[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"doc-detail-85871-en":3,"doc-seo-85871-105":29,"detail-sidebar-cat-0-en-105":91},{"code":4,"msg":5,"data":6},0,"success",{"doc_id":7,"user_id":8,"nickname":9,"user_avatar":10,"doc_module":4,"category_id":11,"category_name":12,"doc_title":13,"doc_description":14,"doc_content":15,"file_id":16,"file_url":17,"file_type":18,"file_size":19,"view_count":20,"is_deleted":4,"is_public":20,"is_downloadable":20,"audit_status":20,"page_count":21,"language":22,"language_code":23,"site_id":24,"html_lang":23,"table_of_contents":25,"faqs":26,"seo_title":13,"seo_description":14,"update_tm":27,"read_time":28},85871,1099514068035,"Ezra","https://ap-avatar.wpscdn.com/davatar_276721f389ce27ea32af1340a28f341c",8,"Research & Report","Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices","Vision-Language Models (VLMs) are being deployed on wearable devices such as smart glasses to support multimodal perception and AI-assisted decision-making. Existing research on visual prompt injection into digital images does not fully address the security risks created when physical environments interact with wearable intelligence. This work models Physical Prompt Injection where malicious scene text uses a high-priority visual channel to hijack VLM behavior, disrupting tasks and steering outputs toward profane, biased, or untruthful results. Experiments across 200+ environments evaluate 6 threat vectors on 12 VLMs, with attack success up to 96% (simulated) and 60% (real), and propose mask-based filtering and semantic-vector internal detection defenses.","Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices  \nYaxin Li  \n[yli849@connect.hkust-gz.edu.cn](yli849@connect.hkust-gz.edu.cn)[ ](yli849@connect.hkust-gz.edu.cn)Hong Kong University of Science and Technology (Guangzhou) Guangzhou, China  \nHao Wang  \nHong Kong University of Science and Technology (Guangzhou) Guangzhou, China  \nYanda Shao  \nBeijing University of Posts and Telecommunications Beijing, China  \nShuhao Zhang  \nHong Kong University of Science and Technology (Guangzhou) Guangzhou, China  \nYan Long∗ [yanlong@hkust-gz.edu.cn](yanlong@hkust-gz.edu.cn)[ ](yanlong@hkust-gz.edu.cn)Hong Kong University of Science and Technology (Guangzhou) Guangzhou, China  \narXiv :2607 . 10269v 1 [ cs .CR] 11 Jul 2026  \nAbstract  \nVision-Language Models (VLMs) are rapidly deployed on humanfacing wearable devices such as smart glasses to enable multimodal perception and AI-assisted decision-making. While prior research has demonstrated the risks of visual prompt injection into digital image inputs of VLMs, the unique security challenges posed by the increasing integration between physical environments and wearable intelligence, such as those embodied in VLM-enabled AI glasses, remain underexplored. Toward understanding and modeling such threats, our work characterizes how malicious textual information embedded in physical environments introduces a highpriority visual channel for indirect prompt injection, where scene texts that hinder or evade human perception could hijack VLM models’ behavior. Such Physical Prompt Injection Attacks can not only disrupt normal tasks of VLM-enabled wearable devices, but also steer models to produce profane, biased, or even untruthful outputs. Using physically captured photos from AI glasses in over 200 real-world environments, our analysis identifies 6 representative threat vectors of physically injected prompts, and further evaluates their impacts on 12 VLM models. Results show that these attacks consistently manipulate model outputs across integrity-and safety-critical tasks, achieving attack success rates of up to 96% and 60% in simulated and real-world settings. Our analysis confirms that multiple models exhibit excessive blind trust in environmental text, ignoring the actual visual context and producing completely opposite summaries or directives. We further propose two targeted defense strategies, including a mask-based external filter and a semantic-vector-based internal detector, to effectively reduce the success rate and safety impact of these attacks.  \n∗ Corresponding author  \nPermission to make digital or hard copies of all or part of this work for personal or classroom use is granted without fee provided that copies are not made or distributed for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or republish, to post on servers or to redistribute to lists, requires prior specific permission [and/or a fee. Request permissions from permissions@acm.org](and/or a fee. Request permissions from permissions@acm.org).  \nConference’17, Washington, DC, USA  \n© 2026 Copyright held by the owner/author(s) . Publication rights licensed to ACM. ACM ISBN 978-x-xxxx-xxxx-x/YYYY/MM [https://doi.org/10.1145/nnnnnnn.nnnnnnn](https://doi.org/10.1145/nnnnnnn.nnnnnnn)  \nCCS Concepts  \n• Security and privacy → Usability in security and privacy.  \nKeywords  \nlarge vision-language model, multi-modal, visual attack, prompt injection attack  \nACM Reference Format:  \nYaxin Li, Hao Wang, Yanda Shao, Shuhao Zhang, and Yan Long. 2026. Devil in the Lens: Analyzing and Defending Physical Prompt Injection Against Vision-Language Models on Wearable Devices. In . ACM, New York, NY, USA, 10 pages. [https://doi.org/10.1145/nnnnnnn.nnnnnnn](https://doi.org/10.1145/nn","cbCaimhcQUENqv62","https://ap.wps.com/l/cbCaimhcQUENqv62","pdf",4008401,1,10,"English","en",105,"# Introduction\n## Motivation and safety concerns\n## Prompt injection background and related work\n## Threat overview and problem statement","[{\"question\":\"What is the main threat studied in the paper?\",\"answer\":\"The paper studies Physical Prompt Injection attacks where malicious textual information embedded in physical environments hijacks Vision-Language Models via scene text.\"},{\"question\":\"How do these attacks affect wearable VLM behavior?\",\"answer\":\"They can disrupt normal tasks and steer models to produce unsafe, profane, biased, or even untruthful outputs, including guidance that contradicts the actual visual context.\"},{\"question\":\"What defenses does the paper propose to reduce attack success and safety impact?\",\"answer\":\"It proposes a mask-based external filter and a semantic-vector-based internal detector to lower the success rate and mitigate harmful effects of physical prompt injection.\"}]",1784206824,25,{"code":4,"msg":30,"data":31},"ok",{"site_id":24,"language":23,"slug":32,"title":13,"keywords":33,"description":14,"schema_data":34,"social_meta":86,"head_meta":88,"extra_data":90,"updated_unix":27},"devil-in-the-lens-analyzing-and-defending-physical-prompt-injection-against-vision-language-models-on-wearable-devices","",{"@graph":35,"@context":85},[36,53,68],{"@type":37,"itemListElement":38},"BreadcrumbList",[39,43,47,50],{"item":40,"name":41,"@type":42,"position":20},"https://docshare.wps.com","Home","ListItem",{"item":44,"name":45,"@type":42,"position":46},"https://docshare.wps.com/document/","Document",2,{"item":48,"name":12,"@type":42,"position":49},"https://docshare.wps.com/document/research-report/",3,{"item":51,"name":13,"@type":42,"position":52},"https://docshare.wps.com/document/devil-in-the-lens-analyzing-and-defending-physical-prompt-injection-against-vision-language-models-on-wearable-devices/85871/",4,{"url":51,"name":13,"@type":54,"author":55,"headline":13,"publisher":57,"fileFormat":60,"inLanguage":23,"description":14,"dateModified":61,"datePublished":62,"encodingFormat":60,"isAccessibleForFree":63,"interactionStatistic":64},"DigitalDocument",{"name":9,"@type":56},"Person",{"url":40,"name":58,"@type":59},"DocShare","Organization","application/pdf","2026-07-17","2026-07-16",true,{"@type":65,"interactionType":66,"userInteractionCount":20},"InteractionCounter",{"@type":67},"ViewAction",{"@type":69,"mainEntity":70},"FAQPage",[71,77,81],{"name":72,"@type":73,"acceptedAnswer":74},"What is the main threat studied in the paper?","Question",{"text":75,"@type":76},"The paper studies Physical Prompt Injection attacks where malicious textual information embedded in physical environments hijacks Vision-Language Models via scene text.","Answer",{"name":78,"@type":73,"acceptedAnswer":79},"How do these attacks affect wearable VLM behavior?",{"text":80,"@type":76},"They can disrupt normal tasks and steer models to produce unsafe, profane, biased, or even untruthful outputs, including guidance that contradicts the actual visual context.",{"name":82,"@type":73,"acceptedAnswer":83},"What defenses does the paper propose to reduce attack success and safety impact?",{"text":84,"@type":76},"It proposes a mask-based external filter and a semantic-vector-based internal detector to lower the success rate and mitigate harmful effects of physical prompt injection.","https://schema.org",{"og:url":51,"og:type":87,"og:title":13,"og:site_name":58,"og:description":14},"article",{"robots":89,"canonical":51},"index,follow",{"doc_id":7,"site_id":24},{"code":4,"msg":5,"data":92},[93,97,101,105,110,115,120,123,128,131,134],{"id":20,"doc_module":4,"doc_module_name":45,"category_name":94,"show_sort_weight":95,"slug":96},"Story & Novel",90,"story-novel",{"id":46,"doc_module":4,"doc_module_name":45,"category_name":98,"show_sort_weight":99,"slug":100},"Literature",80,"literature",{"id":52,"doc_module":4,"doc_module_name":45,"category_name":102,"show_sort_weight":103,"slug":104},"Exam",70,"exam",{"id":106,"doc_module":4,"doc_module_name":45,"category_name":107,"show_sort_weight":108,"slug":109},5,"Comic",60,"comic",{"id":111,"doc_module":4,"doc_module_name":45,"category_name":112,"show_sort_weight":113,"slug":114},6,"Technology",50,"technology",{"id":116,"doc_module":4,"doc_module_name":45,"category_name":117,"show_sort_weight":118,"slug":119},7,"Healthcare",40,"healthcare",{"id":11,"doc_module":4,"doc_module_name":45,"category_name":12,"show_sort_weight":121,"slug":122},30,"research-report",{"id":124,"doc_module":4,"doc_module_name":45,"category_name":125,"show_sort_weight":126,"slug":127},9,"Religion & Spirituality",20,"religion-spirituality",{"id":126,"doc_module":4,"doc_module_name":45,"category_name":129,"show_sort_weight":126,"slug":130},"World Cup","world-cup",{"id":21,"doc_module":4,"doc_module_name":45,"category_name":132,"show_sort_weight":21,"slug":133},"Lifestyle","lifestyle",{"id":135,"doc_module":4,"doc_module_name":45,"category_name":136,"show_sort_weight":106,"slug":137},19,"General","general"]