{"id":"https://openalex.org/W4415540841","doi":"https://doi.org/10.1145/3746027.3755646","title":"Evaluating the Robustness of Multimodal Agents Against Active Environmental Injection Attacks","display_name":"Evaluating the Robustness of Multimodal Agents Against Active Environmental Injection Attacks","publication_year":2025,"publication_date":"2025-10-25","ids":{"openalex":"https://openalex.org/W4415540841","doi":"https://doi.org/10.1145/3746027.3755646"},"language":null,"primary_location":{"id":"doi:10.1145/3746027.3755646","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746027.3755646","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd ACM International Conference on Multimedia","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Yurun Chen","orcid":"https://orcid.org/0009-0005-7088-7414"},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]},{"id":"https://openalex.org/I55712492","display_name":"Zhejiang University of Technology","ror":"https://ror.org/02djqfd08","country_code":"CN","type":"education","lineage":["https://openalex.org/I55712492"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Yurun Chen","raw_affiliation_strings":["School of Software Technology, Zhejiang University, Hangzhou, ZHejiang, China"],"raw_orcid":"https://orcid.org/0009-0005-7088-7414","affiliations":[{"raw_affiliation_string":"School of Software Technology, Zhejiang University, Hangzhou, ZHejiang, China","institution_ids":["https://openalex.org/I168879160","https://openalex.org/I55712492"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5102066273","display_name":"Xueyu Hu","orcid":null},"institutions":[{"id":"https://openalex.org/I168879160","display_name":"Zhejiang University of Science and Technology","ror":"https://ror.org/05mx0wr29","country_code":"CN","type":"education","lineage":["https://openalex.org/I168879160"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Xueyu Hu","raw_affiliation_strings":["College of Computer Science and Technology, Zhejiang University, Hangzhou, Zhejiang, China"],"raw_orcid":"https://orcid.org/0009-0007-6055-8996","affiliations":[{"raw_affiliation_string":"College of Computer Science and Technology, Zhejiang University, Hangzhou, Zhejiang, China","institution_ids":["https://openalex.org/I168879160"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5036511951","display_name":"Keting Yin","orcid":"https://orcid.org/0000-0001-9674-4132"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Keting Yin","raw_affiliation_strings":["School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China"],"raw_orcid":"https://orcid.org/0000-0001-9674-4132","affiliations":[{"raw_affiliation_string":"School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5015420479","display_name":"Juncheng Li","orcid":"https://orcid.org/0000-0003-2258-1291"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Juncheng Li","raw_affiliation_strings":["School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China"],"raw_orcid":"https://orcid.org/0000-0003-2258-1291","affiliations":[{"raw_affiliation_string":"School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China","institution_ids":["https://openalex.org/I76130692"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100757087","display_name":"Shengyu Zhang","orcid":"https://orcid.org/0000-0002-0030-8289"},"institutions":[{"id":"https://openalex.org/I76130692","display_name":"Zhejiang University","ror":"https://ror.org/00a2xv884","country_code":"CN","type":"education","lineage":["https://openalex.org/I76130692"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Shengyu Zhang","raw_affiliation_strings":["School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China"],"raw_orcid":"https://orcid.org/0000-0002-0030-8289","affiliations":[{"raw_affiliation_string":"School of Software Technology, Zhejiang University, Hangzhou, Zhejiang, China","institution_ids":["https://openalex.org/I76130692"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"11648","last_page":"11656"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.8639000058174133,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11512","display_name":"Anomaly Detection Techniques and Applications","score":0.8639000058174133,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11357","display_name":"Risk and Safety Analysis","score":0.8417999744415283,"subfield":{"id":"https://openalex.org/subfields/1804","display_name":"Statistics, Probability and Uncertainty"},"field":{"id":"https://openalex.org/fields/18","display_name":"Decision Sciences"},"domain":{"id":"https://openalex.org/domains/2","display_name":"Social Sciences"}},{"id":"https://openalex.org/T10809","display_name":"Occupational Health and Safety Research","score":0.8133000135421753,"subfield":{"id":"https://openalex.org/subfields/3614","display_name":"Radiological and Ultrasound Technology"},"field":{"id":"https://openalex.org/fields/36","display_name":"Health Professions"},"domain":{"id":"https://openalex.org/domains/4","display_name":"Health Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.8036999702453613},{"id":"https://openalex.org/keywords/robustness","display_name":"Robustness (evolution)","score":0.7437999844551086},{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.7281000018119812},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.4194999933242798},{"id":"https://openalex.org/keywords/benchmark","display_name":"Benchmark (surveying)","score":0.3531999886035919},{"id":"https://openalex.org/keywords/threat-model","display_name":"Threat model","score":0.3303000032901764}],"concepts":[{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.8036999702453613},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7587000131607056},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.7437999844551086},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.7281000018119812},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.6193000078201294},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.4194999933242798},{"id":"https://openalex.org/C185798385","wikidata":"https://www.wikidata.org/wiki/Q1161707","display_name":"Benchmark (surveying)","level":2,"score":0.3531999886035919},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.3303000032901764},{"id":"https://openalex.org/C557433098","wikidata":"https://www.wikidata.org/wiki/Q94","display_name":"Android (operating system)","level":2,"score":0.31790000200271606},{"id":"https://openalex.org/C65856478","wikidata":"https://www.wikidata.org/wiki/Q3991682","display_name":"Attack model","level":2,"score":0.29499998688697815},{"id":"https://openalex.org/C77618280","wikidata":"https://www.wikidata.org/wiki/Q1155772","display_name":"Scheme (mathematics)","level":2,"score":0.2770000100135803},{"id":"https://openalex.org/C38369872","wikidata":"https://www.wikidata.org/wiki/Q7445009","display_name":"Security analysis","level":2,"score":0.2678999900817871},{"id":"https://openalex.org/C186967261","wikidata":"https://www.wikidata.org/wiki/Q5082128","display_name":"Mobile device","level":2,"score":0.2662000060081482}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3746027.3755646","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3746027.3755646","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 33rd ACM International Conference on Multimedia","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1576604124","display_name":null,"funder_award_id":"62402429, U24A20326, 62441236","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":5,"referenced_works":["https://openalex.org/W4389520250","https://openalex.org/W4402671607","https://openalex.org/W4402753874","https://openalex.org/W4405809438","https://openalex.org/W4412887860"],"related_works":[],"abstract_inverted_index":{"As":[0],"researchers":[1],"continue":[2],"to":[3,27,61,115,133,159,176],"optimize":[4],"AI":[5],"agents":[6,26],"for":[7],"more":[8],"effective":[9],"task":[10,127],"execution":[11,59,128],"within":[12,30,112],"operating":[13,157],"systems,":[14],"they":[15],"often":[16],"overlook":[17],"a":[18,43,88,180],"critical":[19,96],"security":[20,97],"concern:":[21],"the":[22,37,57,71,79,83,125,140,161,188],"ability":[23],"of":[24,36,82,91,142,163,185],"these":[25,143],"detect":[28],"''impostors''":[29],"their":[31,63],"environment.":[32],"Through":[33],"an":[34,148],"analysis":[35],"agents'":[38,58],"operational":[39],"context,":[40],"we":[41,86,145],"identify":[42,94],"significant":[44],"threat-attackers":[45],"can":[46],"disguise":[47],"malicious":[48],"attacks":[49,135],"as":[50,70],"environmental":[51,113],"elements,":[52],"injecting":[53],"active":[54],"disturbances":[55],"into":[56],"processes":[60],"manipulate":[62],"decision-making.":[64],"We":[65],"define":[66],"this":[67,177],"novel":[68],"threat":[69],"Active":[72],"Environment":[73],"Injection":[74],"Attack":[75],"(AEIA).":[76],"Focusing":[77],"on":[78,187],"interaction":[80,105,153],"mechanisms":[81],"Android":[84],"OS,":[85],"conduct":[87],"risk":[89],"assessment":[90],"AEIA":[92,134],"and":[93,119],"two":[95,193],"vulnerabilities:":[98],"(1)":[99],"Adversarial":[100],"content":[101],"injection":[102],"in":[103,124,155],"multimodal":[104],"interfaces,":[106],"where":[107],"attackers":[108],"embed":[109],"adversarial":[110],"instructions":[111],"elements":[114],"mislead":[116],"agent":[117],"decision-making;":[118],"(2)":[120],"Reasoning":[121],"gap":[122],"vulnerabilities":[123,154],"agent's":[126],"process,":[129],"which":[130],"increase":[131],"susceptibility":[132],"during":[136],"reasoning.":[137],"To":[138],"evaluate":[139],"impact":[141],"vulnerabilities,":[144],"propose":[146],"AEIA-MN,":[147],"attack":[149,182],"scheme":[150],"that":[151,169],"exploits":[152],"mobile":[156],"systems":[158],"assess":[160],"robustness":[162],"MLLM-based":[164],"agents.":[165],"Experimental":[166],"results":[167],"show":[168],"even":[170],"advanced":[171],"MLLMs":[172],"are":[173],"highly":[174],"vulnerable":[175],"attack,":[178],"achieving":[179],"maximum":[181],"success":[183],"rate":[184],"93%":[186],"AndroidWorld":[189],"benchmark":[190],"by":[191],"combining":[192],"vulnerabilities.":[194]},"counts_by_year":[],"updated_date":"2026-07-22T07:51:19.307946","created_date":"2025-10-25T00:00:00"}