Pith. sign in

REVIEW 3 major objections 4 minor 57 references

AdvNav shows that a gradient-free, behavior-guided search over Perlin-noise visual perturbations can derail vision-language navigation agents, achieving 49.70–87.30% attack success rates on Transformer- and LLM-based models.

Reviewed by Pith at T0; open to challenge. T0 means a machine referee read the full paper against a public rubric. the ladder, T0–T4 →

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

T0 review · deepseek-v4-flash

2026-08-02 07:02 UTC pith:AG5A5WYW

load-bearing objection First query-only black-box attack on the full VLN loop, with real empirical payoff, but the threat model has an undefined reference-action source that needs fixing before publication. the 3 major comments →

arxiv 2607.11063 v2 pith:AG5A5WYW submitted 2026-07-13 cs.AI

AdvNav: Behavior-Guided Black-Box Adversarial Attacks on Vision-Language Navigation

Chenyang Li , Kaige Li , Zeyu Jiang , Changhao Chen This is my paper
classification cs.AI
keywords Vision-and-Language NavigationBlack-box adversarial attackPerlin noise perturbationquery-based attackbehavior-guided optimizationgenetic evolutionmultimodal embodied agentsrobustness evaluation
verification ladder T0 review T1 audit T2 compute T3 formal T4 reserved

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper tries to show that vision-language navigation (VLN) agents—embodied systems that move through environments by following natural-language instructions—can be reliably attacked without any access to the model's internals. The proposed method, AdvNav, overlays a smooth, low-frequency Perlin-noise pattern on the agent's first-person view and searches for the most disruptive pattern using only the agent's observed behavior as feedback. The search is guided by a dual-granularity signal: a trajectory-level score derived from navigation metrics, a step-level reward from action probabilities, and a deviation flag. On the Room-to-Room (R2R) benchmark, AdvNav achieves 49.70% attack success on a Transformer-based agent (HAMT) and 65.96%/87.30% on an LLM-based agent (MapGPT with Qwen3-VL/GPT-4V). The reader should care because deployed VLN systems are often proprietary and gradient-inaccessible; if this attack works, current agents share a visual vulnerability that does not require white-box knowledge to exploit.

Core claim

The central claim is that multi-step VLN agents can be broken by a gradient-free, query-only attack on their visual stream. AdvNav parameterizes the attack as a Perlin-noise perturbation, then maximizes an attack objective via iterative rounds: candidate noise patterns are added to a cumulative base, the agent is rolled out under each candidate, and a feedback set is read from the agent's outputs. The trajectory-level score combines navigation-error increase with path-efficiency decrease; the action-level reward is the accumulated per-step gap between the probability of the reference action and the most likely incorrect alternative; and the deviation flag indicates whether the trajectory has

What carries the argument

The load-bearing object is a spatially coherent Perlin-noise perturbation field applied uniformly to every first-person frame. Because it is low-frequency and smooth, it acts like haze or dust on the lens, is perceptually subtle, and has a low-dimensional parameterization that makes black-box search feasible. The search is driven by dual-granularity behavior feedback: G, a trajectory-level attack score from normalized changes in navigation error and path efficiency; R, an action-level reward summing the per-step gap between the probability of the reference action and the most likely wrong alternative; and γ, a deviation indicator. These feed a hybrid optimizer that couples adaptive intensity

Load-bearing premise

The attack's step-level reward and deviation gate require knowing, at every time step, the 'reference action' or whether the agent has deviated from a reference trajectory; if that reference is ground-truth navigation labels rather than an observable clean rollout, the claim of using only observable inputs and outputs collapses.

What would settle it

Run AdvNav with the reference action defined by a clean rollout of the same victim model instead of the ground-truth R2R action. If the attack success rate drops sharply when ground-truth labels are withheld, then the method depends on oracle access and the black-box claim is falsified; if the success rate holds, the attack is genuinely query-only. A second check is to count queries: if each step requires an extra rollout to obtain the reference action, the reported budget is understated.

Watch this falsifier. Get emailed when new claim-graph text bears on it.

If this is right

  • If the reported attack success rates hold, a black-box adversary with no gradient information can force most navigation episodes to fail on models it has never seen internally, making query-only attacks a credible threat for deployed VLN systems.
  • Low-frequency, spatially coherent perturbations are a general attack vector: AdvNav outperforms brightness shift, mask occlusion, and Gaussian-noise baselines on both Transformer-based and LLM-based agents, suggesting a shared vulnerability in the visual perception stream.
  • LLM-based VLN agents are especially susceptible to holistic view-level perturbation—on the GPT-4V backbone the attack success rate reaches 87.30% and SPL falls to 4.71%, indicating that strong language reasoning does not by itself resist visual disturbance.
  • The same framework serves as a stress-testing tool for robustness evaluation; the ablations show that the trajectory-level and action-level feedback signals and the adaptive plus genetic optimizer each contribute beyond random search.
  • Because the perturbation persists across the whole trajectory, the attack exploits error accumulation across a long perception–action loop rather than a single-frame misclassification, which is the kind of failure mode that standard single-step adversarial defenses may not address.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Inference: An implication the paper leaves implicit is that the 'reference action' used in the action-level reward and the deviation gate could come from ground-truth R2R labels, which are unavailable to a deployed black-box attacker. If that is the implementation, the 'only observable inputs and outputs' claim needs a revised threat model; a clean rollout of the same agent would preserve query-on
  • Inference: The success across two different LLM backbones suggests a testable extension—perturbations optimized against one LLM may transfer to another without re-optimization. The paper does not report cross-model transfer, but if it holds, the attack becomes cheaper and more threatening in practice.
  • Inference: Because Perlin noise is a smooth luminance field, it could plausibly be realized physically as a translucent film, projector disturbance, or lens filter rather than an injected digital perturbation. The paper only simulates the visual stream, leaving physical realizability as an open question.
  • Inference: The paper's stress-testing framing points toward a natural countermeasure—training with adversarial visual perturbations or adding contrast-restoration and denoising modules. Whether such a defense generalizes to LLM-based VLN agents is untested and would be a useful next experiment.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes AdvNav, a query-based black-box adversarial attack on Vision-Language Navigation (VLN) agents. The attacker adds a Perlin-noise perturbation to the agent's first-person views and optimizes it by maximizing a surrogate objective composed of a trajectory-level score G (based on NE/SPL changes), an action-level reward R (based on predicted action probabilities), and a binary deviation indicator γ. The optimization is gradient-free: adaptive step-size updates are coupled with a genetic algorithm over noise parameters. Experiments on R2R val-unseen against HAMT and MapGPT report Attack Success Rates of 49.70%, 65.96%, and 87.30%, with ablations and comparisons to three black-box baselines. The central claim is that AdvNav demonstrates effective gradient-free black-box attacks on multi-step VLN using only observable input-output behavior.

Significance. If the central claim is fully supported, the paper makes a useful contribution: it is one of the first black-box, gradient-free adversarial attack frameworks for multi-step VLN, and it shows that structured low-frequency perturbations can degrade both Transformer-based and LLM-based navigation agents. The use of behavior-level feedback to guide a low-dimensional Perlin search is a reasonable way to avoid gradient access, and the paper includes ablation studies (Table 5) and perceptual stealthiness comparisons (Figure 4/LPIPS) that go beyond a single success metric. However, the black-box claim depends on the availability of reference actions/trajectories and on the observability of the metrics used in the objective; these points are not yet established. The paper does not release code, but the optimization protocol is described in enough detail for reimplementation once the reference-behavior ambiguity is resolved.

major comments (3)
  1. [Section 3.2, Equations (5) and (8)] The central black-box claim rests on the reference behavior used to compute the action-level reward R and the deviation indicator γ. Eq. (5) defines R_t = z_sec^t − z_opt^t, where z_opt^t is 'the possibility for choosing the reference action,' but the paper never states what the reference action is or how the attacker obtains it. Eq. (8) similarly gates the optimization on whether the agent 'deviates from the reference trajectory,' without defining the reference trajectory. If the reference comes from R2R ground-truth action/path labels, the attacker has access to labeled supervision not included in the black-box threat model of Section 3.1. If it comes from a clean rollout of the same model, that rollout is an additional oracle whose query cost must be counted in the reported budget and whose definition must be given. Because R and γ are the only per-step feedback used to guide the grad
  2. [Sections 3.1 and 3.2, trajectory-level score] The paper characterizes the attack as using 'only observable inputs and outputs' (Abstract; Section 3.1), but the trajectory-level score G in Eq. (4) is computed from NE and SPL. These metrics are not raw agent outputs: NE requires the ground-truth goal position, and SPL requires the shortest-path length from start to goal. The attack therefore assumes either an external evaluation harness that supplies these labels, or knowledge of the ground-truth goal. The authors should state this explicitly and, if the threat model is meant to be deployment-style, show how G can be obtained from observable behavior alone (e.g., by estimating success from the final position relative to the instruction). As written, 'observable' conflates agent outputs with benchmark evaluation labels.
  3. [Tables 1 and 2, Section 4.1] ASR is the primary metric, but no clean success rate (SR) is reported for either model. The No Attack rows list SPL and NE only, while ASR is defined as the fraction of clean successes that become failures under attack. Without the clean success rate, the reader cannot tell whether, for example, the 49.70% ASR on HAMT is close to the ceiling imposed by the model's clean success rate or far below it, and cross-model comparisons are hard to interpret. Please include clean SR in the No Attack rows (or a standard SR column in every method block) for all model and scene partitions.
minor comments (4)
  1. [Table 1, Mask Occlusion row] Several entries are concatenated, e.g. '47.1240.00' and '33.8526.00', making scene-level values unreadable. Reformat the table and check all numeric entries for alignment and accuracy.
  2. [Equation (4)] The normalization function Norm(·) is never defined. State whether it is min-max scaling, standard-score normalization, or some fixed constant, since it directly affects the balance between ΔNE and ΔSPL.
  3. [Section 4.1, MapGPT subset] The LLM experiments use a randomly sampled subset of 165 instructions (15 per scene). No random seed or repeated subsampling is reported, so the ASR values in Table 2 have unknown sampling variability. Report seeds and/or bootstrap confidence intervals.
  4. [Section 4.1, hyperparameters] The weighting λ and step size α are fixed at 0.5 and 1, but no sensitivity analysis is reported for them. Table 3 explores rounds and population size only; adding λ/α sensitivity would strengthen the robustness claims.

Circularity Check

0 steps flagged

No significant circularity: reported ASR is an external evaluation, not a fitted quantity; Eq. (5)'s undefined 'reference action' is a threat-model gap, not a circular derivation.

full rationale

The derivation chain is not circular. AdvNav defines an attack objective (Eq. 3) and a dual-granularity feedback: trajectory-level G in Eq. (4) combines observable ΔNE and ΔSPL; action-level R in Eq. (5) aggregates differences between action probabilities; γ gates the gain in Eq. (8). The final ASR (Tables 1-2) is computed as the proportion of episodes that succeed cleanly but fail under perturbation, i.e. an independent outcome measure, not one of the optimized quantities. Although hyperparameters (rounds, population size) are selected from a 165-instruction subset in Sec. 4.4, the headline results are reported on the full val-unseen evaluation and are not the same subset numbers, so this is normal tuning rather than fitting the reported metric. No load-bearing result is justified by a self-citation chain or by an equation that contains the reported ASR by construction. One genuine limitation should be flagged, though it is not circularity: Eq. (5) depends on z_opt^t, 'the possibility for choosing the reference action,' and γ indicates 'whether the agent actually deviates from the reference trajectory'; the paper never states whether this reference is the R2R ground-truth action (privileged supervision) or a clean rollout of the same agent (extra queries). If ground truth is used, the 'only observable inputs and outputs' claim in Sec. 3.1 is unsupported; if a clean rollout is used, the query budget should include it. This affects the threat model, not the circularity of the derivation, because ASR is still measured independently.

Axiom & Free-Parameter Ledger

6 free parameters · 4 axioms · 0 invented entities

The paper contributes an optimization recipe, not a derived law. The main free choices are hyperparameters, and the main unstated dependency is access to reference actions/trajectories for computing R and γ. No new physical or conceptual entity is introduced.

free parameters (6)
  • λ (lambda) = 0.5
    Hand-set weight in Eq. (4) balancing normalized NE and SPL differences; no sensitivity analysis reported for it.
  • step size α = 1
    Fixed step for adding/subtracting candidate noise in Eq. (7)/(12); chosen by hand.
  • GA population size, rounds, top-k, mutation rate = 10, 20, 2, 0.2
    Selected by grid search on a 165-instruction HAMT subset (Table 3); these are tuned hyperparameters, not derived from theory.
  • Perlin noise parameters = not specified
    Frequency, octaves, persistence, and parameter vector θ are not given; the search space is incompletely specified.
  • Norm(·) normalization = not specified
    Eq. (4) uses Norm to align NE and SPL scales without defining how the normalization factors are computed.
  • perturbation budget ε = not reported
    The constraint ∥δ∥∞≤ε appears in Eq. (3) but no ε value is reported in the experiments.
axioms (4)
  • domain assumption Attacker has query access to the full action probability vector at every step.
    Stated in Sec. 3.1; needed to compute R in Eq. (5). Some deployed VLN APIs may expose only the selected action, not probabilities.
  • ad hoc to paper Reference/optimal actions are available to compute z^opt_t and the deviation indicator γ.
    Eq. (5) and Eq. (8) require knowing the 'correct' action each step and whether the trajectory deviates; the paper never states whether these are ground-truth labels or clean-model rollouts.
  • domain assumption A single static Perlin-noise perturbation overlaid on every frame is an expressive enough search space to disrupt navigation.
    The entire optimization searches over this low-dimensional family; there is no evidence that other perturbation classes would not be needed for different agents.
  • domain assumption SPL, SR, and NE are observable evaluation metrics in the black-box scenario.
    These metrics require goal locations and path lengths from the simulator/dataset; they are treated as observable outputs throughout the attack loop.

pith-pipeline@v1.3.0-alltime-deepseek · 15536 in / 18749 out tokens · 162515 ms · 2026-08-02T07:02:20.681024+00:00 · methodology

0 comments
read the original abstract

Despite progress in Embodied AI, Vision-and-Language Navigation systems remain vulnerable to adversarial visual disturbances. Most existing methods rely on white-box access to target model gradients, which is often unrealistic for real-world deployed systems and computationally exhaustive due to recursive backpropagation for optimization, limiting their applicability. While previous black-box methods predominantly target single-step, instantaneous decision tasks, they struggle to handle the task complexities and temporal dependencies. This highlights the need for a gradient-free attack method that can effectively disrupt the multistep sequential perception-action loop using only observable inputs and outputs. Therefore, we propose AdvNav, a behavior-guided black-box adversarial attack framework that disturbs an agent's first-person views during navigation. To construct an informative surrogate objective for effective optimization guidance in gradient-free search under the black-box setting, we design a dual-granularity behavior-based feedback, aggregating a trajectory-level performance score representing overall navigation degradation, an action-level reward score considering the potential decision risk, and a deviation indicator, all of which are extracted from the agent's self-output behaviors. This feedback guides a hybrid optimization strategy that heuristically tunes perturbation strength via adaptive updates and evolves noise spatial structure genetically, to iteratively discover the most disruptive noise configuration. Evaluated against Transformer-based HAMT and LLM-based MapGPT with two types of backbones on R2R dataset, AdvNav achieves 49.70/65.96/87.30% Attack Success Rate. The result demonstrates the effectiveness and generality of AdvNav, reveals critical perception vulnerabilities and offers insights for the design of future resilient VLN models.

Figures

Figures reproduced from arXiv: 2607.11063 by Changhao Chen, Chenyang Li, Kaige Li, Zeyu Jiang.

Figure 1
Figure 1. Figure 1: Comparison between existing and our target adver [PITH_FULL_IMAGE:figures/full_fig_p002_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Behavior-guided perturbation optimization loop under black-box setting. (1) Generate trial candidate perturbations [PITH_FULL_IMAGE:figures/full_fig_p004_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Ranking of trial candidate noises by relative gain. [PITH_FULL_IMAGE:figures/full_fig_p005_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Visual comparison of the agent’s first-person observations under different perturbations. We visualize how different [PITH_FULL_IMAGE:figures/full_fig_p006_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Trajectory deviation induced by adversarial perturbations. We visualize the agent’s navigation trajectories before and [PITH_FULL_IMAGE:figures/full_fig_p008_5.png] view at source ↗

Review history (2 revisions) →

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

57 extracted references · 14 linked inside Pith

  1. [1]

    GPT-4V(ision) System Card

    2023. GPT-4V(ision) System Card. https://api.semanticscholar.org/CorpusID: 263218031

    2023

  2. [2]

    Peter Anderson, Qi Wu, Damien Teney, Jake Bruce, Mark Johnson, Niko Sünder- hauf, Ian Reid, Stephen Gould, and Anton Van Den Hengel. 2018. Vision-and- language navigation: Interpreting visually-grounded navigation instructions in real environments. InProceedings of the IEEE conference on computer vision and pattern recognition (CVPR). 3674–3683

    2018

  3. [3]

    Shuai Bai, Yuxuan Cai, Ruizhe Chen, Keqin Chen, Xiong-Hui Chen, Zesen Cheng, Lianghao Deng, Wei Ding, Rongyao Fang, Chang Gao, Chunjiang Ge, Wenbin Ge, Zhifang Guo, Qidong Huang, Qidong Huang, Fei Huang, Binyuan Hui, Shutong Jiang, Zhaohai Li, Mingsheng Li, Mei Li, Kaixin Li, Zicheng Lin, Junyang Lin, Xuejing Liu, Jiawei Liu, Chenglong Liu, Yang Liu, Dayi...

    Pith/arXiv arXiv 2025

  4. [4]

    Siddhant Bhambri, Sumanyu Muku, Avinash Tulasi, and Arun Balaji Buduru

  5. [5]

    Tom B Brown, Dandelion Mané, Aurko Roy, Martín Abadi, and Justin Gilmer

  6. [6]

    Yulong Cao, Chaowei Xiao, Benjamin Cyr, Yimeng Zhou, Won Park, Sara Ram- pazzi, Qi Alfred Chen, Kevin Fu, and Z Morley Mao. 2019. Adversarial sensor attack on lidar-based perception in autonomous driving. InProceedings of the 2019 ACM SIGSAC conference on computer and communications security. 2267–2281

    2019

  7. [7]

    Nicholas Carlini and David Wagner. 2017. Towards evaluating the robustness of neural networks. In2017 ieee symposium on security and privacy (sp). Ieee, 39–57

    2017

  8. [8]

    Nicholas Carlini and David Wagner. 2018. Audio adversarial examples: Targeted attacks on speech-to-text. In2018 IEEE security and privacy workshops (SPW). IEEE, 1–7

    2018

  9. [9]

    Anirban Chakraborty, Manaar Alam, Vishal Dey, Anupam Chattopadhyay, and Debdeep Mukhopadhyay. 2018. Adversarial attacks and defences: A survey.arXiv preprint arXiv:1810.00069(2018)

    Pith/arXiv arXiv 2018

  10. [10]

    Angel Chang, Angela Dai, Thomas Funkhouser, Maciej Halber, Matthias Niessner, Manolis Savva, Shuran Song, Andy Zeng, and Yinda Zhang. 2017. Matterport3D: Learning from RGB-D Data in Indoor Environments.International Conference on 3D Vision (3DV)(2017)

    2017

  11. [11]

    Devendra Singh Chaplot, Dhiraj Prakashchand Gandhi, Abhinav Gupta, and Russ R Salakhutdinov. 2020. Object goal navigation using goal-oriented semantic exploration.Advances in Neural Information Processing Systems33 (2020), 4247– 4258

    2020

  12. [12]

    Jiaqi Chen, Bingqian Lin, Ran Xu, Zhenhua Chai, Xiaodan Liang, and Kwan-Yee Wong. 2024. Mapgpt: Map-guided prompting with adaptive path planning for vision-and-language navigation. InProceedings of the 62nd Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers). 9796–9810

    2024

  13. [13]

    Meng Chen, Jiawei Tu, Chao Qi, Yonghao Dang, Feng Zhou, Wei Wei, and Jianqin Yin. 2024. Towards Physically Realizable Adversarial Attacks in Embodied Vision Navigation.arXiv preprint arXiv:2409.10071(2024)

    Pith/arXiv arXiv 2024

  14. [14]

    Pin-Yu Chen, Huan Zhang, Yash Sharma, Jinfeng Yi, and Cho-Jui Hsieh. 2017. Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models. InProceedings of the 10th ACM workshop on artificial intelligence and security. 15–26

    2017

  15. [15]

    Shizhe Chen, Pierre-Louis Guhur, Cordelia Schmid, and Ivan Laptev. 2021. History aware multimodal transformer for vision-and-language navigation.Advances in neural information processing systems34 (2021), 5834–5847

    2021

  16. [16]

    Shizhe Chen, Pierre-Louis Guhur, Makarand Tapaswi, Cordelia Schmid, and Ivan Laptev. 2022. Think global, act local: Dual-scale graph transformer for vision- and-language navigation. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 16537–16547

    2022

  17. [17]

    Ta-Chung Chi, Minmin Shen, Mihail Eric, Seokhwan Kim, and Dilek Hakkani- Tur. 2020. Just ask: An interactive learning framework for vision and language navigation. InProceedings of the AAAI conference on artificial intelligence, Vol. 34. 2459–2466. MM ’26, November 10–14, 2026, Rio de Janeiro, Brazil Chenyang Li, Kaige Li, Zeyu Jiang, and Changhao Chen

    2020

  18. [18]

    Abhishek Das, Samyak Datta, Georgia Gkioxari, Stefan Lee, Devi Parikh, and Dhruv Batra. 2018. Embodied question answering. InProceedings of the IEEE conference on computer vision and pattern recognition. 1–10

    2018

  19. [19]

    Danny Driess, Fei Xia, Mehdi SM Sajjadi, Corey Lynch, Aakanksha Chowdh- ery, Brian Ichter, Ayzaan Wahid, Jonathan Tompson, Quan Vuong, Tianhe Yu, et al. 2023. Palm-e: An embodied multimodal language model.arXiv preprint arXiv:2303.03378(2023)

    Pith/arXiv arXiv 2023

  20. [20]

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. 2018. Robust physical- world attacks on deep learning visual classification. InProceedings of the IEEE conference on computer vision and pattern recognition. 1625–1634

    2018

  21. [21]

    Amelia Fiske, Peter Henningsen, and Alena Buyx. 2019. Your robot therapist will see you now: ethical implications of embodied artificial intelligence in psychiatry, psychology, and psychotherapy.Journal of medical Internet research21, 5 (2019), e13216

    2019

  22. [22]

    Ji Gao, Jack Lanchantin, Mary Lou Soffa, and Yanjun Qi. 2018. Black-box genera- tion of adversarial text sequences to evade deep learning classifiers. In2018 IEEE Security and Privacy Workshops (SPW). IEEE, 50–56

    2018

  23. [23]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. 2014. Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572(2014)

    Pith/arXiv arXiv 2014

  24. [24]

    Chuan Guo, Jacob Gardner, Yurong You, Andrew Gordon Wilson, and Kilian Weinberger. 2019. Simple black-box adversarial attacks. InInternational conference on machine learning. PMLR, 2484–2493

    2019

  25. [25]

    Andrew Ilyas, Logan Engstrom, Anish Athalye, and Jessy Lin. 2018. Black- box adversarial attacks with limited queries and information. InInternational conference on machine learning. PMLR, 2137–2146

    2018

  26. [26]

    Annu Lambora, Kunal Gupta, and Kriti Chopra. 2019. Genetic algorithm-A literature review. In2019 international conference on machine learning, big data, cloud and parallel computing (COMITCon). IEEE, 380–384

    2019

  27. [27]

    Bingqian Lin, Yi Zhu, Yanxin Long, Xiaodan Liang, Qixiang Ye, and Liang Lin

  28. [28]

    Aishan Liu, Tairan Huang, Xianglong Liu, Yitao Xu, Yuqing Ma, Xinyun Chen, Stephen J Maybank, and Dacheng Tao. 2020. Spatiotemporal attacks for embodied agents. InEuropean Conference on Computer Vision. Springer, 122–138

    2020

  29. [29]

    Xin Liu, Huanrui Yang, Ziwei Liu, Linghao Song, Hai Li, and Yiran Chen

  30. [30]

    Yang Liu, Weixing Chen, Yongjie Bai, Xiaodan Liang, Guanbin Li, Wen Gao, and Liang Lin. 2025. Aligning cyber space with physical world: A comprehensive survey on embodied ai.IEEE/ASME Transactions on Mechatronics(2025)

    2025

  31. [31]

    Wenqi Lyu, Zerui Li, Yanyuan Qiao, and Qi Wu. 2025. Badnaver: Exploring jail- break attacks on vision-and-language navigation.arXiv preprint arXiv:2505.12443 (2025)

    Pith/arXiv arXiv 2025

  32. [32]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2017. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083(2017)

    Pith/arXiv arXiv 2017

  33. [33]

    Bahar Memarian and Tenzin Doleck. 2024. Embodied AI in education: A review on the body, environment, and mind.Education and Information Technologies29, 1 (2024), 895–916

    2024

  34. [34]

    Ken Perlin. 1985. An image synthesizer.ACM Siggraph Computer Graphics19, 3 (1985), 287–296

    1985

  35. [35]

    Yanyuan Qiao, Yuankai Qi, Yicong Hong, Zheng Yu, Peng Wang, and Qi Wu

  36. [36]

    Lei Ren, Jiabao Dong, Shuai Liu, Lin Zhang, and Lihui Wang. 2024. Embodied intelligence toward future smart manufacturing in the era of AI foundation model. IEEE/ASME Transactions on Mechatronics(2024)

    2024

  37. [37]

    Mahmood Sharif, Sruti Bhagavatula, Lujo Bauer, and Michael K Reiter. 2016. Ac- cessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition. InProceedings of the 2016 acm sigsac conference on computer and communications security. 1528–1540

    2016

  38. [38]

    Satya Narayan Shukla, Anit Kumar Sahu, Devin Willmott, and J Zico Kolter

  39. [39]

    Hanqing Wang, Wei Liang, Luc V Gool, and Wenguan Wang. 2022. Towards versatile embodied navigation.Advances in neural information processing systems 35 (2022), 36858–36874

    2022

  40. [40]

    Xin Wang, Qiuyuan Huang, Asli Celikyilmaz, Jianfeng Gao, Dinghan Shen, Yuan- Fang Wang, William Yang Wang, and Lei Zhang. 2019. Reinforced cross-modal matching and self-supervised imitation learning for vision-language naviga- tion. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 6629–6638

    2019

  41. [41]

    Zixia Wang, Jia Hu, and Ronghui Mu. 2025. Safety of embodied navigation: A survey.arXiv preprint arXiv:2508.05855(2025)

    Pith/arXiv arXiv 2025

  42. [42]

    Yuchen Wu, Pengcheng Zhang, Meiying Gu, Jin Zheng, and Xiao Bai. 2024. Embodied navigation with multi-modal information: A survey from tasks to methodology.Information Fusion112 (2024), 102532

    2024

  43. [43]

    Wenpeng Xing, Minghao Li, Mohan Li, and Meng Han. 2025. Towards robust and secure embodied ai: A survey on vulnerabilities and attacks.arXiv preprint arXiv:2502.13175(2025)

    Pith/arXiv arXiv 2025

  44. [44]

    Black-box adversarial attacks with bayesian optimization.arXiv preprint arXiv:1909.13857(2019)

    Pith/arXiv arXiv 1909

  45. [45]

    Chengyang Ying, You Qiaoben, Xinning Zhou, Hang Su, Wenbo Ding, and Jiany- ong Ai. 2023. Consistent attack: Universal adversarial perturbation on embodied vision navigation.Pattern Recognition Letters168 (2023), 57–63

    2023

  46. [46]

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang

  47. [47]

    Yue Zhang, Ziqiao Ma, Jialu Li, Yanyuan Qiao, Zun Wang, Joyce Chai, Qi Wu, Mohit Bansal, and Parisa Kordjamshidi. 2024. Vision-and-Language Navigation Today and Tomorrow: A Survey in the Era of Foundation Models.arXiv preprint arXiv:2407.07035(2024)

    Pith/arXiv arXiv 2024

  48. [48]

    Duo Zheng, Shijia Huang, Lin Zhao, Yiwu Zhong, and Liwei Wang. 2024. To- wards learning a generalist model for embodied navigation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 13624–13634

    2024

  49. [49]

    Gengze Zhou, Yicong Hong, and Qi Wu. 2024. Navgpt: Explicit reasoning in vision-and-language navigation with large language models. InProceedings of the AAAI Conference on Artificial Intelligence, Vol. 38. 7641–7649

    2024

  50. [50]

    Zijiao Yang, Xiangxi Shi, Eric Slyman, and Stefan Lee. 2025. Hijacking Vision- and-Language Navigation Agents with Adversarial Environmental Attacks. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV). IEEE, 6094–6103

    2025

  51. [53]

    InProceedings of the IEEE conference on computer vision and pattern recognition

    The unreasonable effectiveness of deep features as a perceptual metric. InProceedings of the IEEE conference on computer vision and pattern recognition. 586–595

  52. [57]

    Yuke Zhu, Roozbeh Mottaghi, Eric Kolve, Joseph J Lim, Abhinav Gupta, Li Fei-Fei, and Ali Farhadi. 2017. Target-driven visual navigation in indoor scenes using deep reinforcement learning. In2017 IEEE international conference on robotics and automation (ICRA). IEEE, 3357–3364

    2017

  53. [2017]

    Adversarial patch.arXiv preprint arXiv:1712.09665(2017)

    Pith/arXiv arXiv 2017

  54. [2018]

    Dpatch: An adversarial patch attack on object detectors.arXiv preprint arXiv:1806.02299(2018)

    Pith/arXiv arXiv 2018

  55. [2019]

    A survey of black-box adversarial attacks on computer vision models.arXiv preprint arXiv:1912.01667(2019)

    Pith/arXiv arXiv 1912

  56. [2021]

    Adversarial reinforced instruction attacker for robust vision-language navigation.IEEE Transactions on Pattern Analysis and Machine Intelligence44, 10 (2021), 7175–7189

    2021

  57. [2022]

    InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition

    Hop: History-and-order aware pre-training for vision-and-language navi- gation. InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 15418–15427