Paper Signs Hijack VLM Robots via Prompt Injection

Problem

The paper studies whether human‑readable text placed in a robot’s visual workspace can act as a physical prompt injection against vision‑language model (VLM) planners, causing robots to follow scene signage instead of operator instructions. This matters because VLMs are increasingly used as high‑level planners that translate natural‑language commands into actions, creating a new attack surface where adversarial signage can redirect behaviour without accessing software or networks.

Approach

The authors design a controlled, large‑scale benchmark centred on a canonical colour‑basket sorting task. They introduce a four‑category taxonomy of 20 attack prompts (indirect signage, task redefinition, authority impersonation, conflict injection) and vary three operator command formulations that differ in destination specificity and rule explicitness. The static‑image protocol supplies an overhead photograph of a real workspace to three VLMs (GPT‑4o, Gemini 2.5 Flash, Qwen3‑VL‑32B), and each model returns a structured pick‑and‑place plan. Trials cover three physical scene layouts and 10 repetitions per cell, totalling 5,670 evaluations. They measure task correctness, attack success, and classify model reasoning traces for whether the injected note is referenced, rejected, or ignored. They also evaluate three simple mitigations: a prompt‑level instruction to ignore in‑scene text, a two‑stage verification call, and OCR‑based pre‑processing that masks text regions.

Key Findings

• Overall attack rates: across 1,800 attack trials per model, attack success rates were 27.0% for GPT‑4o, 29.4% for Gemini 2.5 Flash, and 5.0% for Qwen3‑VL‑32B, showing substantial vulnerability in two frontier closed‑source models and markedly greater robustness for Qwen.
• Taxonomy results: indirect signage attacks consistently failed (0% ASR), while authority‑impersonation and direct negation attacks transferred most effectively across models. Specific prompts labelled OPERATOR OVERRIDE and "Do not use the blue basket" achieved cross‑model mean ASRs of roughly 80% and 67% respectively.
• Command dependence: making the operator’s rule explicit (the most informative command) paradoxically increased susceptibility to task‑redefinition attacks, enabling adversarial signs to overwrite rules and raising ASR notably for closed‑source models.
• Mechanism: successful compromises are almost always conscious—99.9% of successful trials explicitly reference the injected note in model reasoning. Models therefore read and defer to in‑scene instructions rather than failing to perceive them.
• Model differences: Gemini tends to defend by explicit rejection in its reasoning; GPT‑4o more often avoids mentioning the note (perceptual inattention); Qwen’s lower ASR reflects reduced attention to in‑scene text rather than a stronger instruction‑hierarchy, and when it does reference a note it complies similarly.
• Defences: OCR‑based text masking prevented all successful attacks in the benchmark (0% ASR). Two‑stage verification reduced ASR by about 85–100% depending on model. Prompt‑based defence effectiveness varied markedly (about 75–99% depending on model), reflecting differences in default model behaviour.

Limitations

The study uses a static‑image protocol and a single sorting task, so results may not generalise to continuous perception or other manipulation domains. Only three VLMs and printed paper notes were evaluated; attacks were not adversarially optimised. Defences that remove or ignore in‑scene text may degrade legitimate tasks that require reading labels.

Implications

From an offensive security perspective, the work demonstrates a practical, low‑cost attack vector: an adversary can influence VLM‑controlled robots by placing readable signs in the environment, without code or network access. Authority impersonation and negation prompts are particularly potent and can transfer across models, meaning attackers could plausibly redirect sorting or routing in warehouses, streets, or factories. Simple perceptual or verification changes mitigate these attacks in the benchmark, but the differing defence profiles suggest attackers can adapt by exploiting model‑specific behaviours or by increasing text salience to overcome perceptual inattention.