Adversarial patches applied to Vision‑Language‑Action (VLA) policies not only corrupt actions immediately but also leave lasting state effects that persist after the patch is removed. The study introduces a state‑restoration protocol that evaluates recoverability after patch removal, distinguishing true adversarial impact from occlusion or action‑error magnitude. Experiments on OpenVLA‑OFT with EDPA attacks show that only 36.2% of episodes recover after five chunks, while controls recover at much higher rates; a recovery adapter can improve recovery but its effectiveness drops with delayed intervention.
By Enhao Wu, Fusen Guo, Yuxin Cao, Ziyang Lyu, Lin Li, Wei Song
arXiv:2607. 00174v1 Announce Type: cross Abstract: We present a black-box model-stealing attack that recovers private vision-tokenizer configurations of deployed vision-language models (VLMs), including the visual patch size and input preprocessing pipeline.
By Kai Hu, Akash Bharadwaj, Weichen Yu, Matt Fredrikson
CertVLA is a certified defense for Vision‑Language‑Action (VLA) models that protects closed‑loop control against bounded patch and texture attacks. It calibrates a region of behaviorally consistent actions and uses deterministic covering masks to guarantee at least one attack‑free prediction, normalizing action disagreement by benign variation and accepting only consistent single‑mask anchors. The method provides finite‑sample clean coverage, extends the certificate to full rollouts, and proves that certified rollouts execute only action chunks consistent with clean predictions, ensuring task success regardless of patch content or physical transformation.
By Hui Lu, Zhijie Peng, Yuqi Lin, Zaijia Yang, Jiaming He, Shuhan Ye, Yi Yu, Hanwei Zhu, Bingquan Shen, Alex Kot, Xudong Jiang
arXiv:2506. 03933v2 Announce Type: replace-cross Abstract: Vision Language Models (VLMs) have shown remarkable capabilities in multimodal understanding, yet their susceptibility to adversarial perturbations poses a significant threat to their reliability in real-world applications.
By Jia Fu, Yongtao Wu, Yihang Chen, Kunyu Peng, Xiao Zhang, Volkan Cevher, Sepideh Pashami, Anders Holst
arXiv:2607. 29169v1 Announce Type: cross Abstract: Vision-language-action (VLA) policies achieve strong performance in robotic manipulation but remain vulnerable to runtime disturbances that break the temporal alignment among visual observations, robot states, and executed actions.
By Wenda Yu, Tianshi Wang, Fengling Li, Xin Li, Jingjing Li, Lei Zhu
arXiv:2608. 03231v1 Announce Type: cross Abstract: Vision-Language-Action (VLA) policies promise general robotic manipulation, but their robustness against physical-world attacks remains fragile.
By Jinquan Zhang, Dongfu Yin, Run Yang, Yufeng Yan, Zhen Tian, F. Richard Yu