💻 computer science

Not What You Asked For: Typographic Attacks in Household Robot Manipulation

This paper demonstrates that typographic attacks on household robots utilizing vision-language models can bypass visual judgment to cause physically consequential manipulation failures, achieving a 67.8% success rate in a simulated environment by poisoning the robot's semantic map and leading to the incorrect grasping and transport of objects.

Original authors: Ali Iranmanesh, Peng Liu

Published 2026-05-19

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Ali Iranmanesh, Peng Liu

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine a household robot as a helpful but slightly naive assistant. It has two main ways of understanding the world:

Its Eyes (Vision): It looks at an object and says, "That looks like a coffee mug."
Its Brain (Language): It listens to your command, "Please bring me the coffee mug," and matches the words to what it sees.

In modern robots, these two systems are glued together into a single "brain" (called a Vision-Language Model). This is great because the robot can understand thousands of new things without needing to be retrained. However, the paper argues that this glue creates a dangerous loophole.

The "Magic Sticker" Trick

The researchers discovered that if you stick a piece of paper with the words "COFFEE MUG" printed on it onto a completely different object—like a toaster, a shoe, or a lamp—the robot's brain gets confused.

Because the robot's "language" and "vision" parts are so tightly linked, the robot stops looking at the object's shape and color. Instead, it starts reading the text first and looking later. It sees the words "COFFEE MUG" and immediately decides, "Ah, this must be the coffee mug," completely ignoring the fact that it's actually a toaster.

The Domino Effect: From a Glance to a Grasp

What makes this dangerous isn't just that the robot thinks the toaster is a mug. It's what happens next.

The Poisoned Map: The robot doesn't just make a quick mistake; it writes this error into its permanent 3D mental map of the room. It's like the robot scribbles "This is a mug" on a sticky note and sticks it to the toaster in its memory.
The Blind Trust: Even if the robot walks away and comes back, or if the sticker is hidden from view, it still trusts its mental map. It thinks, "I know there's a mug right there," because it wrote that down earlier.
The Kinetic Failure: The robot then physically walks over, grabs the toaster, and tries to hand it to you or put it in a cup holder.

The paper calls this a "Kinetic Failure." It's not just a software glitch where the robot says the wrong thing; it's a physical action where the robot commits to the wrong object and carries it around the house.

The Experiment: How They Tested It

The researchers couldn't test this on real robots in real homes (it's too expensive and risky), so they used a highly realistic video game simulation called Habitat.

The Setup: They took a robot that was already good at finding and picking up objects.
The Attack: They placed a printed sticker with the name of the target object (e.g., "CUP") on a random, nearby object (a distractor).
The Result: Out of 59 specific test scenarios where the robot was already capable of doing the job, the sticker tricked the robot 67.8% of the time.

In the most successful cases, the robot didn't just grab the wrong thing; it successfully navigated to the wrong object, picked it up, carried it across the room, and tried to place it in the correct spot. The robot was fully "committed" to the mistake.

Why This Matters (According to the Paper)

The paper highlights that previous research looked at how stickers trick robots into navigating to the wrong place (like a drone flying to the wrong roof). But this is the first time anyone has shown that stickers can trick a robot into physically grabbing and moving the wrong item.

The danger is that the robot's "memory" (the 3D map) keeps the poison alive. Even if you take the sticker away, the robot might still try to pick up the wrong object because its internal map is corrupted.

The Proposed Fix

The authors suggest that we can't just fix the robot's "eyes" to ignore the text. Instead, we need to change how the robot uses its memory. They propose three safety checks:

Double-Check: Don't trust a single glance. Make the robot look at the object from different angles before writing it into its permanent memory.
Spot the Text: Have a secondary system that says, "Wait, there's a sticker on this object. Don't trust the label yet."
Final Check: Right before the robot actually grabs the object, have it look at it one last time to make sure it hasn't been tricked.

In short: A piece of paper with words on it can trick a smart robot into thinking a toaster is a cup, and the robot will happily carry that toaster to your kitchen counter. The paper proves this is a real, physical risk for future home robots.

Technical Summary: Typographic Attacks in Household Robot Manipulation

Problem Statement
Open-vocabulary embodied AI agents, particularly those utilizing Vision-Language Models (VLMs) like CLIP, rely on a shared embedding space to align visual and linguistic features. While this enables flexibility in identifying thousands of object categories without retraining, it introduces a structural vulnerability to typographic attacks. In these attacks, printed text in a physical scene semantically overrides the model's visual judgment, causing the agent to misclassify an object based on the text rather than its appearance.

While prior research (e.g., SCAM, CHAI) has quantified this threat in static 2D benchmarks and high-level navigation tasks (drones, ground vehicles), the impact on household robot manipulation remains unexamined. Manipulation agents differ critically from navigation agents: a misclassification is not merely a wrong decision about where to go, but a wrong decision about what to grasp. In a modular manipulation pipeline, a perceptual error is written into a persistent 3D semantic map and propagated through the entire Sense-Plan-Act loop. This results in a kinetic failure: the agent physically grasps and transports the wrong object to a target receptacle, irreversibly altering the state of the world within the episode.

Methodology
The authors evaluate this threat using the Habitat simulation environment and the HomeRobot benchmark. To address the specific challenges of evaluating attacks on manipulation agents, the authors introduce a decoupled perception architecture:

Modified OvmmPerception Module: The standard HomeRobot agent uses DETIC for both spatial proposals and semantic labeling. DETIC is not vulnerable to typographic attacks. The authors retain DETIC for geometric grounding (bounding boxes, masks, depth) but introduce a frozen CLIP encoder as a parallel, threshold-gated override mechanism for the final object classification.
Attack Mechanism: An adversary places a physical sticker bearing the goal object's name (e.g., "cup") on a distractor object along the agent's navigation path. If the sticker enters a DETIC bounding box crop and the CLIP text-image similarity score exceeds a threshold ( $\theta = 0.28$ ), CLIP overrides DETIC's label.
Persistence: The misclassified label is written into a 3D Semantic Voxel Map. This map acts as a spatial cache; once poisoned, the agent continues to navigate toward and grasp the adversarial target even after the sticker leaves the field of view.
Evaluation Pool: From a validation set of 1,199 episodes, the authors isolate 59 attributable episodes. These are episodes where the unattacked agent either fully succeeds or fails only at the final placement step. This filtering ensures that any deviation observed during the attack is unambiguously caused by the typographic perturbation rather than pre-existing agent limitations.

Key Contributions

Identification of a New Attack Surface: The paper formalizes household robot manipulation as an unexamined domain for typographic attacks, distinguishing it from navigation by the propagation of errors into physical grasping actions.
Reference Architecture: The authors instantiate a representative open-vocabulary manipulation stack that mirrors deployed systems (e.g., EmbCLIP, TidyBot) by isolating the vision-language alignment stage to enable controlled evaluation of downstream kinetic failures.
Quantified Kinetic Failure: The work establishes that typographic misclassification leads to "kinetic failures" where the robot physically delivers the wrong object, a failure mode not captured in prior 2D or navigation-only benchmarks.
Controlled Evaluation: The study provides the first controlled evaluation of how confirmed perceptual flaws propagate through a full-stack manipulation pipeline under uncontrolled physical conditions (unoptimized viewing angles, occlusion).

Results
The evaluation was conducted across 59 attributable episodes with no perceptual optimization of the stickers:

Attack Success Rate (ASR): The attack achieved an overall ASR of 67.8% (40/59 episodes).
- Among fully successful episodes ( $E^*_f$ ), the ASR was 70.0% (7/10).
- Among partially successful episodes ( $E^*_p$ ), the ASR was 67.3% (33/49).
Mechanism: In 92.5% of successful attacks, the agent picked the sticker directly. In 7.5%, the agent picked an object in front of the sticker because the sticker was visible in the background of the DETIC crop, triggering a background classification failure.
Persistence: In 100% of successful attacks, the agent executed the grasp based on coordinates stored in the poisoned 3D voxel map, often returning to the target after wandering the scene, confirming that a single poisoned write bypasses subsequent safety margins.
Failure Modes: The attack shifted the failure distribution. While the unattacked agent failed primarily during object navigation (71.7%), the attack-induced failures were concentrated at the Place phase. The attack resulted in two distinct outcomes:
- Hijacked Delivery: The agent successfully completed the full loop, picking and placing the wrong object (7 cases).
- Malicious Transport: The agent picked the wrong object and transported it to the receptacle, failing only at the final placement step (33 cases).

Significance and Claims
The paper claims to establish that typographic misclassification is a real, measurable, and physically consequential threat to the safety of modular manipulation pipelines. The significance lies in demonstrating that a low-resource physical adversary (requiring only a printer and brief access) can poison the agent's spatial memory to drive kinetic failures.

The authors emphasize that this vulnerability is structural to the joint vision-language embedding paradigm (affecting CLIP and successors like SigLIP). They argue that while encoder-level defenses (e.g., Dyslexify, Defense-Prefix) may reduce misclassification rates, they do not address the architectural condition where a single poisoned entry in a persistent map commits the agent to a wrong action. Consequently, the paper advocates for architectural mitigations that treat VLA classifier outputs as untrusted inputs, requiring multi-stage validation (e.g., multi-view confirmation, grasp-time re-query) before kinetic commitment.