Title: AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents
Venue: NeurIPS 2025
Accepted: yes
Keywords: Adversarial Attack

Vision-Language Model

Embodied AI
Abstract: Vision-Language Models (VLMs), with their strong reasoning and planning capabilities, are widely used in embodied decision-making (EDM) tasks in embodied agents, such as autonomous driving and robotic manipulation. Recent research has increasingly explored adversarial attacks on VLMs to reveal their vulnerabilities. However, these attacks either rely on overly strong assumptions, requiring full knowledge of the victim VLM, which is impractical for attacking VLM-based agents, or exhibit limited effectiveness. The latter stems from disrupting most semantic information in the image, which leads to a misalignment between the perception and the task context defined by system prompts. This inconsistency interrupts the VLM's reasoning process, resulting in invalid outputs that fail to affect interactions in the physical world. To this end, we propose a fine-grained adversarial attack framework, AdvEDM, which modifies the VLM's perception of only a few key objects while preserving the semantics of the remaining regions. This attack effectively reduces conflicts with the task context, making VLMs output valid but incorrect decisions and affecting the actions of agents, thus posing a more substantial safety threat in the physical world. We design two variants of based on this framework, AdvEDM-R and AdvEDM-A, which respectively remove the semantics of a specific object from the image and add the semantics of a new object into the image. The experimental results in both general scenarios and EDM tasks demonstrate  fine-grained control and excellent attack performance.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper explores adversarial attacks on VLM-based embodied decision-making systems by manipulating object-level semantics in visual feature maps. The method generates masks to insert or remove patches based on semantic similarity with target labels, and applies a feature-level alignment loss to alter masked regions while preserving context. Experiments on image captioning and autonomous driving demonstrate the method’s effectiveness. Transferability to proprietary LLMs such as GPT-4o, Gemini, and Claude is also well explored.\n\nSTRENGTHS AND WEAKNESSES:\nStrength\n\n1.\tThis work introduces a novel concept of fine-grained adversarial attacks and demonstrates that increasing the level of granularity can lead to more effective manipulation of embodied EDM systems, with physical impacts on real-world interactions. \n2.\tThe authors conduct experiments across diverse task settings, including a general image description task and two embodied decision-making scenarios grounded in the physical world—autonomous driving and robotic manipulation. The results validate the effectiveness of the proposed attack method in both digital and real-world scenarios.\n3.\tThe authors’ demo webpage and video further vividly illustrate the effectiveness of the fine-grained attacks.\n\n\nWeakness\n\n1.\tThere are some typos. In Fig. 3 (ADVEDM-A part), the $A’ * [patch] _ R$ should be corrected as $A _ {I’} * [patch]_R$. In line 236, $[cls]$ should be replaced as $[CLS]$.\n2.\tThe authors do not explore the impact of the weighting of different loss functions on the attack performance, and a corresponding ablation study should be included to strengthen the evaluation.\n3.\tThe paper lacks an evaluation of the proposed attack under common defense methods, such as image purification techniques (e.g., [a] and [b]). Including such analyses would offer a more comprehensive assessment of the method’s robustness. I hope the authors could provide further discussion in this regard.\n4.\tI hope the authors can release the dataset collected during their robotic manipulation experiments and to further expand it, thereby facilitating future research in this area.\n\n[a] Nie W, Guo B, Huang Y, et al. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460, 2022.\n\n[b] Naseer M, Khan S, Hayat M, et al. A self-supervised approach for adversarial robustness. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2020: 262-271.\n\nQUESTIONS:\nSee the weakness above\n\nLIMITATIONS:\nSee the weakness above", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-16"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper focuses on fine-grained adversarial attacks of Vision-Language Models (VLM), specifically in embodied decision-making (EDM) tasks. It is established in the gray-box setting, where the attacker only has access to the image-text encoder of the VLM. The proposed attack framework, AdvEDM, contains two variants. The first one, AdvEDM-R, removes the object semantics from the patch embeddings both globally via the class token and locally via utilizing object masks. In this case, the VLM will ignore the target object. The second one, AdvEDM-A, injects object semantics into the patch embeddings of a specific area, following a similar pipeline as AdvEDM-R. It relies on a pre-trained text2image model for generating the target object image. Both variants rely on a pre-computed object mask, obtained via a similarity matrix between the patch embedding and text encoding. The authors evaluate the attack performance on 3 tasks: image description (general), autonomous driving, and robotic manipulation. The method shows effectiveness in the attack success rate, and preserves the image semantics, as shown by semantic similarity (SS) and semantic preservation rate (SPR).\n\nSTRENGTHS AND WEAKNESSES:\n### Strengths\n- The proposed method is effective in achieving high ASR in EDM tasks, demonstrating its ability to alter the decision-making process in a targeted manner. \n- The preservation of image semantics is quantified and validated using the proposed metrics, SS and SPR.\n- The paper is well-written and easy to follow.\n\n### Weaknesses\n\n- According to the Appendix, the proposed method needs 500 iterations of optimization per image, which can lead to large computational overhead. Given the size of modern image encoders in VLMs, I'm concerned about the practicality (time consumption, memory requirement, etc) of the proposed method.\n- Manual selection of the background patches in AdvEDM-A seems unrealistic in real-world scenarios. \n- Reliance on an extra text2image model in AdvEDM-A undermines the practicality. \n- No ablation studies on the numerical values (such as $\\alpha, \\beta,$ etc) used in the framework, albeit the ablation on setting the loss weights to 0. In other words, there is no discussion on the effects of these hyperparameters in the proposed framework.\n\nQUESTIONS:\n- How would the effect be if simply combining stronger adversarial attacks, such as targeted CW [1] or AutoPGD [2], with L_fix? According to the ablation study, the effects of L_fix and other losses are disentangled. \n- Is it possible to automatically select the complex hyperparameters?\n\n[1] Carlini, Nicholas, and David Wagner. \"Towards evaluating the robustness of neural networks.\" 2017 ieee symposium on security and privacy (sp). Ieee, 2017.\n\n[2] Croce, Francesco, and Matthias Hein. \"Reliable evaluation of adversarial robustness with an ensemble of diverse parameter-free attacks.\" International conference on machine learning. PMLR, 2020.\n\nOverall, my concerns are mainly on the complexity and inefficiency of AdvEDM. However, this is not strict, as the main claim is to perform targeted, fine-grained attacks and further reveal the vulnerability of VLM in physical-world EDM tasks.\n\nLIMITATIONS:\nThe authors discuss the limitations in Section E.\nNegative societal impact: The authors mention the goal of revealing the vulnerability of the VLM in EDM tasks.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-06-20"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes ADVEDM, a fine-grained adversarial attack framework targeting vision-language model-based embodied decision-making systems. Unlike previous approaches that generate coarse global perturbations causing invalid outputs, ADVEDM aims to preserve the overall scene semantics while subtly manipulating the perception of specific objects and to achieve valid yet incorrect outputs.\n\nSTRENGTHS AND WEAKNESSES:\n**Strengths:**  \n1. The motivation of the paper is well-grounded. Ensuring the robustness of VLM-based Embodied Decision-Making (EDM) systems is an important and timely challenge, particularly given the growing deployment of such systems in real-world applications like autonomous driving and robotic manipulation.  \n2. The paper introduces a fine-grained adversarial attack framework tailored to EDM systems, which is a meaningful shift from existing coarse-grained attacks that tend to disrupt global semantics.  \n3. This paper includes a black-box evaluation on commercial VLMs showing moderate success, demonstrating the broader applicability of the method.  \n\n**Weaknesses:**  \n1. The method relies heavily on cosine similarity between image patch embeddings and object text embeddings to determine semantic relevant regions. This assumption may not hold in cluttered or complex scenes. There exist more advanced region selection models (e.g., semantic segmentation or object grounding methods) that could provide stronger supervision or robustness. A comparison with such methods is missing.  \n2. The ADVEDM-A method requires manual selection of contiguous patches, usually from less semantically meaningful regions like the background, which may limit its automation and scalability. It also remains unclear how the method performs on naturally crowded or complex images where background space is limited.  \n3. The Semantic Preservation Rate (SPR) metric compares object sets before and after attack to evaluate preservation. However, it does not consider other semantic confusion—i.e., unintended additions of new semantics beyond the target. As a result, the SPR score may overestimate semantic preservation. A more fine-grained or robust metric may be necessary.   \n4. The proposed attention-weight reallocation mechanism (particularly in ADVEDM-A) is claimed to enhance the preservation of non-target semantics. However, the paper does not include an ablation study to isolate and quantify its actual impact on attack success or semantic preservation. Additionally, other hyperparameters such as the scaling factor β are not analyzed in terms of sensitivity or influence on performance.\n\nQUESTIONS:\n1. The paper uses cosine similarity between patch embeddings and object text embeddings for semantic region selection, which may be less reliable in complex, multi-object scenes. Have the authors considered comparing this with more robust alternatives such as segmentation or object grounding (e.g., GLIP)? A comparison or further justification would be helpful.   \n2. Could you elaborate on the rationale for requiring manual selection of contiguous patches in ADVEDM-A? Additionally, how does the method perform when applied to images with minimal background space or densely packed objects?   \n3. The attention reallocation is one of key components of ADVEDM-A, but its impact is not evaluated. Including an ablation study would help clarify its contribution to performance. Also, have you examined the sensitivity of other key hyperparameters (e.g., scaling factor β) to understand their influence on attack success or semantic preservation?  \n4. What target response templates are used to guide baseline attacks toward object injection or removal? For example, if the goal is to inject a “ruler to the left of a tape on the table,” how is this target specified for the baselines? Clarifying this would help assess the fairness of the comparisons.\n\nLIMITATIONS:\nSee weakness.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 4, "CLARITY": 2, "IMPACT": 2, "ORIGINALITY": 2, "DATE": "2025-06-27"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes AdvEDM, a fine-grained adversarial attack on vision-language models (VLMs) in embodied decision making tasks. Unlike prior methods that rely on strong assumptions or disrupt global semantics, this approach perturbs only key objects to produce valid but incorrect decisions. Two variants—semantic removal and addition—demonstrate strong effectiveness across general and EDM specific benchmarks, revealing realistic safety risks from subtle, task-consistent attacks.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n\nThe paper addresses a timely and important topic—embodied safety in vision-language decision-making systems.\n\nThe motivation is clearly articulated: prior attacks often disrupt global semantics, whereas the proposed method subtly alters key objects while preserving overall scene context, posing more realistic and severe safety risks.\n\nWeaknesses:\n\nThe proposed method appears tailored to decoupled VLM architectures and may not generalize to recent unified models such as OpenVLA series.\n\nThe set of baselines is limited and outdated; strong recent methods in the same setting, such as [1, 2], are missing.\n\nThe overall idea closely resembles [3], but the paper lacks adequate comparison and discussion.\n\n\n[1]Chain of Attack: On the Robustness of Vision-Language Models Against Transfer-Based Adversarial Attacks, CVPR2025\n\n[2]Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models, TIFS2024\n\n[3] Replace-then-Perturb: Targeted Adversarial Attacks With Visual Reasoning for Vision-Language Models, arxiv 2024\n\nQUESTIONS:\nSee Weakness.\n\nLIMITATIONS:\nThe attack assumes access to images after capture by the robot’s camera, which is unrealistic in physical-world deployment where post-capture modification is impractical.", "TITLE": "Official Review", "RECOMMENDATION": 3, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-01"}