<?xml version="1.0" encoding="UTF-8"?>
<modsCollection xmlns="http://www.loc.gov/mods/v3">
<mods ID="sihan-etal-2026-typocd">
    <titleInfo>
        <title>TypoCD: Training-Free Contrastive Decoding for Typographic Defense in Large Vision-Language Models</title>
    </titleInfo>
    <name type="personal">
        <namePart type="given">Xia</namePart>
        <namePart type="family">Sihan</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Jing</namePart>
        <namePart type="family">Li</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Junhao</namePart>
        <namePart type="family">Dong</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Ivor</namePart>
        <namePart type="family">Tsang</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <name type="personal">
        <namePart type="given">Yew-Soon</namePart>
        <namePart type="family">Ong</namePart>
        <role>
            <roleTerm authority="marcrelator" type="text">author</roleTerm>
        </role>
    </name>
    <originInfo>
        <dateIssued>2026-10</dateIssued>
    </originInfo>
    <typeOfResource>text</typeOfResource>
    <relatedItem type="host">
        <titleInfo>
            <title>Findings of the Association for Computational Linguistics: EMNLP 2026</title>
        </titleInfo>
        <name type="personal">
            <namePart type="given">Hung-Yi</namePart>
            <namePart type="family">Lee</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Sunipa</namePart>
            <namePart type="family">Dev</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Jessy</namePart>
            <namePart type="family">Li</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <name type="personal">
            <namePart type="given">Desmond</namePart>
            <namePart type="family">Elliott</namePart>
            <role>
                <roleTerm authority="marcrelator" type="text">editor</roleTerm>
            </role>
        </name>
        <originInfo>
            <publisher>Association for Computational Linguistics</publisher>
            <place>
                <placeTerm type="text">Budapest, Hungary</placeTerm>
            </place>
        </originInfo>
        <genre authority="marcgt">conference publication</genre>
        <identifier type="isbn">979-8-89176-462-0</identifier>
    </relatedItem>
    <abstract>Large vision-language models (LVLMs) remain highly sensitive to text embedded in images: a misleading word printed, painted, or pasted onto an object can override visual evidence and flip the model’s answer. Existing defenses are often tied to specific vision encoders, require training or feature-level intervention, or do not operate on the autoregressive decoding interface of modern LVLMs. We propose TypoCD, a training-free contrastive decoding method for typographic robustness. TypoCD constructs a text-localized counterfactual view by detecting visible text regions and inpainting only the typographic content, then contrasts the attacked-image and typography-removed logits during decoding. This localized contrastive direction targets the attacker’s textual signal while preserving unrelated visual content, allowing TypoCD to subtract the typography-induced logit shift without modifying model parameters or internal features. Across three open-source LVLM backbones and synthetic, real-world, and safety-oriented typographic benchmarks, TypoCD recovers attacked-image accuracy to within a few percentage points of clean-image performance without per-backbone tuning, closing a gap that often exceeds 40 percentage points under attack. When combined with a simple prompt prefix, TypoCD also substantially reduces jailbreak attack success on safety-oriented typographic attacks.</abstract>
    <identifier type="citekey">sihan-etal-2026-typocd</identifier>
    <location>
        <url>https://aclanthology.org/2026.findings-emnlp.944/</url>
    </location>
    <part>
        <date>2026-10</date>
        <extent unit="page">
            <start>19905</start>
            <end>19919</end>
        </extent>
    </part>
</mods>
</modsCollection>

%0 Conference Proceedings
%T TypoCD: Training-Free Contrastive Decoding for Typographic Defense in Large Vision-Language Models
%A Sihan, Xia
%A Li, Jing
%A Dong, Junhao
%A Tsang, Ivor
%A Ong, Yew-Soon
%Y Lee, Hung-Yi
%Y Dev, Sunipa
%Y Li, Jessy
%Y Elliott, Desmond
%S Findings of the Association for Computational Linguistics: EMNLP 2026
%D 2026
%8 October
%I Association for Computational Linguistics
%C Budapest, Hungary
%@ 979-8-89176-462-0
%F sihan-etal-2026-typocd
%X Large vision-language models (LVLMs) remain highly sensitive to text embedded in images: a misleading word printed, painted, or pasted onto an object can override visual evidence and flip the model’s answer. Existing defenses are often tied to specific vision encoders, require training or feature-level intervention, or do not operate on the autoregressive decoding interface of modern LVLMs. We propose TypoCD, a training-free contrastive decoding method for typographic robustness. TypoCD constructs a text-localized counterfactual view by detecting visible text regions and inpainting only the typographic content, then contrasts the attacked-image and typography-removed logits during decoding. This localized contrastive direction targets the attacker’s textual signal while preserving unrelated visual content, allowing TypoCD to subtract the typography-induced logit shift without modifying model parameters or internal features. Across three open-source LVLM backbones and synthetic, real-world, and safety-oriented typographic benchmarks, TypoCD recovers attacked-image accuracy to within a few percentage points of clean-image performance without per-backbone tuning, closing a gap that often exceeds 40 percentage points under attack. When combined with a simple prompt prefix, TypoCD also substantially reduces jailbreak attack success on safety-oriented typographic attacks.
%U https://aclanthology.org/2026.findings-emnlp.944/
%P 19905-19919

Markdown (Informal)

[TypoCD: Training-Free Contrastive Decoding for Typographic Defense in Large Vision-Language Models](https://aclanthology.org/2026.findings-emnlp.944/) (Sihan et al., Findings 2026)

• TypoCD: Training-Free Contrastive Decoding for Typographic Defense in Large Vision-Language Models (Sihan et al., Findings 2026)

ACL

• Xia Sihan, Jing Li, Junhao Dong, Ivor Tsang, and Yew-Soon Ong. 2026. TypoCD: Training-Free Contrastive Decoding for Typographic Defense in Large Vision-Language Models. In Findings of the Association for Computational Linguistics: EMNLP 2026, pages 19905–19919, Budapest, Hungary. Association for Computational Linguistics.