Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policies
cs.CV, cs.RO
Submitted: 2026-09-17
Updated: 2026-09-17
Comments: 8 pages, 2 figures
License: http://creativecommons.org/licenses/by/4.0/
The gist: Adversarial patches to Vision-Language-Action (VLA) policies can cause both immediate action corruption and persistent state effects that remain after the patch is removed.
Terminology
Abstract
Adversarial patches to Vision-Language-Action (VLA) policies can cause both immediate action corruption and persistent state effects that remain after the patch is removed. Existing evaluations largely focus on continuous attacks and do not separate these two effects. We introduce a state-restoration protocol that removes the patch at matched action-chunk boundaries and measures subsequent recoverability under the same remaining step budget. Clean, random-patch, deviation-matched, and fixed-direction controls distinguish adversarial effects from occlusion, action-error magnitude, and directional persistence. We also evaluate a recovery adapter trained on attack-induced states under controlled intervention latency. On OpenVLA-OFT with EDPA attacks, only 36.2% of LIBERO-Long episodes remain recoverable after five chunks, compared with 89.9% and 87.0% for the deviation-matched and fixed-direction controls. Similar persistent effects are observed on autoregressive OpenVLA. The recovery adapter improves recovery from 7.7% to 47.4% at one-chunk latency, but its benefit decreases substantially with delayed intervention. These results show that adversarial effects can persist after patch removal and that timely intervention is critical for recovery.
Sources
- $\pi_0$: A Vision-Language-Action Flow Model for General Robot Control
- Adversarial Patch
- Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Driving
- Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models
- Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faults
- ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Control
- Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Success
- RT-1: Robotics Transformer for Real-World Control at Scale
- Adversarial Attacks on Robotic Vision Language Action Models
- VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijacking
- AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
- LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Models
- Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations
- Adversarial Attacks on Neural Network Policies
- Can We Detect Failures Without Failure Data? Uncertainty-Aware Runtime Failure Detection for Imitation Learning Policies
- Distilling the Knowledge in a Neural Network
- robosuite: A Modular Simulation Framework and Benchmark for Robot Learning
Related papers
- Loss Knows Best: Detecting Annotation Errors in Videos via Loss Trajectories
- AnchorWeave: World-Consistent Video Generation with Retrieved Local Spatial Memories
- Benchmarking the Robustness of Foundation Models for Mammography under Domain Shift
- MambaX-Net: Dual-Input Mamba-Enhanced Cross-Attention Network for Longitudinal MRI Segmentation
- TeleOCR: Navigating Document Parsing Across Digital and Camera-Captured Documents
- A Survey on Efficient Vision-Language-Action Models