A lens smudge just broke the AI that follows you through buildings

Vision-and-language navigation agents are built to follow natural-language commands through unfamiliar indoor spaces, guided by a live camera feed. A new adversarial attack shows they can be thrown off track by subtle, lens-style visual noise that mimics something as ordinary as fog or dust on a lens. The attacker never needs to see inside the model.

Researchers at the Hong Kong University of Science and Technology (Guangzhou) and Sun Yat-sen University built the method, called AdvNav. It injects spatially coherent distortions into the agent's first-person view. All the attacker needs is query access: feed in modified images and watch where the agent goes. No gradients, no architecture details, no training data. The result is the kind of demonstration that feeds broader worries about AI safety, alongside the incident where Claude published malware to PyPI.

AdvNav works by turning the agent's own behavior into feedback. It computes two signals: a trajectory-level score for how far the agent strays from its goal, and an action-level reward score that estimates the chance of picking a wrong step along the way. A binary flag tracks whether the agent has already left its intended path. Together, those signals drive a hybrid optimizer that adjusts perturbation intensity like an adaptive thermostat while genetic algorithms evolve the noise structure.

In tests on the Room-to-Room (R2R) dataset inside the Matterport3D simulator, AdvNav went up against two kinds of VLN models: the Transformer-based HAMT, and the LLM-based MapGPT running on Qwen3-VL and GPT-4V backbones. Against HAMT, it posted an average 49.70% attack success rate, meaning nearly half of all previously successful navigations failed under attack. Success weighted by path length dropped from 57.69% to 29.35%, and navigation error grew from 3.94 meters to 6.05 meters. Brittleness like this shows up elsewhere in the agent world: desktop agents failed before-after tasks 35% of the time in one test suite.

Against MapGPT with Qwen3-VL, the attack success rate climbed to 65.96%. With GPT-4V, it hit 87.30%, and SPL fell to just 4.71%. The attack worked better on LLM-based agents, which the authors suspect are more vulnerable to global perturbations because they lean heavily on holistic visual reasoning. That fits a benchmark where even the best VLMs failed at 3D action.

The noise is built from Perlin noise, a low-frequency, continuous luminance field that resembles natural effects like haze or lens smudge. The choice is deliberate. Unlike high-frequency Gaussian noise or localized mask occlusions, Perlin noise resists standard preprocessing filters and creates a steady perceptual bias. Its LPIPS score was much lower than the baselines, which suggests a human observer would have a harder time noticing the attack.

Our perturbation forms a low-frequency, coherent luminance field akin to haze or dust on the lens. It reduces contrast along structural cues and resists suppression by standard preprocessing, leading to continuous bias in navigation action that accumulates across trajectories.

AdvNav stands apart from earlier VLN attacks that required white-box access, meaning the ability to compute or approximate model gradients. That is often impossible in real deployments, where the models are proprietary. Existing black-box methods like ZOO, NES, and SimBA were designed for single-step vision tasks, and they do poorly on the multi-step, temporally dependent navigation task, where agents can self-correct and errors accumulate in nonlinear ways. The same distance between sandbox results and deployment shows up elsewhere, documented in the gap between SWE-bench Verified and private enterprise code.

Ablation studies confirmed that every component pulls its weight. Removing both feedback signals cut the attack success rate to 23.40%, effectively random search. Removing only the action-level score dropped it to 30.85%. Fixing the noise structure while keeping the adaptive update yielded 38.30%, still well below the full method's 47.87% on that subset. Swapping AdvNav's optimizer for NES, Bayesian search, or SimBA while keeping Perlin noise also produced weaker attacks.

The researchers frame AdvNav as a stress-testing tool as much as an attack method. Possible defenses include adversarial training or preprocessing filters tuned to Perlin-like perturbation patterns. The results also feed the wider agent-safety conversation, including a cohort design that separates exploration, validation, and brokering. The paper is set to appear at the 34th ACM International Conference on Multimedia (MM 2026) in Rio de Janeiro.