{"id":"4246c9d0-3c8c-4ed1-bd26-22f982f437ac","arxiv_id":"2501.13563","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":4,"one_line_summary":"CAD is a transfer-based black-box attack using CLIP embeddings and ChatGPT-generated deceptive reasoning text to make vision-language autonomous driving models take unsafe actions.","lead":"This paper introduces CAD, a way to trick self-driving vision-language AI models by adding crafted visual noise without knowing the model's internals. The authors report large performance drops across several driving models and small robot cars, which matters for safety testing of AI-driven vehicles.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The black-box claim rests entirely on CLIP-space transfer, but the evidence does not include a target with a genuinely non-CLIP visual encoder; Table 5 only varies the surrogate on the CLIP-based target Dolphins. Without such a test, the 'arbitrary victim VLM' claim is unsubstantiated.","rationale":"The reader's weakest assumption and mine coincide: CAD is only black-box if perturbations optimized in CLIP's embedding space transfer to VLMs whose visual encoders were never used during optimization. The paper states this reliance explicitly in Sec. 3.5 ('our attacks mainly rely on transferability'), and Eqs. 7, 10, and 11 are all CLIP-only objectives. The load-bearing empirical support is therefore the diversity of target models, but the target list is less diverse than it appears: the two strongest open-loop targets share CLIP-style pretraining, and the one table that isolates the surrogate choice (Table 5) keeps the victim fixed at Dolphins. This does not refute the paper; the measured drops are large and the real-world result is striking. It means, however, that the strongest claim (effective black-box attack on arbitrary AD VLMs) is broader than the tested evidence. A single experiment with a non-CLIP visual encoder would settle whether the concern is real or merely hypothetical. I therefore keep the reader's conditional verdict: the paper is technically sound as far as it goes, but acceptance should require either the transferability check or a narrowed claim about CLIP-like victims. No ad hominem or accusations of fabrication are intended; this is a standard evidence-breadth concern.","tokens_in":25251,"tokens_out":6344,"duration_ms":62059,"concrete_test":"Evaluate CAD with the exact Sec. 5.1 settings against a VLM whose visual encoder is not CLIP, e.g., a LLaVA-style model using SigLIP or DINOv2 features, or an AD VLM such as DriveVLM, on the same benchmark with comparable QA pairs. Compare the final-score drop to the 19.6% average claimed for open-loop targets. If the drop on the non-CLIP model falls to the level of the best baseline (e.g., AnyAttack) or below, the transferability premise is not general. As a secondary check, repeat the attack with BLIP or CoCa as the surrogate E on the same non-CLIP target: if a matching encoder restores the attack while CLIP does not, this confirms that CAD's black-box effectiveness is driven by encoder similarity rather than by a universally transferable semantic disruption.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that CAD is an effective black-box attack on AD VLMs through transferability (Sec. 3.5). The optimization never touches the victim: Eqs. 7, 10, and 11 are all computed in CLIP's embedding space. For the claim to hold, perturbation that moves an image toward 'deceptive' or 'risky' text in CLIP space must also corrupt the victim's visual reasoning. The paper's evidence for this is thinner than the claim. Dolphins is built on OpenFlamingo, whose visual encoder is CLIP-based; LLaVA and MiniGPT-4 use CLIP ViT; InstructBLIP uses a BLIP-family ViT trained on image-text data; GPT-4o is closed and evaluated only through a small number of stochastic API calls; DriveLM and LMDrive are LLaMA-based but their vision encoders are not disclosed, so it is unclear whether they cross a genuinely different visual feature space. Table 5 is the key missing piece: it varies the surrogate model (ALBEF, VLMo, CoCa, BLIP, CLIP) but keeps the victim fixed at Dolphins, a CLIP-based model. Showing CLIP is the best surrogate for a CLIP-based victim does not establish that CLIP is an adequate surrogate for arbitrary victims. If a target uses a substantially different visual encoder, the alignment objective in Eq. 7 may fail to transfer, and the claimed advantage over query-based or other transfer baselines would disappear. This is a correctness-risk concern about the breadth of the central claim, not an internal inconsistency; the method itself is coherent and the reported numbers are plausible for the tested models.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"This manuscript proposes Cascading Adversarial Disruption (CAD), a black-box transfer-based attack on vision-language models for autonomous driving. The attack optimizes an ℓ∞-bounded perturbation in the embedding space of a CLIP surrogate to (i) align adversarial images with deceptive texts describing a broken perception-prediction-planning chain (Decision Chain Disruption, Eq. 7), (ii) invert the image-text matching probability between safe and unsafe scene descriptors (Risky Scene Induction, Eq. 10), and (iii) maximize semantic divergence from the clean image (Eq. 11). The three objectives are combined with weights α, β, and γ (Eq. 12). The paper reports open-loop results on Dolphins, DriveLM, and four general VLMs, closed-loop results on LMDrive in CARLA, and real-world road-following tests on JetBot and LIMO vehicles. It also introduces the CADA dataset of 18,808 adversarial visual-question-answer pairs.","tokens_in":25574,"tokens_out":8354,"duration_ms":65789,"significance":"If the claims hold, CAD would be the first black-box adversarial attack specifically designed for AD VLMs, and the real-world route-completion drop (61.11%) would demonstrate a serious physical-world vulnerability. The paper is clearly written and the attack design is coherent: all optimization objectives are defined against external surrogate components, so the method does not require gradients or queries to the victim. The authors also provide ablations, countermeasure evaluations, and a dataset, which are useful contributions. However, the evidence does not yet support the full breadth of the claims: the transferability argument relies on experiments that never test a genuinely non-CLIP victim encoder, and the headline open-loop results are obtained with hyperparameters tuned on the same Dolphins benchmark used for evaluation. These points require additional experiments rather than mere rewording.","major_comments":[{"comment":"The paper's black-box claim is explicitly founded on transferability ('our attacks mainly rely on transferability', §3.5), and the loss functions in Eqs. (7), (10), and (11) are all computed in CLIP's embedding space. Yet the only surrogate-model ablation (Table 5) holds the victim fixed at Dolphins, whose OpenFlamingo backbone uses a CLIP visual encoder. No experiment attacks a target whose visual encoder is outside the CLIP family, so the claim that CAD transfers to 'arbitrary victim VLM' is unsubstantiated. I recommend adding one or more targets with non-CLIP encoders (e.g., a BLIP-2-based InstructBLIP variant or a pure BLIP encoder) and/or a surrogate that is not CLIP, and reporting the resulting success rates; without this, the central black-box claim is not established beyond same-family transfer.","section":"§3.5, §4.1–4.3, Table 5"},{"comment":"The loss weights α=0.75, β=0.05, γ=0.75 are selected via the ablation study in Sec. 5.4, which uses the Dolphins model on the Dolphins Benchmark. The same benchmark then appears in the headline open-loop results (Table 1a and Table 2). This constitutes selection on the evaluation set and can inflate the reported attack effectiveness. The authors should either fix the weights a priori, or choose them on a separate validation set (e.g., DriveLM) and then evaluate on Dolphins and the general VLMs, or at minimum show that the results are stable across a range of weight values.","section":"§5.1, §5.4, Tables 1–2"},{"comment":"The real-world experiments are based on 36 total runs, i.e., three repetitions per route per vehicle, and Table 4 reports only success counts without confidence intervals or statistical tests. The claim that 'route completion rate drops by 61.11%' is computed from 13/18 successes to 2/18; a 95% exact binomial confidence interval for the attack condition spans roughly 1.4% to 35%, which weakens the practical-applicability claim. Please provide more repetitions, per-route statistics, and ideally confidence intervals or a significance test. Also specify whether the adversarial patches were optimized for each carrier image and whether lighting or camera viewpoint vary between runs.","section":"§5.3, Table 4"},{"comment":"The abstract and introduction state that CAD 'significantly outperforming existing methods (+13.43% on average)', but the calculation behind this number is not defined in the paper. From Tables 1 and 2, the average relative improvement over the best baseline per model is about 7.6%, while the average relative drop against the mean of all baselines is about 14.4%; neither yields 13.43%. Please specify the baseline set and the averaging procedure used to obtain the headline 13.43% figure.","section":"Abstract, §5.2"}],"minor_comments":[{"comment":"The y-axis labels and legend in the ablation figure are corrupted with unicode escape sequences (e.g., '/uni00000013/...'), making the figure unreadable; please regenerate the figure with proper fonts.","section":"Figure 7"},{"comment":"The caption and surrounding text contain typos: 'LMDirve' should be 'LMDrive', and the duplicate line '(b)LMDirve Model after attack... 4 79' appears to be a LaTeX artifact; please clean up.","section":"Table 3 and Figure 3"},{"comment":"The heading 'Image Denoising (I.T)' should be 'Image Denoising (I.D)' to match the category label in Table 6.","section":"Section 6"},{"comment":"The references list contains duplicates (e.g., [17] and [18] are the same paper) and incomplete entries (e.g., [49] is cited as 'ChatGPT, 2023' in the bibliography but elsewhere as 'GPT-4o'); please standardize citations.","section":"References"},{"comment":"The phrase 'LLaV A' contains an erroneous space; it should be 'LLaVA'.","section":"Section 5.2"}],"recommendation":"major_revision","confidential_remarks":"The stress-test concern about CLIP-only transferability is real and central; the authors should be asked for a non-CLIP victim experiment. Additionally, the paper claims release of code and dataset but they are not yet available; given the number of results (especially GPT-4o) that depend on closed APIs, reproducibility would benefit from releasing artifacts. The paper is well within scope for a vision/security journal and the dataset is a useful contribution, but the experimental validation needs strengthening before publication."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The paper does something new: it is the first black-box attack designed specifically for VLM-based autonomous driving, and the two-module design (decision chain disruption plus risky scene induction) is a sensible way to address reasoning-chain and context-dynamics challenges using only CLIP-space alignment. The experimental surface is broad: Dolphins, DriveLM, LMDrive in closed-loop CARLA, several general VLMs including GPT-4o, and physical JetBot/LIMO vehicles. They also contribute CADA, a dataset of 18,808 adversarial VQA pairs. That is real work and the method is coherent.\n\nThe reported numbers are plausible for the tested models. CAD consistently beats the compared transfer and query baselines in open-loop tables, the closed-loop driving score drops by about 19%, and the real-world route completion drop from 72% to 11% is large even with only 36 runs. The ablations show each loss term earns its place.\n\nThe soft spots are about the breadth of the central claim, not about internal consistency. The attack's load-bearing premise is that perturbations optimized in CLIP space transfer to arbitrary victim VLMs, but every target in the paper either uses a CLIP-based visual encoder (Dolphins, LLaVA, MiniGPT-4, InstructBLIP with BLIP-family) or does not disclose its encoder (DriveLM, LMDrive). Table 5 varies the surrogate but fixes the victim at Dolphins, a CLIP-based model, so it only shows CLIP is the best surrogate for a CLIP-based victim. No genuinely non-CLIP visual feature space is tested. That leaves the 'arbitrary victim' claim unsubstantiated, though the method itself is not broken.\n\nTwo smaller issues: the loss weights are tuned on the Dolphins benchmark and then used on the same benchmark for the headline open-loop results, which is a mild selection effect; and the real-world results would benefit from confidence intervals, though the effect size makes them credible. Code and the CADA dataset are promised only after acceptance, which limits reproducibility now.\n\nThis paper deserves a serious referee. The main revision should add at least one target with a genuinely different visual backbone, and ideally cross-surrogate experiments on multiple victims. If the transfer claim survives that test, the result is a strong safety finding. Send it to review with that request.","headline":"Genuinely new black-box attack pipeline for AD VLMs with a solid dataset, but the transferability claim outruns the evidence: no victim with a non-CLIP visual encoder is tested.","tokens_in":26134,"tokens_out":2433,"would_cite":true,"duration_ms":20288,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"This paper claims that a transfer-based black-box attack, Cascading Adversarial Disruption (CAD), misleads vision-language driving models with no gradient or query access, cutting real-world route completion by 61.11% and causing a…","keywords":["black-box adversarial attack","vision-language models","autonomous driving","transfer-based attack","CLIP embedding alignment","adversarial patches","driving reasoning chain","CADA dataset"],"falsifier":"Test CAD against a driving VLM whose visual encoder was trained without any CLIP-style contrastive alignment and whose text decoder was never exposed to CLIP embeddings, using the same $\\ell_\\infty=0.1$ budget on the DriveLM benchmark; if the score drop shrinks to the no-attack level, the transferability premise is false. A cheaper physical check is to reuse the printed patch that made the LIMO robot crash on the same robot with a different VLM backbone: if the collision rate returns to the clean rate, the real-world result is pipeline-specific rather than a general vulnerability of VLM driving.","tokens_in":25036,"feed_emoji":"🚗","tokens_out":12037,"duration_ms":98573,"temperature":0.7,"pith_summary":"The paper sets out to establish that autonomous-driving systems built on vision-language models (VLMs) can be hijacked blindly: no knowledge of the victim model's weights, gradients, or even its outputs is required. It introduces Cascading Adversarial Disruption (CAD), which uses a surrogate image-text model, CLIP, to align perturbed driving images with deceptive textual descriptions of a wrong perception-prediction-planning chain, and to flip the model's high-level assessment of whether the scene is safe. On open-loop and closed-loop benchmarks spanning Dolphins, DriveLM, LMDrive, and general VLMs including GPT-4o, CAD is reported to outperform existing attack baselines by 13.43% on average. In physical tests on two robot vehicles, adversarial patches printed and attached to a stop sign and an obstacle vehicle reduce route completion from 72.22% to 11.11% and make one vehicle crash into the obstacle. If these results are right, a practical vulnerability class follows: a camera-visible patch alone can cause VLM-driven vehicles to fail.","feed_headline":"Black-box patches crash VLM-driven test vehicles","feed_subtitle":"A transfer attack that never queries the model beats prior methods by 13.43% and cuts route completion by 61.11%.","key_machinery":"The load-bearing mechanism is a three-part loss optimized in the embedding space of CLIP, a pre-trained contrastive model that maps images and text into a shared space, rather than in the victim VLM itself. The decision-chain loss $L_l$ minimizes the cosine similarity between the visual embedding of the perturbed image and the text embedding of deceptive sentences generated backward along the perception-prediction-plan chain by an auxiliary VLM. The risky-scene loss $L_h$ computes an image-text matching probability over the descriptors 'a safe driving scenario' and 'an unsafe driving scenario' and uses a mask that flips the class that was less probable on clean images, forcing the scene-level safety assessment to reverse. A third term $L_d$ minimizes the cosine similarity between clean and adversarial image embeddings, and the full objective is $L_{\\mathrm{adv}}=\\alpha L_l+\\beta L_h+\\gamma L_d$ with $\\alpha=0.75$, $\\beta=0.05$, and $\\gamma=0.75$, optimized by momentum-based gradient descent under an $\\ell_\\infty$ norm budget of $0.1$. Because CLIP's alignment is what defines 'deceptive' and 'risky', the victim's own reasoning is never queried; the attack depends on CLIP-to-victim transferability.","core_discovery":"On the paper's own terms, the central discovery is that black-box attacks on driving VLMs work best when the perturbation is crafted to corrupt two different levels of reasoning at once. The decision-chain component works backward from a desired planning error to produce a coherent deceptive text for the perception, prediction, and planning stages, then pulls the adversarial image's CLIP embedding toward that text; the risky-scene component uses an image-text matching head over the descriptors 'a safe driving scenario' and 'an unsafe driving scenario' and flips the less probable class. These two objectives, plus a semantic-discrepancy term that pushes clean and adversarial visual embeddings apart, are optimized jointly under a projected $\\ell_\\infty$ budget of $0.1$. The paper reports that this is the first black-box attack designed specifically for VLM-based autonomous driving, and that it achieves state-of-the-art effectiveness: an average score reduction of 19.60% across driving-specific VLMs and general VLMs in open-loop digital tests, an 18.87% drop in closed-loop CARLA driving score, and a fall in real-vehicle route-completion success from 72.22% to 11.11%, including a direct collision into an obstacle vehicle carrying the adversarial patch.","pith_inferences":["Because the attack optimizes in CLIP space, it should transfer to any future driving VLM that keeps a CLIP-like contrastive encoder; by the same token, replacing the visual encoder with a non-CLIP-aligned architecture may neutralize this attack class without adversarial training.","The risky-scene induction loss is effectively a probe of whether a driving VLM's safety judgment is grounded in scene semantics or in shallow descriptor statistics; it could be reused to distinguish models that truly reason about safety from models that match text templates.","The same recipe—generate deceptive text, align images to it in embedding space, and flip a safety descriptor—could be adapted to other safety-critical black-box VLM deployments such as remote inspection, assistive navigation, or medical image interpretation, where query access is also unavailable and a single misreasoning can be costly.","The textual-enhancement defense the paper tests suggests a cheap and immediately deployable hardening: adding safety-constraint prompts to the instruction text. Since adversarial training is not yet covered, fine-tuning on the released CADA examples is a natural next test."],"forward_implications":["If CAD is correct, a camera-only VLM driving system can be degraded by an attacker who has no model access at all: a printed patch on a sign or obstacle reduced the paper's real-vehicle route-completion success rate from 72.22% to 11.11%.","Because the attack transfers to Dolphins, DriveLM, LMDrive, InstructBlip, LLaVA, MiniGPTv4, and GPT-4o, robustness evaluation of AD VLMs should include surrogate-based transfer attacks, not only white-box and query-based ones.","The defense experiments show that image denoising gives the strongest partial mitigation of the tested options, while some input transformations can make performance worse, so practical deployers should prefer denoising and output filtering over generic image preprocessing.","The released CADA dataset, with 18,808 adversarial visual-question-answer pairs at four severity levels, provides a common benchmark for measuring how AD VLMs degrade under increasing perturbation budgets and patch sizes."],"supporting_citations":[{"why":"Supplies the CLIP surrogate model; its shared image-text embedding space defines all three loss terms and the transferability premise.","marker":"[51]"},{"why":"Dolphins is the primary VQA benchmark and target AD VLM, and it is the decision model used in the real-vehicle pipeline.","marker":"[42]"},{"why":"DriveLM is the second open-loop GVQA target model and benchmark on which CAD's score drop is measured.","marker":"[55]"},{"why":"LMDrive is the closed-loop CARLA driving agent whose driving score, route completion, and infraction score are attacked.","marker":"[54]"},{"why":"GPT-4o is the auxiliary VLM that generates the deceptive reasoning chain and also serves as a general-VLM attack target.","marker":"[49]"},{"why":"CARLA is the simulator and leaderboard framework used for the closed-loop driving evaluation.","marker":"[13]"},{"why":"The JetBot robot is one of the two physical test vehicles used to validate the printed adversarial patch attack.","marker":"[48]"},{"why":"The LIMO robot is the physical vehicle that the paper reports crashing directly into the obstacle vehicle carrying the adversarial patch.","marker":"[52]"},{"why":"ADvLM is the prior white-box AD-VLM attack that CAD compares against and extends to the black-box setting.","marker":"[74]"},{"why":"AnyAttack is the strongest general-VLM black-box baseline, marking the performance level CAD must beat to claim state-of-the-art effectiveness.","marker":"[70]"}],"fun_headline_variants":["Black-box attack on driving VLMs cuts route success by 61%","First black-box attack on VLM driving crashes test cars","CAD attack induces crashes in VLM-powered autonomous vehicles","Black-box perturbations derail VLM driving with 61% route failure"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that a pattern that shifts the meaning of an image inside CLIP's shared image-text space will also shift the meaning inside any victim driving VLM, even though the attacker has never seen the victim's architecture, gradients, parameters, or outputs.","fun_headline_variants_meta":{"raw":{"variants":["Black-box attack on driving VLMs cuts route success by 61%","First black-box attack on VLM driving crashes test cars","CAD attack induces crashes in VLM-powered autonomous vehicles","Black-box perturbations derail VLM driving with 61% route failure"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001233,"raw_usage":{"total_tokens":5142,"prompt_tokens":1101,"completion_tokens":4041,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":717,"completion_tokens_details":{"reasoning_tokens":3969}},"tokens_in":717,"tokens_out":4041,"duration_ms":25905,"temperature":1.0,"reasoning_tokens":3969,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-10T15:49:17.002251+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Test CAD against a driving VLM whose visual encoder was trained without any CLIP-style contrastive alignment and whose text decoder was never exposed to CLIP embeddings, using the same $\\ell_\\infty=0.1$ budget on the DriveLM benchmark; if the score drop shrinks to the no-attack level, the transferability premise is false. A cheaper physical check is to reuse the printed patch that made the LIMO robot crash on the same robot with a different VLM backbone: if the collision rate returns to the clean rate, the real-world result is pipeline-specific rather than a general vulnerability of VLM driving.","supporting_citations":[{"cited_title":"Learning transferable visual models from natural lan- guage supervision","cited_arxiv_id":null,"evidence_quote":"Supplies the CLIP surrogate model; its shared image-text embedding space defines all three loss terms and the transferability premise."},{"cited_title":"Lm- drive: Closed-loop end-to-end driving with large lan- guage models","cited_arxiv_id":null,"evidence_quote":"LMDrive is the closed-loop CARLA driving agent whose driving score, route completion, and infraction score are attacked."},{"cited_title":"Chatgpt, 2023","cited_arxiv_id":null,"evidence_quote":"GPT-4o is the auxiliary VLM that generates the deceptive reasoning chain and also serves as a general-VLM attack target."},{"cited_title":"Carla: An open urban driving simulator","cited_arxiv_id":null,"evidence_quote":"CARLA is the simulator and leaderboard framework used for the closed-loop driving evaluation."},{"cited_title":"Jetbot, 2021","cited_arxiv_id":null,"evidence_quote":"The JetBot robot is one of the two physical test vehicles used to validate the printed adversarial patch attack."},{"cited_title":"Limo, 2021","cited_arxiv_id":null,"evidence_quote":"The LIMO robot is the physical vehicle that the paper reports crashing directly into the obstacle vehicle carrying the adversarial patch."}],"review_version":1}