发表机构
Beihang University; University of Chinese Academy of Sciences; Institute of Computing Technology, Chinese Academy of Sciences; Tongji University; iFLYTEK Co., Ltd.; Anhui Laboratory for Safe Artificial Intelligence in the Yangtze River Delta; Wenzhou Business College; Jiangnan University; Guangzhou City University of Technology; Inceptio Technology; Institute of Dataspace; Zhongguancun Laboratory; Tsinghua University; ETH Zürich; University of Oxford; Shanghai AI Laboratory; BAAI; Meta; Johns Hopkins University; University of California, Berkeley; Nanyang Technological University（北京航空航天大学; 中国科学院大学; 中国科学院计算技术研究所; 同济大学; 科大讯飞股份有限公司; 长三角安全人工智能安徽实验室; 温州商学院; 江南大学; 广州理工学院; 智元机器; 数据空间研究所; 中关村实验室; 清华大学; 苏黎世联邦理工学院; 牛津大学; 上海人工智能实验室; 北京智源人工智能研究院; Meta; 约翰·霍普金斯大学; 加州大学伯克利分校; 南洋理工大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
介绍CVPR 2026@AdvML研讨会针对自动驾驶VLAs的对抗性多模态攻击挑战赛，基于多视图视觉问答，参赛者要生成对抗图像和文本扰动。阐述任务设计等，研究领先提交作品发现后缀惩罚等模式，为多模态自动驾驶系统相关工作提供参考。
AI 中文摘要
视觉语言智能体（VLAs）越来越多地用于解释复杂驾驶场景并支持安全关键推理。本报告介绍了针对自动驾驶VLAs的对抗性多模态攻击的CVPR 2026@AdvML研讨会挑战赛。该挑战赛基于DriveLM风格的多视图视觉问答构建，用六个同步相机图像和一组结构化的驾驶相关问答对来表示每个场景。参与者生成对抗性图像和仅后缀的文本扰动，使模型响应偏离参考答案，同时保持图像保真度并限制文本成本。竞赛包括两个阶段，第二阶段增加了一个隐藏的黑盒模型来评估可迁移性。我们描述了任务设计、提交规则、评估协议和排行榜结果，然后研究了五份有技术报告的领先提交作品。在这些报告中出现了几个反复出现的模式：后缀惩罚有利于图像侧攻击；场景级、多视图优化比单独处理视图更有效；问答类型和图结构为分配攻击预算提供了有用的先验信息；特征空间目标可以提高黑盒迁移能力；相机图像中嵌入的排版内容暴露了驾驶VLAs中持续存在的漏洞。这些发现为未来多模态自动驾驶系统的鲁棒性评估和防御设计提供了实际参考。
英文摘要
Vision-language agents (VLAs) are increasingly used to interpret complex driving scenes and support safety-critical reasoning. This report presents the CVPR 2026@AdvML Workshop Challenge on adversarial multimodal attacks against autonomous-driving VLAs. Built on DriveLM-style multi-view visual question answering, the challenge represents each scene with six synchronized camera images and a structured collection of driving-related question-answer pairs. Participants generate adversarial images and suffix-only textual perturbations that induce model responses to deviate from reference answers while preserving image fidelity and limiting textual cost. The competition comprises two phases, with Phase II adding a hidden black-box model to assess transferability. We describe the task design, submission rules, evaluation protocol, and leaderboard results, and then examine five leading submissions for which technical reports were available. Across these reports, several recurring patterns emerge: image-side attacks are favored by the suffix penalty; scene-level, multi-view optimization is more effective than treating views in isolation; QA types and graph structure provide useful priors for allocating attack budget; feature-space objectives can improve black-box transfer; and typographic content embedded in camera images exposes a persistent vulnerability in driving VLAs. These findings provide a practical reference for future robustness evaluation and defense design in multimodal autonomous-driving systems.
