Source-linked AI summary
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Yudong Gao, Linghan Chen, Wenhan Wu, Mia Zhou, Jiyao Wang, Kaiyan Ji, Mingyu Guo, Honglong Chen
TL;DR
Deployed VLA weights can be corrupted by Rowhammer-style faults, but the required attack budget and containment strategies were unknown. This paper develops gradient-ranked INT8 bit-flip attacks through action decoders and finds that 1–5 selected flips can collapse direct and token policies, while evaluated flow heads require ~100–300.
Problem
The paper asks how few deployed-weight flips can cause VLA failure and how such faults can be contained despite decoder-mediated closed-loop behavior.
Method
The authors optimize a fixed-direction manifold-escape loss through each action decoder, then rank INT8 bits by quantization-aware directional gain and selectively protect vulnerable layers.
Results
1–5 selected flips collapse direct and token policies, whereas evaluated flow heads require ~100–300; task-calibrated K=100 perturbations produce 0/20 real-robot successes versus 14/20 clean.
Takeaways & Limitations
Weight integrity is a VLA security boundary, with architecture-aware evaluation and localized integrity checks offering supported directions for deployment protection.
Takeaways & Limitations
The evaluation models logical INT8 corruption rather than end-to-end physical fault delivery, whose reachability depends on device, placement, and fault profile.
Abstract
from arXiv · showhide
Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0\%$, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in $1$--$5$ flips, whereas the evaluated flow-matching policies require ${\sim}100$--$300$. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from ${\sim}1000$ to ${\sim}100$ flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting $3.1\%$ of weights preserves $60\%$ success at $K{=}100$, and protecting $5.3\%$ moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated $K{=}100$ flips yield $0/20$ real-robot successes, versus $14/20$ clean and $16/20$ global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.
1 Introduction
The paper introduces the first bit-flip attack on a VLA, showing that a few selected INT8 faults can collapse closed-loop robot performance while hundreds of random flips remain harmless. Vulnerability varies by action-decoding architecture, and concentrated damaging layers enable targeted defenses.
- Attack objective: 10× lower empirical collapse budgets result from the fixed-direction objective for π0; across ten rerankings, it is higher in 7 and tied in 3 against energy.The comparison reports one-sided Wilcoxon p=.0078 and motivates a common actionspace orientation across calibration traces.
- Attack results: 3 selected flips collapse simulated closed-loop success from 88% to 0% on LIBERO-Spatial (n=50), while 300 random flips are harmless.Across four suites, 1–5 selected flips suffice; evaluated flow heads require ∼100–300 flips.
- Real-robot validation: 0/20 real-robot successes occur under task-calibrated emulated K=100 perturbations, versus 14/20 clean and 16/20 global-random.This result demonstrates that calibrated weight faults transfer from simulation to a real 6-DoF arm.
- Defense: 3.1% protected weights preserve closed-loop success through K=100, while protecting 5.3% moves the open-loop threshold from 3 to 100 flips.Damaging bits concentrate in a few action-generating layers, enabling architecture-aware protection.
- Contributions: 1–5 selected INT8 flips collapse simulated task success to 0%, establishing the first reported weight-fault attack on a VLA and continuous closed-loop action policy.The contribution emphasizes closed-loop consequences beyond prior attacks on categorical outputs.
2 Related Work
Prior VLA security work targets inputs, training pipelines, supply chains, or implanted triggers, while bit-flip research demonstrates sparse, gradient-ranked INT8 vulnerabilities and motivates selective protection. Related studies also identify vulnerable visual encoders and localized sensitivity in vision transformers.
- Security of VLAs and generative robot policies: VLA attacks span input perturbations, training- or supply-chain backdoors, action-level backdoors, and implanted triggers in diffusion or flow policies.AttackVLA and ANNIE study input-side attacks; BadVLA, TrojanRobot, DropVLA, DP-Attacker, and TrojFlow cover the other threat surfaces described.
- Bit flips and quantized deployment: ∼11–17 gradient-ranked INT8 bit flips can collapse classifiers, whereas hundreds of random flips have little effect.BFA/PBS established this contrast, and targeted variants later installed chosen behavior.
- Bit flips and quantized deployment: Recent work extends bit-flip searches to LLMs, motivates selective protection through sparse sign-bit lesions, and reports block-localized sensitivity in vision transformers.DeepHammer further connects these concerns to DDR3/4 fault mechanisms, as indicated in the cited passage.
3 Preliminaries
This section defines VLA policies and three action-decoding heads, then formalizes per-channel symmetric INT8 faults as bounded perturbations to stored weight integers. Flow-matching actions arise through solver updates, whereas direct regression and token policies use distinct readout mechanisms.
- Quantized VLA policies: VLA policies map images and instructions to H-step, d-dimensional action chunks through an action-generating transformer.The policy is written as πθ: O → A with weights θ = {W^(ℓ)}ℓ.
- Quantized VLA policies: Three decoders are evaluated: direct regression, 256-bin discrete tokens, and flow matching.The direct head applies a linear readout; the token head decodes the highest-scoring bin; flow matching transforms Gaussian noise into actions.
- Quantized VLA policies: Flow-matching actions depend on a sequence of solver updates rather than a single readout.This distinguishes their action propagation from the direct and discrete-token heads.
- INT8 logical faults: INT8 faults toggle stored 8-bit weight integers while leaving per-channel scales and activations intact, inducing dequantized weight perturbations.Non-sign and sign flips change integers by at most 64 and 128, respectively; no flip directly produces ∞/NaN.
4 Threat Model
The threat model targets an edge-served INT8 VLA with persistent weight faults selected using architecture, weight, scale, decoder, and calibration-set access, while excluding control over training, inputs, activations, scales, and environment. It evaluates adaptive logical corruption and distinguishes attack effectiveness from physical fault deliverability.
- Deployment and attacker: The attacker can induce at most K persistent linear-weight flips, one per selected scalar, using a disjoint calibration set Dcal and known deployment information.The attacker does not control training, inputs, activations, scales, or the environment.
- Goal and defender: The primary objective is to collapse closed-loop success with few flips, while targeted diagnostics drive a chosen action.Selective protection removes defended weights from the candidate set and adaptively rebuilds the attack over the remainder.
- Physical-delivery boundary: The evaluation measures logical INT8 corruption rather than end-to-end physical delivery because coordinate reachability depends on device, placement, and fault profile.The ∼100–300 flow-head regime is explicitly not a deliverability claim.
- Physical-delivery boundary: Prior demonstrations reach fault counts comparable to the 1–5 direct-head regime, but this comparison does not establish physical reachability for the evaluated attacks.The paper cites DeepHammer, GPUHammer, and GDDRHammer as prior physical-delivery demonstrations.
5 Method
The method attacks executed actions rather than parameter-field fit, combining a decoder-aware fixed-direction loss with unrestricted quantization-aware bit ranking. This two-step design identifies high-leverage action-generating weights without pre-specifying their locations.
- Two-step attack design: The attack first differentiates the final executed action through each decoder, then ranks and flips quantized bits most efficiently.The procedure uses a decoder-aware loss for action displacement and a separate location-search step.
- Executed-action objective: Flow policies backpropagate through all solver steps, while attack gradients average over M = 2–3 fixed noise draws; deterministic heads use M = 1.Discrete-token policies use a differentiable expected decoded value during attack-time optimization, while evaluation retains hard decoding.
- Fixed-direction objective: The fixed-direction manifold-escape objective detaches the clean action and optimizes one-sided displacement, avoiding zero initialization gradients and saturation observed with alternative losses.The primary direction is u = 1; the method also tests −1 and three Gaussian directions.
- Quantization-aware ranking: For each scalar weight, the method selects the bit with maximum directional gain and flips the K largest positive per-weight gains.The gain combines directional action sensitivity with the quantization-dependent flip magnitude.
- Search and localization: O(8Nw) = O(Nw) scoring cost requires one backward pass and evaluates eight bits per eligible weight, while unrestricted ranking concentrates flips in a few action-generating layers.All action-generating linears remain eligible, so localization emerges from the ranking rather than a prior restriction.
6 Experiments
Experiments show that gradient-selected INT8 bit flips, unlike random or magnitude-targeted flips, can collapse VLA behavior with architecture-dependent budgets. Vulnerabilities localize to action-generating layers, while targeted protection and real-robot tests demonstrate both practical impact and mitigation.
- Attack effectiveness: 300 random and 100 magnitude-targeted INT8 flips keep action deviation within approximately 0.004 of clean, whereas gradient-ranked flips reach deviation 0.828 at K=3.The contrast shows that loss-aligned search, rather than flip count alone, drives the attack.
- Attack effectiveness: 3 gradient-selected flips reduce discrete OpenVLA’s LIBERO-Spatial success to 0/50, while 300 random flips retain 80% versus 88% clean success.The selected flips produce deviation 0.105, with errors compounding over the approximately 200-step horizon.
- Real-robot validation: K=100 task-calibrated flips yield 0/20 real-robot successes versus 14/20 clean and 16/20 global-random successes.Two-sided Fisher tests give p < 10^-5 against either control, while clean and random do not differ (p = .716).
- Defenses and limitations: Protecting 3.1% of direct-head weights preserves 60% success at K=100, while localized protection does not transfer to π0, where protecting 14% of its expert fails.After L1 exclusion, 18/30 trials still succeed at K=100 as rankings redistribute to later layers.
- Localization: Highest-gain bits occupy sparse, architecture-dependent action-generating layers: discrete OpenVLA concentrates in LLM L1, whereas π0 concentrates in its action expert, especially expert-L17.Localization identifies where attacks enter; decoder architecture and directional consistency shape how faults propagate into closed-loop failure.
7 Conclusion
Selected INT8 bit flips expose an architecture-dependent VLA vulnerability: direct heads fail after 1–5 flips, while evaluated flow heads require ∼100–300. Fixed-direction manifold escape, physical-robot validation, and selective integrity checks support decoder-aware protection before deployment.
- Conclusion: 1–5 flips collapse direct-head VLAs, versus ∼100–300 for evaluated flow heads.The conclusion identifies this contrast as evidence that action-decoding architecture shapes vulnerability.
- Conclusion: A fixed-direction manifold-escape attack cuts π0’s budget tenfold and works across five directions.The method also guides protection through K=100.
- Conclusion: Physical-robot trials validate task-calibrated failure, motivating decoder-aware fault evaluation and localized integrity checks before deployment.The conclusion frames weight integrity as a VLA security boundary and selective protection as a practical starting point for direct heads.
A Additional Statistical and Reproducibility Details · A.1 Code and environment
The ancillary release provides reusable INT8 attack and analysis utilities plus a real-robot patch-and-restore tool, while omitting checkpoints, benchmark assets, selected patches, videos, and outputs. The π0 experiments used one NVIDIA A800 with a specified Ubuntu, Python, PyTorch, and Transformers environment.
- A.1 Code and environment: The ancillary code includes INT8 quantization and bit-ranking utilities, implementations for four experiment families, fixed-direction analysis, and real-robot patch-and-restore support.The implementations cover direct, discrete-token, π0, and π0.5 experiments.
- A.1 Code and environment: The release excludes checkpoints, benchmark assets, calibration observations, selected patch lists, robot videos, and experiment outputs.
- A.1 Code and environment: The π0 jobs ran on one NVIDIA A800 under Ubuntu 22.04.3, Python 3.12.12, PyTorch 2.5.0, and Transformers 4.53.3.
A.2 Real-robot aggregate results
The section aggregates physical-robot blue-bowl results and reports exact statistical comparisons among directed, clean, and global-random conditions. The comparisons distinguish directed from both controls, but not clean from global-random, and do not establish task transfer.
- Table 9 aggregates physical-robot trials on the blue-bowl task, with two-sided Clopper–Pearson confidence intervals.
- p = 3.34×10−6 for directed versus clean and p = 1.54×10−7 for directed versus global-random.
- p = 0.716 for clean versus global-random, indicating the conditions are not distinguishable in this comparison.
- These comparisons do not establish task transfer, and the random control is not layer/bit matched.
A.3 Fixed-path consistency diagnostic · A.4 Attack-port comparison
The fixed-path diagnostic finds perfect coherence for fixed-direction rankings across ten seeds, while energy rankings are less coherent and localize to varying action-expert layers. The attack-port comparison frames direct-head attacks as gradient-ranked bit search and flow-head comparisons around zero- versus nonzero-gradient objectives.
- A.3 Fixed-path consistency diagnostic: 1.000 coherence held across all ten seeds for fixed-direction rankings, compared with 0.969 average coherence for energy rankings.Each seed reranked both objectives and averaged the same 51 within-seed traces.
- A.3 Fixed-path consistency diagnostic: A 51-trace expanded ranking comparison found coherence of 1.000 versus 0.998, without resolving a difference at p = .159.The comparison used 17 held-out frames and three shared noise draws.
- A.3 Fixed-path consistency diagnostic: Manifold-escape flips usually concentrate in Expert-L17, but layer identity varies across ranking seeds.The passage relates this pattern to a five-seed localization study.
- A.3 Fixed-path consistency diagnostic: Energy rankings often favor Expert-L12 and sometimes Expert-L0, supporting concentration in a small action-expert subset rather than one invariant layer.The supported claim is subset-level concentration, not exact-layer invariance.
- A.4 Attack-port comparison: The direct-head comparison reduces to gradient-ranked bit search.This identifies the direct-head attack procedure used in the attack-port comparison.
- A.4 Attack-port comparison: The flow-head comparison separates zero-gradient and nonzero-gradient objectives.The passage presents this as the relevant comparison for flow heads.
- A.4 Attack-port comparison: Table 10 reports head-specific empirical collapse budgets.The supplied table passage provides the table title but no individual budget values.
B Exploratory Flow-Attenuation Analysis … C Conditional First-Order Contraction Bound
The diagnostics show endpoint shrinkage and solver-depth robustness of manifold-escape attacks, but they do not causally identify contraction or predict closed-loop bit budgets. A conditional contraction proposition supplies an open-loop first-order lower bound, while emphasizing that experimental budgets must be measured.
- B Exploratory Flow-Attenuation Analysis: The endpoint and solver-depth diagnostics do not isolate decoder dynamics causally or predict closed-loop bit budgets.The solver-depth intervention changes discretization rather than the learned vector field, and the deviation result is open-loop.
- B.1 Endpoint sensitivity to initial-noise perturbations: 0.16–0.38 for π0 and 0.04–0.22 for π0.5 are the measured endpoint ratios over ϵ ∈ {0.1, 0.3, 1.0}.The ratios use n=24 random unit-direction perturbations and show endpoint shrinkage without identifying the symmetric part of Jx.
- B.1 Endpoint sensitivity to initial-noise perturbations: π0.5 has larger first-order per-flip open-loop damage despite its higher closed-loop attack budget.The descriptive endpoint quantity κend = −ln ρend does not predict budget ordering.
- B.2 Solver-depth diagnostic: 2× lower isotropic open-loop deviation occurs as denoising depth increases from N ≤5 to N=20, falling from 0.057 to 0.025.Manifold escape collapses success at every tested solver depth, establishing objective efficacy without identifying cancellation or contractivity.
- C Conditional First-Order Contraction Bound: The conditional analysis assumes Jx + Jx^T ⪯ −2µI along the sampling trajectory and derives a first-order action-variation bound.This sufficient condition is not verified by the endpoint diagnostic and is not used to estimate experimental budgets.
- C Conditional First-Order Contraction Bound: K ≥ D/[LmaxbC(µ)] is the stated lower bound for reaching first-order open-loop deviation D with K INT8 flips.Here b bounds each flip’s weight change, Lmax is the maximum block sensitivity, and C(µ) captures contraction attenuation.
- C Conditional First-Order Contraction Bound: C(µ) →1 as µ →0 recovers the unattenuated first-order case, but the result is an open-loop upper bound rather than an equality or closed-loop certificate.Direct heads lie outside the premise, while task tolerance, bit values, nonlinear interactions, and feedback can dominate measured budgets.
- C Conditional First-Order Contraction Bound: ∥Sℓ(1)δθℓ∥≤LℓC(µ)∥δθℓ∥ bounds each block’s terminal sensitivity under the contraction hypothesis.The proof uses the state-sensitivity dynamics, the transition bound ∥Φ(1, s)∥≤ e−µ(1−s), and summation over parameter blocks.