REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs

2026-06-22

AI Summary

This work addresses the lack of a unified benchmark for red-teaming vision-language models (VLMs) in the physical world, which hinders fair evaluation of attack effectiveness. The authors introduce the first physical-world red-teaming benchmark for VLMs, integrating 12 attack methods, 3 model-agnostic defenses, and 13 VLMs, all evaluated under black-box settings using a shared dataset and standardized metrics. A key innovation is an agent-based target generation pipeline that produces consistent, specific, and physically realizable attack objectives across diverse scenarios, enabling equitable cross-method comparison. Experiments reveal that textual and layout-based attacks most readily induce model failures; multimodal co-optimization substantially enhances the transferability of visual perturbations; single-step attacks can closely match the performance of iterative approaches; and increased model scale does not necessarily confer greater adversarial robustness.

Abstract

Vision-language models (VLMs) are increasingly used as perception-reasoning backbones for embodied intelligence in safety-critical physical systems, where perception or reasoning errors can lead to unsafe decisions or actions. Although many red-teaming methods have been developed to probe VLM vulnerabilities, their evaluation remains fragmented across datasets, metrics, and threat models, making direct comparison difficult and obscuring whether observed differences arise from stronger attacks, more vulnerable models, or incompatible evaluation settings. Existing chatbot-centric red-teaming benchmarks mainly standardize jailbreak and content-safety evaluation, but they do not systematically capture physically grounded functional failures or cover red-teaming methods that target physical-world VLMs. This raises the key challenge of comparing diverse attack methods under a unified protocol while targeting the same scenario-specific failures. We introduce REALM, to our knowledge the first unified red-teaming benchmark for physical-world VLMs. REALM integrates 12 red-teaming methods, 3 model-agnostic defenses, and 13 VLMs under a practical black-box threat model with shared datasets and metrics. To align adversarial objectives across attack families, REALM introduces an agentic target-generation pipeline that constructs shared, scenario-specific, and physically grounded attack objectives for each scene, enabling fair comparison of diverse red-teaming methods under aligned adversarial goals. Our evaluation shows that text and typographic injection attacks induce the most failures, multimodal co-optimization yields the strongest visual-perturbation transfer, single-pass attacks approach iterative methods at much lower cost, and model scale alone does not confer adversarial robustness. Code is available at https://github.com/UCF-ML-Research/REALM.

Problem

• red-teaming
• vision-language models
• physical-world
• benchmark
• adversarial evaluation

Innovation

• red-teaming benchmark
• vision-language models
• physical-world attacks
• agentic target generation
• adversarial robustness