FreezeVLA: Action-Freezing Attacks against Vision-Language-Action Models

Threat and contribution

• Inaction can preserve a fixed viewpoint, making action-freezing attacks more stable and persistent than attacks that induce viewpoint-changing incorrect actions.The threat can disrupt manufacturing, surgery, or driving by halting robot activity.Source: §1 · p. 2
• FreezeVLA generates adversarial images that persistently freeze VLA models and make them ignore subsequent commands.The attack targets inaction, which can be mistaken for standby or successful task completion and delay intervention.Source: §1 · p. 2

Method

• FreezeVLA uses min–max bi-level optimization, combining robust hard-prompt maximization with adversarial-image minimization.The inner process searches for prompts resistant to freezing, while the outer process crafts images that defeat those prompts.Source: §1 · p. 2
• Adversarial images generated by FreezeVLA transfer across different prompts, expanding attack coverage beyond a single user instruction.The framework leverages learnable multi-prompts to cover the prompt embedding space.Source: §1 · p. 2

Experiments

• 73.3% on SpatialVLA, 95.4% on OpenVLA, and 59.8% on π0 average attack success rates surpass existing baselines by 53.2%, 78.4%, and 57.3%, respectively.Experiments span different robotic manipulation tasks and three state-of-the-art VLA models.Source: §1 · p. 3

Vision-Language-Action Models

• VLA models integrate visual perception and language understanding to output robotic control actions, using architectures such as OpenVLA, π0, and SpatialVLA.Recent designs use vision encoders, action tokenizers, flow matching, and spatial representations.Source: §2 · p. 3

Adversarial Attacks on VLA Models

• Prior adversarial attacks on VLA models mainly induce dangerous or incorrect physical actions through jailbreak prompts or adversarial images.These vulnerabilities extend threats previously studied in LLMs and VLMs into embodied robotics.Source: §2 · p. 3

Adversarial Transferability

• Cross-prompt transferability allows a single adversarial input to disrupt behavior across diverse textual instructions, but persistent-inaction transfer attacks remain largely unexplored in VLA models.The paper positions action-freezing attacks as an early formalization of this risk.Source: §2 · p. 3

3.1 PRELIMINARIES

• FreezeVLA assumes white-box access to the target VLA and permits image manipulation only, while the user’s textual instruction remains inaccessible.The adversary perturbs the visual input using model architecture, parameters, and adversarial gradients.Source: §3.1 · pp. 3–4
• Action-freezing attacks optimize an adversarial image so the VLA consistently emits an inaction token, such as <eos> or <stop token>, for a given instruction.The paper denotes whichever tokenizer-specific token enforces inaction as <freeze>.Source: §3.1 · p. 4

3.2 ACTION-FREEZING ATTACK ON VLA MODELS

• FreezeVLA first generates reference prompts, then gradient- and synonym-based inner optimization finds hard rephrasings that reduce the probability of predicting <freeze>.Accepted synonym substitutions are retained when they lower the freezing-token probability, producing the hard prompt set P⋆.Source: §3.2 · pp. 4–5
• The outer optimization updates an adversarial image against the hard prompt set, maximizing <freeze> prediction while constraining perturbations within ϵ.The procedure alternates prompt maximization and image minimization, with image updates computed from gradients aggregated over P⋆.Source: §3.2 · p. 5
• Table 1 reports cross-prompt ASR comparisons across SpatialVLA, OpenVLA, and π0 on four LIBERO datasets at ϵ = 4/255, including single-prompt, multi-prompt, and GPT-generated-prompt baselines.The table distinguishes randomly sampled reference prompts from diverse prompts generated by o3 and boldfaces the best results.Source: Table 1 · p. 6

4.1 EXPERIMENTAL SETUP

• The evaluation uses LIBERO-10, LIBERO-Goal, LIBERO-Object, and LIBERO-Spatial with SpatialVLA, OpenVLA, and π0, measuring ASR on original prompts after image generation from reference prompts.The principal attack comparisons use 20 reference prompts and a perturbation budget of ϵ = 4/255.Source: §4.1 · pp. 6–7

4.2 MAIN RESULTS

• Prompt diversification raises OpenVLA’s average ASR from 17.0% with single-prompt PGD to 92.0% with the Multi-Prompt attack.Random noise is near 0% ASR, while FreezeVLA with randomly sampled prompts reaches 65.1%, 93.2%, and 54.2% on SpatialVLA, OpenVLA, and π0.Source: §4.2 · p. 7
• 73.3% ASR on SpatialVLA, 95.4% on OpenVLA, and 59.8% on π0 make FreezeVLA + GPT the strongest overall configuration across the evaluated models.The method combines min-max optimization with GPT-generated prompts and achieves the highest action-freezing ASRs across almost all settings.Source: §4.2 · p. 7

4.3 ABLATION STUDIES

• Using 20 reference prompts increases average ASR from 20.0% to 65.1% for FreezeVLA and from 22.0% to 73.3% for FreezeVLA + GPT.Gains are largest through roughly ten prompts, after which performance gradually levels off.Source: Figure 3 · p. 7, §4.3 · p. 8
• At ϵ = 1/255, both attack variants achieve nearly 0% ASR, whereas at ϵ = 8/255 and 16/255 they exceed 95% on average.The performance gap between variants narrows at these larger budgets as both approach saturation.Source: §4.3 · p. 8, Figure 4 · p. 8
• Increasing image steps improves ASR most substantially through 200 steps, while prompt-step gains diminish beyond approximately 15–20 steps.The adopted main-experiment setting is 100 image steps and 10 prompt steps; optimal settings vary by task.Source: §4.3 · pp. 8–9, Figure 5 · p. 9
• Table 3 shows progressively more diverse prompts as inner synonym substitutions and outer image updates proceed in FreezeVLA and FreezeVLA + GPT.GPT-generated prompts exhibit especially broad semantic variation, while the image updates optimize attack effectiveness against these prompts.Source: Table 3 · p. 8, §4.3 · p. 9

5 LIMITATION

• FreezeVLA assumes access to model parameters and has only been evaluated in simulation benchmarks, so black-box and real-world performance remain untested.The authors identify gradient-free attacks and dynamic real-world environments as directions for future work.Source: §5 · p. 9

6 CONCLUSION

• FreezeVLA combines adversarial text-prompt maximization with image minimization in a min-max optimization framework.The framework is designed to craft highly transferable adversarial examples.Source: §6 · p. 10
• Across three VLA models and four robotic benchmarks, FreezeVLA consistently outperforms existing baselines and induces persistent paralysis across diverse instructions.These findings motivate addressing action-freezing vulnerabilities and developing robust defenses for VLA systems.Source: §6 · pp. 9–10

ETHICS STATEMENT

• The study does not endorse real-world deployment and frames its purpose as motivating safeguards against a previously overlooked VLA vulnerability.Its stated objective is awareness and development of evaluation protocols.Source: ETHICS STATEMENT · p. 10

• Detailed dataset, model, and experimental-setup descriptions appear in Section 4.1 and Appendix B.Source: REPRODUCIBILITY STATEMENT · p. 10
• System prompts and the FreezeVLA generation reference prompt are provided in Appendices A and C, respectively.Source: REPRODUCIBILITY STATEMENT · p. 10
• Part of the FreezeVLA reproduction code is included in the supplementary material, with the remaining code planned upon acceptance.Source: REPRODUCIBILITY STATEMENT · p. 10

• o3 generates reference action prompts for VLA tasks using concise, goal-oriented descriptions.Source: A REFERENCE PROMPT GENERATION · p. 14
• A fixed question-style template ensures consistent downstream parsing while the {prompt} placeholder allows varied descriptions.Source: A REFERENCE PROMPT GENERATION · p. 14
• Whitespace and Unicode normalization plus case-insensitive deduplication are applied before action grounding, planning evaluation, and dataset construction.Source: A REFERENCE PROMPT GENERATION · p. 14
• Figure 6 presents examples of LLM-generated reference action prompts for VLA images.Source: Figure 6 · p. 14

• The experiments use three VLA models: OpenVLA, SpatialVLA, and π0.Source: B VLA MODELS · p. 14
• The models differ in action chunking, action tokenizer, and prompt templates designed for them.Source: B VLA MODELS · p. 14
• Table 4 provides an architectural comparison of the VLA models.Source: Table 4 · p. 14, B VLA MODELS · p. 14

Coffee preparation

• Coffee-task prompts cover filling, assembling, operating, monitoring, serving, cleaning, and storing coffee makers and moka pots.Examples include filling a coffee maker, placing a moka pot on a burner, detecting steam, and storing the coffee pot.Source: C PROMPTS FOR DIFFERENT TASKS · pp. 14–15

Cooking tasks

• Cooking-task prompts include moving, heating, adjusting, cleaning, cooling, and storing a frying pan and burner.They include placing or removing pans, adjusting burner heat, measuring coil temperature, and transferring a hot pan to a cooling rack.Source: C PROMPTS FOR DIFFERENT TASKS · p. 15

Microwave and mug tasks

• Microwave-and-mug prompts span loading, heating, retrieving, pouring, checking temperature, washing, drying, and relocating a mug.The set also includes operating microwave controls and handling the mug before and after heating.Source: C PROMPTS FOR DIFFERENT TASKS · pp. 15–16

Table and espresso tasks

• Table-organization and espresso prompts cover arranging, sorting, inspecting, presenting, and clearing table objects, plus portafilter, grinder, and tamping actions.Examples include arranging mugs, sorting objects by color, aligning a portafilter under a grinder chute, and tamping ground coffee.Source: C PROMPTS FOR DIFFERENT TASKS · p. 16

Espresso tasks

• Espresso prompts cover locking the portafilter, placing a cup, starting and monitoring extraction, stopping at target volume, and cleaning afterward.They also include discarding the coffee puck and rinsing the portafilter basket.Source: C PROMPTS FOR DIFFERENT TASKS · p. 16

Household and tabletop tasks

• Household and tabletop prompts span object pickup and placement, drawer and cabinet interaction, arrangement, inspection, cleaning, counting, and robot positioning.Examples include handling bottles, blocks, cartons, baskets, cans, and food containers under spatial or organizational constraints.Source: C PROMPTS FOR DIFFERENT TASKS · pp. 16–18

LIBERO-10

• LIBERO-10 prompts combine multi-object placement, appliance operation, container manipulation, and compound sequences involving drawers, baskets, plates, and stoves.The prompts include both single and paired-object actions, such as placing items in baskets or operating a stove with a moka pot.Source: C PROMPTS FOR DIFFERENT TASKS · p. 18

LIBERO benchmark tasks

• LIBERO-Goal, LIBERO-Object, and LIBERO-Spatial prompts test goal-directed placement, object-specific transfer, and location-conditioned retrieval of black bowls.The spatial prompts vary the bowl’s initial relation to plates, ramekins, drawers, cabinets, stoves, and other objects.Source: C PROMPTS FOR DIFFERENT TASKS · pp. 18–19

• LLMs were restricted to grammar, style, and wording suggestions on author-written text.Source: D THE USE OF LARGE LANGUAGE MODELS · p. 19
• Authors authored and verified the paper’s technical content, including ideas, methods, claims, equations, and figures.Source: D THE USE OF LARGE LANGUAGE MODELS · p. 19
• All LLM suggestions were manually reviewed and revised before inclusion.Source: D THE USE OF LARGE LANGUAGE MODELS · p. 19