🤖 AI

Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation

This paper introduces Semantic-Aware Universal Perturbation (SAUP), a novel attack that leverages a single adversarial perturbation to hijack stateless Multimodal Large Language Models by acting as a semantic router that directs diverse inputs to attacker-defined targets, achieving a 66% success rate across multiple targets on representative models.

Original authors: Changyue Li, Jiaying Li, Youliang Yuan, Jiaming He, Zhicong Huang, Pinjia He

Published 2026-06-18

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Changyue Li, Jiaying Li, Youliang Yuan, Jiaming He, Zhicong Huang, Pinjia He

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a very smart, autonomous robot car or a robotic arm. These machines use a "brain" called a Multimodal Large Language Model (MLLM) to look at the world and decide what to do next.

Here is the problem: These robots often work in "stateless" mode. This means they don't remember what happened five seconds ago. They only look at the current picture and the current instruction, make a snap decision, and then forget everything. It's like a driver who has amnesia every time they blink; they only know what they see right now.

The paper "Semantic Router" reveals a scary new way to hack these robots using just one single, tiny, invisible sticker (an adversarial perturbation).

The "Magic Sticker" Analogy

Think of the robot's brain as a very strict traffic cop.

Normal situation: The cop looks at a picture of an intersection and says, "Stop." The cop looks at a picture of a roundabout and says, "Go."
The Attack: The hacker places a tiny, almost invisible "Magic Sticker" on the robot's camera lens. This sticker doesn't just make the robot see things wrong; it acts like a Semantic Router (a fancy term for a smart switch).

This sticker has a superpower: It can read the context of the image and flip a switch to send the robot to a completely different, dangerous destination.

Scenario A: The robot sees a roundabout. The sticker senses this and tells the robot: "Turn Left." (Normal behavior).
Scenario B: The robot sees an intersection. The sticker senses this different context and instantly switches the instruction to: "Turn Right" (or even "Drive off a cliff").

The scary part? The hacker only needs to paste one sticker. That single sticker works on every image the robot sees, but it changes its mind based on what the robot is actually looking at. It's like a remote control that changes its button function depending on which room you are in.

How Did They Do It? (The "Geometric" Trick)

The researchers didn't just guess; they looked inside the robot's "brain" (the mathematical space where images are processed) to understand how to build this sticker. They found two main tricks:

The "Dominant Shift" (The Big Push): The sticker pushes the robot's brain away from its normal, safe thinking path. It forces the robot into a "confused zone" where the rules are different.
The "Semantic Deflection" (The Gentle Nudge): Once the robot is in that confused zone, the sticker uses the tiny differences between images (like the difference between a "truck" and a "mountain") to gently nudge the robot toward specific, pre-programmed dangerous commands.

To make this work, they invented a new math recipe called SORT. Think of SORT as a master chef who knows exactly how much salt (noise) to add to a soup (the image) so that it tastes like "chicken" if you look at a chicken, but tastes like "poison" if you look at a cake.

The Results: How Bad Is It?

The researchers tested this on three different types of robot brains (called LLaVA, Qwen, and InternVL) using two types of test data:

Simple pictures (like a cat vs. a dog).
Real-world driving and robot tasks (like a car approaching a stop sign or a robot arm picking up a cup).

The findings were startling:

One sticker, many targets: They could make one sticker guide a robot to 5 different dangerous outcomes depending on the scene.
High success rate: On one of the models (Qwen), a single sticker successfully tricked the robot 66% of the time across 5 different targets.
Fine-grained control: Even when the scenes were very similar (like a car on a highway vs. a car on a sidewalk), the sticker could tell the difference and issue the correct dangerous command.
Long instructions: They could even make the robot say long, specific sentences (like "Delete all files") based on what it saw, not just short words.

The Bottom Line

This paper proves that it is possible to "hijack" a robot's decision-making process with a single, universal trick. The robot doesn't need to be hacked every time it moves; the hacker just needs to plant one "Semantic Router" sticker. Once it's there, the robot will happily follow the hacker's instructions, switching between different dangerous commands based entirely on what it sees in front of it.

The paper concludes that this is a fundamental vulnerability in how these AI systems currently work, especially when they make decisions without remembering the past.

Technical Summary: Semantic Router: On the Feasibility of Hijacking MLLMs via a Single Adversarial Perturbation

1. Problem Definition: Semantic-Aware Hijacking

This paper investigates a novel threat to Multimodal Large Language Models (MLLMs) termed Semantic-Aware Hijacking. While MLLMs are increasingly deployed in stateless systems (e.g., autonomous driving, robotics) where they process individual frames without retaining historical context, this work explores the feasibility of compromising a sequence of these atomic decisions using a single, universal adversarial perturbation.

Unlike traditional Universal Adversarial Perturbations (UAPs) that map diverse inputs to a single target or untargeted noise that degrades performance generally, the proposed threat involves a Semantic-Aware Universal Perturbation (SAUP). A SAUP acts as a "semantic router," actively perceiving the visual semantics of an input frame and routing it to a distinct, attacker-defined target based solely on that input's content. For instance, in an autonomous driving scenario, a single perturbation could force the model to output "turn right" when it detects an intersection, but "stop" when it detects a roundabout, cumulatively guiding an agent to a malicious destination.

The core challenge lies in the geometric constraints of the latent space: the perturbation must simultaneously shift all inputs away from their natural manifolds (Dominant Shift) while preserving and amplifying subtle semantic differences to deflect them toward specific, distinct targets (Semantic Deflection).

2. Methodology: SORT and Theoretical Framework

Theoretical Analysis

The authors formalize the threat model under a white-box setting, analyzing the geometric properties of the MLLM's latent space. They decompose the vision encoder's response to a perturbed input $x + \delta$ into two components via a first-order Taylor expansion:

Dominant Shift ( $\mu_\delta$ ): The perturbation $\delta$ creates a dominant shift $\phi(\delta)$ , moving the input cluster into an adversarial subspace where decision boundaries are dense.
Semantic Deflection ( $\nu_c$ ): The perturbation leverages the Jacobian matrix $J_\delta$ to extract intrinsic semantic differences from the input $x(c)$ , deflecting features toward specific proxy target embeddings.

The authors derive a theoretical bound (Theorem 3.4) stating that successful mapping requires the perturbation's expansion capability (spectral norm of the Jacobian) to exceed the ratio of the distance between target embeddings to the distance between input embeddings. This highlights the difficulty of attacking fine-grained semantics where input distances are small.

The SORT Algorithm

To overcome these optimization challenges, the paper proposes the Semantic-ORienTed (SORT) optimization strategy, which consists of two key components:

Normalized Space Optimization (NSO): Instead of optimizing directly in the pixel space $[0, 1]$ , which leads to unstable gradients and local minima, SORT introduces a change of variables to a normalized, unconstrained space. This stabilizes the optimization landscape and ensures consistent step sizes.
Semantic Separation Optimization (SSO): To explicitly maximize the deflection potency, the authors introduce a margin-based loss ( $L_{Margin}$ ) alongside standard cross-entropy loss. This loss function forces the perturbed features of different semantic classes to separate in the output space, ensuring they align with their respective proxy target embeddings rather than collapsing into a single cluster.

Dataset: RIST

To evaluate fine-grained semantic hijacking, the authors introduce RIST (Real Image Sequence Trajectories). Unlike standard classification benchmarks, RIST consists of sequential frames from continuous videos (AutoDriving and RoboTasking scenarios). It features fine-grained semantic categories (e.g., specific intersection types or robotic manipulation states) where inputs within a category are visually similar but require distinct, context-aware actions.

3. Key Results

The authors conducted extensive experiments on three representative MLLMs: LLaVA-1.5, Qwen2.5-VL, and InternVL3, across two datasets (ImageNet for coarse-grained and RIST for fine-grained semantics).

Feasibility of Semantic Routing: The experiments demonstrate that a single SAUP can successfully hijack multiple stateless decisions. On the Qwen model, a single perturbation achieved a 66% Attack Success Rate (ASR) across five distinct targets using a single frame.
Fine-Grained Control: On the RIST dataset, SAUPs achieved an average ASR of 72% on the RoboTasking scenario (2 targets) and 62% on the AutoDriving scenario (5 targets), proving the ability to distinguish subtle semantic variations (e.g., different road conditions) to trigger specific commands like "accelerate" or "steer."
Long-Text Generation: The attack extends to controlling long-text generation. With 2 targets, SAUPs maintained an 83% ASR even when targets consisted of 10 words. With 5 targets, they achieved a 54% ASR for 4-word targets.
Information Capacity: The study identifies an "information capacity" limit. As the number of targets increases, ASR declines, particularly for perturbations with limited spatial constraints (e.g., corner patches vs. full frames). The Frame constraint (7,056 pixels) maintained higher success rates than the Corner constraint (1,600 pixels) as the number of targets grew, suggesting a bottleneck in encoding multiple decision boundaries within a limited pixel budget.
Ablation Studies: Removing NSO caused a catastrophic drop in performance (average 49.5% ASR drop), confirming its necessity for optimization stability. Removing SSO resulted in lower performance in multi-target scenarios, highlighting its role in separating semantic clusters.

4. Significance and Claims

The paper claims to demonstrate the fundamental feasibility of hijacking stateless MLLM decisions via a single perturbation that acts as a semantic router. The significance of this work lies in:

Novel Threat Model: It moves beyond simple misclassification or single-target hijacking to a "many-to-many" universal attack, where a single perturbation dynamically routes inputs to different malicious targets based on visual context.
Geometric Insight: It provides a theoretical and empirical understanding of the "Dominant Shift" and "Semantic Deflection" mechanisms in the latent space, offering a principled framework for understanding how universal perturbations can encode complex mappings.
Real-World Implications: While the study is conducted in a digital white-box setting, the authors argue that this vulnerability poses meaningful risks for stateless agents in autonomous driving and robotics. They suggest that an attacker could embed a crafted SAUP in a web advertisement or visual environment to coerce an agent into a chain of malicious decisions (e.g., uploading private data followed by executing a "submit" command).

The authors maintain a modest stance regarding physical deployment, acknowledging that robustness to physical factors (lighting, motion blur) and black-box settings remains a significant challenge requiring future research. However, they posit that the demonstrated digital feasibility serves as a critical starting point for understanding and mitigating semantic hijacking in complex agentic environments.