Research map / Multi-agent systems and games / LLM agents

MAGIC: Mastering Physical Adversarial Generation in Context Through Collaborative LLM Agents

AAAI 2026 · Multi-agent systems and games › LLM agents · approach: Agent safety and attack benchmarks · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes MAGIC, a three-agent GPT-4o framework that generates, deploys, and self-examines diffusion-based adversarial stop-sign patches in driving scenes to attack YOLO and DETR detectors digitally and physically.

Problem

Physical adversarial patches for driving perception must be effective against detectors and natural in context, but prior diffusion-based attacks (NDDA) ignore scene context and deployment location, so their effectiveness and stealthiness degrade after real-world placement.

Approach

Reformulates physical adversarial attacks as one-shot patch generation in context: multimodal LLM agents (GAgent writes T2I prompts, DAgent chooses location and scale with set-of-mark prompting, EAgent checks detector confidence and naturalness and iteratively refines the prompt) collaborate in a closed loop with Stable Diffusion v2.

Key results

• MAGIC achieves 80.66% average ASR at confidence 0.5 across six nuImage environments versus 46.66% for the best NDDA+DAgent baseline in Environment 1.
• At a stricter 0.8 confidence threshold, MAGIC averages 58.66% ASR in Environment 1 while NDDA Rand reaches at most 29.11%.
• Average naturalness score rises from about 0.22-0.40 for NDDA Rand to 0.89-0.99 for MAGIC across the six environments, as scored by GPT-4o.

Measured effects reported in the paper

Surprising findings

• Naive GAgent prompts without prompt engineering achieve essentially 0 to 4% ASR, so the EAgent attack-feedback loop drives most of the gain.
• DAgent placement alone does not improve ASR at the 0.8 threshold, which the authors attribute to DAgent targeting stealthiness rather than attack strength.

Limitations

• Experiments are limited to proof-of-concept scenes under standard conditions, without varied weather, lighting, or noisy cameras.
• Blending of adversarial patches with the environment is not modeled in digital implementations.
• Naturalness is judged by an LLM rather than human observers, and physical evaluation is limited to a few scenes.

Experimental setup

Datasets: nuImage NDDA released patches

Benchmarks: nuImage

Metrics: Attack Success Rate (ASR) average naturalness score

Baselines: NDDA Rand NDDA+DAgent GAgent-naive GAgent-naive w/ DAgent GAgent-naive w/ EAgent-ae

Builds on: Natural Denoising Diffusion Attack Stable Diffusion set-of-mark prompting

Closest papers by meaning

• SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments (CVPR 2025 · similarity 0.87)
• AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents (NeurIPS 2025 · similarity 0.86)
• A Unified, Resilient, and Explainable Adversarial Patch Detector (CVPR 2025 · similarity 0.85)
• Pandora's Box: Towards Building Universal Attackers against Real-World Large Vision-Language Models (NeurIPS 2024 · similarity 0.85)
• Visual Adversarial Examples Jailbreak Aligned Large Language Models (AAAI 2024 · similarity 0.85)
• PAD: Patch-Agnostic Defense against Adversarial Patch Attacks (CVPR 2024 · similarity 0.85)