mlsanityData to 14 Oct 2026

Physical Prompt Injection Attacks on Large Vision-Language Models

arXiv 2601.17383 ↗First posted 24 Jan 2026cs.CV cs.AIcited by 4

On the map: Multimodal LLMs / vision-language models → MLLM jailbreaks and adversarial robustness

also in 1 more
Abstract (arXiv)

Large Vision-Language Models (LVLMs) are increasingly deployed in real-world intelligent systems for perception and reasoning in open physical environments. While LVLMs are known to be vulnerable to prompt injection attacks, existing methods either require access to input channels or depend on knowledge of user queries, assumptions that rarely hold in practical deployments. We propose the first Physical Prompt Injection Attack (PPIA), a black-box, query-agnostic attack that embeds malicious typographic instructions into physical objects perceivable by the LVLM. PPIA requires no access to the model, its inputs, or internal pipeline, and operates solely through visual observation. It combines offline selection of highly recognizable and semantically effective visual prompts with strategic environment-aware placement guided by spatiotemporal attention, ensuring that the injected prompts are both perceivable and influential on model behavior. We evaluate PPIA across 10 state-of-the-art LVLMs in both simulated and real-world settings on tasks including visual question answering, planning, and navigation, PPIA achieves attack success rates up to 98%, with strong robustness under varying physical conditions such as distance, viewpoint, and illumination. Our code is publicly available at https://github.com/2023cghacker/Physical-Prompt-Injection-Attack.

Key facts. Cited by 4 papers in the map (data through 14 Oct 2026). Placed in MLLM jailbreaks and adversarial robustness, one of 16 directions in Multimodal LLMs / vision-language models. Builds on 46 of its 50 references that are in the map. First posted on arXiv 24 Jan 2026.

Builds on

46 of 50 references.

Closest ancestors · 8

Same direction, newest first

  1. 2025SHIELD: Classifier-Guided Prompting for Robust and Safer LVLMs15 Oct
  2. 2025Web Artifact Attacks Disrupt Vision Language Models17 Mar
  3. 2024RapGuard: Safeguarding Multimodal Large Language Models via Rationale-aware Defensive Prompting25 Dec
  4. 2024SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments28 Nov
  5. 2024Universal Adversarial Perturbations for Vision-Language Pre-trained Models9 May
  6. 2024Unveiling Typographic Deceptions: Insights of the Typographic Vulnerability in Large Vision-Language Model29 Feb
  7. 2024Vision-LLMs Can Fool Themselves with Self-Generated Typographic Attacks1 Feb
  8. 2023FigStep: Jailbreaking Large Vision-Language Models via Typographic Visual Prompts9 Nov

Other references · 38

  1. 2021Learning Transferable Visual Models From Natural Language Supervisioncited by 33,744
  2. 2020Language Models are Few-Shot Learnerscited by 32,419
  3. 2023BLIP-2: Bootstrapping Language-Image Pre-training with Frozen Image Encoders and Large Language Modelscited by 6,137
  4. 2022BLIP: Bootstrapping Language-Image Pre-training for Unified Vision-Language Understanding and Generationcited by 4,322
  5. 2024Gemini 1.5: Unlocking multimodal understanding across millions of tokens of contextcited by 3,224
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 3,104
  7. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,071
  8. 2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
  9. 2019Habitat: A Platform for Embodied AI Researchcited by 1,191
  10. 2023Prompt Injection attack against LLM-integrated Applicationscited by 605
  11. 2024InjecAgent: Benchmarking Indirect Prompt Injections in Tool-Integrated Large Language Model Agentscited by 538
  12. 2024DriveVLM: The Convergence of Autonomous Driving and Large Vision-Language Modelscited by 490
26 more
  1. 2022LLM-Planner: Few-Shot Grounded Planning for Embodied Agents with Large Language Modelscited by 462
  2. 2023Formalizing and Benchmarking Prompt Injection Attacks and Defensescited by 364
  3. 2023A Survey on Multimodal Large Language Models for Autonomous Drivingcited by 290
  4. 2023EmbodiedGPT: Vision-Language Pre-Training via Embodied Chain of Thoughtcited by 279
  5. 2023Exploiting Programmatic Behavior of LLMs: Dual-Use Through Standard Security Attackscited by 278
  6. 2021History Aware Multimodal Transformer for Vision-and-Language Navigationcited by 271
  7. 2023Large Language Models are Versatile Decomposers: Decompose Evidence and Questions for Table-based Reasoningcited by 178
  8. 2022DetCLIP: Dictionary-Enriched Visual-Concept Paralleled Pre-training for Open-world Detectioncited by 176
  9. 2023Towards Open Vocabulary Learning: A Surveycited by 166
  10. 2022Coarse-to-Fine Vision-Language Pre-training with Fusion in the Backbonecited by 109
  11. 2025GPT4Scene: Understand 3D Scenes from Videos with Vision-Language Modelscited by 109
  12. 2024A Survey on Multilingual Large Language Models: Corpora, Alignment, and Biascited by 84
  13. 2025MMLU-ProX: A Multilingual Benchmark for Advanced Large Language Model Evaluationcited by 79
  14. 2023Octopus: Embodied Vision-Language Programmer from Environmental Feedbackcited by 73
  15. 2023Embodied Multi-Modal Agent trained by an LLM from a Parallel TextWorldcited by 65
  16. 2024CarLLaVA: Vision language models for camera-only closed-loop drivingcited by 57
  17. 2024EmbodiedCity: A Benchmark Platform for Embodied Agent in Real-world City Environmentcited by 42
  18. 2022Unifying Vision-Language Representation Space with Single-tower Transformercited by 22
  19. 2023AlphaBlock: Embodied Finetuning for Vision-Language Reasoning in Robot Manipulationcited by 19
  20. 2025Embodied Scene Understanding for Vision Language Models via MetaVQAcited by 19
  21. 2025SurveillanceVQA-589K: A Benchmark for Comprehensive Surveillance Video-Language Understanding with Large Modelscited by 18
  22. 2024PROMPTFUZZ: Harnessing Fuzzing Techniques for Robust Testing of Prompt Injection in LLMscited by 17
  23. 2018Fooling OCR Systems with Adversarial Text Imagescited by 12
  24. 2025Typographic Attacks in a Multi-Image Settingcited by 9
  25. 2025LMAD: Integrated End-to-End Vision-Language Model for Explainable Autonomous Drivingcited by 4
  26. 2025Evaluation of Vision-LLMs in Surveillance Videocited by 3

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026Extended to Reality: Prompt Injection in 3D Environmentscited by 1
  2. 2026A Systematic Study of Cross-Modal Typographic Attacks on Audio-Visual Reasoningcited by 0
  3. 2026Engineering Trustworthy Agentic AI for Critical Systemscited by 0
  4. 2026Refusals That Bend: Measuring and Predicting Task Malleability in Embodied VLM Plannerscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots
  2. 2025Text Prompt Injection of Vision Language Models
  3. 2024A Survey of Attacks on Large Vision-Language Models: Resources, Advances, and Future Trends
  4. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  5. 2024Empirical Analysis of Large Vision-Language Models against Goal Hijacking via Visual Prompt Injection
  6. 2026Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices
  7. 2026A Cross-Modal Prompt Injection Attack against Large Vision-Language Models with Image-Only Perturbation
  8. 2025When Data Manipulation Meets Attack Goals: An In-depth Survey of Attacks for VLMs