AdvNav: Behavior-Guided Black-Box Adversarial Attacks on Vision-Language Navigation

2026-07-13

AI Summary

This work addresses the vulnerability of existing vision-and-language navigation (VLN) systems to adversarial attacks in black-box settings, where gradient-based methods are inapplicable and temporal dependencies across multi-step decision-making pose significant challenges. To this end, we propose AdvNav, a behavior-guided black-box adversarial attack framework that perturbs first-person visual observations solely based on observable agent input-output behaviors, thereby disrupting the perception-action loop. AdvNav introduces a novel dual-granularity behavioral feedback mechanism—integrating trajectory-level performance, action-level risk, and path deviation—and combines it with adaptive perturbation strength adjustment and genetic-inspired noise structure evolution to enable efficient gradient-free attacks. Evaluated on the R2R dataset, AdvNav achieves attack success rates of 49.70%, 65.96%, and 87.30% against HAMT and MapGPT agents, respectively, demonstrating its effectiveness and strong generalization capability.

Abstract

Despite progress in Embodied AI, Vision-and-Language Navigation systems remain vulnerable to adversarial visual disturbances. Most existing methods rely on white-box access to target model gradients, which is often unrealistic for real-world deployed systems and computationally exhaustive due to recursive backpropagation for optimization, limiting their applicability. While previous black-box methods predominantly target single-step, instantaneous decision tasks, they struggle to handle the task complexities and temporal dependencies. This highlights the need for a gradient-free attack method that can effectively disrupt the multistep sequential perception-action loop using only observable inputs and outputs. Therefore, we propose AdvNav, a behavior-guided black-box adversarial attack framework that disturbs an agent's first-person views during navigation. To construct an informative surrogate objective for effective optimization guidance in gradient-free search under the black-box setting, we design a dual-granularity behavior-based feedback, aggregating a trajectory-level performance score representing overall navigation degradation, an action-level reward score considering the potential decision risk, and a deviation indicator, all of which are extracted from the agent's self-output behaviors. This feedback guides a hybrid optimization strategy that heuristically tunes perturbation strength via adaptive updates and evolves noise spatial structure genetically, to iteratively discover the most disruptive noise configuration. Evaluated against Transformer-based HAMT and LLM-based MapGPT with two types of backbones on R2R dataset, AdvNav achieves 49.70/65.96/87.30% Attack Success Rate. The result demonstrates the effectiveness and generality of AdvNav, reveals critical perception vulnerabilities and offers insights for the design of future resilient VLN models.

Problem

• Vision-Language Navigation
• Adversarial Attacks
• Black-Box
• Embodied AI
• Sequential Decision Making

Innovation

• black-box adversarial attack
• vision-language navigation
• behavior-guided optimization
• gradient-free search
• embodied AI