Source-linked AI summary
CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models
Hui Lu, Zhijie Peng, Yuqi Lin, Zaijia Yang, Jiaming He, Shuhan Ye, Yi Yu, Hanwei Zhu, Bingquan Shen, Alex Kot, Xudong Jiang
TL;DR
VLA policies face a gap in certifying continuous actions under bounded physical perturbations across closed-loop execution. CertVLA combines calibrated action consistency with covering masks and episode-level decisions, demonstrating empirical and certifiable robustness across VLA models and physical attacks.
Problem
Existing certified defenses target discrete labels, leaving certification of continuous VLA actions and their closed-loop task execution unresolved.
Method
CertVLA uses position-normalized action consistency, covering masks, and episode-level calibration to certify query actions and complete rollouts.
Results
Experiments demonstrate empirical defense effectiveness and certifiable robustness across VLA models and physical attacks.
Takeaways & Limitations
Certified rollouts execute actions consistent with attack-erased predictions and imply task success when dual-mask rollout correctness holds.
Takeaways & Limitations
Certification requires the attack’s projected support in each defended view to fit a known bounded region no larger than P × P pixels.
Abstract
from arXiv · showhide
Vision-Language-Action (VLA) policies are vulnerable to localized physical perturbations, yet existing certified patch defenses target discrete labels and cannot directly certify continuous, temporally correlated actions. We introduce CertVLA, a certified defense for closed-loop VLA control under bounded patch and texture attacks. CertVLA proposes a calibrated region of behaviorally consistent actions, while deterministic covering masks ensure that at least one checked prediction is attack-free. Specifically, CertVLA normalizes action disagreement by the benign variation of each mask pair and accepts a single-mask anchor only when it remains consistent under every second mask. It then calibrates the resulting max-min-max episode score to provide finite-sample clean coverage. Conjoining query-level decisions extends the action certificate to the complete closed-loop rollout. Furthermore, we prove that against any adaptive attacker satisfying the bounded-support threat model, every rollout certified by CertVLA executes only action chunks consistent with attack-erased clean predictions. Under dual-mask rollout correctness, this consistency certificate further guarantees task success. The certificate is independent of patch content, generation method, and physical transformation. Experiments in simulation and the real world demonstrate the empirical and certified effectiveness of CertVLA against patch attacks, with additional simulation validation on texture attacks.
Introduction
CertVLA addresses the challenge of certifying continuous VLA actions and closed-loop task execution against unknown bounded physical perturbations. It combines covering masks, calibrated action consistency, and rollout-level guarantees against adaptive patch and texture attacks.
- Motivation: VLA models directly connect visual perception and language instructions to robot control, creating an attack surface where localized patches or adversarial textures can corrupt behavior across viewpoints.The introduction identifies persistent physical perturbations as a safety concern for embodied control.
- Motivation: Existing certified patch defenses target discrete predictions, whereas VLAs require certification for continuous action chunks and closed-loop execution.The paper frames continuous control and the extension from individual queries to task execution as fundamental challenges.
- CertVLA method: CertVLA uses an R-covering mask family to ensure that at least one evaluated mask completely erases any admissible corrupted region.This provides the attack-erasure basis for certifying predictions under bounded patch and texture attacks.
- CertVLA method: CertVLA normalizes dual-mask action disagreement by position-specific clean variation and calibrates a shared tolerance using held-out clean episodes.Its max-min-max score represents the ∀-query–∃-anchor–∀-second-mask decision, with early stopping during recovery.
- Guarantees: CertVLA certifies action chunks as belonging to a calibrated clean-consistency region of an attack-erased prediction under bounded-support adaptive attacks.The guarantee permits arbitrary patch content and adaptive generation when the attack support fits inside a fixed-size square region.
- Guarantees: Conjoining query-level certification flags extends consistency guarantees from individual policy queries to the complete executed rollout.The paper further identifies an additional condition under which this observable consistency certificate guarantees task success.
Related Work
Related work spans the development of VLA policies, attacks targeting VLA control, empirical perturbation defenses, and certified defenses against patch attacks. These efforts establish the model, threat, and certification landscape motivating CertVLA.
- VLA models: VLA policies map vision and language directly to robot actions, with scaling established by RT-1, PaLM-E, and RT-2.RoboFlamingo adapts open VLMs through imitation learning, while Open X-Embodiment and Octo use heterogeneous cross-robot data.
- Attacks and empirical defenses: RoboticAttack demonstrates untargeted, trajectory-targeted, and physical attacks on VLA control, while UPA-RFAS transfers patches across architectures, tasks, viewpoints, and sim-to-real settings.Tex3D turns 3D object textures into persistent attack surfaces.
- Certified defenses against patch attacks: Certified patch defenses use interval bounds, deterministic ablation, restricted receptive fields, masking, or occlusion consistency.ScaleCert improves high-resolution certification, PatchCURE exposes robustness–utility–efficiency trade-offs, and CertMask reduces redundant mask evaluations.
Preliminaries
CertVLA models a VLA policy that maps multimodal observations and language instructions to finite-horizon action chunks, executing only an initial prefix before each new query. Its threat model allows arbitrary pixel replacement within a bounded connected region, while deterministic covering masks ensure at least one mask removes any admissible support regardless of attack content.
- Policy and action representation: At each query, the VLA policy maps external-camera, wrist-camera, proprioceptive, and language inputs to an H-step action chunk in R^H×D.The controller executes only the first h ≤ H actions before the next policy query.
- Threat model: The adversary may arbitrarily replace pixels in one connected region whose footprint belongs to R(P), including every axis-aligned region no larger than P × P pixels.Certification assumes only that the projected support in each defended view lies within R(P), with no restrictions on content, generation method, location, or physical transformation.
- Deterministic covering masks: Because the patch location is unknown, CertVLA enumerates K deterministic masks that overwrite fixed regions with benign values.An R-covering family guarantees that every admissible bounded patch is completely removed by at least one candidate mask.
- Prediction notation: The notation distinguishes clean and attacked unmasked, single-mask, and anchored dual-mask predictions, with the single-mask prediction serving as the candidate recovery anchor.For attacked inputs, superscript Ω marks deployment observations and the anchored dual-mask prediction is A^Ω_i,j = π(Mj(Mi(x^Ω)), ℓ).
Methodology
CertVLA combines position-aware action-consistency scoring with episode-level conformal calibration and deterministic covering masks. It certifies closed-loop rollouts when every query passes, linking recovered actions to attack-erased clean predictions.
- Deployment and attack erasure: At deployment, each first-mask prediction is checked against every second mask, and R-covering guarantees that at least one check erases the unknown patch.DualMaskRecover can discard rows early because their running scores are nondecreasing, returning a certified anchor only when a row survives all checks.
- Position-aware consistency: CertVLA normalizes directional action deviation by the benign variation of each ordered mask pair, making location-dependent mask comparisons comparable.The denominator uses action-coordinate ranges and ϵ > 0 for numerical stability; the deviation is evaluated at the single-mask anchor.
- Episode calibration: It calibrates a joint episode score as max_q min_i max_j z_e,q,i,j, requiring every query to have an anchor consistent with every second mask.Disjoint scale and row splits preserve exchangeability for conformal calibration, while the max-min-max structure implements ∀q, ∃i, and ∀j.
- Episode calibration: The episode threshold τ is calibrated from clean row-calibration episodes to provide finite-sample marginal coverage under exchangeability.The clean-episode miscoverage rate α controls rejection probability; smaller α produces a larger τ and a looser consistency certificate.
- Deployment and attack erasure: If the recovery algorithm certifies an attacked input, its returned action equals an attack-erased clean dual-masked prediction, independently of patch content and transformation.The theorem requires the attack support to satisfy the certified size bound and belong to the covered region family.
- Closed-loop certification: Conjoining query-level decisions yields a closed-loop certificate: every executed action chunk corresponds to an attack-erased clean prediction, even when patch location changes between queries.The guarantee assumes every query’s support belongs to R(P) and the mask set is R-covering.
Experiments
Experiments evaluate CertVLA on four VLA policies across simulated LIBERO suites and physical robot patch attacks. Results report both empirical defended success and stricter end-to-end certified success, alongside design-parameter and calibration trade-offs.
- Experimental setup: Experiments cover LIBERO’s Spatial, Object, Goal, and Long suites with 10 tasks each, evaluating OpenVLA, OpenVLA-OFT, π0, and π0.5.The paper also evaluates physical patch attacks on a dual-arm Piper robot using synchronized third-person and wrist RGB cameras.
- Covering, utility, and calibration trade-offs: Setting β = 0.95 mitigates extreme values while avoiding an overly large τ and loose certificate; reducing α raises acceptance but loosens the consistency region.Neither calibration parameter replaces deterministic R-covering for patch erasure.
- Simulation results: 94% average Defense and Certified success is achieved by OpenVLA-OFT under simulated patch and texture attacks, while OpenVLA† reaches 94% Defense and 82.5% Certified success.The Defense-Certified gap for generative policies indicates successful rollouts containing a query outside the calibrated region.
- Physical robot results: 60% CertVLA Defense success recovers 40% of the attack-induced loss for π0.5 on the real robot, whose patch-attacked success rises from 40% to 60%.The 30% Certified success rate means half of successfully defended trials pass the consistency test at every query.
- Covering, utility, and calibration trade-offs: Across valid R-covering configurations satisfying P ≤ M − s + 1, π0 maintains consistently high Defense, while OpenVLA-OFT degrades more strongly under increased occlusion.π0 remains more stable, indicating greater tolerance to increased occlusion under the same covering density.
Conclusion
CertVLA certifies continuous closed-loop VLA control by combining position-normalized action consistency with episode-level calibration. Its guarantees relate certified actions to attack-erased predictions under bounded-support attacks, and dual-mask rollout correctness further guarantees task success.
- Conclusion: CertVLA combines position-normalized action consistency and episode-level calibration to defend continuous closed-loop VLA control.The defense operates at both query and episode levels.
- Conclusion: Query- and rollout-level guarantees relate certified actions to attack-erased predictions under bounded-support attacks.The guarantees apply to certified rollouts within the stated threat model.
- Conclusion: Dual-mask rollout correctness further guarantees task success.This guarantee follows when the specified dual-mask correctness condition holds.
- Conclusion: Experiments demonstrate empirical defense effectiveness and certifiable robustness across VLA models and perturbations.The passage states that experiments support both empirical effectiveness and certifiable robustness.