AdvNav: a lens smudge just broke the AI that follows you through buildings

Vision-and-language navigation agents are designed to follow natural-language commands through unfamiliar indoor spaces, guided by a live camera feed. A new adversarial attack shows these systems can be thrown off track by subtle, lens-style visual noise that mimics something as ordinary as fog or dust on a lens. The attacker never needs to see inside the model.

Researchers at the Hong Kong University of Science and Technology (Guangzhou) and Sun Yat-sen University built AdvNav, a fully black-box method that injects spatially coherent distortions into the agent's first-person view. The attacker only needs query access: feed in modified images and watch where the agent goes. No gradients, no architecture details, no training data required. This work adds to a growing list of adversarial vulnerabilities uncovered in AI systems, a threat vector also explored in a study on poisoning LLMs through public comments.

The method works by building a feedback loop from the agent's own behavior. AdvNav computes two signals: a trajectory-level score that measures how far the agent strays from its goal, and an action-level reward score that estimates the chance of picking wrong steps along the way. A binary flag tracks whether the agent has already left its intended path. Together, these signals drive a hybrid optimization that adjusts perturbation intensity like an adaptive thermostat while evolving the noise