Malicious Path Manipulations via Exploitation of Representation Vulnerabilities of Vision-Language Navigation Systems

TL;DR

The paper investigates adversarial vulnerabilities in Vision-Language Navigation (VLN) systems arising from semantically weak embedding spaces of vision-language transformers. It introduces a gradient-based embedding-alignment method to craft imperceptible image perturbations that cause the system to follow manipulated routes, formalized by the loss $L(x)=\frac{1}{2}\| f(x_0+\Delta x)-f(x_{tg})\|^2$, and demonstrates two algorithms for adversarial route manipulation on a graph: optimal node selection via Dijkstra-based path + dynamic programming, and targeted node modification to boost landmark similarity while suppressing alternatives. Experiments on LM-Nav-derived graphs (RECON dataset) show high route-modification success (100% in both large and small environments), strong landmark-matching and path-efficiency metrics, and a notable arrival-rate reduction in smaller settings, underscoring practical security implications. A robust detection method based on CLIP feature differences under Gaussian noise achieves high accuracy (≈0.963) and F1 (≈0.961) at $\sigma=10^{-5}$, offering a first defense against such representation-based attacks. Overall, the work highlights critical vulnerabilities in VLN systems and motivates the development of representation-aware defenses to ensure reliable robotic navigation under multimodal adversarial pressures.

Abstract

Building on the unprecedented capabilities of large language models for command understanding and zero-shot recognition of multi-modal vision-language transformers, visual language navigation (VLN) has emerged as an effective way to address multiple fundamental challenges toward a natural language interface to robot navigation. However, such vision-language models are inherently vulnerable due to the lack of semantic meaning of the underlying embedding space. Using a recently developed gradient based optimization procedure, we demonstrate that images can be modified imperceptibly to match the representation of totally different images and unrelated texts for a vision-language model. Building on this, we develop algorithms that can adversarially modify a minimal number of images so that the robot will follow a route of choice for commands that require a number of landmarks. We demonstrate that experimentally using a recently proposed VLN system; for a given navigation command, a robot can be made to follow drastically different routes. We also develop an efficient algorithm to detect such malicious modifications reliably based on the fact that the adversarially modified images have much higher sensitivity to added Gaussian noise than the original images.

Figures (5)

• Figure 1: Typical examples from the RECON dataset obtained using the proposed framework in salman2024intriguing. Three pairs of visually indistinguishable images (a and e, b and f, c and g) have different representations from each other as shown in their low-dimensional projections. In contrast, images (f), (g), and (a) exhibit highly similar representations despite their significant semantic differences. A similar trend is observed with images (e) and (c). Please note that the arrow in the title ($original \rightarrow target$) indicates a derived image resulting from aligning the embedding of the original image with that of the target image using the method described. The matrices (d) and (h) show the classification outcomes from the multimodal CLIP pre-trained model used directly with no modifications.
• Figure 2: Visualization of robot route manipulation in EnvLarge-10, showing original Paths A (Green) and B (Cyan) with their respective landmarks. The green nodes denote original landmarks. Paths A and B are adversarially modified into Paths $A'$ (Orange) and $B'$ (Pink) with red nodes modified to resemble corresponding landmarks. The LM-Nav system guides the robot along these modified paths to reach the targeted malicious node, denoted by Yellow Star. Here, the first half of Path A and Path A' is shown separately for a clear view.
• Figure 3: Additional examples from the RECON dataset obtained using the proposed framework in salman2024intriguing; however, the arrow in the title ($original \rightarrow target$) here signifies a derived image from the original one by aligning the embedding of the original image with the target text embedding using the method. The projections of embedding-aligned images closely resemble the projections of the aligned text.
• Figure 4: The detection of adversarial image modifications via feature representation (embedding) analysis with noise variation in the CLIP model.
• Figure 5: (top) More instances from the RECON dataset, where visually indistinguishable images have very different representations via embedding alignment with the corresponding texts, and resulting significantly different classification outcomes (as shown in the classification probabilities; each row in the matrix corresponds to one image (from left to right)). (bottom) Visually distinguishable images have very similar embeddings, aligned and classified to a particular text.