Physical Prompt Injection Attacks on Large Vision-Language Models

TL;DR

This work introduces Physical Prompt Injection Attack (PPIA), a fully black-box, query-agnostic method to manipulate Large Vision-Language Models by embedding malicious text into physical objects perceived by the model. It decouples content design from online feedback through offline prompt generation and recognizability assessment, plus a spatiotemporal attention-guided location search to select deployment sites, enabling robust, real-world attacks. Evaluations across 10 LVLMs in simulation and on an unmanned vehicle in real environments show high attack success rates (often above 80%) under diverse conditions, with detailed analyses of prompt recognizability, deployment location, language effects, and defense strategies. The results underscore a practical vulnerability surface in multimodal perception systems and highlight the need for defense mechanisms, such as OCR-based filtering or moderated cross-modal attention, to mitigate such physical-world prompt injections.

Abstract

Large Vision-Language Models (LVLMs) are increasingly deployed in real-world intelligent systems for perception and reasoning in open physical environments. While LVLMs are known to be vulnerable to prompt injection attacks, existing methods either require access to input channels or depend on knowledge of user queries, assumptions that rarely hold in practical deployments. We propose the first Physical Prompt Injection Attack (PPIA), a black-box, query-agnostic attack that embeds malicious typographic instructions into physical objects perceivable by the LVLM. PPIA requires no access to the model, its inputs, or internal pipeline, and operates solely through visual observation. It combines offline selection of highly recognizable and semantically effective visual prompts with strategic environment-aware placement guided by spatiotemporal attention, ensuring that the injected prompts are both perceivable and influential on model behavior. We evaluate PPIA across 10 state-of-the-art LVLMs in both simulated and real-world settings on tasks including visual question answering, planning, and navigation, PPIA achieves attack success rates up to 98%, with strong robustness under varying physical conditions such as distance, viewpoint, and illumination. Our code is publicly available at https://github.com/2023cghacker/Physical-Prompt-Injection-Attack.

Figures (18)

• Figure 1: A toy experiment that reveals LLMs tend to follow commands that match their assumed identity, e.g., the name.
• Figure 2: Overview of the PPIA workflow, which consists of four stages: (1) candidate prompt generation using LLM; (2) prompt assessment and selection; (3) deployment location search within physical environments.
• Figure 3: From left to right, illustration of diverse simulation environments: Embodied City gao2024embodied and Habitat habitat19iccv.
• Figure 4: Several examples of PPIA in simulation. In benign settings, the LVLM-based systems produce correct outputs based on environmental observations. In contrast, when exposed to adversarial environments, their outputs are influenced by embedded malicious prompts, resulting in incorrect responses.
• Figure 5: Comparison with baseline Typographic wang2025typographic, SceneTap cao2025scenetap and SGTA qraitem2024vision attacks across three tasks under known-user query and unknown-user query settings.