneously introduces a visible artifact that degrades image fidelity, creating a self-contradictory attack. We propose Naturalistic Typographic Attack (NTA), a black-box method that uses a text-guided image editor to embed quality-related words into scene-consistent carriers such as signs, posters, and labels. NTA preserves the semantic influence of typographic cues while avoiding the visual degradation of naive overlays. Experiments on AVA images scored by Q-Align show that NTA nearly doubles the mean score gain of direct overlay while achieving higher success rates and greater stability across images. These results indicate that scene-consistent text insertion exposes a more potent semantic vulnerability in VLM-based IQA than conventional pasted text.