Search papers, labs, and topics across Lattice.
Tsinghua AICollege of Information Sciences and TechnologyFaculty of PsychologyHeinz College of Information Systems and PublicSchool of Transportation EngineeringThe Future LaboratoryThe Institute for Design InformaticsAug 6, 2026arXiv:2608.05495This paper introduces PromptShield-Home, a benchmark designed to evaluate the ability of smart-home agents to distinguish genuine user commands from misleading ambient inputs in multimodal contexts. The study compares three abstraction layers: traditional detectors, a single MLLM agent, and a multi-agent mediation approach, revealing that while traditional detectors overreact to all inputs, MLLMs significantly underperform by failing to recognize genuine commands. The findings indicate that an oracle combining the best of each layer achieves a 94.1% success rate, highlighting the need for learned routing and sensor fusion for effective home-agent safety rather than relying solely on MLLMs.
Smart-home agents struggle to differentiate between real commands and misleading ambient noise, with traditional detectors and MLLMs both failing in complementary ways.
Smart-home assistants increasingly use multimodal large language models (MLLMs) that perceive video and audio directly. This raises a safety question specific to the home: can the agent tell a genuine user command from ambient or externally-sourced content, television speech, on-screen text, or an overheard conversation, that merely looks like a command? We introduce PromptShield-Home, a pilot benchmark of realistic smart-home scenarios spanning addressee ambiguity, screen/audio injection, health-monitor false triggers, mixed occupancy, and a legitimate-command floor, and use it to compare three abstraction layers: traditional detectors (L0), a single MLLM agent (L1; vision, vision+ASR, and audio-visual), and multi-agent mediation (L2; voting, role specialists, cross-model arbitration). Because the label distribution is skewed toward inaction, aggregate accuracy is misleading, a constant always-block predictor scores 82%, so we report unsafe-execution and safe-completion rates separately. The two paradigms fail in opposite ways: detectors act on everything, while every MLLM configuration over-refuses, completing almost no genuine command and missing a true fall in every case. Crucially, their correct sets are disjoint: an oracle that always picks the right layer reaches 94.1%, against 76.5% for the best single layer. We report this as an upper bound, not a system - no router is implemented - and argue that home-agent safety is best served by learned routing and sensor fusion, not by replacing detectors with an MLLM.
