Skip to content

TRAP: Targeted Redirecting of Agentic Preferences

🕒 Published (v1): 2025-01-01 · Source: NeurIPS · Venue: NeurIPS 2025 · link

Ask a follow-up

Open an assistant pre-loaded with this paper's context.

💬 Ask ChatGPT✦ Ask Claude

TL;DR

TRAP is a black-box adversarial framework that uses diffusion-based semantic injection into CLIP embedding space to redirect VLM-powered agents toward attacker-chosen images without modifying pixels directly. By optimizing image embeddings via a Siamese semantic network and layout-aware spatial masking, TRAP produces visually natural images that reliably manipulate agent selection decisions. It achieves up to 100% attack success rate (ASR) on models including GPT-4o and LLaVA-34B, far exceeding pixel-level baselines.

Problem

Existing adversarial attacks on VLM-based agents require either visible pixel perturbations or white-box access to model weights/gradients, making them impractical for real-world stealthy exploitation. There is no effective black-box attack that operates at the semantic level—exploiting cross-modal reasoning—to manipulate agent decision-making while keeping images visually plausible and bypassing platform integrity checks.

Method

TRAP formulates the attack as a constrained optimization in CLIP's shared image-text embedding space under a black-box threat model (query-only access). Given a target image and attacker-chosen positive prompt p_pos, it:

  1. Extracts CLIP embeddings for the target image and positive prompt.
  2. Optimizes the image embedding e_adv via gradient descent on a composite loss: semantic alignment loss L_sem (cosine distance to e_pos), distinctive feature preservation loss L_dist via a Siamese MLP that decomposes embeddings into common/distinctive branches, and perceptual loss L_LPIPS in pixel space.
  3. Applies layout-aware spatial masking: a lightweight MLP encoder-decoder generates a soft heatmap of semantic relevance, refined by a DeepLabv3 foreground segmentation mask, ensuring edits concentrate on the primary subject.
  4. Decodes the optimized embedding through Stable Diffusion v2.1 (Img2Img) to produce the final adversarial image x_adv.

Optimization runs for up to K=20 outer iterations × T=20 inner gradient steps, using CLIP ViT-B/32 as the surrogate. The attack exploits transferability across architectures due to shared CLIP-space geometry.

Key Contributions

  • Black-box semantic adversarial attack on VLM agents operating entirely in embedding space, requiring no model weights or gradients.
  • Composite loss combining semantic alignment, Siamese identity preservation, and perceptual realism.
  • Layout-aware spatial masking via learned MLP + DeepLabv3 segmentation for foreground-targeted edits.
  • Empirical demonstration of cross-architecture transferability including to closed-source GPT-4o and non-contrastive CogVLM.
  • Evaluation against existing defenses (Gaussian noise, CIDER, MirrorCheck, adversarially trained LLaVA) showing persistent high ASR.

Results

  • TRAP ASR vs. baselines on 100 COCO image-caption pairs in an N-way selection task:
  • LLaVA-1.5-34B: TRAP 100% vs. SA_AET 85% vs. SSA_CWA 65% vs. SPSA 36%
  • Gemma3-8B: TRAP 100% vs. SA_AET 67% vs. SPSA 27%
  • Mistral-small-3.1-24B: TRAP 100% vs. SA_AET 61%
  • Mistral-small-3.2-24B: TRAP 99% vs. SA_AET 55%
  • GPT-4o: TRAP 63% vs. SA_AET 12% (all other baselines ≤1%)
  • CogVLM: TRAP 94% vs. SA_AET 42%
  • Defense robustness (LLaVA-1.5-34B): TRAP+Gaussian Noise 100%, TRAP+CIDER 100%, TRAP+MirrorCheck 100%; on Robust-LLaVA: 92%, 85%, 74% respectively.
  • System prompt/temperature robustness: ∆ASR ≤ ±4% across prompt variants; performance stable at T=0.1 and T=0.7.

Limitations

  • Assumes agents rely on contrastive vision-language similarity scoring; less applicable to future architectures that fully depart from CLIP-style retrieval.
  • Computationally expensive: ~520 seconds/iteration vs. ~376s (SPSA) and ~110s (Bandit) on 4× A100-40GB GPUs; not yet viable for real-time attack scenarios.
  • Performance depends on auxiliary component quality (layout mask, Stable Diffusion decoding); may degrade on edge cases or resource-constrained settings.
  • Evaluated on a single dataset (COCO) in controlled N-way selection; generalization to diverse real-world agentic pipelines not fully characterized.

Relevance to Agentic AI / LLM Agents

TRAP directly targets the visual perception layer of autonomous VLM agents—the exact component enabling GUI navigation, e-commerce selection, and retrieval-augmented reasoning—and demonstrates that this layer is systematically exploitable without any privileged access. The attack's success against GPT-4o and cross-architecture transferability indicate this is a generalized vulnerability class, not a model-specific quirk. For researchers tracking agentic AI safety, this work establishes that pixel-level robustness guarantees are insufficient and that semantic embedding-space defenses are a necessary but currently missing component of trustworthy agent design. It connects directly to the broader challenge of adversarial environments in agentic systems (alongside prompt injection and jailbreak literature) and motivates new robustness criteria at the VLM embedding level.