AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents

Yichen Wang (University of Wisconsin-Madison) · Hangtao Zhang (Huazhong University of Science and Technology) · Hewen Pan (Huazhong University of Science and Technology) · Ziqi Zhou (Huazhong University of Science and Technology) · Xianlong Wang (City University of Hong Kong) · Peijin Guo · Lulu Xue (Huazhong University of Science and Technology) · Shengshan Hu (Huazhong University of Science and Technology) · Minghui Li (Huazhong University of Science and Technology) · Leo Yu Zhang (Griffith University)

adversarial attacks attack performancecontrol variantsembodied decision-makingexperimental resultsfine-grained adversarial attackinvalid outputsmisalignmentperception modificationreasoning processsafety threatsemantic informationtask contextvision-language models vulnerabilities

Vision-Language Models (VLMs), with their strong reasoning and planning capabilities, are widely used in embodied decision-making (EDM) tasks in embodied agents, such as autonomous driving and robotic manipulation. Recent research has increasingly explored adversarial attacks on VLMs to reveal their vulnerabilities. However, these attacks either rely on overly strong assumptions, requiring full knowledge of the victim VLM, which is impractical for attacking VLM-based agents, or exhibit limited effectiveness. The latter stems from disrupting most semantic information in the image, which leads to a misalignment between the perception and the task context defined by system prompts. This inconsistency interrupts the VLM's reasoning process, resulting in invalid outputs that fail to affect interactions in the physical world. To this end, we propose a fine-grained adversarial attack framework, AdvEDM, which modifies the VLM's perception of only a few key objects while preserving the semantics of the remaining regions. This attack effectively reduces conflicts with the task context, making VLMs output valid but incorrect decisions and affecting the actions of agents, thus posing a more substantial safety threat in the physical world. We design two variants of based on this framework, AdvEDM-R and AdvEDM-A, which respectively remove the semantics of a specific object from the image and add the semantics of a new object into the image. The experimental results in both general scenarios and EDM tasks demonstrate fine-grained control and excellent attack performance.