PaperlayerView exact revision on arXiv

Source-linked AI summary

A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era

Eric Liang, Alan Luo, Kaiwen Yuan

arXiv:2610.29196v1cs.CVcs.CRcs.LG

TL;DR

Physical adversarial robustness of edge grounding VLMs has not been systematically studied, despite their deployment relevance and differences from detector outputs. The paper compares compact VLMs and detectors with a unified, occlusion-controlled evaluation and failure partition. It finds VLMs can be as vulnerable as detectors, while failure modes vary with output format and shift under distribution change.

  • Problem

    Physical vulnerabilities of edge-deployable grounding VLM localization had not been evaluated alongside detectors, despite VLMs’ increasing use in edge settings.

    Source: §1 · p. 1, §2.2 · p. 3

  • Method

    The paper evaluates person-worn adversarial patches with cASR conditioned on localization under a matched gray occluder and partitions failures into omission, substitution, and displacement.

    Source: §4.3 · p. 6, §4.4 · p. 6

  • Results

    Grounding VLMs can be as vulnerable as detectors, and failure mode is largely associated with output format rather than architecture family.

    Source: §1 · p. 2

  • Takeaways & Limitations

    Only omission is visible to downstream systems; displacement and substitution produce well-formed but incorrectly placed boxes that may appear correct.

    Source: §7 · p. 9

    The attacks were digitally simulated rather than evaluated with printed patches and camera capture, and the study uses only white-box suppression attacks.

    Source: §6 · p. 9

Abstract

from arXiv · show

Recent advancements in Vision-Language Models (VLMs) enable end-to-end visual grounding via language prompts and generative decoding, demonstrating largely improved zero-shot and open-vocabulary detection capabilities. As a result, VLMs are rapidly being deployed at the edge in safety-critical real-world systems. However, the physical adversarial robustness of edge VLMs has not been systematically studied, and the fundamental differences in output with modern object detectors create methodological challenges for fair evaluation. To compare the two families directly, we evaluate every selected representative model on one outcome: whether an adversarial patch worn on a person evades detection of the model. We report this by introducing a unified metric, conditional attack success rate (cASR), counted only on images the model still localizes under a matched gray occluder, and partition every failure into omission (no box), substitution (a box on the patch), and displacement (a box on neither). We benchmark the physical adversarial vulnerability of compact grounding VLMs against a range of object detectors, and find that the VLMs can be as vulnerable as the detectors. We disclose that failure mode is largely associated with the output format of a model rather than its architecture family. Of the three, only omission is visible to a downstream system; displacement and substitution return confident, well-formed boxes, making them potentially more dangerous failures. Further, we find that, under distribution shift, VLMs that primarily failed by omission instead shift to failing more by displacement/substitution. Thus, a grounding VLM can inherit the detector's vulnerability while showing the possibility to adopt more dangerous failure modes. Our code and data are available at https://github.com/ericliang1/physical-adversarial-robustness.

1 Introduction

Grounding VLMs are moving into edge systems, but their physical adversarial robustness has not been tested on a common scale with detectors. The paper compares their vulnerability and failure modes using person-worn patches.

1 Introduction

  • Grounding VLMs return boxes from language prompts, and edge systems may pass those boxes directly to planners without confidence or uncertainty signals.Thus, correct and incorrect boxes can arrive in the same form.Source: §1 · p. 1
  • Physical adversarial patches threaten detectors, but grounding VLMs had not been tested against them on a common scale.The paper trains patches to suppress each model’s native output to compare their spatial-grounding vulnerabilities.Source: §1 · p. 2
  • The evaluation compares eleven models on whether a box lands on the target, using cASR and partitions for omission, substitution, and displacement.cASR counts only images localized under a matched gray occluder; Figure 1 illustrates the three failure modes.Source: §1 · p. 2, Figure 1 · p. 2
  • Grounding VLMs can be as vulnerable as detectors, while failure mode is largely associated with output format rather than architecture family.Architecture also plays a role in the failure partition.Source: §1 · p. 2

2 Related work

Object detection spans CNN and transformer systems, including open-vocabulary detectors, while compact VLMs add language-prompted grounding. Prior physical-attack evaluations addressed detectors, not edge-deployable real-time VLM localization.

2.1 Object detection and grounding VLMs

  • CNNs and transformers both serve detection, and open-vocabulary capabilities let detectors respond to natural-language prompts.Compact grounding VLMs also return boxes for open-vocabulary queries, motivating security comparisons across detection schemas.Source: §2.1 · pp. 2–3

2.2 Adversarial attacks on object detection

  • Physical adversarial patches expose detector vulnerabilities, while language-interface attacks use a different search formulation because gradients do not act on discrete tokens.VLMs sit at the intersection of these vulnerability types; prior physical attacks on vision-language-action models targeted actions rather than localization.Source: §2.2 · p. 3
  • Existing physical-attack evaluations covered detectors, but none addressed real-time VLMs small enough for edge deployment.This work aims to evaluate their physical localization vulnerabilities using the traditional detector-attack framing.Source: §2.2 · p. 3

3 Methodology

The methodology benchmarks representative detectors and compact edge VLMs on a matched person-localization task. It trains model-specific suppression patches with printability and smoothness constraints.

3.1 Models and datasets

  • The benchmark selects closed-set and open-vocabulary detectors alongside edge VLMs with no more than 4B parameters.Training and evaluation use single-person images from COCO, PASCAL VOC, AdvT-Shirt, and out-of-distribution Waymo views.Source: §3.1 · p. 3

3.2 Adversarial patch training

  • The patch is placed at half the smaller target-box dimension, covering the person’s center while leaving heads and limbs visible.The square patch begins at 160 × 160 pixels before placement resizing.Source: §3.2 · pp. 3–4
  • Each model receives an independently trained, image-agnostic patch optimized to suppress its native person-detection output.Detector patches suppress final detections; VLM patches suppress bounding-box tokens. Figure 2 summarizes the training pipeline.Source: §3.2 · p. 4, Figure 2 · p. 4
  • Training uses Expectation Over Transformation with random rotations and brightness jitter to improve patch robustness across scenes.The patches are digitally applied; “physical” describes the threat model, not the evaluation medium.Source: §3.2 · p. 4
  • The shared loss adds non-printability and smoothness constraints to a model-specific suppression objective.The suppression term targets detector confidence, region-text similarity, or VLM grounding likelihood; Figure 3 shows detector patches with high-frequency patterns and VLM patches with text-like features.Source: Figure 3 · p. 4, §3.2 · p. 5

4 Evaluation framework

The framework aligns heterogeneous detectors and grounding VLMs around whether a patched person is correctly localized, then measures and categorizes failures under occlusion-controlled conditions.

4 Evaluation framework

  • The framework makes adversarial evaluation comparable across architectures by defining success as a patched person evading detection.Models are compared on the shared outcome of whether a box lands on the target.Source: §4 · p. 5

4.1 Configuration

  • The validation set has 331 images, while 999 Waymo images form the separate out-of-distribution set.The validation images comprise 155 COCO, 135 PASCAL VOC, and 41 AdvT-Shirt images.Source: §4.1 · p. 5

4.2 Output alignment

  • VLM outputs are prompted in native grounding format and normalized to xyxy; malformed or invalid boxes count as detection failures.Each detector contributes its highest-confidence person box clearing γ, while each VLM contributes its single emitted box.Source: §4.2 · p. 5

4.3 Occlusion control and conditional ASR

  • cASR counts adversarial failures only among images localized under a matched gray occluder, separating patch effects from occlusion and baseline errors.The gray-survivor set contains images localized at IoU ≥ τ against the ground-truth box; a patched-image box below τ counts as failure.Source: §4.3 · p. 6
  • Gray-occluder effects depend on localization tightness: precise boxes can lose overlap when the target center is covered, unlike loose boxes.Raw attack success could therefore penalize precise models for failures caused by the control occluder.Source: §4.3 · p. 6

4.4 Failure partition

  • The failure partition distinguishes omission, substitution onto the patch, and displacement onto neither target nor patch; the three modes sum to cASR.Substitution requires IoU with the patch footprint of at least 0.5; displacement falls below τ against the target and below 0.5 against the patch.Source: §4.4 · p. 6

5 Results

Across the benchmark, grounding VLMs can be as vulnerable to physical adversarial patches as detectors, while the failure modes vary with output format and shift under distribution change. Results also show that baseline localization and the gray-control set condition how cASR should be interpreted.

5 Results

  • Baseline in-distribution localization ranges from 83.0% to 100.0%, while Waymo accuracy falls for every model and reaches 27.6% for InternVL3-2B.Waymo cASR is computed on each model’s own gray-control set, as small as 305 of 999 images for InternVL3-2B and 366 for MiniCPM-V 4.6.Source: §5 · p. 6

5.1 VLMs can be as vulnerable as detectors

  • InternVL3-2B and PaliGemma 2-3B fail on 100% and 97.6% of their gray-control sets under patch attack, comparable to YOLO11s and YOLO26s at 100%.On AdvT-Shirt, all models localize at 95% or above without a patch; cASR counts failures only on images localized under the matched gray occluder.Source: §5.1 · p. 6, Table 1 · p. 7

5.2 Failure modes

  • Gated VLMs and YOLO models fail predominantly by omission, whereas free-text VLMs emit boxes and fail through displacement or substitution.InternVL3-2B and PaliGemma 2-3B have omission shares of 98.3% and 96.7%; Qwen3-VL-2B and LFM2.5-VL-3B record zero omissions at every threshold tested. Substitution occurs in region-text matchers and free-text VLMs, but not closed-set detectors or gated VLMs.Source: Table 2 · p. 7, §5.2 · p. 8
  • Raising τ from 0.5 to 0.9 raises Qwen3-VL-2B’s cASR to 95.6% while its omission rate remains zero.The increase comes from emitted boxes failing the stricter overlap criterion; omission-dominated PaliGemma 2-3B and InternVL3-2B change less.Source: §5.2 · p. 8

5.3 Under distribution shift

  • Under Waymo distribution shift, several models’ failures shift from omission toward displacement or substitution, even when overall cASR falls.InternVL3-2B’s cASR drops from 57.7% to 35.4%, while its displacement rises from 1.0% to 29.5%; closed-set YOLO11s, YOLO26s, and RT-DETRv2 remain omission-dominated.Source: §5.3 · pp. 8–9

6 Limitations

The study uses digitally simulated attacks rather than printed patches or camera captures, and evaluates only white-box attacks with a suppression objective.

6 Limitations

  • Attacks are digitally simulated, so the study does not measure transfer from physically printed patches or camera captures.The patches are optimized to be printable and pose-robust, but that does not constitute physical-world evaluation.Source: §6 · p. 9
  • The evaluation uses only white-box attacks, which assume full model access and do not reflect real-world deployment scenarios.The authors identify black-box evaluation as future work.Source: §6 · p. 9
  • The study tests only a suppression objective, leaving the persistence of failure-mode partitions under other attack objectives unevaluated.Source: §6 · p. 9

7 Conclusion

The conclusion finds that edge grounding VLMs can be as vulnerable as classic detectors, while their failure forms are associated largely with output format. The appendix reports four single-parameter ablations under the canonical settings.

7 Conclusion

  • Under one attack framework, one occlusion control, and a shared predicate, edge grounding VLMs can be as vulnerable as classic detectors, with failure form associated largely with output format.Only omission is visible downstream; displacement and substitution may be indistinguishable from correct detections.Source: §7 · p. 9

A Ablation studies

  • The appendix reports four ablations, each varying one attack parameter while holding the rest of the pipeline constant.All use the 331 validation images at canonical settings and are conditioned on the gray-control set.Source: A Ablation studies · p. 13

A.1 Patch size ablation

Across the patch-scale sweep, cASR generally rises but not monotonically, while the vulnerability ordering is broadly preserved.

A.1 Patch size ablation

  • Vulnerability ordering is broadly preserved across patch scales, indicating robustness to the scale parameter.The sweep uses a ∈ {0.25, 0.5, 0.75, 1.0}; cASR generally rises, though not monotonically.Source: §A.1 · p. 13, Figure 4 · p. 13

A.2 IoU threshold ablation

As the IoU threshold tightens, emitted-box models accumulate failures while omission-dominated models change comparatively little. Across tested prompts, the failure partition remains stable for the gated grammars and Qwen3-VL-2B.

A.2 IoU threshold ablation

  • Qwen3-VL-2B’s cASR rises from 20.1% to 95.6% as the IoU threshold increases from 0.5 to 0.9.Omission-dominated models change comparatively little because a box that is never emitted fails at every threshold.Source: §A.2 · p. 13, Figure 5 · p. 13

A.3 VLM prompt ablation

  • Across four prompts, gated grammars remain omission-dominated, while Qwen3-VL-2B records exactly zero omissions.The patch is held fixed while VLMs are evaluated under their training prompt and three paraphrases; failure rate varies by prompt.Source: §A.3 · pp. 13–14, Table 3 · p. 14

A.4 Detector confidence threshold ablation

The detector confidence-threshold ablation finds that higher confidence requirements coincide with increased attack success for every model.

A.4 Detector confidence threshold ablation

  • Attack success increases for every model as the detector confidence threshold rises.Table 4 reports conditional attack success versus detector confidence threshold; the passage suggests tasks requiring more precision become more vulnerable.Source: §A.4 · p. 15, Table 4 · p. 15

B Dataset construction

The dataset construction combines selected splits from four sources with filtering for one-person visibility and annotation quality.

B Dataset construction

  • The evaluation uses COCO val2017, PASCAL VOC 2007 and 2012 validation sets, AdvT-Shirt’s 1-person folder, and Waymo v2 perception training split.COCO val2017 was selected to prevent leakage from models trained on train2017.Source: B Dataset construction · p. 15
  • Datasets were filtered to one-person images using ground-truth boxes, then images with extra unannotated people and Waymo night-time images were removed.The night-time removal was intended to ensure proper visibility.Source: B Dataset construction · p. 15
  • Table 5 reports per-dataset filtering counts, and Figure 6 shows example images from each final dataset.Source: Table 5 · p. 15, B Dataset construction · p. 15, Figure 6 · p. 16

Related papers

Loading 2610.29196v1…