Robots that read the world through cameras now lean on large vision-language models to interpret what they see and decide what to do next. These models handle images and text together, so any words that fall inside the camera frame become part of the input. A stop sign, a street name, a sticker on a wall.
The overthinking behavior at the center of the attack
Researchers at Michigan Technological University have shown that this reading habit opens a door for attackers, and the door leads to a denial-of-service problem that looks nothing like the ones most defenders track.
The work targets a behavior called overthinking. Reasoning-oriented models sometimes generate long chains of deliberation even for simple questions. Because inference time rises roughly in step with the number of tokens produced, a response that balloons from a sentence to several paragraphs also balloons in latency. The researchers turn that tendency into a weapon. They craft short passages of scene text that, once placed in view of a robot’s camera, push the model into extended reasoning and delay its decision.
An example of the overthinking-triggered slowdown attack on LVLM-based robotic systems (Source: Research paper)
An old attack with a new disguise
Think about how most AI security stories go. Someone tricks a model into leaking data it should guard, or coaxes it into saying something it should refuse. This one plays a different game. It goes after availability, the third leg of the classic security triad, and the goal is to keep the system too busy to answer in time.
The idea itself is ancient. Flood a target with more work than it can handle and watch it grind to a halt. What changes here is the delivery. The overload arrives as ordinary words on a sign, the kind a person would read and walk past without a second thought.
The attacker gets no access to model weights, no peek at the developer’s hidden prompt, no fancy pixel tricks or sensor meddling. The whole capability is a readable sign placed where the camera will catch it, sized and printed so a human could parse it too.
Finding the words that jam the gears
Not just any text will do this. The researchers tried dropping random paragraphs into a scene, and the robots shrugged them off, answering about as fast as they did with nothing there at all. The triggers that work have to be built on purpose, and figuring out how to build them is the real contribution here.
The recipe turned out to be a stack of demands piled into one sign. A physics word problem. A life-or-death moral choice. A request to write out pseudocode. An order to explain the reasoning before committing to an answer. Any one of these nudges a model toward longer output. Combine them, and the model tangles itself trying to satisfy everything at once, second-guessing and circling back instead of just deciding.
Building those combinations by hand would take forever, so the team automated the search. They let the strongest ingredients breed and mutate across generations, keeping whatever produced the biggest slowdowns, a kind of survival of the most confusing. The clever shortcut is how they scored each candidate. A full overthinking response takes a long time to play out, which makes testing thousands of them painfully slow. The researchers found they could judge a trigger from just its first few dozen words, since the tell-tale signs of a spiral show up almost immediately. That let them screen a huge pile of candidates cheaply and only run the slow, complete test on the handful that looked most promising.
Reading the results with a careful eye
The big number in this paper is a slowdown of nearly seven times, and it comes with a footnote worth reading. That result landed on a model called Gemma3, which happens to be closely related to the one the researchers used to build their triggers in the first place. So it’s really a best-case picture, the kind an attacker gets when they already know the target intimately. The more telling question is whether these signs work on models they were never tuned against. On two of those, Kimi-VL and Qwen3-VL, they did, but the effect was milder, somewhere in the range of one and a half to three and a half times slower. Still a real drag, and nowhere near seven.
The team also carried the attack out of the lab and into a room. They bolted a camera onto a small robot, printed a trigger on a sheet of A3 paper like a regulatory sign, and propped it in view. One model slowed to a crawl under the live camera feed, running close to five times slower than normal. The others roughly doubled. The robot never moved during any of this, so what the test proves is delay under real optics, and nothing about crashes or anyone getting hurt.
One last check gives the result some spine. When the researchers took attack prompts from earlier text-only research and simply printed them onto signs, most of them did nothing. A prompt that ties a chatbot in knots turns out to be almost harmless once a robot has to read it off a wall and weigh it against what its camera sees. The triggers had to be designed for this setting to work in it.
The good news is how easy it is to stop
Here is the reassuring part. The defense costs almost nothing. Cap the token budget, set a hard timeout, and switch to a bounded fallback policy when a response runs long. A lightweight monitor can watch the opening tokens and pull the plug before a full blowup, since the warning signs tend to show up right away.
That simplicity puts the stakes in perspective. The attack only bites systems that run unbounded reasoning models inside a time-sensitive loop, and any team building one can close the gap with a budget and an early-warning check.
Demo: Prophet Agentic AI SOC Platform transforms alert triage and investigation
