Physical Prompt Injection Attacks on Large Vision-Language Models

• URL: http://arxiv.org/abs/2601.17383v1
• Date: Sat, 24 Jan 2026 09:13:28 GMT
• Title: Physical Prompt Injection Attacks on Large Vision-Language Models
• Abstract summary: Large-Language Models (LVLMs) are increasingly deployed in real-world intelligent systems for perception and reasoning in open physical environments.<n>We propose the first Physical Prompt Injection Attack (PPIA), a black-box attack that embeds malicious typographic instructions into physical objects perceivable by the LVLM.<n>We evaluate PPIA across 10 state-of-the-art LVLMs in both simulated and real-world tasks including visual question answering, planning, and navigation, PPIA attack success rates up to 98%.
• Score: 21.694496200641794
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Large Vision-Language Models (LVLMs) are increasingly deployed in real-world intelligent systems for perception and reasoning in open physical environments. While LVLMs are known to be vulnerable to prompt injection attacks, existing methods either require access to input channels or depend on knowledge of user queries, assumptions that rarely hold in practical deployments. We propose the first Physical Prompt Injection Attack (PPIA), a black-box, query-agnostic attack that embeds malicious typographic instructions into physical objects perceivable by the LVLM. PPIA requires no access to the model, its inputs, or internal pipeline, and operates solely through visual observation. It combines offline selection of highly recognizable and semantically effective visual prompts with strategic environment-aware placement guided by spatiotemporal attention, ensuring that the injected prompts are both perceivable and influential on model behavior. We evaluate PPIA across 10 state-of-the-art LVLMs in both simulated and real-world settings on tasks including visual question answering, planning, and navigation, PPIA achieves attack success rates up to 98%, with strong robustness under varying physical conditions such as distance, viewpoint, and illumination. Our code is publicly available at https://github.com/2023cghacker/Physical-Prompt-Injection-Attack.

Related papers

• Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices [7.183439319638428]
  Vision-Language Models (VLMs) are rapidly deployed on human-facing wearable devices such as smart glasses to enable multimodal perception and AI-assisted decision-making.<n>Our work characterizes how malicious textual information embedded in physical environments introduces a high-priority visual channel for prompt injection.<n>Using physically captured photos from AI glasses in over 200 real-world environments, our analysis identifies 6 representative threat vectors of physically injected prompts.<n>Results show that these attacks consistently manipulate model outputs across integrity- and safety-critical tasks, achieving attack success rates of up to 96% and 60% in simulated and real-world settings.
  arXiv  Detail & Related papers  (2026-07-11T11:56:05Z)
• Towards Robustness against Typographic Attack with Training-free Concept Localization [42.575178574443946]
  Contrastive Language-Image Pretraining models (CLIP) serve as the foundational vision encoders for most modern Large Vision Language Models (LVLMs)<n>CLIP models exhibit a critical yet underexplored failure mode: irrelevant text appearing within images confounds visual representations, biasing them toward lexical meaning rather than true visual semantics.<n>This issue, commonly described as a Typographic Attack (TA), exposes a vulnerability that poses a significant risk to safety-critical applications such as autonomous driving.<n>We propose a novel, training-free mechanistic interpretability method to achieve interpretable and effective robustness against TA.
  arXiv  Detail & Related papers  (2026-07-02T17:55:24Z)
• CPG-PAD: Concept-Informed Prompts Guided Presentation Attack Detection [33.657914787417525]
  Concept-Informed Prompts Guided Presentation Attack Detection (CPG-PAD) is a framework that introduces model-level concept guidance into the prompt learning process.<n>CPG-PAD consistently achieves state-of-the-art cross-domain performance under multi-source, limited-source, and single-source settings.
  arXiv  Detail & Related papers  (2026-07-01T15:33:45Z)
• Deep Expert Injection for Anchoring Retinal VLMs with Domain-Specific Knowledge [66.67024684187915]
  Large Vision Language Models (LVLMs) show immense potential for automated ophthalmic diagnosis.<n>Their clinical deployment is severely hindered by lacking domain-specific knowledge.<n>EyExIn is a framework designed to anchor retinal VLMs with expert knowledge via a Deep Expert Injection mechanism.
  arXiv  Detail & Related papers  (2026-03-07T09:43:49Z)
• Image-based Prompt Injection: Hijacking Multimodal LLMs through Visually Embedded Adversarial Instructions [7.575333495550402]
  We study Image-based Prompt Injection (IPI), a black-box attack in which adversarial instructions are embedded into natural images to override model behavior.<n>Our end-to-end IPI pipeline incorporates segmentation-based region selection, adaptive font scaling, and background-aware rendering.
  arXiv  Detail & Related papers  (2026-03-04T01:58:08Z)
• V-Attack: Targeting Disentangled Value Features for Controllable Adversarial Attacks on LVLMs [66.81402538540458]
  We propose V-Attack, a novel method for precise local semantic attacks.<n>V-Attack improves the attack success rate by an average of 36% over state-of-the-art methods.
  arXiv  Detail & Related papers  (2025-11-25T11:51:17Z)
• Look, Zoom, Understand: The Robotic Eyeball for Embodied Perception [8.542874528320004]
  Existing vision models and fixed RGB-D camera systems fail to reconcile wide-area coverage with fine-grained detail acquisition.<n>We propose EyeVLA, a robotic eyeball for active visual perception that can take proactive actions based on instructions.
  arXiv  Detail & Related papers  (2025-11-19T09:42:08Z)
• Attentive Feature Aggregation or: How Policies Learn to Stop Worrying about Robustness and Attend to Task-Relevant Visual Cues [69.24378760740171]
  We address visuomotor policy feature pooling as a solution to the observed lack of robustness in perturbed scenes.<n>We achieve this via Attentive Feature Aggregation (AFA), a lightweight, trainable pooling mechanism that learns to naturally attend to task-relevant visual cues.<n>Our findings show that ignoring extraneous visual information is a crucial step towards deploying robust and generalisable visuomotor policies.
  arXiv  Detail & Related papers  (2025-11-13T19:31:05Z)
• Black-Box Visual Prompt Engineering for Mitigating Object Hallucination in Large Vision Language Models [16.743274500376657]
  Large Vision Language Models (LVLMs) often suffer from object hallucination, which undermines their reliability.<n>We propose Black-Box Visual Prompt Engineering (BBVPE) to identify optimal VPs that enhance LVLM responses without needing access to model internals.<n>Our approach employs a pool of candidate VPs and trains a router model to dynamically select the most effective VP for a given input image.
  arXiv  Detail & Related papers  (2025-04-30T11:58:30Z)
• Exploring Typographic Visual Prompts Injection Threats in Cross-Modality Generation Models [64.55456491855678]
  Cross-Modality Generation Models (GMs) demonstrate remarkable capabilities in various generative tasks.<n>This paper comprehensively investigates the performance impact induced by Typographic Visual Prompt Injection (TVPI) in various LVLMs and I2I GMs.<n>We thoroughly evaluate the TVPI security risks on various open-source and closed-source LVLMs and I2I GMs under visual prompts with different target semantics.
  arXiv  Detail & Related papers  (2025-03-14T15:42:42Z)
• Manipulation Facing Threats: Evaluating Physical Vulnerabilities in End-to-End Vision Language Action Models [79.60405008196139]
  Vision Language Action Models (VLAMs) are being proposed to achieve better performance in open-vocabulary scenarios for robotic manipulation tasks.<n>In this paper, we comprehensively evaluate VLAMs in the face of potential physical threats.
  arXiv  Detail & Related papers  (2024-09-20T03:02:05Z)
• MOKA: Open-World Robotic Manipulation through Mark-Based Visual Prompting [97.52388851329667]
  We introduce Marking Open-world Keypoint Affordances (MOKA) to solve robotic manipulation tasks specified by free-form language instructions. Central to our approach is a compact point-based representation of affordance, which bridges the VLM's predictions on observed images and the robot's actions in the physical world. We evaluate and analyze MOKA's performance on various table-top manipulation tasks including tool use, deformable body manipulation, and object rearrangement.
  arXiv  Detail & Related papers  (2024-03-05T18:08:45Z)
• PIN: Positional Insert Unlocks Object Localisation Abilities in VLMs [55.8550939439138]
  Vision-Language Models (VLMs) have shown immense potential by integrating large language models with vision systems. These models face challenges in the fundamental computer vision task of object localisation, due to their training on multimodal data containing mostly captions. We introduce an input-agnostic Positional Insert (PIN), a learnable spatial prompt, containing a minimal set of parameters that are slid inside the frozen VLM. Our PIN module is trained with a simple next-token prediction task on synthetic data without requiring the introduction of new output heads.
  arXiv  Detail & Related papers  (2024-02-13T18:39:18Z)
• Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injection [64.67495502772866]
  Large Language Models (LLMs) are increasingly being integrated into various applications. We show how attackers can override original instructions and employed controls using Prompt Injection attacks. We derive a comprehensive taxonomy from a computer security perspective to systematically investigate impacts and vulnerabilities.
  arXiv  Detail & Related papers  (2023-02-23T17:14:38Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.