Spatiotemporal Attacks for Embodied Agents

1 Introduction

• Embodied agents navigate using egocentric vision to answer questions or recognize objects, and Figure 1 illustrates an attack that changes an answer by perturbing a sofa and laptop.The correct answer shown in the example is “living room.”Source: §1 · p. 2, Figure 1 · p. 2
• Because embodied agents move through dynamic environments and predict from historical observations, attacks based on a single image or view may be insufficient.Prior adversarial work had focused mainly on static images or scenes.Source: §1 · p. 2
• The method uses trajectory attention to identify influential scene views, then perturbs contextual objects’ 3D properties in those views.A differentiable neural renderer enables gradient-based attacks where agents otherwise use images from undifferentiable renderers.Source: §1 · p. 3
• The attacks outperform other 3D adversarial methods against state-of-the-art embodied agents and transfer to a black-box renderer; agents are reported as more sensitive to texture than shape.The paper also reports a perceptual study comparing current embodied agents with human vision.Source: §1 · p. 3

2 Related Work

• Image-domain methods perturb pixels, while static 3D methods manipulate shapes, textures, camouflage, or patches; these approaches principally address static scenes.The cited methods include gradient-based attacks with differentiable renderers and patches for real-world 3D attacks.Source: §2 · pp. 3–4
• Unlike prior static-scene attacks, the paper incorporates temporal and spatial information and reports stronger attacks for embodied tasks.The related-work discussion names PS-GAN as a patch-based approach for autonomous-driving systems.Source: §2 · p. 4
• Attacks on reinforcement-learning agents generally target game settings with visual observations, whereas this work studies embodied EQA and EVR tasks with vision and language inputs.The passage cites Atari as a common single-agent setting and Gleave et al. for multi-agent attacks.Source: §2 · p. 4

3 Adversarial Attacks for the Embodiment

• Embodied agents navigate and interact with dynamic environments through egocentric vision, with intelligence framed as emerging through agent–environment interaction and sensorimotor activity.In EQA, an agent navigates a 3D environment to answer a question.Source: §3 · p. 4

3.1 Motivations

• Attacks may manipulate agents into unexpected actions, while also providing a way to examine model weaknesses and blind spots and inform robustness efforts.The paper presents these as motivations for adversarial attacks on embodied agents.Source: §3.1 · p. 4

3.2 Problem Definition

• For a static image, an adversarial example makes the model predict the wrong label while keeping the input distance small.The formulation uses a distance metric to constrain the difference between the original and adversarial images.Source: §3.2 · p. 5
• For embodied agents, the formulation perturbs 3D object properties across selected time steps so the resulting rendered observations can fool the agent.The rendered views depend on the object and time-specific conditions such as camera view and illumination; Figure 2 depicts temporal view selection and spatial perturbation of contextual objects.Source: §3.2 · p. 5, Figure 2 · p. 5

4 Spatiotemporal Attack Framework

• The framework couples temporal and spatial information to generate 3D adversarial perturbations for embodied agents.It uses interaction history to select views and perturb contextual objects within them.Source: §4 · pp. 5–6

4.1 Temporal Attention Stimulus

• Trajectory attention assigns contribution weights to historical views, guiding attacks toward objects in views with higher weights.The module computes view contributions from gradients of the target class with respect to feature maps, then normalizes the weights.Source: §4.1 · pp. 6–7

4.2 Spatially Contextual Perturbations

• The spatial component perturbs multiple contextual 3D objects in the K most important views, rather than targeting only one object.Perturbable physical properties include texture and shape, weighted by the contribution of the selected views.Source: §4.2 · p. 7

4.3 Optimization Formulations

• The optimization combines attack and perceptual losses, averaging across conditions such as camera views and illumination to seek visually imperceptible perturbations.For each object, five positional views one meter away with azimuths uniformly sampled from 0° to 180° are used; rendered RGB changes constrain shape or texture perturbations consistently.Source: §4.3 · p. 8

5.2 Evaluation Metrics

• Evaluation uses top-1 accuracy, distance to target at termination (dT), distance change (d∆), and minimum distance to target (dmin), with attacks seeking worse metric values.Higher dT and dmin and lower d∆ and accuracy indicate worse performance.Source: §5.2 · p. 9

5.3 Implementation Details

• Attacks use PACMAN for EQA and Embodied Mask R-CNN for EVR; unless specified otherwise, they perturb texture rather than shape.The implementation uses SGD with momentum 0.9, weight decay 10^-4, and up to 60 iterations; texture attacks are described as more suitable for physical extension.Source: §5.3 · p. 9

5.1 Experimental Setting

• The experiments cover EQA question answering and EVR visual recognition, evaluating agent performance throughout episodes from random placement to task completion.EQA uses the EQA-v1 dataset, with 648 training, 68 validation, and 58 test environments; perturbations are bounded by 32 pixel values per 224 × 224 frame in ℓ∞ norm.Source: §5.1 · p. 8, §5.4 · p. 9

5.4 Attack via a Differentiable Renderer

• 50.23%, 44.19%, and 39.94% EQA accuracy fell to 6.17%, 4.26%, and 3.42% at 10, 30, and 50 steps; the attacks also outperform static 3D methods.Visual-recognition accuracy fell from 89.91% to 18.32%; the example shows the agent answering “television” instead of “chair” after adversarial textures.Source: Table 1 · p. 10, §5.4 · p. 10, Figure 3 · p. 10
• For navigation, white-box and black-box attacks increase dT and dmin, especially on T−50 tasks, while d∆ falls to around zero or becomes negative.These changes indicate little movement toward the target, and in some cases movement away from it.Source: §5.4 · pp. 10–11
• The attacks transfer to non-differentiable renderers, but are less effective there than against the neural renderer.The evaluation also tests transfer across PACMAN, NAV-GRU, NAV-React, and VIS-VGG.Source: §5.4 · p. 9, Figure 4 · p. 11

5.5 Transfer Attack onto a non-differentiable Renderer

• The transfer test applies scenes perturbed with the neural renderer to the original non-differentiable renderer.The perturbations are saved as scenes before evaluation.Source: §5.5 · p. 11
• The perturbations transfer to the black-box renderer, but attack it less effectively than the neural renderer.The black-box test uses the original EQA-V1 OpenGL renderer with unknown parameters.Source: §5.5 · p. 11
• The authors attribute weaker transfer to JPG compression, renderer parameter differences, and limited transferability from optimization-based attacks.They note that adversarial examples are sensitive to image transformations.Source: §5.5 · p. 12

5.6 Generalization Ability of the Attack

• The same perturbations retain strong attack ability across different questions and starting points, despite a slight drop from the baseline attack.The evaluated settings use higher QA accuracy than the baseline.Source: §5.6 · p. 12, Table 2 · p. 12

5.7 Improving Agent Robustness with Adversarial Training

• The defense trains two PACMAN models with either generated texture perturbations or Gaussian noise, adding a fixed number of examples each epoch.The models are denoted AT and GT, respectively.Source: §5.7 · pp. 12–13
• Adversarial training improves QA accuracy and lowers dT for some tested noise types.The test set contains 110 questions in five houses, and perturbations are generated in the white-box setting.Source: §5.7 · p. 13, Table 3 · p. 13

5.8 Ablation Study

• The ablations vary K, the number of historical views, and M, the number of contextual objects considered, on T−30.The overall perturbation magnitude is held at 32/255 in both comparisons.Source: §5.8 · p. 13
• For navigation, K=3 historical views nearly achieves the optimal attack success rate, while increasing K improves question answering less.The comparison holds maximum M=5 and total perturbation magnitude at 32/255.Source: §5.8 · p. 13, Figure 5 · p. 13
• Attack success rate increases as the number of contextual objects M grows and converges around M=5.The experiments fix K=3 and perturbation magnitude at 32/255; about five or six objects are observable in three frames.Source: §5.8 · p. 13, Figure 5 · p. 13
• Contextual-object attacks outperform single-object attacks by 4.67% for room-location questions and 28.51% for composition questions.For color questions, attack success rates are 3.56% with contextual attacks and 9.88% with single-object attacks.Source: §5.8 · p. 14, Figure 6 · p. 14
• Attention visualizations show agents use contextual-object clues for location and composition questions, but focus on target objects for color questions.The visualization covers the last five views and attention maps for locational/compositional and color-related questions.Source: §5.8 · p. 14, Figure 6 · p. 14

6 Conclusion

• The framework combines trajectory attention over scene views with perturbations to physical properties of contextual objects in important views.The paper reports experiments on EQA-v1 across several embodied tasks in white-box and black-box settings, with strong attack and generalization abilities.Source: §6 · p. 14
• The perturbations form 3D adversarial examples intended to attack embodied agents.The conclusion characterizes their scope as adversarial attacks on the embodiment.Source: §6 · p. 14
• The authors identify simulated evaluation as the current boundary for most embodied tasks and propose real-world attacks as future work.They suggest projection or 3D printing as possible ways to bring perturbations into real-world scenarios.Source: §6 · p. 14

Supplementary Material: Spatiotemporal Attacks for Embodied Agents

• The listed authors include Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, and Yuqing Ma.The author list marks Xianglong Liu with a star.Source: Supplementary Material: Spatiotemporal… · p. 19
• The remaining listed authors are Xinyun Chen, Stephen J. Maybank, and Dacheng Tao.Source: Supplementary Material: Spatiotemporal… · p. 19
• The affiliations include Beihang University and the Beijing Advanced Innovation Center for Big Data-Based Precision Medicine.The passage also lists State Key Laboratory of Software Development Environment at Beihang University.Source: Supplementary Material: Spatiotemporal… · p. 19

• Affiliation listed: UBTECH Sydney AI Centre, School of Computer Science, Faculty of Engineering, The University of Sydney, Australia.Source: §4 · p. 19

1.1 Generalization Ability of the Attack

• Generalization uses 99 questions from 5 houses, testing transfer across questions on the same perturbed object and across alternate starting points.Alternate starts averaged a distance change of 2.47 (range 0.83–9.52); 45.45% of the 99 starts were in different rooms.Source: §1.1 · p. 19

1.2 Improving Agent Robustness with Adversarial Training

• Adversarial training uses equal numbers of clean and perturbed scenes, 32/255 perturbations, and 300 epochs for QA and NAV; evaluation also tests Gaussian noise.Training uses SGD at learning rate 0.001; Gaussian noise has mean 0 and standard deviation 0.38.Source: §1.2 · p. 19

1.3 Perceptual Studies via Amazon Mechanical Turk (AMT)

• The AMT study compares human classification of shape- and texture-perturbed objects using 30 objects and 600 responses.Each of 60 HITs received 10 assignments; participants selected an object category without a response time limit.Source: §1.3 · p. 20

2.1 Texture v.s. Shape

• T−30 attack accuracy was 4.26% for texture versus 27.14% for shape; human classification accuracy was 83.3% for texture versus 32.7% for shape.The authors conclude embodied agents are more sensitive to texture than shape, unlike humans, and identify shape-based training as future work.Source: §2.1 · pp. 20–21

2.2 Transfer Attack onto a Black-box Renderer

• The attacks transfer to a black-box renderer on EQA tasks T−10 and T−50, extending the reported T−30 transfer result.Figures 2 and 3 show transfer results for T−10 and T−50, respectively.Source: §2.2 · p. 21, Figure 2 · p. 21, Figure 3 · p. 21

2.3 Sample Adversarial Attacks for Question Answering and Visual Recognition

• Agents answer EQA questions and recognize visual objects correctly in clean scenes but incorrectly in the corresponding adversarial scenes.The examples include questions about object color and room location, and visual-recognition failures such as missing the cabinet.Source: §2.3 · p. 22, Figure 4 · p. 22, Figure 5 · p. 22

2.4 Sample Attention Maps of the Agent for Question Answering

• Attention maps show agents use contextual objects for locational and compositional questions but focus mainly on target objects for color questions.Source: §2.4 · p. 23

2.5 Sample Adversarial Attacks for Navigation

• Agents reach the navigation goal in clean scenes but stop early in adversarial scenes.The examples show stops at planner steps 5, 4, and 12 after textures of contextual objects are perturbed.Source: §2.5 · p. 23, Figure 15 · p. 26, Figure 16 · p. 26