Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots

Background

Vision-language models are increasingly deployed as planners in robotic systems, translating natural-language commands into actions grounded in visual scene understanding. This tight coupling of perception and instruction-following creates a new attack surface: text that appears in the robot’s camera view — a sign, a label, a sticker — is processed by the same stack that processes user commands. If an attacker can put text in the robot’s visual field, they may be able to inject instructions that the VLM treats as legitimate, with no digital compromise required. This physical-world attack vector has been studied for chatbots but not systematically for embodied, VLM-controlled robots.

Core Innovation

The paper delivers the first systematic study of physical prompt injection against VLM-controlled robots. It introduces a four-category taxonomy of attacks — indirect signage, task redefinition, authority impersonation, and conflict injection — and instantiates them as a benchmark of 20 attack prompts evaluated across three physical scene layouts and three command formulations that vary in destination specificity and rule explicitness. It also evaluates three practical mitigations: prompt-based defense, two-stage verification, and pre-processing text masking, analyzing the trade-offs of each.

Results

Across 5,670 trials on three frontier VLMs (GPT-4o, Gemini 2.5 Flash, Qwen3-VL-32B), physical signage attacks succeeded at 27.0%, 29.4%, and 5.0% respectively, with authority-impersonating and negation attacks transferring across all three models. Reasoning-trace analysis shows successful compromise is almost always conscious (99.9% acknowledgment rate) and that models defend through structurally different mechanisms: explicit rejection for Gemini, perceptual inattention for GPT-4o. Simple mitigations substantially reduce risk — prompt-based defense is 75–100% effective (model-dependent), two-stage verification 85–100%, and pre-processing text masking 100% — though defense choice involves trade-offs and masking can impair tasks that require reading in-scene labels.

Limitations

The benchmark uses a sorting task family and three command formulations; broader task diversity would strengthen generality. Defense evaluations focus on attack-blocking rates and preserve general task capabilities in the tested scenarios, but the authors note defenses may impair label-reading tasks. The study does not address multi-step attacks, adaptive adversaries who tune prompts against a known defense, or attacks embedded in non-text visual content.

Industry Implications

VLM-controlled manipulation is moving toward real deployment in warehouses, kitchens, and service environments — all places with human-readable signage everywhere. This paper is a practical security baseline for that transition: it demonstrates that a piece of paper can hijack a robot, and that cheap defenses are effective without killing task performance. For robot vendors, the results argue for shipping VLM planners with text-masking or verification layers by default, and for safety teams they provide a concrete, repeatable benchmark for auditing VLM-controlled systems before field deployment.