Comparative Analysis of Patch Attack on VLM-Based Autonomous Driving Architectures

Jun 22, 2026· David FernandezDavid Fernandez , Pedram MohajerAnsari, Amir Salarpour, Long Cheng, Abolfazl Razi, Mert D. Pesé
PDF Code DOI Cite

Key Contributions & Takeaways

  • Builds the first framework that puts different VLM driving models on equal footing. A semantic homogenization step translates each model’s very different output into one shared space, so a single attack and one set of metrics apply to all of them.
  • All three models (Dolphins, OmniDrive Omni-L, and LeapVAD) fail, with a 73 to 76% attack success rate. That is 12 to 20 times higher than normal, and each failure lasts 6 to 8 frames in a row, long enough to slip past defenses that check several frames before acting.
  • Each architecture fails in its own way. The cross-attention model stops seeing pedestrians (a 71-point drop in detection), the MLP model is just as easy to fool at every distance, and the dual-process model keeps seeing objects yet still makes the wrong call. Seeing correctly and acting correctly can come apart.
publications

01  ·  The Problem

Cars are starting to use VLMs to make driving decisions, but no one has tested how well they hold up against a printed patch on a roadside billboard. And because each model answers in its own format, there was no fair way to compare them.

02  ·  The Framework

One shared translation step turns each model’s answer into the same kind of signal. That lets one black-box attack and one scoring method work on every model, all tested in the CARLA driving simulator.

03  ·  The Finding

All three models fail: the attack works 73 to 76% of the time (12 to 20 times more than normal) and holds for 6 to 8 frames. Each model fails in its own way.

Threat Model
An attacker can print a patch on existing road infrastructure, such as a roadside ad. They never see inside the model and never touch the car’s sensors.
Access
Send an image, read the text reply. Nothing about the model’s internals.
Surface
Existing roadside infrastructure, such as bus-shelter ad panels and billboards.
Patch Generation
About 6,000 quick tries per patch, with no access to the model’s internals.
Realizability
Limited to printable colors and smooth patterns, so it holds up as a real print.
The Attack in Action

The study runs two kinds of attack. One hides a real hazard, such as a pedestrian at a crosswalk. The other, shown here, forces an unsafe move on the highway.

Action Attack Highway: Hijacking the Decision 1024×512 patch · 85 km/h
Here the model still sees the road fine. The patch attacks the decision instead, nudging it to “turn right” straight into the concrete barrier.
CONCRETE BARRIER
Safe action

“Maintain speed / accelerate.”

Hijacked action

“Turn right to exit the highway.”

→ steers toward the barrier
The bigger 2 m × 1 m billboard patch can be seen from about 80 m away. It goes after the model’s choice of action, not its eyesight: the model still “sees” the road correctly.
Methodology
A repeating loop that lets one attack test three very different VLMs on equal terms.
01
NES Patch
Generation
02
CARLA
Simulation
03
VLM
Inference
04
Semantic
Homogenization
05
Multi-Dim.
Evaluation
Stage 01 · Black-Box NES
Tuning the patch without seeing inside the model

The attack only asks the model questions and watches its answers, so it never needs the model’s inner workings. Step by step, it nudges the patch until the answer matches a phrase the attacker picked.

// CLIP-space semantic similarity loss
L  =  1 − cos( egen ,  etarget )
// NES gradient estimate over N directions
∇θJ  ≈  (Nσ)−1 Σi J(θ+σεi) εi
N = 20 dirs · σ = 0.1 150 iters · ~6k queries EoT (K=5) · TV smoothing
Stage 04 · Semantic Homogenization
Turning three kinds of answers into one

The three models answer in different ways: plain sentences, structured data, and step-by-step reasoning. A frozen CLIP text encoder turns each answer into the same kind of signal, so one attack goal and one set of metrics fit all of them.

Dolphinsfree-form NLOmni-Lstructured JSONLeapVADdual reasoningCLIP textencoder ❄shared space
Stage 03 · Three designs, three different weak spots
Dolphins
cross-attention · CLIP ViT-L/14 + MPT-7B
Weak to

Being fooled about what it sees. Corrupted image features pass straight into the language model.

−71 pppedestrian
detection
OmniDrive (Omni-L)
MLP projection · multi-view
Weak to

Everything, evenly. Its fixed way of handling images leaves no safe distance.

82–91%ASR across
all distances
LeapVAD
dual-process · critical-object attention
Weak to

Bad reasoning. It spots objects best of the three, yet still gets talked into unsafe actions.

81.7%highway ASR
(highest)
Results
The weakness is serious, long-lasting, and shows up in every design. We measured it in four ways.
73–76%
combined attack
success rate
12–20×
increase over
benign baseline
6.2–7.8
consecutive frames
of failure
p<.001
GEE significance,
all architectures
A · Overall Attack Success (Table I)
Crosswalk Highway Benign baseline
Dolphinscombined 76.0%
Crosswalk
73.1
Highway
79.2
Baseline
3.8
OmniDrive (Omni-L)combined 73.5%
Crosswalk
71.8
Highway
75.6
Baseline
5.1
LeapVADcombined 75.0%
Crosswalk
68.4
Highway
81.7
Baseline
6.3
B · Distance-Dependent Efficacy (Fig. 3, crosswalk)
Dolphins Omni-L LeapVAD
critical decision range50% threshold0255075100Attack Success (%)510152535Distance to patch (m)

Every model does poorly at the far and very near extremes, where the patch is either too small or too warped to work. They all peak in the 10 to 25 m range, exactly when the car has to decide whether to brake or steer. Omni-L stays the most vulnerable the whole way, while LeapVAD holds up best when the patch is close.

C · Temporal Persistence (Fig. 4, highway)

The failures last; they are not quick flickers. Each row shows ten frames, half a second apart, and each cell is one frame’s result. Runs of 6 to 8 bad frames outlast any defense that waits 3 to 5 frames before trusting a decision.

Attack succeeds (unsafe action) Attack fails (safe action)
Dolphins
7.4 frames
Omni-L
6.9 frames
LeapVAD
7.8 frames
F0F9 · 0.5 s intervals
D · Detection Collapse & Scene Corruption (Table II)

Under attack, the models mostly stop spotting pedestrians. They don’t go quiet, either. They keep describing the scene in smooth, confident language that is simply wrong.

Dolphins
92.3→21.2% −71pp
Omni-L
89.7→34.8% −55pp
LeapVAD
94.6→48.2% −46pp
bar shows benign detection (faded) → adversarial (red), pedestrian, crosswalk scenario
scene-description quality: BLEU-4 0.18–0.31 · semantic sim. 0.49–0.67
What the Comparison Answers
RQ1 · Spatial & Temporal

The attack works across the whole 10 to 25 m decision zone and lasts 6 to 8 frames in a row. This is not one-off noise a filter could catch.

RQ2 · Perception vs Behavior

They come apart. Even under attack, LeapVAD still spots 48% of pedestrians, yet it still acts unsafely. Seeing the object is not the same as making the right choice.

RQ3 · Scope of Corruption

It spreads. Low text-overlap and meaning scores show the patch throws off the model’s whole understanding of the scene, not just one label. The result is fluent but false descriptions.

Implications
Security

No design is safe on its own. All three approaches fail at 73 to 76%. The weakness comes from how today’s vision and language parts are joined together, not from one unlucky model.

Design

Each design trades one weakness for another. LeapVAD’s focus on key objects makes it better at seeing but easier to mislead in its reasoning. Omni-L’s fixed image handling leaves no safe distance. Safety has to be built into both the seeing and the deciding.

Defense

Defenses that wait and compare frames won’t save you. Failures run 6 to 8 frames, so a check that needs 3 to 5 matching frames still locks in the unsafe action before it can object.

All tests ran in the CARLA 0.9.14 driving simulator (Town04) with a single forward camera at 1920×1080, using real-world patch sizes (1 m² at the crosswalk, 2 m×1 m on the billboard). Attack Success Rate is the share of frames where the model picks the unsafe action, tested for statistical significance against normal driving. The line chart and frame strips above illustrate the paper’s Figures 3 and 4; the exact numbers are in the PDF.

Abstract

“All three VLM driving models fail against real, printable patches: 73 to 76% attack success, sustained for 6 to 8 frames in a row. Each one fails in its own way.”

Vision-language models are emerging for autonomous driving, yet their robustness to physical adversarial attacks remains unexplored. This paper presents a systematic framework for comparative adversarial evaluation across three VLM architectures: Dolphins, OmniDrive (Omni-L), and LeapVAD. Using black-box optimization with semantic homogenization for fair comparison, we evaluate physically realizable patch attacks in CARLA simulation. Results reveal severe vulnerabilities across all architectures, sustained multi-frame failures, and critical object detection degradation. Our analysis exposes distinct architectural vulnerability patterns, demonstrating that current VLM designs inadequately address adversarial threats in safety-critical autonomous driving applications.
Type Conference paper
Venue 2026 IEEE Intelligent Vehicles Symposium (IV)
Adversarial Attacks Vision Language Models Autonomous Vehicles AI Security
David Fernandez
Authors
David Fernandez
PhD Candidate in Computer Science

David Fernandez is a PhD candidate in Computer Science at Clemson University, working on safe, efficient, and explainable AI for safety-critical systems. His research spans perception, adversarial robustness, and on-device deployment of large foundation models, including LLMs and VLMs, with five first-authored publications on component-level explainability, zero-shot reasoning, and adversarial scenario analysis, alongside collaborative work on edge AI for industrial agentic systems. Much of this research is grounded in autonomous driving, where trustworthiness, latency, and robustness constraints are unforgiving, but the underlying methods transfer broadly to other high-stakes domains.

As a member of Clemson’s VIPR-GS Research Program, he develops hierarchical LLM reasoning frameworks and VLM evaluation systems for the U.S. Army’s Next Generation Combat Vehicle (NGCV) program, focusing on zero-shot reasoning and component-level explainability under real-world deployment constraints.

At BMW Group, he designs agentic AI systems for enterprise environments, building autonomous prompt optimization pipelines that enable continual agent improvement without model retraining and context-aware moderation frameworks that detect coordinated multi-turn adversarial attacks in production deployments.