Technical Report on the CVPR 2026@AdvML Workshop Challenge

Source

• Source name: arXiv
• Source kind: paper
• Authors / organization: Tianyuan Zhang, Zonglei Jing, Jiangfan Liu, Ligong Zhang, Ke Ma, Chengzhi Sun, Xiaohai Xu, Zhirui Zhang, Qianqian Xu, Qingming Huang, Hanyu Fang, Junhua Liu, Zheng Wang, Xiaoliang Liu, Yuanbo Li, Shuai Gui, Bin Wang, Menghe Zheng, Jing Nie, Hanyang Meng, Zeyang Zhang, Xiang Zhang, Yongxuan Zhu, Rui Ding, Hainan Li, Yongkang Zhang, Zhilei Zhu, Xianglong Kong, Jin Hu, Zonghao Ying, Yisong Xiao, Lei Chen, Haotong Qin, Jiakai Wang, Aishan Liu, Ruikai Li, Julia Karbing, Yinpeng Dong, Zhenfei Yin, Shao Jing, Xia Hu, Jingyi Xu, Juntao Dai, Xinyun Chen, Vishal M. Patel, Xianglong Liu, Dawn Song, Alan Yuille, Philip H. S. Torr, Dacheng Tao
• Venue: arXiv: cs.CV
• Published: 2026-07-13
• Collected: 2026-07-14
• URL: http://arxiv.org/abs/2607.11560v1
• PDF: https://arxiv.org/pdf/2607.11560v1
• DOI: UNKNOWN

Plain-Language Brief

This text is about the CVPR 2026@AdvML Workshop Challenge which focuses on testing the robustness of vision-language agents (VLAs) used in autonomous driving. The challenge involved creating adversarial images and textual perturbations that could manipulate VLA responses while preserving image quality and minimizing text cost. The competition had two phases, with Phase II introducing a hidden black-box model for testing transferability. The report discusses the challenge structure, rules, evaluation protocol, and results, as well as analyzing five top submissions.

What the Document Says

• The CVPR 2026@AdvML Workshop Challenge focused on adversarial multimodal attacks against autonomous-driving VLAs.
• The challenge used DriveLM-style multi-view visual question answering and presented each scene with six synchronized camera images and a structured collection of driving-related question-answer pairs.
• Participants generated adversarial images and textual perturbations to induce model responses to deviate from reference answers, preserving image fidelity and limiting textual cost.
• The competition had two phases: Phase I and Phase II, with Phase II including a hidden black-box model for testing transferability.
• The report discusses the task design, submission rules, evaluation protocol, and leaderboard results.
• Five leading submissions were analyzed, revealing several recurring patterns.
• Image-side attacks are favored by the suffix penalty.
• Scene-level, multi-view optimization is more effective than treating views in isolation.
• QA types and graph structure provide useful priors for allocating attack budget.
• Feature-space objectives can improve black-box transfer.
• Typographic content embedded in camera images exposes a persistent vulnerability in driving VLAs.
• These findings offer practical references for future robustness evaluation and defense design in multimodal autonomous-driving systems.

Key Concepts Mentioned

• Vision-language agents
• Autonomous driving
• Adversarial attacks
• Multi-view visual question answering
• Challenge
• Submission rules
• Evaluation protocol
• Leaderboard results
• Top submissions analysis
• Recurring patterns

Claims Made by the Document

• Image-side attacks are favored by the suffix penalty.
• Scene-level, multi-view optimization is more effective than treating views in isolation.
• QA types and graph structure provide useful priors for allocating attack budget.
• Feature-space objectives can improve black-box transfer.
• Typographic content embedded in camera images exposes a persistent vulnerability in driving VLAs.

Evidence Used

• Participants generated adversarial images and textual perturbations to induce model responses to deviate from reference answers, preserving image fidelity and limiting textual cost.
• The competition had two phases: Phase I and Phase II, with Phase II including a hidden black-box model for testing transferability.
• Five leading submissions were analyzed, revealing several recurring patterns.

Methods / Approach

UNKNOWN

Limitations Stated by the Authors

UNKNOWN

Limitations Noted by the Agent

Agent interpretation — not from the source.

UNKNOWN

Open Questions

UNKNOWN

Notes for Future Q&A

May include interpretation. Labeled where it does.

UNKNOWN

Raw Abstract / Excerpt

Vision-language agents (VLAs) are increasingly used to interpret complex driving scenes and support safety-critical reasoning. This report presents the CVPR 2026@AdvML Workshop Challenge on adversarial multimodal attacks against autonomous-driving VLAs. Built on DriveLM-style multi-view visual question answering, the challenge represents each scene with six synchronized camera images and a structured collection of driving-related question-answer pairs. Participants generate adversarial images and suffix-only textual perturbations that induce model responses to deviate from reference answers while preserving image fidelity and limiting textual cost. The competition comprises two phases, with Phase II adding a hidden black-box model to assess transferability. We describe the task design, submission rules, evaluation protocol, and leaderboard results, and then examine five leading submissions for which technical reports were available. Across these reports, several recurring patterns emerge: image-side attacks are favored by the suffix penalty; scene-level, multi-view optimization is more effective than treating views in isolation; QA types and graph structure provide useful priors for allocating attack budget; feature-space objectives can improve black-box transfer; and typographic content embedded in camera images exposes a persistent vulnerability in driving VLAs. These findings provide a practical reference for future robustness evaluation and defense design in multimodal autonomous-driving systems.