A smudge on the camera can send a delivery robot to the wrong floor. Researchers just proved it.

A delivery robot that reads its camera can be steered to the wrong floor by a smudge on its lens. Robots built on the most modern AI are the easiest to fool, not the hardest. A team at HKUST Guangzhou just measured the gap.

In August, AdvNav was accepted at the ACM Multimedia 2026 conference as the first black-box adversarial attack on vision-language navigation robots, the kind that look at a camera, follow a spoken instruction, and pick the next step on their own. Built by Prof. Chen Changhao's team, the framework never touches the robot's model. It only watches the robot walk.

On the standard Room-to-Room benchmark, the older Transformer-based HAMT system fell for the attack 49.70% of the time, a mid-tier system 65.96%, and MapGPT, the most modern LLM-based one, 87.30%. The three numbers in a row turn a comfortable assumption on its head: leaderboard accuracy and corridor robustness are not the same thing.

AdvNav works without model parameters or gradients. It substitutes trajectory-level scores (SPL and NE) and action-level rewards for white-box gradients, and a genetic algorithm evolves the perturbation under a limited query budget. The method targets two specific weaknesses: long multimodal decision sequences and sparse, delayed feedback.

These robots are already in hospitals, warehouses, and homes. AdvNav is not a verdict that AI is broken. It is a reproducible test operators can run before shipping. Whether the same attack transfers to physical robots and to other deployed systems is the open question. Original coverage