Pith. sign in

REVIEW 2 major objections 6 minor 46 references

Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attacks

T0 review · 2 major / 6 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper establishes that a whitebox adversary can repaint a single 3D object in an environment to make a pretrained vision-and-language navigation agent either stop early or follow an attacker-chosen multi-step trajectory, even when the…

desk verdict Solid whitebox existence proof that 3D texture attacks can divert a VLN agent, but the forced-encounter evaluation makes the headline numbers an upper bound on practical threat. read the letter →

arxiv 2412.02795 v1 pith:XLX6CFOQ submitted 2024-12-03 cs.CV cs.RO

Zijiao Yang , Xiangxi Shi , Eric Slyman , Stefan Lee This is my paper · ORCID
classification cs.CVcs.RO
keywords adversarialattackvision-and-languagenavigationdifferentiablerendering3Dobjecttextureoptimizationembodiedagentswhiteboxtrajectoryhijackingenvironmental
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Vision-and-language navigation (VLN) agents are meant to follow natural-language instructions through real indoor environments. The paper asks whether a local, physical modification to the environment—repainting a single object—can hijack such an agent, and answers yes. Using differentiable rendering of 3D scene meshes, the authors optimize an object's texture so that a pretrained HAMT agent, upon viewing it, either terminates its episode immediately or follows an attacker-defined multi-step trajectory. The attacks generalize to instruction-trajectory pairs not used in optimization: on R2R, stop attacks terminate 75.98% of test episodes (versus 0.98% in unaltered scenes), and trajectory attacks raise arrival at the attacker's target from 3.66% to 21.61%. The result matters because it identifies a concrete, physically realistic vulnerability in embodied instruction-following systems before they are deployed.

What carries the argument

The load-bearing mechanism is the differentiable renderer (PyTorch3D) that connects the 3D mesh texture atlas to the VLN agent's panoramic observations. The attack computes the gradient of the cross-entropy loss—the likelihood that the frozen agent chooses the attack trajectory step by step—with respect to the object's texture, masks the gradient to the object's mesh faces, and updates the texture with Adam under an $\ell_\infty$ constraint ($\epsilon = 0.3$). Rendering the attack viewpoint plus the next two viewpoints during training lets the same texture influence a sequence of decisions from different viewing angles.

What would settle it

Run the stop and trajectory attacks on R2R val-unseen without forcing the guide trajectory, measuring how often a naturally navigating agent actually enters the attack viewpoint and stops. If agents rarely pass near the repainted object, or stop rates approach the unaltered baseline when they get there, the reported 75.98% and 21.61% figures would not hold in the wild.

Watch

Extended reading notes

Core claim

The central discovery is that a VLN agent's sequential decision-making can be controlled by modifying the appearance of a static 3D object, without touching the agent, its camera, or the instruction. The attack optimizes the texture of an object (chairs, cabinets, tables, plants, sofas, TV monitors) by rendering adversarial panoramic observations at an attack viewpoint and a few steps beyond, then backpropagating the cross-entropy loss of the agent following a desired attack trajectory through a differentiable renderer to the texture atlas. The authors show the optimized texture transfers to novel instructions and partial trajectories: on R2R test instances, the stop attack terminates the episode in 75.98% of cases, and trajectory-following attacks make the agent reach the attacker's destination 21.61% of the time while cutting instruction-following success from 82.42% to 53.85%. Effects are weaker but still present on the longer, multilingual RxR benchmark.

Load-bearing premise

The evaluation assumes the agent can be made to reach the attack viewpoint with the object highly visible, and that the pre-selected test instances (objects with large view coverage and ample training support) represent realistic encounters.

Editorial extensions

If this is right

  • Deployed VLN robots can be diverted or halted by repainting everyday objects, without any access to the agent's software or communications.
  • Standard VLN evaluation that renders scenes from meshes must treat texture-based attacks as a safety variable; agents that look robust on clean rendered scenes may fail catastrophically under object-level manipulation.
  • The attack's success on novel instructions and partial trajectories implies object appearance is a stronger control channel than the language grounding in current agents.
  • Defenses must operate on scene-object consistency, not just per-image robustness, since the attack changes a physical object's appearance across multiple views.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The forced guide-trajectory evaluation likely overstates real-world risk: an attacker would need the object to sit at a viewpoint the agent actually visits with high probability.
  • A blackbox variant could be built by querying the agent and estimating gradients, or by transferring textures optimized on one model; the whitebox assumption is a convenience, not a fundamental limit.
  • The same differentiable-rendering attack could target other embodied tasks (object navigation, instruction-following in manipulation) by changing what objects afford in the agent's policy.
  • Because object category and pixel coverage strongly modulate success, the attack's practical reach is concentrated on large, central objects—an attacker would need to repaint furniture rather than small decorations.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 6 minor

Summary. The paper introduces a whitebox adversarial attack on Vision-and-Language Navigation (VLN) agents. The adversary optimizes the texture of a 3D object in a reconstructed environment using differentiable rendering, with the goal of causing a frozen pretrained agent (HAMT) to either stop immediately upon observing the object or follow an attacker-chosen multi-step trajectory. The authors evaluate on R2R and RxR using a held-out set of novel instruction-trajectory pairs (val-seen) that are not used in attack optimization, and they compare against rendered unaltered baselines. They report large increases in stop rates and attack-trajectory success, large drops in instruction-following success, plus ablations and a statistical factor analysis.

Significance. If the results hold, this is a meaningful demonstration of a new attack surface for embodied instruction-following: a localized, view-consistent 3D appearance change can override a previously unseen natural-language instruction in a history-aware VLN policy. The experiments are careful in several respects: the unaltered baseline is rendered with the same pipeline, so the domain gap is accounted for; test instances are held out from attack optimization; and the paper explicitly acknowledges that validation-based checkpoint selection overestimates validation attack performance. The main unresolved issue is that the evaluation forces the agent to the attack viewpoint along the ground-truth guide trajectory and restricts test instances to a high-support, high-visibility subset, so the reported rates are upper bounds on what an attacker would achieve during free navigation.

major comments (2)
  1. [Sec 3.2, Evaluation; Sec 5, Discussion] The evaluation protocol forces the VLN agent through the guide trajectory until it reaches vATK, and for Test instances this guide trajectory is the ground-truth trajectory of the novel episode. This means the agent is handed the correct history and camera pose at the moment it first observes the attack object. Because HAMT is history-aware, the 75.98% stop rate (Tab. 2) and 21.61% attack SR (Tab. 3) are conditional on an encounter that a free-running agent may never make, and on a history that a freely navigating agent would not have. The paper should either add a natural-navigation experiment that measures how often a free agent reaches vATK and how the attack behaves with off-history encounters, or explicitly reframe the headline numbers as conditional rates and soften the 'no-go zone' claim in Sec. 5.
  2. [Sec 3.2, Generating and Evaluating Attacks; Appendix A] The attack-instance test set is curated by requiring at least five supporting training episodes per viewpoint and at least 40% pixel visibility of the object in a sub-image, yielding only 273 R2R instances over 68 objects/39 environments and 254 RxR instances over 20 objects/9 environments. This is a high-support, high-visibility subset, so the reported success rates do not represent typical VLN episodes; the paper does not test how the attack fares when the object is smaller, less visible, or has fewer training episodes. The claims in the abstract and Sec. 1 should be scoped to this favorable setting, or the authors should report results on less favorable instances.
minor comments (6)
  1. [Sec 3.2, Evaluation] The word 'autoregessively' should be corrected to 'autoregressively'.
  2. [Sec 4.1] The sentence 'RxR having substantially longer path lengths – roughly ∼6.1 vs.∼10.5 average steps' is ambiguous and appears to contradict the earlier statement in Sec. 1 that RxR paths have about 8 edges on average versus 5 for R2R; please clarify which numbers refer to which dataset and to the attack trajectories.
  3. [Sec 4.4 and Appendix B] The string 'ANOV A' should be 'ANOVA' in both places.
  4. [Appendix A.3] The ablation data subset covers roughly half of the full R2R test instances (147 vs. 273); the text should state explicitly that all ablations in Tab. 5 are run on this subset, since the main tables use the full set.
  5. [Table 5(d)] The Test SR for 600 and 900 iterations is reported as identical (26.53); the authors should verify whether this is a plateau or a reporting artifact.
  6. [Abstract and Sec. 1] The paper studies a single VLN architecture (HAMT); the abstract and contributions should be phrased in the singular or include a discussion of expected transfer to other architectures.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the attack texture is optimized on train episodes and evaluated on held-out val-seen instruction-trajectory pairs; the self-citations are not load-bearing.

full rationale

The paper's empirical chain is self-contained. The 3D object texture is optimized by backpropagating the cross-entropy loss ℓ_CE over attack-training episodes (Sec. 3.1) drawn from R2R-train and RxR-train-guide, and the reported generalization is measured on R2R-val-seen and RxR-val-seen-guide instances that are not used in optimization. The paper states: 'we exclude any training episode if its guide trajectory matches that of the val-seen episode to ensure our evaluation represents a novel observation history' and 'These trajectory-instruction pairs have not been seen when optimizing the attack or training the VLN model.' Checkpoint selection uses only the per-instance validation subset of the training split, and the paper openly notes that 'checkpoint selection uses these episodes so attack performance is likely overestimated here'; the Test split is never used for model or attack selection. The forced-encounter protocol ('we force the VLN agent through the guide trajectory until reaching v_ATK and then allow it to autoregessively navigate') is an evaluation setup, not a fitted input: the attacked texture is not defined in terms of the test episode's instruction or trajectory, and the measured stop rates, SR, and nDTW values are conditional behavioral outcomes rather than identities forced by construction. The self-citations ([41] and [2]) support ancillary interpretations about weak object grounding and sim-to-real plausibility, and they are not load-bearing assumptions in the attack derivation. No equation or metric in the paper reduces by construction to the optimization objective.

Assumptions & free parameters 4 free parameters · 3 assumptions · 0 invented entities

The central claim is empirical: an optimized texture changes agent behavior. It rests on the rendering proxy, the frozen model's stability, and attack-generalization assumptions. The hand-chosen hyperparameters are ablated, so they are transparent, but they do shape the results.

free parameters (4)
  • attack magnitude epsilon = 0.3 (L∞ norm bound)
    Limits the per-pixel texture change; hand-chosen after ablating 0.1, 0.3, 0.5 in Table 5(b). Results depend on this budget.
  • rendered steps during attack training = 3 (attack viewpoint plus next two)
    Number of viewpoints rendered during optimization; ablated in Table 5(a); more steps improve attack success.
  • training iterations = 300 (R2R), 600 (RxR)
    Optimization length per attack instance; ablated in Table 5(d); longer training improves generalization.
  • minimum supporting episodes and visibility threshold = 5 episodes; 40% pixel coverage
    Instance filtering in Sec 3.2; affects which episodes are attacked and likely inflates success rates.
assumptions (3)
  • domain assumption PyTorch3D rendering provides gradients that, when propagated through the frozen HAMT agent, meaningfully update object texture to steer decisions
    The entire method in Sec 3.1 relies on this.
  • domain assumption Rendered images from decimated MP3D meshes are a sufficiently faithful proxy for the agent's real visual observations to measure attack impact
    Acknowledged and partially quantified in Table 1, but attacks are never tested on real images.
  • domain assumption Cross-entropy supervision on a few training episodes generalizes to novel instruction-trajectory pairs in the same environment
    Core empirical premise, evaluated on val-seen but limited to the same scenes and forced guide trajectories.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attacks." pith.science (2026). https://pith.science/paper/XLX6CFOQ

@misc{pith2026241202795,
  author       = {Pith},
  title        = {Pith review of: Hijacking Vision-and-Language Navigation Agents with Adversarial Environmental Attacks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/XLX6CFOQ}},
  note         = {Machine review of arXiv:2412.02795}
}
read the original abstract

Assistive embodied agents that can be instructed in natural language to perform tasks in open-world environments have the potential to significantly impact labor tasks like manufacturing or in-home care -- benefiting the lives of those who come to depend on them. In this work, we consider how this benefit might be hijacked by local modifications in the appearance of the agent's operating environment. Specifically, we take the popular Vision-and-Language Navigation (VLN) task as a representative setting and develop a whitebox adversarial attack that optimizes a 3D attack object's appearance to induce desired behaviors in pretrained VLN agents that observe it in the environment. We demonstrate that the proposed attack can cause VLN agents to ignore their instructions and execute alternative actions after encountering the attack object -- even for instructions and agent paths not considered when optimizing the attack. For these novel settings, we find our attacks can induce early-termination behaviors or divert an agent along an attacker-defined multi-step trajectory. Under both conditions, environmental attacks significantly reduce agent capabilities to successfully follow user instructions.

Figures

Figures reproduced from arXiv: 2412.02795 by the authors.

Figure 1
Figure 1. We directly optimize the appearance of an in-environment object to control the trajectory of a trained VLN agent using a [PITH_FULL_IMAGE:figures/full_fig_p003_1.png] view at source ↗
Figure 2
Figure 2. Example original and attacked objects for a desk (left), [PITH_FULL_IMAGE:figures/full_fig_p006_2.png] view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

46 extracted references · 38 canonical work pages

  1. [1]

    A systematic review of robotics research in support of in-home care for older adults

    Anas Abou Allaban, Maozhen Wang, and Tas ¸kın Padır. A systematic review of robotics research in support of in-home care for older adults. Information, 11(2):75, 2020. 1

    work page 2020

  2. [2]

    Sim- to-real transfer for vision-and-language navigation

    Peter Anderson, Ayush Shrivastava, Joanne Truong, Arjun Majumdar, Devi Parikh, Dhruv Batra, and Stefan Lee. Sim- to-real transfer for vision-and-language navigation. In Con- ference on Robot Learning , pages 671–681. PMLR, 2021. 8

    work page 2021

  3. [3]

    Vision-and-language navigation: In- terpreting visually-grounded navigation instructions in real environments

    Peter Anderson, Qi Wu, Damien Teney, Jake Bruce, Mark Johnson, Niko S ¨underhauf, Ian Reid, Stephen Gould, and Anton van den Hengel. Vision-and-language navigation: In- terpreting visually-grounded navigation instructions in real environments. CVPR, 2018. 1, 2, 4

    work page 2018

  4. [4]

    Synthesizing robust adversarial examples

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. Synthesizing robust adversarial examples. ICML,

    work page

  5. [5]

    Joseph, and J

    Marco Barreno, Blaine Nelson, Russell Sears, Anthony D. Joseph, and J. D. Tygar. Can machine learning be secure? In Proceedings of the 2006 ACM Symposium on Informa- tion, Computer and Communications Security , ASIACCS ’06, page 16–25, New York, NY , USA, 2006. Association for Computing Machinery. 1, 2

    work page 2006

  6. [6]

    Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer

    Tom B. Brown, Dandelion Man ´e, Aurko Roy, Mart´ın Abadi, and Justin Gilmer. Adversarial patch. arXiv, 2017. 2

    work page 2017

  7. [7]

    Matterport3d: Learning from rgb-d data in indoor environments

    Angel Chang, Angela Dai, Thomas Funkhouser, Maciej Hal- ber, Matthias Niebner, Manolis Savva, Shuran Song, Andy Zeng, and Yinda Zhang. Matterport3d: Learning from rgb-d data in indoor environments. In 2017 International Confer- ence on 3D Vision (3DV), pages 667–676. IEEE, 2017. 4

    work page 2017

  8. [8]

    History aware multimodal transformer for vision-and-language navigation

    Shizhe Chen, Pierre-Louis Guhur, Cordelia Schmid, and Ivan Laptev. History aware multimodal transformer for vision-and-language navigation. In NeurIPS, 2021. 1, 2, 5

    work page 2021

Show all 46 references
  1. [9]

    How deep learning sees the world: A survey on ad- versarial attacks & defenses

    Joana C Costa, Tiago Roxo, Hugo Proenc ¸a, and Pedro RM In´acio. How deep learning sees the world: A survey on ad- versarial attacks & defenses. IEEE Access, 2024. 1, 2, 6, 7

    2024

  2. [10]

    Embodied Question Answer- ing

    Abhishek Das, Samyak Datta, Georgia Gkioxari, Stefan Lee, Devi Parikh, and Dhruv Batra. Embodied Question Answer- ing. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), 2018. 2

    2018

  3. [11]

    An image is worth 16x16 words: Transformers for image recognition at scale

    Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010.11929, 2020. 5

    2010 arXiv

  4. [12]

    Adversarial camouflage: Hiding physical-world attacks with natural styles

    Ranjie Duan, Xingjun Ma, Yisen Wang, James Bailey, A Kai Qin, and Yun Yang. Adversarial camouflage: Hiding physical-world attacks with natural styles. In CVPR, 2020. 2

    2020

  5. [13]

    Robust physical-world attacks on deep learning visual classification

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning visual classification. In CVPR, 2018. 1, 2

    2018

  6. [14]

    Vision-and-language navigation: A survey of tasks, methods, and future directions

    Jing Gu, Eliana Stefani, Qi Wu, Jesse Thomason, and Xin Wang. Vision-and-language navigation: A survey of tasks, methods, and future directions. ACL, 2022. 2

    2022

  7. [15]

    Huang, Nicolas Papernot, Ian J

    Sandy H. Huang, Nicolas Papernot, Ian J. Goodfellow, Yan Duan, and P. Abbeel. Adversarial attacks on neural network policies. ICLR (Workshop), 2017. 1, 2

    2017

  8. [16]

    General evaluation for instruction con- ditioned navigation using dynamic time warping

    Gabriel Ilharco, Vihan Jain, Alexander Ku, Eugene Ie, and Jason Baldridge. General evaluation for instruction con- ditioned navigation using dynamic time warping. arXiv preprint arXiv:1907.05446, 2019. 5

    1907 arXiv

  9. [17]

    Jan, Joseph Messou, Yen-Chen Lin, Jia-Bin Huang, and Gang Wang

    Steve T.K. Jan, Joseph Messou, Yen-Chen Lin, Jia-Bin Huang, and Gang Wang. Connecting the digital and phys- ical world: Improving the robustness of adversarial attacks. In AAAI, 2019. 2, 8

    2019

  10. [18]

    Adam: A method for stochastic optimization

    Diederik P Kingma and Jimmy Ba. Adam: A method for stochastic optimization. arXiv preprint arXiv:1412.6980 ,

    arXiv

  11. [19]

    Room-across-room: Multilingual vision- and-language navigation with dense spatiotemporal ground- ing

    Alexander Ku, Peter Anderson, Roma Patel, Eugene Ie, and Jason Baldridge. Room-across-room: Multilingual vision- and-language navigation with dense spatiotemporal ground- ing. arXiv preprint arXiv:2010.07954, 2020. 1, 4, 7

    2010 arXiv

  12. [20]

    Goodfellow, and Samy Bengio

    Alexey Kurakin, Ian J. Goodfellow, and Samy Bengio. Ad- versarial examples in the physical world. ICLR, 2017. 2, 8

    2017

  13. [21]

    Schmidt, and J

    Juncheng Li, Frank R. Schmidt, and J. Zico Kolter. Adver- sarial camera stickers: A physical camera-based attack on deep learning systems. ICML, 2019. 2, 3

    2019

  14. [22]

    Tactics of adversarial attack on deep reinforcement learning agents

    Yen-Chen Lin, Zhang-Wei Hong, Yuan-Hong Liao, Meng- Li Shih, Ming-Yu Liu, and Min Sun. Tactics of adversarial attack on deep reinforcement learning agents. IJCAI, 2017. 2

    2017

  15. [23]

    Maybank, and Dacheng Tao

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J. Maybank, and Dacheng Tao. Spatiotemporal attacks for embodied agents. ECCV, 2020. 2

    2020

  16. [24]

    An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models, 2024

    Haochen Luo, Jindong Gu, Fengyuan Liu, and Philip Torr. An image is worth 1000 lies: Adversarial transferability across prompts on vision-language models, 2024. 1, 2

    2024

  17. [25]

    Towards deep learning models resistant to adversarial attacks

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. ICLR, 2018. 4

    2018

  18. [26]

    Isometric 3d adversarial examples in the physical world

    Yibo Miao, Yinpeng Dong, Junyi Zhu, and Xiao-Shan Gao. Isometric 3d adversarial examples in the physical world. NeurIPS, 2022. 2

    2022

  19. [27]

    George A. Miller. WordNet: A lexical database for En- glish. In Human Language Technology: Proceedings of a Workshop held at Plainsboro, New Jersey, March 8-11, 1994,

    1994

  20. [28]

    Universal adversarial perturba- tions

    Seyed-Mohsen Moosavi-Dezfooli, Alhussein Fawzi, Omar Fawzi, and Pascal Frossard. Universal adversarial perturba- tions. CVPR, 2016. 2, 3

    2016

  21. [29]

    Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp

    John X Morris, Eli Lifland, Jin Yong Yoo, Jake Grigsby, Di Jin, and Yanjun Qi. Textattack: A framework for adversarial attacks, data augmentation, and adversarial training in nlp. arXiv preprint arXiv:2005.05909, 2020. 1, 2

    2005 arXiv

  22. [30]

    Camilo Pestana, Naveed Akhtar, Nazanin Rahnavard, Mubarak Shah, and Ajmal S. Mian. Transferable 3d adver- sarial textures using end-to-end optimization. WACV, 2022. 2

    2022

  23. [31]

    M.F. Porter. An algorithm for suffix stripping. In Program, pages 130–137, 1980. 8

    1980

  24. [32]

    Reverie: Remote embodied visual referring ex- pression in real indoor environments

    Yuankai Qi, Qi Wu, Peter Anderson, Xin Wang, William Yang Wang, Chunhua Shen, and Anton van den Hengel. Reverie: Remote embodied visual referring ex- pression in real indoor environments. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pag...

    2020

  25. [33]

    Consistent attack: Universal adversarial perturbation on embodied vision navigation

    You Qiaoben, Chengyang Ying, Xinning Zhou, Hang Su, Jun Zhu, and Bo Zhang. Consistent attack: Universal adversarial perturbation on embodied vision navigation. Pattern Recog- nition Letters, 168, 2022. 2

    2022

  26. [34]

    Ad- versarial attack and defense technologies in natural language processing: A survey

    Shilin Qiu, Qihe Liu, Shijie Zhou, and Wen Huang. Ad- versarial attack and defense technologies in natural language processing: A survey. Neurocomputing, 492:278–307, 2022. 4

    2022

  27. [35]

    Accelerating 3d deep learning with pytorch3d

    Nikhila Ravi, Jeremy Reizenstein, David Novotny, Tay- lor Gordon, Wan-Yen Lo, Justin Johnson, and Georgia Gkioxari. Accelerating 3d deep learning with pytorch3d. arXiv preprint arXiv:2007.08501, 2020. 4

    2007 arXiv

  28. [36]

    Token-modification adversarial attacks for nat- ural language processing: A survey

    Tom Roth, Yansong Gao, Alsharif Abuadbba, Surya Nepal, and Wei Liu. Token-modification adversarial attacks for nat- ural language processing: A survey. AI Communications , (Preprint):1–22, 2021. 4

    2021

  29. [37]

    Ai-driven warehouse automation: A comprehensive review of systems

    Enoch Oluwademilade Sodiya, Uchenna Joseph Umoga, Olukunle Oladipupo Amoo, and Akoh Atadoga. Ai-driven warehouse automation: A comprehensive review of systems. GSC Advanced Research and Reviews, 18(2):272–282, 2024. 1

    2024

  30. [38]

    Goodfellow, and Rob Fergus

    Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian J. Goodfellow, and Rob Fergus. Intriguing properties of neural networks. In Yoshua Bengio and Yann LeCun, editors, 2nd International Conference on Learning Representations, ICLR 2014, Banff, AB...

    2014

  31. [39]

    Dual attention suppression attack: Generate adversarial camouflage in physical world

    Jiakai Wang, Aishan Liu, Zixin Yin, Shunchang Liu, Shiyu Tang, and Xianglong Liu. Dual attention suppression attack: Generate adversarial camouflage in physical world. CVPR,

  32. [40]

    Making an invisibility cloak: Real world adversarial attacks on object detectors

    Zuxuan Wu, Ser-Nam Lim, Larry Davis, and Tom Goldstein. Making an invisibility cloak: Real world adversarial attacks on object detectors. ECCV, 2020. 1, 2

    2020

  33. [41]

    Behavioral analysis of vision-and-language navigation agents

    Zijiao Yang, Arjun Majumdar, and Stefan Lee. Behavioral analysis of vision-and-language navigation agents. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 2574–2582, 2023. 8

    2023

  34. [42]

    Towards improving adversarial training of nlp models

    Jin Yong Yoo and Yanjun Qi. Towards improving adversarial training of nlp models. arXiv preprint arXiv:2109.00544 ,

    arXiv

  35. [43]

    Liu, Duane S

    Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Mingyan D. Liu, Duane S. Boning, and Cho-Jui Hsieh. Ro- bust deep reinforcement learning against adversarial pertur- bations on state observations. NeurIPS, 2020. 2

    2020

  36. [44]

    3d adversarial attacks beyond point cloud

    Jinlai Zhang, Lyujie Chen, Binbin Liu, Bojun Ouyang, Qizhi Xie, Jihong Zhu, and Yanmei Meng. 3d adversarial attacks beyond point cloud. Information Sciences, 2021. 2

    2021

  37. [45]

    Navigation as the attacker wishes? towards building byzantine-robust embodied agents under federated learning

    Yunchao Zhang, Zonglin Di, Kaiwen Zhou, Cihang Xie, and Xin Eric Wang. Navigation as the attacker wishes? towards building byzantine-robust embodied agents under federated learning. arXiv, 2022. 2

    2022

  38. [46]

    On evaluating adversarial robustness of large vision-language models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Chongx- uan Li, Ngai-Man Cheung, and Min Lin. On evaluating adversarial robustness of large vision-language models. In Thirty-seventh Conference on Neural Information Process- ing Systems, 2023. 1 A. Data Description A.1. R2R Data...

    2023

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.