Exploring the Robustness of Decision-Level Through Adversarial Attacks on LLM-Based Embodied Models

TL;DR

This paper introduces a new dataset and attack strategies to evaluate and demonstrate the vulnerability of LLM-based embodied models to adversarial prompt manipulations, revealing their limited robustness.

Contribution

The paper constructs the Embodied Intelligent Robot Attack Dataset (EIRAD) and develops novel attack methods, including evaluation techniques, to assess the robustness of LLM-based embodied models.

Findings

Higher attack success rates on LLM-based embodied models.

Lower decision-level robustness observed in these models.

Efficient prompt suffix initialization improves attack convergence.

Abstract

Embodied intelligence empowers agents with a profound sense of perception, enabling them to respond in a manner closely aligned with real-world situations. Large Language Models (LLMs) delve into language instructions with depth, serving a crucial role in generating plans for intricate tasks. Thus, LLM-based embodied models further enhance the agent's capacity to comprehend and process information. However, this amalgamation also ushers in new challenges in the pursuit of heightened intelligence. Specifically, attackers can manipulate LLMs to produce irrelevant or even malicious outputs by altering their prompts. Confronted with this challenge, we observe a notable absence of multi-modal datasets essential for comprehensively evaluating the robustness of LLM-based embodied models. Consequently, we construct the Embodied Intelligent Robot Attack Dataset (EIRAD), tailored specifically for robustness evaluation. Additionally, two attack strategies are devised, including untargeted attacks and targeted attacks, to effectively simulate a range of diverse attack scenarios. At the same time, during the attack process, to more accurately ascertain whether our method is successful in attacking the LLM-based embodied model, we devise a new attack success evaluation method utilizing the BLIP2 model. Recognizing the time and cost-intensive nature of the GCG algorithm in attacks, we devise a scheme for prompt suffix initialization based on various target tasks, thus expediting the convergence process. Experimental results demonstrate that our method exhibits a superior attack success rate when targeting LLM-based embodied models, indicating a lower level of decision-level robustness in these models.