A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era

Eric Liang; Alan Luo; Kaiwen Yuan

cs.CVOct 21, 2026

A Unified Evaluation Framework of Physical Adversarial Robustness in the Edge VLM Era

Authors: Eric Liang, Alan Luo, Kaiwen Yuan

Organizations: Saratoga High School · Google · University of Illinois Urbana-Champaign

Abstract

Recent advancements in Vision-Language Models (VLMs) enable end-to-end visual grounding via language prompts and generative decoding, demonstrating largely improved zero-shot and open-vocabulary detection capabilities. As a result, VLMs are rapidly being deployed at the edge in safety-critical real-world systems. However, the physical adversarial robustness of edge VLMs has not been systematically studied, and the fundamental differences in output with modern object detectors create methodological challenges for fair evaluation. To compare the two families directly, we evaluate every selected representative model on one outcome: whether an adversarial patch worn on a person evades detection of the model. We report this by introducing a unified metric, conditional attack success rate (cASR), counted only on images the model still localizes under a matched gray occluder, and partition every failure into omission (no box), substitution (a box on the patch), and displacement (a box on neither). We benchmark the physical adversarial vulnerability of compact grounding VLMs against a range of object detectors, and find that the VLMs can be as vulnerable as the detectors. We disclose that failure mode is largely associated with the output format of a model rather than its architecture family. Of the three, only omission is visible to a downstream system; displacement and substitution return confident, well-formed boxes, making them potentially more dangerous failures. Further, we find that, under distribution shift, VLMs that primarily failed by omission instead shift to failing more by displacement/substitution. Thus, a grounding VLM can inherit the detector's vulnerability while showing the possibility to adopt more dangerous failure modes. Our code and data are available at https://github.com/ericliang1/physical-adversarial-robustness.

Figures & tables

Figure 1: The three failure modes: omission, displacement, and substitution.

Figure 3: Trained adversarial patches for each model. Patches trained on detectors contain high frequency patterns while patches trained on VLMs contain features that resemble text.

Closed-set detectors
		In-distribution (trained)						Out-of-distribution
		COCO		VOC		AdvT-Shirt		Waymo
Model	Params	Clean	cASR	Clean	cASR	Clean	cASR	Clean	cASR
YOLO11s	9.5 M	96.1	80.3	91.9	66.7	100.0	100.0	74.5	86.1
YOLO26s	9.5 M	95.5	66.1	92.6	50.5	100.0	100.0	75.5	38.7
RT-DETRv2	20.2 M	94.2	63.0	92.6	53.8	100.0	75.6	65.8	80.4

Table 1: Clean detection accuracy and conditional attack success (cASR). Bold marks the lowest cASR within each family.

Closed-set detectors
		In-distribution				Waymo (out-of-distribution)
Model	Output Format	cASR	O	S	D	cASR	O	S	D
YOLO11s	score-gated	78.3	72.8	0.0	5.5	86.1	81.5	0.0	4.6
YOLO26s	score-gated	65.3	62.2	0.0	3.1	38.7	31.0	0.0	7.6
RT-DETRv2	score-gated	61.9	53.5	0.0	8.4	80.4	61.2	0.5	18.7
Open-vocabulary detectors

Table 2: Failure partition into omission (O), substitution (S), and displacement (D).

Appendix figures & tables6 assets

Supplementary material from the paper’s appendix.

Appendix

Panel of Figure 4 — Figure 4: Conditional attack success versus patch scale.

Panel of Figure 5 — Figure 5: Conditional attack success versus IoU threshold.

Prompt	cASR	Omission	Substitution	Displacement
PaliGemma 2-3B (gated)
detect all people ( trained )	55.2	53.4	0.0	1.9
detect all pedestrians	57.0	55.0	0.0	2.0
detect all humans	43.4	39.7	0.0	3.7
detect all persons	39.2	38.0	0.0	1.2
InternVL3-2B (gated)

Appendix

Table 3: Conditional attack success and failure partition across prompts.

Closed-set detectors
Detector	cASR (%)
$\gamma$	0.1	0.25	0.5	0.7
YOLO11s	67.2	73.1	78.3	83.8
YOLO26s	40.7	56.7	65.3	67.9
RT-DETRv2	34.7	49.8	61.9	68.6
Open-vocabulary detectors

Appendix

Table 4: Conditional attack success versus detector confidence threshold.

Figure 6: Example images from each source dataset.

Source dataset	Original	One-person pool	Kept	Kept (%)
COCO val2017	5,000	925	777	15.5
PASCAL VOC 2007+2012 val	8,333	987	674	8.1
AdvT-Shirt-1K, 1-person subset	208	208	204	98.1
Waymo v2 perception, training split	4,662	1,014	999	21.4

Appendix

Table 5: Per-dataset filtering counts.

VLM Robustness

Vision-language model robustness studies whether models remain reliable under visual, textual, and distribution shifts, adversarial inputs, and safety challenges.

See all 454 papers

REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs
Jun 22, 2026Yifei Zhao, Qian Lou, Mengxin ZhengVLM Evaluation VLM Robustness
University of Central Florida
GeoDetect: Geometric Adversarial Detection for VLPs
Jul 16, 2026Afsaneh Hasanebrahimi, Hanxun Huang, Christopher Leckie +2VLM Robustness Adversarial Attacks on VLMs
The University of Melbourne, Melbourne, Australia · Monash University, Melbourne, Australia
Sparse Autoencoders as Plug-and-Play Firewalls for Adversarial Attack Detection in VLMs
May 8, 2026Hao Wang, Yiqun Sun, Pengfei Wei +2VLM Robustness Adversarial Attacks on VLMs
2Waseda University · 1Magellan Technology Research Institute (MTRI)

Jun 22, 2026J/K move · Enter open · S save

REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs

Yifei Zhao, Qian Lou, Mengxin Zheng

University of Central Florida

VLM Evaluation VLM Robustness Adversarial Attacks on VLMs Black-Box Adversarial Attacks Physical Adversarial Attacks

Open paper AskPDF arXiv

Vision-language models (VLMs) are increasingly used as perception-reasoning backbones for embodied intelligence in safety-critical physical systems, where perception or reasoning errors can lead to unsafe decisions or actions. Although many red-teaming methods have been developed to probe VLM vulnerabilities, their evaluation remains fragmented across datasets, metrics, and threat models, making direct comparison difficult and obscuring whether observed differences arise from stronger attacks, more vulnerable models, or incompatible evaluation settings. Existing chatbot-centric red-teaming benchmarks mainly standardize jailbreak and content-safety evaluation, but they do not systematically capture physically grounded functional failures or cover red-teaming methods that target physical-world VLMs. This raises the key challenge of comparing diverse attack methods under a unified protocol while targeting the same scenario-specific failures. We introduce REALM, to our knowledge the first unified red-teaming benchmark for physical-world VLMs. REALM integrates 12 red-teaming methods, 3 model-agnostic defenses, and 13 VLMs under a practical black-box threat model with shared datasets and metrics. To align adversarial objectives across attack families, REALM introduces an agentic target-generation pipeline that constructs shared, scenario-specific, and physically grounded attack objectives for each scene, enabling fair comparison of diverse red-teaming methods under aligned adversarial goals. Our evaluation shows that text and typographic injection attacks induce the most failures, multimodal co-optimization yields the strongest visual-perturbation transfer, single-pass attacks approach iterative methods at much lower cost, and model scale alone does not confer adversarial robustness. Code is available at https://github.com/UCF-ML-Research/REALM.

Abstract

VLM Robustness

Explore similar work

REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs

GeoDetect: Geometric Adversarial Detection for VLPs

Sparse Autoencoders as Plug-and-Play Firewalls for Adversarial Attack Detection in VLMs