🤖 AI

AdvNav: Behavior-Guided Black-Box Adversarial Attacks on Vision-Language Navigation

This paper introduces AdvNav, a behavior-guided black-box adversarial attack framework that effectively disrupts vision-language navigation agents by using dual-granularity behavioral feedback to guide a hybrid optimization strategy for generating disruptive visual perturbations without requiring model gradients.

Original authors: Chenyang Li, Kaige Li, Zeyu Jiang, Changhao Chen

Published 2026-07-14

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Chenyang Li, Kaige Li, Zeyu Jiang, Changhao Chen

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine you have a super-smart robot friend who loves to explore new houses. You give it a voice command like, "Walk past the couch, go through the dining room, and wait outside." This robot uses its eyes (cameras) and its brain (AI) to figure out where to step next. This is called Vision-and-Language Navigation (VLN).

But here's the twist: What if someone could trick the robot's eyes without the robot even knowing? That's exactly what the researchers behind AdvNav discovered. They built a "magic lens" that can confuse the robot, making it wander off course, all without ever peeking inside the robot's brain.

The "Black Box" Mystery

Usually, to trick a robot, hackers need to be "white-box" experts. This means they need the robot's secret blueprints (its internal code and math) to calculate exactly how to mess with its vision. But in the real world, you can't see inside a company's robot. It's a black box. You can only talk to it and watch what it does.

The paper argues that old tricks don't work well here. Trying to guess the robot's moves step-by-step is like trying to solve a maze by guessing one turn at a time; it takes forever and often fails because the robot might correct its own mistakes along the way. The researchers say we need a new way to attack that doesn't need the blueprints and doesn't get stuck on just one step.

The "Foggy Lens" Trick

So, how did they do it? Instead of trying to hack the code, they treated the robot like a person walking through a foggy room.

They created a special kind of noise that looks like a soft, hazy dust or fog on a camera lens. They didn't just throw random static (like TV snow) at the robot. Instead, they used a smart, evolving strategy to find the perfect kind of fog that makes the robot lose its sense of direction.

Think of it like this: If you put a tiny sticker on a robot's eye, it might just ignore it. But if you put a specific pattern of "fog" over the whole lens, the robot might think a wall is a door, or a hallway is a dead end. The researchers call this AdvNav.

The "Behavioral GPS"

Since they couldn't see the robot's internal thoughts, they had to guess if their "fog" was working by watching the robot's behavior. They built a dual-granularity feedback system. Imagine a coach watching a runner:

The Big Picture (Trajectory Level): Did the runner finish the race? If the robot gets lost or stops early, the coach gives a "bad score."
The Small Steps (Action Level): Even if the runner finishes, were they wobbling? Did they almost trip? The coach looks at every single step the robot took. If the robot hesitated or almost chose the wrong door, the coach notes that as a "risk."

By watching these two things, the researchers could tell their "fog" how to get stronger. They used a method called genetic evolution, which is like natural selection for computer noise. They tried 10 different types of fog at a time. The ones that made the robot stumble the most survived and mixed together to create even better fog for the next round.

The Results: How Bad Did It Get?

The team tested this on two different types of robot brains:

HAMT: A standard, powerful robot brain.
MapGPT: A super-smart brain powered by a giant language model (like the ones that write essays or chat with you).

They tested these robots in 11 different indoor scenes with thousands of instructions. Here is what happened:

On the HAMT robot: The attack was successful 49.70% of the time. This means the robot failed to reach its goal in almost half the attempts. Its path efficiency (how well it walked) dropped to 29.35%, and it ended up 6.05 meters away from where it was supposed to be.
On the MapGPT robot with a Qwen3-VL brain: The attack worked 65.96% of the time.
On the MapGPT robot with a GPT-4V brain: The attack was even more effective, succeeding 87.30% of the time!

The researchers found that while some robots were tough against simple tricks (like covering part of the camera with a black patch), they were surprisingly vulnerable to this "foggy lens" noise. Even the super-smart GPT-4V robot, which is usually very good at reasoning, got confused and wandered off.

What This Means (and What It Doesn't)

The paper shows that even the most advanced navigation robots are fragile when their eyes are slightly distorted. The researchers suggest that this isn't just a cool trick; it's a warning. If a robot is used in a factory or a hospital, a tiny bit of "fog" on its camera could cause it to crash or stop working.

However, the paper is careful to say this is a simulation. They tested it in a computer world called "Matterport3D," not in a real physical robot walking around a real house. They also didn't invent a new robot to fix this; they just showed that the current ones are vulnerable.

The main takeaway? We can't just assume robots are safe because they are smart. As long as they rely on cameras, a little bit of invisible "fog" can make them lose their way, and we need to build robots that can see through the fog.

Technical Summary: AdvNav

Problem Statement

Vision-and-Language Navigation (VLN) enables embodied agents to follow natural language instructions to navigate unseen environments. While recent advances in Transformer-based and Large Language Model (LLM)-based VLN systems have improved performance, these models rely on deep neural networks (DNNs) that are inherently vulnerable to adversarial perturbations.

Existing adversarial attack methods for VLN predominantly operate under a white-box setting, requiring access to the target model's internal gradients. This approach is often unrealistic for real-world deployed systems where models are proprietary and internal states are inaccessible. Furthermore, white-box attacks are computationally expensive due to the need for recursive backpropagation over long-horizon trajectories.

While black-box methods exist, they are primarily designed for single-step, instantaneous decision tasks (e.g., image classification) and struggle with the multi-step, sequential nature of VLN. VLN involves delayed feedback, non-linear error accumulation, and the agent's capacity for policy self-correction, making standard gradient-free optimization ineffective. There is a critical gap in developing a gradient-free, black-box attack framework capable of disrupting the multi-step perception-action loop of VLN agents using only observable inputs and outputs.

Methodology: AdvNav

The authors propose AdvNav, a behavior-guided black-box adversarial attack framework designed to disturb an agent's first-person views during navigation without accessing model gradients. The method employs a hybrid optimization strategy driven by a novel feedback mechanism.

1. Dual-Granularity Behavior-Based Feedback

To guide the gradient-free search, AdvNav constructs a surrogate objective function derived solely from the agent's observable behaviors. This feedback aggregates three components:

Trajectory-Level Performance Score ( $G$ ): A unified score combining Success weighted by Path Length (SPL) and Navigation Error (NE). It quantifies overall navigation degradation (lower SPL and higher NE indicate a successful attack).
Action-Level Reward Score ( $R$ ): An accumulated score measuring the drift in action selection at each timestep. It calculates the difference between the probability of the reference action and the most likely incorrect alternative. This captures "soft failures" and latent decision risks even when the final trajectory appears intact.
Deviation Indicator ( $\gamma$ ): A binary flag indicating whether the agent has deviated from the reference trajectory.

These signals form an integrated feedback set that guides the optimization process, prioritizing candidates that induce actual trajectory deviations while also considering those that increase action-level risk.

2. Hybrid Optimization Strategy

AdvNav utilizes a Perlin noise texture to parameterize the perturbation $\delta$ , ensuring spatial coherence and simulating realistic disturbances like fog or dust. The optimization proceeds in rounds with two coupled mechanisms:

Adaptive Intensity Tuning: The framework heuristically updates the perturbation strength. It generates candidate perturbations by overlaying patterns from a noise population onto a cumulative base noise. Candidates are ranked by their relative gain in the feedback scores. If a candidate improves the attack, the base is updated; otherwise, the update direction is flipped.
Genetic Evolution of Noise Structure: The spatial structure of the noise is refined via a genetic algorithm. The population of noise patterns undergoes selection, crossover, and mutation. The top-performing candidates (based on the dual-granularity feedback) are selected as parents to evolve the next generation of noise structures, allowing the search to discover highly disruptive configurations over time.

Key Contributions

AdvNav Framework: The proposal of a general, behavior-guided black-box adversarial attack framework specifically targeting the visual perception of VLN agents. It provides a cost-efficient tool for robustness evaluation without requiring model internals.
Gradient-Free Hybrid Optimization: The development of a novel optimization strategy that combines adaptive intensity tuning with genetic evolution of noise structure. This approach is specifically tailored to the sequential decision-making challenges of VLN, leveraging dual-granularity behavior feedback to overcome the lack of gradient information.
Comprehensive Evaluation: Extensive experiments demonstrating the framework's effectiveness across different model architectures (Transformer-based HAMT and LLM-based MapGPT) and backbones (Qwen3-VL and GPT-4V).

Experimental Results

The authors evaluated AdvNav on the Room-to-Room (R2R) dataset within the Matterport3D simulator, targeting the val-unseen split across 11 indoor scenes.

Performance on HAMT (Transformer-based): AdvNav achieved an Attack Success Rate (ASR) of 49.70%, significantly outperforming baselines such as Mask Occlusion (38.74%), Gaussian Noise (19.10%), and Brightness Shift (7.67%). It reduced the Success weighted by Path Length (SPL) to 29.35% (from 57.69% in clean settings) and increased Navigation Error (NE) to 6.05m.
Performance on MapGPT (LLM-based): The method demonstrated strong generalizability, achieving an ASR of 65.96% on the Qwen3-VL backbone and 87.30% on the GPT-4V backbone.
Perceptual Stealthiness: Visual comparisons and LPIPS (Learned Perceptual Image Patch Similarity) metrics indicate that AdvNav's perturbations are perceptually stealthier than standard noise or occlusion methods, appearing as low-frequency luminance fields (similar to haze) that resist standard preprocessing.
Ablation Studies: Experiments confirmed that the synergy of the dual-granularity feedback (trajectory + action levels) and the combination of adaptive updates with structure evolution are both critical for achieving high attack success rates.

Significance and Claims

The paper claims that AdvNav effectively exposes the universal latent visual vulnerabilities of current VLN systems, regardless of whether they are based on Transformers or LLMs. By operating under strict black-box constraints with limited query budgets, AdvNav serves as a general stress-testing tool for evaluating the robustness of deployed VLN agents.

The authors position AdvNav not merely as an attack method but as a catalyst for future research in resilient VLN model design. The findings highlight that even advanced models with strong reasoning capabilities remain susceptible to continuous, spatially coherent visual disturbances, suggesting a need for improved robustness mechanisms in embodied AI systems.