DeepSeek on a Trip: Inducing Targeted Visual Hallucinations via Representation Vulnerabilities

Visual hallucinations can be reliably induced in DeepSeek models through embedding manipulation, with researchers achieving hallucination rates as high as 98.0% while keeping manipulated images visually similar to originals (SSIM > 0.88), meaning the attacks are difficult to detect by human inspection alone.

Both smaller and larger versions of DeepSeek Janus are vulnerable, indicating that model size does not provide protection against these embedding-level attacks—a concerning finding given the model's open-source availability and potential for widespread deployment.

The vision-language integration mechanism itself is the weak point, rather than individual components, suggesting that how multimodal models connect image understanding to language generation creates specific security vulnerabilities that require targeted defenses.

Current evaluation methods may underestimate the problem, as the researchers found that closed-form evaluation (specific questions with expected answers) showed consistently higher hallucination rates than open-ended questioning, meaning real-world risks could be worse than some testing approaches reveal.

Embedding-level security measures are urgently needed in deployment pipelines, as the paper emphasizes that responsible AI implementation of multimodal models requires new protective measures at the technical level where images are converted into the model's internal representations.