A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era

AI summary

Overview

Research area: Computer vision security — physical adversarial robustness of object detectors versus compact "edge" vision-language models (VLMs) that perform visual grounding.

Technical level: Intermediate. Comfortable for readers who know what bounding boxes, IoU, and adversarial patches are; the paper's core conceptual move (a shared metric and a failure taxonomy) is explained without heavy math.

Scope: An occlusion-controlled benchmark of eleven models (six detectors, five sub-4B grounding VLMs) under person-worn adversarial patches, comparing how often each model fails and how it fails, in-distribution and on out-of-distribution street-level imagery.

What This Paper Is About

Grounding VLMs are replacing object detectors in edge and safety-critical systems, returning a bounding box for a natural-language prompt. Prior work shows detectors can be fooled by printed adversarial patches worn on a person, but nobody had tested whether grounding VLMs are equally vulnerable, partly because VLMs and detectors emit outputs in fundamentally different forms. This paper builds a single evaluation framework — one attack objective, one occlusion control, one shared pass/fail predicate — so the two model families can be compared fairly, and then splits every failure into three categories that matter differently to a downstream system.

Key Contributions

1. A unified evaluation protocol across heterogeneous output formats. Every model is scored on one predicate — whether a box lands on the target person — with VLM outputs normalized to standard xyxy format, detectors read at their canonical confidence thresholds, and malformed VLM output counted as failure.

2. Conditional attack success rate (cASR). A new metric that scores a patch only on images the model still localizes under a matched gray occluder, separating genuine adversarial success from occlusion-induced failure and baseline model error.

3. A three-way failure partition. Every failure is classified as omission (no box emitted), substitution (a box lands on the patch, IoU ≥ 0.5 with the patch footprint), or displacement (a box lands on neither, below τ against the person and below 0.5 against the patch). The three are exclusive and sum to cASR.

4. A controlled benchmark of eleven models — three closed-set detectors, three open-vocabulary detectors, and five grounding VLMs with at most 4B parameters — each with its own white-box-trained patch, evaluated on 331 held-out images and 999 out-of-distribution Waymo images.

Main Findings

• VLMs can be as vulnerable as detectors. On AdvT-Shirt images, where every model localizes at 95% or above clean, the patches drive InternVL3-2B and PaliGemma 2-3B to 100% and 97.6% cASR, comparable to YOLO11s and YOLO26s, which both reach 100%. On in-distribution data InternVL3-2B (57.7%) and PaliGemma 2-3B (55.2%) exceed two of the six detectors tested.

• Robustness is a property of the individual model, not the family. VLM in-distribution cASR spans 9.2% (MiniCPM-V 4.6) to 57.7%; detectors span 18.2% (YOLO-World) to 78.3% (YOLO11s). The two ranges largely overlap, and YOLO-World at 18.2% is more robust than three of the five VLMs.

• Failure mode tracks output format, not architecture family. Gated models — PaliGemma 2-3B (96.7% of failures) and InternVL3-2B (98.3%), plus the score-gated YOLO detectors at 93–95% — fail almost entirely by omission, because a single token gates whether a box exists at all. Free-text VLMs (Qwen3-VL-2B, LFM2.5-VL-3B) record exactly zero omissions and fail by displacement (18.7% and 9.1% of their 20.1% and 14.3% cASR). MiniCPM-V 4.6 omits in fewer than 1% of cases.

• Only omission is visible to a downstream system. Displacement and substitution return confident, well-formed boxes at wrong locations, potentially indistinguishable from correct detections. Substitution is argued to be the more severe of the two: it anchors the system's attention on an attacker-carried object rather than empty space, and the box takes the patch's size, distorting any distance inference.

• Distribution shift converts visible failures into invisible ones. On Waymo, InternVL3-2B's omission drops from 56.7% to 4.6% while its displacement rises from 1.0% to 29.5%, even as its cASR falls from 57.7% to 35.4%. GDINO-Tiny's substitution rises from 3.4% to 16.6% and displacement from 10.8% to 36.7%; GDINO-Base's omission falls from 29.9% to 1.4% and substitution rises from 10.7% to 18.0%. Closed-set detectors shift far less and stay omission-dominated.

• Tightening the overlap criterion separates models by failure mode. Raising τ from 0.5 to 0.9 pushes Qwen3-VL-2B from 20.1% to 95.6% cASR — the largest aggregated in-distribution figure in the benchmark — while its omission holds at exactly zero; PaliGemma 2-3B and InternVL3-2B only move to 68.6% and 62.8%.

• Substitution appears wherever emission is not gated. Every closed-set detector and both gated VLMs register exactly zero substitution; the region-text matchers (GDINO-Base 10.7%, GDINO-Tiny 3.4%, YOLO-World 0.7%) and free-text VLMs (LFM2.5-VL-3B 5.2%, Qwen3-VL-2B 1.5%, MiniCPM-V 4.6 0.3%) register nonzero rates.

• Patches trained on the two families look different. Detector patches contain high-frequency patterns; VLM patches contain features resembling text.

• Prompt choice materially changes measured robustness. Re-evaluating each VLM patch under paraphrases shifts cASR considerably — MiniCPM-V 4.6 ranges from 9.2% to 42.7%, InternVL3-2B from 28.0% to 57.7% — though the failure partition stays stable and Qwen3-VL-2B records zero omissions under every prompt tested.

Methodology in Plain English

The team picked eleven models: three classic detectors, three open-vocabulary detectors that accept text prompts, and five compact VLMs small enough for edge hardware (no larger than 4B parameters). They filtered three person-detection datasets — COCO, PASCAL VOC, and AdvT-Shirt-1K — down to images containing exactly one person, giving 1,324 training and 331 validation images, and added 999 filtered single-person Waymo images as an out-of-distribution street-level test.

For each model they trained one image-agnostic square patch (160×160 at origin, placed at 0.5× the smaller side of the person box) to suppress that model's native output: person confidence for closed-set detectors, region-text similarity for open-vocabulary detectors, and the likelihood of the target's box tokens for VLMs. Printability and smoothness terms, adapted from Thys et al., keep the texture physically realizable. Training ran 500 epochs at learning rate 0.01 with expectation-over-transformation — random rotations in [−20°, 20°] and brightness jitter in [0.9, 1.1] — so the patches tolerate pose and lighting variation.

The evaluation control is the clever part. Before applying any adversarial patch, they apply a matched gray patch at the same location. A gray blob can itself cause a miss simply by covering the person's center, which would inflate a naive attack success rate. So they score the adversarial patch only on the images the model still gets right under the gray patch — that is cASR. Images are resized to 448×448 for VLMs and 640×640 for detectors; success requires IoU ≥ τ = 0.5 with the ground truth; detectors are read at their conventional thresholds (0.5 for closed-set, 0.3 for open-vocabulary).

Finally, each failure is bucketed as omission, substitution, or displacement, which reveals that two models with identical cASR can pose very different risks downstream.

Why This Matters

Research impact. Prior physical-patch evaluations covered detectors alone. This work supplies the missing common scale — a metric that neutralizes occlusion confounds and a taxonomy that turns a single success rate into a safety-relevant profile — plus evidence that output format, not architecture family, governs failure mode. That reframes how adversarial robustness for generative grounding should be reported.

Real-world applications:

• Autonomous driving and ADAS: pedestrian suppression or displacement on a street scene maps directly to a missed or mislocated crossing pedestrian.
• Robotics and embodied agents: planners that condition directly on a returned box, with no confidence score to threshold, inherit any displacement silently.
• Surveillance and crowd-safety systems: a patch worn on a shirt that induces substitution redirects attention to the attacker's own object.
• Edge deployment pipelines: existing hardware stacks built around detectors are being swapped for sub-4B VLMs; this paper says that swap does not buy robustness.

Industry relevance. The pragmatic takeaway is that substituting a grounding VLM for a detector does not reduce white-box failure rates, and the VLM may fail in modes a downstream system cannot detect. Any procurement or safety-case argument for swapping detector for VLM should be evaluated on two axes — how often the model fails, and whether those failures are visible in its output.

Future Directions

• Physical-world validation. All patches are applied digitally; "physical" refers to the threat model, not the evaluation medium. No printed patch or camera capture was tested, so physical-world transfer is unmeasured.
• Black-box attacks. Only white-box optimization was used, assuming full model access, which the authors note does not reflect real deployment.
• Alternative attack objectives. Only a suppression objective was tested; whether the omission/substitution/displacement partition persists under other objectives (for example, targeted mislocalization) is open.
• Prompt-robustness as a first-class variable. With MiniCPM-V 4.6 ranging from 9.2% to 42.7% cASR across phrasings, the community needs a principled way to report robustness that is not an artifact of one prompt.

Target Audience

Safety and security researchers working on adversarial robustness in vision; engineers evaluating whether to deploy grounding VLMs on edge hardware in place of detectors; practitioners in autonomous driving, robotics, and surveillance who consume bounding boxes without confidence scores; and benchmark designers who need a template for comparing generative and discriminative models on a shared task.

Authors’ abstract

Recent advancements in Vision-Language Models (VLMs) enable end-to-end visual grounding via language prompts and generative decoding, demonstrating largely improved zero-shot and open-vocabulary detection capabilities. As a result, VLMs are rapidly being deployed at the edge in safety-critical real-world systems. However, the physical adversarial robustness of edge VLMs has not been systematically studied, and the fundamental differences in output with modern object detectors create methodological challenges for fair evaluation. To compare the two families directly, we evaluate every selected representative model on one outcome: whether an adversarial patch worn on a person evades detection of the model. We report this by introducing a unified metric, conditional attack success rate (cASR), counted only on images the model still localizes under a matched gray occluder, and partition every failure into omission (no box), substitution (a box on the patch), and displacement (a box on neither). We benchmark the physical adversarial vulnerability of compact grounding VLMs against a range of object detectors, and find that the VLMs can be as vulnerable as the detectors. We disclose that failure mode is largely associated with the output format of a model rather than its architecture family. Of the three, only omission is visible to a downstream system; displacement and substitution return confident, well-formed boxes, making them potentially more dangerous failures. Further, we find that, under distribution shift, VLMs that primarily failed by omission instead shift to failing more by displacement/substitution. Thus, a grounding VLM can inherit the detector's vulnerability while showing the possibility to adopt more dangerous failure modes. Our code and data are available at https://github.com/ericliang1/physical-adversarial-robustness.