REALM: A Unified Red-Teaming Benchmark for Physical-World VLMs

Overview of REALM

Vision-language models (VLMs) are increasingly integrated into safety-critical physical systems, such as autonomous vehicles and robotic manipulators. However, existing red-teaming benchmarks primarily focus on chatbot-centric safety, such as jailbreaking or toxic content generation, rather than the physically grounded functional failures that occur in real-world perception and reasoning tasks. REALM (Red-teaming Benchmark for Physical-World VLMs) addresses this gap as the first unified protocol designed to evaluate VLM robustness across diverse physical domains.

Approach and Methodology

REALM organizes evaluation around three axes: physical domains (e.g., driving, manipulation), task families (e.g., perception, planning), and physically grounded failure modes (e.g., action-prediction errors). To ensure fair comparison, the authors introduce an agentic target-generation pipeline. This pipeline uses a reasoning VLM to analyze each scene and construct scenario-specific, physically plausible attack objectives. These objectives serve as a shared reference for 12 different red-teaming methods, ranging from visual perturbations and patch-based attacks to typographic and prompt injections. The benchmark evaluates 13 different VLMs (ranging from 7B to over 100B parameters) under a strict black-box threat model, where attacks are generated offline and evaluated in a one-shot manner without access to model internals.

Key Findings

• Attack Effectiveness: Text and typographic injection attacks were found to be the most successful at inducing failures across the tested models.
• Visual Transfer: Multimodal co-optimization methods yielded the strongest transferability for visual-perturbation attacks.
• Efficiency: Single-pass attack methods were shown to approach the effectiveness of more computationally expensive iterative methods.
• Robustness vs. Scale: The study demonstrates that increasing model parameter count does not inherently confer greater adversarial robustness, suggesting that current scaling laws do not automatically solve physical-world safety vulnerabilities.