PaperlayerView exact revision on arXiv

Source-linked AI summary

Adversarial Attacks on Robotic Vision Language Action Models

Eliot Krzysztof Jones, Alexander Robey, Andy Zou, Zachary Ravichandran, George J. Pappas, Hamed Hassani, Matt Fredrikson, J. Zico Kolter

arXiv:2506.03350v1cs.ROcs.AI

TL;DR

VLAs bring powerful multimodal models into physical control, raising questions about whether they inherit adversarial vulnerabilities from LLMs. This paper adapts textual jailbreaking attacks to VLA prompts and finds full action-space reachability, persistent control, and environment-agnostic attacks. The authors argue that VLA defenses must address low-level control rather than semantic harm alone.

  • Problem

    The paper addresses limited understanding of adversarial vulnerabilities in VLA-controlled robots despite their growing capabilities and potential physical risks.

    Source: §1 · pp. 1–2

  • Method

    The authors adapt token-level LLM jailbreaking attacks to textual prompts for VLAs, targeting specific low-level actions and action sequences.

    Source: §1 · p. 2, §3.2 · p. 4, §3.3 · p. 5

  • Results

    Across OpenVLA fine-tunes, attacks achieve upwards of 90% success eliciting targeted actions, persist up to 28× longer than nominal operation, and transfer across environments.

    Source: §1 · p. 2

  • Takeaways & Limitations

    VLA security requires defenses that address adversarial control authority and the models’ low-level action outputs, not only semantic notions of harmful content.

    Source: §1 · p. 2, §6 · pp. 9–10

    The attack is white-box and relatively costly, and the study does not cover diffusion-based models or black-box scenarios.

    Source: §6 · p. 10

Abstract

from arXiv · show

The emergence of vision-language-action models (VLAs) for end-to-end control is reshaping the field of robotics by enabling the fusion of multimodal sensory inputs at the billion-parameter scale. The capabilities of VLAs stem primarily from their architectures, which are often based on frontier large language models (LLMs). However, LLMs are known to be susceptible to adversarial misuse, and given the significant physical risks inherent to robotics, questions remain regarding the extent to which VLAs inherit these vulnerabilities. Motivated by these concerns, in this work we initiate the study of adversarial attacks on VLA-controlled robots. Our main algorithmic contribution is the adaptation and application of LLM jailbreaking attacks to obtain complete control authority over VLAs. We find that textual attacks, which are applied once at the beginning of a rollout, facilitate full reachability of the action space of commonly used VLAs and often persist over longer horizons. This differs significantly from LLM jailbreaking literature, as attacks in the real world do not have to be semantically linked to notions of harm. We make all code available at https://github.com/eliotjones1/robogcg .

1 Introduction

This paper initiates the study of adversarial attacks on VLA-controlled robots, motivated by the growing deployment and physical risks of robotic foundation models. It adapts textual jailbreaking to obtain targeted low-level control, finding broad action reachability, persistence, and environment-agnostic attacks.

1 Introduction

  • The study addresses emerging risks as increasingly capable robotic foundation models move toward broader real-world deployment.The authors argue that these risks should be understood before deployment becomes widespread.Source: §1 · pp. 1–2
  • Textual adversarial prompts can obtain complete control authority over targeted VLAs, rather than merely eliciting semantically harmful responses.The attack targets specific robotic actions independently of whether those actions are harmful.Source: §1 · p. 2
  • Across OpenVLA fine-tunes, attacks elicit upwards of 90% of targeted actions across distinct LIBERO tasks.The evaluation spans multiple fine-tunes and task subsets.Source: §1 · p. 2
  • Attacks persist across multiple rollout steps, increasing targeted persistence by up to 28× relative to nominal operation.Source: §1 · p. 2
  • The attacks can be environment-agnostic across multiple robotic environments in simulation and the real world.Source: §1 · p. 2

2 Related work

Robotic foundation models span high-level planners and low-level actuators, while prior adversarial research has mainly targeted language or vision model outputs. Existing work reaches robotic planners, but this study addresses the previously unexamined low-level VLA setting.

2.1 Foundation models for robotic applications

  • High-level planners control robots through predefined APIs or integrated reasoning pipelines, supporting applications including driving, service robotics, and surgery.Source: §2.1 · p. 3
  • Low-level actuators, commonly called VLAs, generate continuous robotic actions from textual goals and visual inputs.Architectures include transformer-based models, language-backbone VLAs, flow-matching models, and diffusion-based action models.Source: §2.1 · p. 3

2.2 Adversarial attacks and defenses

  • AI-safety research has emphasized aligning AI actions with human values and assessing misuse, including harmful-content generation and risks from increasingly capable agents.Source: §2.2 · p. 3
  • Jailbreaking research typically elicits objectionable text or toxic visual media, with defenses contributing to a relatively robust suite of frontier models.Source: §2.2 · p. 3
  • Prior work finds LLM-based high-level planners vulnerable to jailbreaking, but this study is presented as the first to attack low-level VLAs.Source: §2.2 · p. 3

3 Jailbreaking attacks on VLAs

The paper adapts GCG-style textual attacks to VLA inputs, targeting low-level action tokens rather than harmful language. It defines control-authority threat models and develops single-step, persistence, and transfer attacks across VLA systems.

3.1 Jailbreaking LLM chatbots

  • The attack adapts GCG by treating a target action sequence as the target string and optimizing textual embeddings with image inputs included in the loss.Source: §3.1 · p. 4, §3.3 · pp. 4–5

3.2 Threat models for VLAs

  • A VLA combines a fixed textual prompt with updated scene images, then autoregressively generates d action tokens that are detokenized into low-level control.Symbol tuning maps selected vocabulary tokens to discretized action-space values.Source: §3.2 · p. 4
  • The threat model lets an adversary append tokens to or replace a textual task prompt to elicit a targeted action or action sequence.Vision-based attacks are left for future work.Source: §3.2 · p. 4

3.3 Adversarial attacks on VLAs

  • Single-step attacks test action-space reachability by seeking prompts that drive a VLA to a specific fixed action across 1792 one-hot targets per OpenVLA variant.The targets cover seven action dimensions and 256 discrete bins per dimension.Source: §3.3 · p. 5, Table 1 · p. 5
  • Persistence attacks aggregate losses over multiple image embeddings to encourage targeted actions despite changing visual observations.The embeddings can come from augmentation or multiple random initializations.Source: §3.3 · p. 5
  • Transfer attacks optimize attack strings on one or more source VLAs and apply them to a distinct target model, extending the white-box method toward model transfer.Source: §3.3 · p. 5

3.5 Attacking chatbots versus VLAs

  • Unlike chatbot jailbreaks, VLA attack success is judged by numerical target-action elicitation rather than a semantic harm evaluation.The VLA objective is control authority over low-level actions, independent of what those actions mean.Source: §3.5 · p. 6

4 Experiments

Across four OpenVLA fine-tunes, adapted textual attacks reliably elicit targeted actions, persist over longer horizons, transfer weakly between architectures, and can be optimized for multiple models.

4.1 Single-step attacks

  • 77.4% overall success on Libero-10 and above 90% on Libero-Goal, Libero-Object, and Libero-Spatial show that adversarial prompting reaches nearly any targeted action.The evaluation uses 1792 one-hot target vectors and requires all seven action dimensions to match.Source: §4.1 · p. 6
  • 30–110 optimization steps typically find successful exact matches, requiring 3–10 minutes per success on H100 GPUs.Attacks run for up to 500 steps, whereas chatbot jailbreaks often require the full budget and over an hour on the same hardware.Source: §4.1 · pp. 6–7
  • Increasing the token budget generally raises success rates and reduces the steps needed to find a match.Halving the budget reduces success rates by at least a factor of two relative to the 20-token setting.Source: §4.1 · p. 7, Figure 3 · p. 7
  • Attacks optimized in SIMPLER transfer successfully to both simulated and real-world HYDRA environments, indicating control authority beyond simulation.Table 2 reports relatively strong performance for attacks optimized on images from both environments.Source: §4.1 · p. 7, Table 2 · p. 8

4.2 Persistence attacks

  • Persistence attacks consistently maintain targeted actions on seen images, while larger image budgets improve generalization to unseen images, including nearly 28× more persistence steps for Libero-Spatial.The attack uses 1–3 images from burn-in or the first rollout steps and then runs the policy for 80 steps.Source: Figure 2 · p. 7, §4.2 · p. 8

4.3 Transfer attacks

  • Single-model attack strings do not achieve exact seven-dimensional matches across architectures and generally perform no better than random prompts for target elicitation.Ensemble attacks have a nontrivial but uncorrelated effect on transferability, and universal attacks optimized across two models succeed across multiple models.Source: §4.3 · pp. 8–9, Figure 4 · p. 8
  • Universal attacks optimized across two OpenVLA fine-tunes can succeed across multiple models, although the evidence does not establish conclusive ensemble-transfer proof.Transfer success is unrelated to whether source-model optimization initially succeeded and relates to the nominal action’s distance from the target.Source: §4.3 · pp. 8–9

5 Discussion

The discussion evaluates defenses against textual attacks on VLAs and finds a trade-off between attack blocking and preserving benign instruction following. It also argues that VLA safety requires defenses tailored to robotic control.

5 Discussion

  • Smoothing reduces attacked-task success to 0% but also reduces non-attacked-task success to 0% by corrupting instructions.Source: §5 · p. 9
  • Multimodal perplexity filtering is ineffective because image inputs dominate the loss, while language-only filtering can resist suffix-style attacks.Source: §5 · p. 9
  • Perplexity filtering is impractical for open-world robotics because its threshold depends on the maximum perplexity observed in a held-out set.Source: §5 · p. 9
  • Existing VLA safety methods target trajectory generalization or task completion rather than adversarial control, motivating VLA refusal mechanisms and control-theoretic defenses.Source: §5 · p. 9

6 Conclusion

The paper presents the first study of adversarial attacks on low-level VLA actuators and shows that optimized instructions can obtain complete control authority. It concludes that new defenses are needed, while noting important attack-scope limitations.

6 Conclusion

  • Optimizing instructions can obtain complete control authority over a targeted VLA, establishing a threat model for low-level robotic actuation.Source: §6 · p. 9
  • The findings motivate defenses designed around the distinctive output format of VLAs as these systems become more powerful and widely used.Source: §6 · p. 10
  • The attack is difficult to deploy in practice because GCG requires white-box access and incurs substantial computational cost.Source: §6 · p. 10
  • The framework targets autoregressive VLAs, leaving black-box settings and diffusion-based models as important directions for future risk assessment.Source: §6 · p. 10

A On the consequences of fine-tuning

Fine-tuning substantially increases single-step attack effectiveness relative to the OpenVLA base model, with failures clustering in particular action-space regions. The results suggest fine-tuning may concentrate normalized actions and thereby ease attacks.

A On the consequences of fine-tuning

B Continued discussion of architectural transfer

Transfer attacks optimized on OpenVLA-Base show little to no transferability to TraceVLA, CogACT, and OpenPi0. This indicates that attack effectiveness does not readily carry across the evaluated architectures.

B Continued discussion of architectural transfer

  • Transfer attacks optimized for OpenVLA-Base show little to no transfer to TraceVLA, CogACT, and OpenPi0.Source: Figure 7 · p. 20

B.1 Architectural details

The transfer study compares OpenVLA with three seven-dimensional action models that differ in architecture and input processing.

B.1 Architectural details

  • TraceVLA [82] is the closest architectural match because it directly fine-tunes OpenVLA while adding a visual trace of active point trajectories.Its input contains the original image and a trace-overlay image at every step.Source: §B.1 · p. 20
  • CogACT adds a diffusion action module to language-model outputs, making text-based optimization difficult because its outputs are more continuous.Source: §B.1 · p. 20
  • OpenPi0 uses an action expert with diffusion and separate weights, while all three transfer models output seven-dimensional actions like OpenVLA.Source: §B.1 · p. 20

B.2 Random vs. optimized instruction action distributions

The apparent transfer advantage of converged GCG runs is explained by target-action distributions rather than by optimized instructions exerting distinct control over other models.

B.2 Random vs. optimized instruction action distributions

  • Figure 8 compares average first-six-dimensional actions for nominal, unsuccessfully optimized, and random instructions against the target, while Figure 9 shows converged cases.The action averages exclude the gripper and are normalized to remove negative values.Source: §B.2 · p. 21, Figure 8 · p. 21, Figure 9 · p. 21
  • For converged runs, the average target action lies much closer to optimized and random actions than in non-converged runs.This pattern is especially clear in the TraceVLA plots.Source: §B.2 · p. 21, Figure 8 · p. 21, Figure 9 · p. 21
  • Convergence correlates with target-action uniformity around the zero vector, because zero was an accessible target for the unfine-tuned OpenVLA base model.Randomly selected actions closer to that vector were therefore more likely to produce convergence.Source: §B.2 · p. 22
  • Optimized instructions produce nearly identical average actions to random instructions across both converged and non-converged runs.This suggests the tested models interpret optimized strings no differently from random token strings.Source: §B.2 · pp. 21–22
  • GCG convergence does not indicate successful transfer: the apparent relationship arises from randomly selected target actions lying near random and optimized action distributions.Source: §B.2 · p. 22

C.1 Action elicitation

The experiments characterize action-space elicitation with GCG and show that suffix attacks work, while normalization creates important task- and dimension-specific difficulty.

C.1 Action elicitation

  • For Libero-10, failures cluster in difficult action-space regions, especially where normalization maps many actions to nearly identical values.The fourth dimension is particularly affected because its q01 value is close to zero; maximum values remain attainable in most other dimensions and models.Source: §C.1 · p. 22

C.2 Suffix trials

  • Table 4 reports per-dimension and overall attack-success rates for four models across 12 extreme actions using optimized suffixes.The trials cover the -1 and 1 one-hot vectors across the first six dimensions, excluding the gripper.Source: Table 4 · p. 22
  • GCG optimization targets maximum and minimum one-hot actions because they are the most difficult actions to achieve within the first six dimensions.Source: §C.2 · p. 23
  • The method also works when the optimized string is appended as a suffix, and larger token budgets increase success rates while reducing optimization steps needed for convergence.The evaluated nominal instructions span Libero-Goal, Libero-Object, Libero-Spatial, and Libero-10 tasks.Source: §C.2 · pp. 22–23
Loading 2506.03350v1…