Technical Summary: PromptShield Home

Problem Statement

The paper addresses a specific safety vulnerability in smart-home agents powered by Multimodal Large Language Models (MLLMs): Ambient Multimodal Prompt Injection. Unlike traditional prompt injection where an attacker explicitly inputs malicious text, this threat arises when the agent misinterprets ambient environmental signals—such as television speech, on-screen text, bystander conversations, or physical gestures—as genuine user commands.

The core challenge is source attribution and action authorization. The agent must distinguish between content that reflects real user intent and content that merely resembles a command within the physical environment. Existing rule-based systems (Trigger-Action Programming) struggle with complex domestic contexts, while MLLMs introduce a new risk: they may correctly perceive ambient signals but incorrectly treat them as executable intent, leading to unwanted actions or privacy leaks. Conversely, overly cautious agents may fail to execute legitimate commands or miss critical emergencies (e.g., a fall).

Methodology

The PromptShield-Home Benchmark

The authors introduce PromptShield-Home, a pilot benchmark consisting of 19 scenarios designed to test smart-home agents' ability to separate real intent from ambient noise. The scenarios are categorized into:

• Addressee ambiguity: Speech not directed at the agent.
• Screen/audio injection: TV content or on-screen text mimicking commands.
• Health false triggers: Distinguishing yoga poses from falls, or heart-rate anomalies.
• Mixed occupancy: Conflicting occupants in a room.
• Command floor: Genuine, clearly addressed commands.
• Occupancy state: Static queries about room occupancy.

The dataset includes 17 video clips (recorded as .MOV or .mp4) and 2 still images for occupancy queries. Gold labels (execute, block, or ask_user) were determined via a structured consensus protocol by five authors, ensuring fixed ground truth rather than post-hoc judgment. The 17 video clips constitute the ternary action decisions scored in the evaluation (14 no-action, 3 action-required), while the 2 images serve as perception queries with no candidate action.

Comparative Framework

The study evaluates three abstraction layers using a ternary decision space: Execute, Block, or Ask User.

1. L0 (Traditional Detectors): Deterministic rule-based systems (wake-word, pose detection, OCR). This serves as a baseline representing current rule-based automation.
2. L1 (Single MLLM Agent): A single MLLM operating under different modalities:
   • Vision-only (Qwen3-VL-30B).
   • Vision + ASR (Whisper transcripts).
   • Native Audio-Visual (Omni-7B).
3. L2 (Multi-Agent Mediation): Strategies involving voting among sampled outputs, role specialists (addressee, safety, authorization), and cross-model arbitration.

Metrics

Due to the skewed label distribution (most smart-home scenarios require no action), aggregate accuracy is deemed misleading (a "never act" predictor achieves ~82% accuracy). The authors report two distinct metrics:

• Unsafe-Execution Rate (UER): The share of "no-action" cases where the agent incorrectly executes.
• Safe-Completion Rate (SCR): The share of "action-required" cases where the agent correctly executes.
• Additional metrics include False-Block Rate (FBR) and Human-Confirmation Rate (HCR).

Key Results

1. Opposite Failure Modes

The study identifies a fundamental trade-off where no single configuration balances safety and utility:

• L0 (Detectors): Exhibits over-execution. It fires on all 17 cases (scenarios) because every scenario contains a surface cue a rule latches onto (UER = 100%), failing to distinguish ambient noise from commands, but successfully catches all 3 action-required cases (SCR = 100%).
• L1/L2 (MLLMs): Exhibit systematic over-refusal. All MLLM configurations (including multi-agent mediation) fail to execute any of the 3 genuine action-required cases (SCR = 0%). While they reduce unsafe execution significantly, they also miss critical emergencies (e.g., a real fall was missed in every MLLM configuration).

2. Accuracy is Degenerate

The highest aggregate accuracy (82.4%) was achieved by the "L2 specialist" configuration, which was found to be byte-identical to a constant "always-block" predictor. This confirms that high accuracy in this domain does not equate to utility or safety.

3. Modality Effects

• ASR Harm: Adding ASR transcripts to vision models (L1b) actually reduced safety (UER increased to 28.6%) due to noisy transcripts.
• Native Audio Instability: Native audio-visual models (Omni) did not improve decision quality; instead, they shifted decisions toward "ask_user" (HCR up to 100%). Robustness testing revealed this was not principled caution but decision instability, as 16 of 17 scenarios flipped decisions across different sampling seeds.

4. Complementarity and the Oracle Upper Bound

The correct decision sets of L0 and the Vision-only MLLM (L1a) are disjoint:

• L0 correctly identified the 3 action-required cases that the MLLM missed.
• The MLLM correctly identified the 13 ambient/noise cases that L0 falsely triggered on.
• An oracle (a hypothetical router that always picks the correct layer) combining L0 and the Vision MLLM achieves 94.1% accuracy, compared to 76.5% for the best single layer.

Significance and Claims

The paper argues that replacing traditional detectors with MLLMs is not the optimal path for home-agent safety. Instead, the complementary nature of their failure modes suggests that safety is best served by learned routing and sensor fusion.

• Routing over Replacement: The authors propose that future systems should route decisions to the layer best suited for the specific context (e.g., using high-sensitivity physical sensors for emergency detection and MLLMs as high-specificity filters for false alarms).
• Evaluation Rigor: The work emphasizes that aggregate accuracy is insufficient for safety-critical domains. Safety and utility must be evaluated separately to avoid deploying systems that are either recklessly over-active or dangerously over-cautious.
• Modest Scope: The authors acknowledge the pilot nature of the work, limited by a small dataset (N=19), the use of an oracle rather than a trained router, and the reliance on a proxy for L0 rather than measured sensor streams. They position this as a foundational step toward understanding ambient multimodal prompt injection rather than a complete solution.

In conclusion, PromptShield-Home demonstrates that while MLLMs offer semantic flexibility, they currently lack the calibration to handle the "long tail" of ambient signals in smart homes without a hybrid architecture that leverages the strengths of both traditional detectors and large models.