Research map / Adversarial robustness and security / Attacks on text and graphs
Autonomous LLM-Enhanced Adversarial Attack for Text-to-Motion
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes ALERT-Motion, an LLM-agent framework that autonomously crafts natural, stealthy adversarial text prompts to make black-box text-to-motion models (MDM, MLD) generate motions matching a target motion.
Problem
Text-to-motion models can be maliciously exploited to generate harmful motions, yet no targeted adversarial attack or safety study exists for T2M; existing T2I attacks produce unnatural prompts unsuitable for the motion domain.
Approach
An LLM agent (adaptive dispatching) iteratively expands, refines, and updates adversarial prompts using only its own language and motion knowledge, guided by a multimodal information contrastive module that scores generated motions against the target motion with a T2M alignment/motion encoder, replacing hand-crafted character/word perturbation rules.
Key results
- On MLD, ALERT-Motion reaches FID 8.881 and perplexity 113.223 with adversarial similarity 0.067, versus RIATIG's 10.899 / 1102.100 / 0.131.
- On MDM (1000 steps), ALERT-Motion achieves R-1 9/20 and R-10 19/20 against 4/20 and 16/20 for RIATIG.
- Across 100 additional target motions, ALERT-Motion gets R-1 27/100 versus 22/100 for RIATIG and 20/100 for MacPromp, with PPL 119.58 versus 1389.67 for RIATIG.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MLD · T2M evaluation | R-1: 4 / 20 -> 6 / 20 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MLD · T2M evaluation | PPL: 1102.100 -> 113.223 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MDM (100 steps) · T2M evaluation | R-2: 8 / 20 -> 13 / 20 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MDM (1000 steps) · T2M evaluation | R-1: 4 / 20 -> 9 / 20 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MDM (100 steps) · TMR evaluation | R-1: 5 / 20 -> 7 / 20 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks · 100 additional experiments | R-1: 22 / 100 -> 27 / 100 | Helped |
| Use ALERT-Motion instead of RIATIG | Targeted attacks · 100 additional experiments | PPL: 1389.67 -> 119.58 | Helped |
| Use ALERT-Motion instead of MacPromp | Targeted attacks on MDM (100 steps) · T2M evaluation | R-1: 7 / 20 -> 7 / 20 | No clear effect |
| Use ALERT-Motion instead of RIATIG | Targeted attacks on MLD · TMR evaluation | R-10: 16 / 20 -> 12 / 20 | Hurt |
| Evaluate with TMR instead of the T2M evaluation model | ALERT-Motion · TMR evaluation, MDM (100 steps) | R-1: 7 / 20 -> 7 / 20 | No clear effect |
Surprising findings
- MacPromp achieves higher R-precision in some settings but produces very high perplexity and adversarial similarity, making its prompts unnatural and easily detected.
Limitations
- Evaluation limited to two victim T2M models (MDM, MLD) and 20 target motions per setting.
- Relies on a proprietary LLM API (gpt-3.5-turbo-instruct), limiting reproducibility.
- Defense strategies are only discussed, not evaluated.
Experimental setup
Datasets: HumanML3D
Benchmarks: HumanML3D
Metrics: R-precision FID multimodal distance perplexity (GPT-2) adversarial similarity (Universal Sentence Encoder cosine)
Baselines: MacPromp RIATIG
Builds on: RIATIG MacPromp CLIP T2M evaluator
Closest papers by meaning
- Light-T2M: A Lightweight and Fast Model for Text-to-motion Generation (AAAI 2025 · similarity 0.85)
- AdvPrompter: Fast Adaptive Adversarial Prompting for LLMs (ICML 2025 · similarity 0.85)
- AdvEDM: Fine-grained Adversarial Attack against VLM-based Embodied Agents (NeurIPS 2025 · similarity 0.85)
- OMG: Towards Open-vocabulary Motion Generation via Mixture of Controllers (CVPR 2024 · similarity 0.84)
- MMM: Generative Masked Motion Model (CVPR 2024 · similarity 0.84)
- SceneTAP: Scene-Coherent Typographic Adversarial Planner against Vision-Language Models in Real-World Environments (CVPR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.