Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots

2026-08-06

AI Summary

This work addresses the vulnerability of vision-language model (VLM)-driven robots to malicious textual interference in physical environments, which can induce erroneous command execution. The study presents the first comprehensive taxonomy and benchmark for physical prompt injection attacks targeting VLM-based robotic systems, introducing four systematic attack strategies. Leveraging state-of-the-art models—including GPT-4o, Gemini 2.5 Flash, and Qwen3-VL-32B—the authors evaluate twenty adversarial prompts in real-world settings. Experimental results demonstrate attack success rates up to 29.4%, with authority impersonation and negation-based attacks exhibiting notable cross-model transferability. Furthermore, three lightweight defense mechanisms are shown to reduce attack risk by 75%–100% while preserving near-original performance on legitimate tasks.

Abstract

Vision-Language Models (VLMs) are increasingly deployed as planners in robotic systems, where they translate natural-language commands into executable actions grounded in visual scene understanding. This tight coupling between perception and instruction-following introduces a new attack surface: adversarial text placed within the robot's visual field can act as an indirect prompt injection into the VLM's reasoning stack. We present a systematic study of physical prompt injection attacks against VLM-controlled sorting, introducing a four-category taxonomy, indirect signage, task redefinition, authority impersonation, and conflict injection, instantiated as a benchmark of 20 attack prompts evaluated across three physical scene layouts and three command formulations that vary in destination specificity and rule explicitness. Across 5,670 trials on three frontier VLMs (GPT-4o, Gemini 2.5 Flash, Qwen3-VL-32B), attacks succeed at 27.0%, 29.4%, and 5.0% respectively, with authority-impersonating and negation attacks transferring across all three models. Analysis of reasoning traces reveals that successful compromise is nearly always conscious (99.9% acknowledgment rate), and that models defend through structurally different mechanisms, explicit rejection for Gemini, perceptual inattention for GPT-4o. We evaluate three simple mitigations: prompt-based defense (75-100% effective, model-dependent), two-stage verification (85-100%), and pre-processing text masking (100%). Our findings show that VLM-controlled manipulation is meaningfully vulnerable to human-readable physical signage, and that simple defenses substantially reduce risk, though defense choice involves trade-offs. The defenses preserve general task capabilities in our benchmark, but they may impair tasks that require reading in-scene labels.

Problem

• physical prompt injection
• vision-language models
• robotic systems
• adversarial text
• instruction hijacking

Innovation

• physical prompt injection
• vision-language models
• robotic security
• adversarial signage
• mitigation strategies