A systematic study on the vulnerabilities of Vision-Language Model (VLM)-controlled robots has revealed significant risks associated with physical prompt injection attacks. Researchers conducted a comprehensive analysis of how adversarial text placed within a robot's visual field can influence its decision-making processes. This study categorizes the types of attacks into four main areas: indirect signage, task redefinition, authority impersonation, and conflict injection, all evaluated through a benchmark of 20 distinct prompts across three physical scene layouts and command variations.
In trials involving three leading VLMs—GPT-4o, Gemini 2.5 Flash, and Qwen3-VL-32B—attack success rates were recorded at 27.0%, 29.4%, and 5.0%, respectively. Notably, entities impersonating authority and those deploying negation tactics successfully transferred their effects among all models. Analysis indicated that nearly all successful attacks were acknowledged by the models (99.9% acknowledgment rate). The mechanisms of defense varied by model: Gemini employed explicit rejection of adversarial inputs, while GPT-4o exhibited perceptual inattention.
The study further evaluated three mitigation strategies: a prompt-based defense (75-100% effectiveness, depending on the model), two-stage verification (85-100%), and pre-processing text masking (100% effective). Although these defenses significantly lower the risk of compromise, they come with trade-offs, potentially impairing the robot's ability to process in-scene labels during complex tasks. These findings highlight the vulnerabilities inherent in VLM-driven robotic systems and the necessity for robust defensive measures.