{"id":"https://openalex.org/W7164491063","doi":"https://doi.org/10.48550/arxiv.2606.12586","title":"Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systems","display_name":"Beyond Attack Success Rate: Examining Trigger Leakage in Vision-Language Agentic Systems","publication_year":2026,"publication_date":"2026-06-10","ids":{"openalex":"https://openalex.org/W7164491063","doi":"https://doi.org/10.48550/arxiv.2606.12586"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.12586","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12586","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.12586","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5077707788","display_name":"Jiamin Chang","orcid":"https://orcid.org/0009-0006-8428-884X"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Chang, Jiamin","raw_affiliation_strings":["Minhui"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Minhui","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138548975","display_name":"Salil Kanhere","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Kanhere, Salil","raw_affiliation_strings":["Minhui"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Minhui","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138528280","display_name":"Piotr Koniusz","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Koniusz, Piotr","raw_affiliation_strings":["Minhui"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Minhui","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138510108","display_name":"Jason","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Jason","raw_affiliation_strings":["Minhui"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Minhui","institution_ids":[]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138496131","display_name":"Xue","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Xue","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5137841874","display_name":"Hammond Pearce","orcid":"https://orcid.org/0000-0002-3488-7004"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Pearce, Hammond","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5708000063896179,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.5708000063896179,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T12808","display_name":"Ferroelectric and Negative Capacitance Devices","score":0.1071000024676323,"subfield":{"id":"https://openalex.org/subfields/2208","display_name":"Electrical and Electronic Engineering"},"field":{"id":"https://openalex.org/fields/22","display_name":"Engineering"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.07940000295639038,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/perception","display_name":"Perception","score":0.5498999953269958},{"id":"https://openalex.org/keywords/executable","display_name":"Executable","score":0.4878999888896942},{"id":"https://openalex.org/keywords/focus","display_name":"Focus (optics)","score":0.45840001106262207},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.4075999855995178},{"id":"https://openalex.org/keywords/leakage","display_name":"Leakage (economics)","score":0.3560999929904938},{"id":"https://openalex.org/keywords/visual-perception","display_name":"Visual perception","score":0.3488999903202057},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.3440000116825104},{"id":"https://openalex.org/keywords/mascot","display_name":"Mascot","score":0.3158999979496002}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6985999941825867},{"id":"https://openalex.org/C26760741","wikidata":"https://www.wikidata.org/wiki/Q160402","display_name":"Perception","level":2,"score":0.5498999953269958},{"id":"https://openalex.org/C160145156","wikidata":"https://www.wikidata.org/wiki/Q778586","display_name":"Executable","level":2,"score":0.4878999888896942},{"id":"https://openalex.org/C192209626","wikidata":"https://www.wikidata.org/wiki/Q190909","display_name":"Focus (optics)","level":2,"score":0.45840001106262207},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.41850000619888306},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.4075999855995178},{"id":"https://openalex.org/C2777042071","wikidata":"https://www.wikidata.org/wiki/Q6509304","display_name":"Leakage (economics)","level":2,"score":0.3560999929904938},{"id":"https://openalex.org/C178253425","wikidata":"https://www.wikidata.org/wiki/Q162668","display_name":"Visual perception","level":3,"score":0.3488999903202057},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.3472999930381775},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.3440000116825104},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.33009999990463257},{"id":"https://openalex.org/C2778160393","wikidata":"https://www.wikidata.org/wiki/Q18670161","display_name":"Mascot","level":2,"score":0.3158999979496002},{"id":"https://openalex.org/C36464697","wikidata":"https://www.wikidata.org/wiki/Q451553","display_name":"Visualization","level":2,"score":0.3027999997138977},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.29409998655319214},{"id":"https://openalex.org/C116834253","wikidata":"https://www.wikidata.org/wiki/Q2039217","display_name":"Identification (biology)","level":2,"score":0.2888000011444092},{"id":"https://openalex.org/C159023312","wikidata":"https://www.wikidata.org/wiki/Q409513","display_name":"NOP","level":3,"score":0.27959999442100525},{"id":"https://openalex.org/C63479239","wikidata":"https://www.wikidata.org/wiki/Q7353546","display_name":"Robustness (evolution)","level":3,"score":0.2685999870300293},{"id":"https://openalex.org/C158495155","wikidata":"https://www.wikidata.org/wiki/Q2369151","display_name":"Visual search","level":2,"score":0.2621999979019165},{"id":"https://openalex.org/C161615301","wikidata":"https://www.wikidata.org/wiki/Q309396","display_name":"Keystroke logging","level":2,"score":0.26030001044273376},{"id":"https://openalex.org/C124304363","wikidata":"https://www.wikidata.org/wiki/Q673661","display_name":"Abstraction","level":2,"score":0.25760000944137573},{"id":"https://openalex.org/C2986089797","wikidata":"https://www.wikidata.org/wiki/Q6501338","display_name":"Visual attention","level":3,"score":0.2567000091075897},{"id":"https://openalex.org/C150202949","wikidata":"https://www.wikidata.org/wiki/Q107602","display_name":"Pointer (user interface)","level":2,"score":0.25099998712539673},{"id":"https://openalex.org/C2780704645","wikidata":"https://www.wikidata.org/wiki/Q9251458","display_name":"Observer (physics)","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.12586","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12586","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.12586","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12586","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision-Language":[0],"Agentic":[1],"Systems":[2],"(VLAS)":[3],"connect":[4],"visual":[5,30,132],"perception":[6],"to":[7,94,130,174],"planning,":[8],"tool":[9],"use,":[10],"and":[11,24,44,98,125,145,197,203,214],"physical":[12],"actions.":[13],"This":[14],"means":[15],"backdoor-type":[16],"triggers":[17,68,127,150,208],"can":[18,209],"propagate":[19,210],"through":[20],"both":[21],"decision":[22],"pipelines":[23],"their":[25,135],"connected":[26],"interfaces,":[27],"thus":[28],"making":[29],"backdoors":[31,39],"a":[32,53,120,152,161],"system-level":[33],"threat.":[34],"Current":[35],"evaluations":[36],"on":[37,41],"such":[38],"focus":[40],"clean":[42],"accuracy":[43],"attack":[45,60],"success":[46],"rate":[47],"(ASR),":[48],"metrics":[49],"that":[50,88,118,157],"capture":[51],"whether":[52,58,66],"trigger":[54,82,97,169,183],"works,":[55],"but":[56,134],"not":[57],"an":[59,167],"is":[61,184],"actually":[62],"\"precise\"":[63],"--":[64],"i.e.":[65],"it":[67],"hidden":[69],"behaviors":[70],"only":[71],"when":[72,180],"intended.":[73],"In":[74],"this":[75,107,194],"work,":[76],"we":[77,109,155],"formalize":[78],"the":[79,95,102,176,181],"failure":[80],"of":[81],"precision":[83],"as":[84,151],"\"trigger":[85],"leakage\":":[86],"inputs":[87],"are":[89],"visually":[90],"or":[91],"semantically":[92],"close":[93],"intended":[96],"therefore":[99],"inadvertently":[100],"activate":[101],"attacker-specified":[103],"behavior.":[104],"To":[105],"quantify":[106],"leakage,":[108,199],"introduce":[110],"Neighbor":[111],"Leakage":[112],"Rate":[113],"(NLR).":[114],"Our":[115],"experiments":[116],"show":[117,156],"at":[119],"3%":[121],"poisoning":[122],"ratio,":[123],"icon":[124],"text":[126],"remain":[128],"robust":[129],"common":[131],"transformations,":[133],"neighboring":[136,172],"variants":[137],"leak":[138],"heavily,":[139],"with":[140],"NLR":[141],"reaching":[142],"0.996":[143],"(icon)":[144],"0.944":[146],"(text).":[147],"Using":[148],"textual":[149],"controlled":[153],"probe,":[154],"standard":[158],"fine-tuning":[159],"learns":[160],"broad":[162],"activation":[163,195],"region":[164,196],"rather":[165],"than":[166],"exact":[168,182],"condition,":[170],"causing":[171],"strings":[173],"invoke":[175],"malicious":[177],"behavior":[178],"even":[179],"absent.":[185],"Adding":[186],"edit-distance-one":[187],"hard-negative":[188],"samples":[189],"during":[190],"training":[191],"substantially":[192],"narrows":[193],"reduces":[198],"including":[200],"in":[201],"image-editing":[202],"embodied-manipulation":[204],"workflows,":[205],"where":[206],"leaked":[207],"into":[211],"executable":[212],"programs":[213],"action":[215],"sequences.":[216]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-13T00:00:00"}