并非你所要求的：家庭机器人操作中的字体攻击
Not What You Asked For: Typographic Attacks in Household Robot Manipulation
AI总结：
本研究探讨了字体攻击对家庭机器人操作全流程的影响，提出了一种解耦感知架构，并发现感知错误会通过持久的3D语义地图导致物理性故障，揭示了字体误分类对机器人安全性的实际威胁。
摘要：
开放词汇的具身AI代理越来越多地依赖如CLIP之类的视觉-语言模型进行物体感知和任务定位。然而，这种共享嵌入空间所带来的结构漏洞使字体攻击成为可能，其中物理场景中的印刷文本会语义上覆盖视觉判断。尽管先前研究在静态2D基准和3D导航任务中量化了这一威胁，但其对家庭机器人操作完整Sense-Plan-Act流程的影响仍未被探索。本文在基于Habitat的模拟中评估了字体攻击，使用HomeRobot基准。我们引入了一种解耦感知架构，使冻结的CLIP编码器暴露于对抗性贴纸，同时通过DEtic保持几何定位。在59个可控评估回合中，攻击的总体攻击成功率（ASR）为67.8%，在完全成功回合中上升至70.0%，在无控制视角和遮挡且无感知优化的情况下。关键发现是，感知错误通过持久的3D语义地图传播，导致动能故障，即由对抗性污染的语义状态驱动的物理性抓取和运输错误物体。在这些情况下，机器人会物理上抓取并传递错误的物体到目标容器。这些结果确立了字体误分类作为对模块化操作流程安全性的实际、可测量且物理上有影响的威胁，而此前的字体攻击研究未对其进行考察。
英文摘要：
Open-vocabulary embodied AI agents increasingly rely on vision-language models such as CLIP for object perception and task grounding. However, the shared embedding space that enables this flexibility introduces a structural vulnerability to typographic attacks, where printed text in a physical scene semantically overrides visual judgment. While prior work has quantified this threat in static 2D benchmarks and 3D navigation tasks, its impact on the full Sense-Plan-Act pipeline of household robot manipulation remains unexplored. This work evaluates typographic attacks in a Habitat-based simulation using the HomeRobot benchmark. We introduce a decoupled perception architecture that exposes a frozen CLIP encoder to adversarial stickers while maintaining geometric grounding via DETIC. In a controlled evaluation pool of 59 attributable episodes, the attack achieves an overall Attack Success Rate (ASR) of 67.8%, rising to 70.0% among fully successful episodes, under uncontrolled viewing angles and occlusion with no perceptual optimization. Critically, we find that perceptual errors propagate through the persistent 3D semantic map to produce kinetic failures, defined here as physically executed grasping and transport of the wrong object driven by an adversarially poisoned semantic state. In these cases, the robot physically grasps and delivers the wrong object to a target receptacle. These results establish typographic misclassification as a real, measurable, and physically consequential threat to the safety of modular manipulation pipelines that prior typographic attack research has left unexamined.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
