Multi-view attacks mislead autonomous driving VLAs
A CVPR AdvML challenge shows how attackers steer autonomous-driving vision‑language agents using coordinated tweaks across six camera views and short text suffixes. Image‑side attacks dominate, typography inside images is a persistent weak point, and feature‑space objectives improve black‑box transfer, reshuffling the leaderboard and signalling real deployment risk.
Autonomous driving now leans on vision‑language agents (VLAs) to read busy roads and reason about hazards. The CVPR 2026@AdvML Workshop Challenge puts those systems under pressure in a controlled but telling way: six synchronised camera views per scene, DriveLM‑style question answering, and a tight set of attack levers that mirror realistic constraints.
Each phase offered 200 scenes with six images and a structured set of driving questions. Attackers could alter the images and append only a textual suffix to each question. Evaluation blended three pieces: a Large Language Model (LLM) judged answer correctness, a representation‑similarity score preserved visual fidelity, and an exponential penalty discouraged long suffixes. Phase I used a known DriveLM‑Agent; Phase II added a hidden black‑box model and averaged scores, forcing transfer rather than overfitting.
What actually breaks these agents is delightfully instructive. Because suffixes were penalised, top submissions leaned into image‑side manipulation. They also treated each scene as a whole, optimising across all six views together. That matches how the agent fuses evidence: if every camera whispers the same lie, the model listens. Teams even used the question taxonomy and graph structure to prioritise budget toward safety‑critical prompts that sway overall scoring.
Feature‑space attacks stood out. Rather than only chasing wrong final text, several methods targeted shared Subspace" target="_blank" rel="noopener" class="term-link">semantic subspaces where the visual encoder and language stack meet. Nudge those bridges and your perturbation rides along to other architectures. Attacking shallow hidden states and CLIP‑like embeddings paid off in Phase II, where simple output‑level hacking tended to stall. JPEG‑aware optimisation mattered too, since the submission pipeline re‑encodes images.
The most stubborn hole remains typographic: render text or text‑like glyphs into the frames and VLAs often follow the script. Spread the same cues across views and the effect strengthens and transfers. It is rarely stealthy in a physical sense, but it reliably exposes how current models over‑index on readable artefacts inside the scene.
Transfer changed the game. The hidden evaluator reordered the leaderboard and widened the spread, underlining that model‑agnostic objectives travel further than model‑specific tricks. There are caveats: limited submissions constrain variance estimates, a proprietary judge clouds root‑cause analysis, and JPEG and packaging details shape outcomes. Still, as a probe of where multi‑view, language‑conditioned systems bend, this is an elegant experiment. The open question is how these lab‑shaped weaknesses manifest amid real signage, reflections and imperfect sensor sync, where six cameras rarely agree so neatly.
Additional analysis of the original ArXiv paper
