PaperlayerView exact revision on arXiv

Source-linked AI summary

Are Vision-Language-Action Models Robust to One-Step Observation Perturbations?

Shojiro Yamabe, Jun Sakuma

arXiv:2609.32550v1cs.AIcs.LGcs.RO

TL;DR

VLA safety research has mainly studied persistent observation perturbations, leaving brief corruption at a single step less understood. This paper evaluates one-step perturbations and introduces CARE, which adapts action execution length using prediction consistency; the perturbations degrade performance, and CARE improves robustness while largely preserving clean performance.

  • Problem

    Robustness to momentary observation corruption at a single step remains less studied than robustness to persistent perturbations, despite the physical risks of inappropriate VLA actions.

    Source: §1 · p. 1

  • Method

    The paper evaluates eight one-step perturbation types across five VLA models and proposes CARE, which selects execution length based on consistency between consecutive action predictions.

    Source: §1 · p. 2

  • Results

    Every evaluated model has a greater-than-50-percentage-point drop from clean success under at least one perturbation in the lowest-10%-of-steps score, while CARE improves robustness with low computational overhead and largely preserves clean performance for most models.

    Source: §1 · pp. 1–2

  • Takeaways & Limitations

    Shortening execution when predictions differ can limit the effects of a one-step perturbation without additional model calls or training.

    Source: §1 · p. 2

    The study focuses on naturally occurring corruptions; short-lived backdoor triggers and adversarial attacks at critical moments remain future directions.

    Source: §7 · pp. 9–10

Abstract

from arXiv · show

Understanding the safety risks of vision-language-action (VLA) models is essential for their deployment in the physical world. Existing safety research has mainly considered persistent perturbations that are applied continuously to observations throughout an episode. However, momentary observation corruption, in which observations are severely perturbed only briefly within an episode, remains an underexplored safety threat. To address this gap, this work investigates robustness to one-step perturbations applied at a single time step per episode. Our experiments reveal that these perturbations substantially degrade VLA performance and that their impact depends on the action chunk execution length. Based on them, we propose CARE, which dynamically selects the execution length based on consistency with the previously predicted action chunk. CARE improves robustness with low computational overhead while preserving clean performance by selecting shorter execution lengths only under perturbations.

1 INTRODUCTION

The paper studies one-step observation corruption, a safety concern that can disrupt physical VLA actions but has received limited attention relative to persistent perturbations. It finds severe, execution-length-dependent degradation and proposes CARE to adapt execution length using prediction consistency.

1 INTRODUCTION

  • Eight one-step perturbation types are evaluated across five VLA models, with each rollout receiving one corrupted observation at a candidate inference step.The evaluations address brief corruption such as temporary overexposure or abnormal sensor values, unlike persistent episode-long perturbations.Source: §1 · p. 1
  • Across 40 LIBERO tasks, every evaluated model loses more than 50 percentage points from clean success under at least one perturbation in its lowest-10%-of-steps score.The corrupted score averages success rates across the 10% most vulnerable intervention steps.Source: §1 · p. 1, Figure 1 · p. 2
  • Shorter execution lengths reduce vulnerability to an incorrect action chunk, while more frequent inference may reduce action consistency and task performance.A robot continues executing the predicted chunk until its next prediction.Source: §1 · p. 2
  • CARE shortens execution when consecutive action predictions differ substantially, improving perturbation robustness without additional model calls or training.The paper reports low computational overhead and largely preserved clean performance for most evaluated models.Source: §1 · p. 2
  • The paper presents CARE as training-free and broadly applicable to chunk-predicting VLAs, with effectiveness demonstrated across multiple models and benchmarks.Its study also identifies longer action-chunk execution as a factor that amplifies one-step perturbation effects.Source: §1 · p. 2

2 RELATED WORK

Prior VLA robustness work primarily evaluates persistent input perturbations, while adaptive execution-length methods have not addressed observation perturbations. This work applies temporal prediction consistency to adaptive execution-length selection for robustness.

2 RELATED WORK

  • Prior input-perturbation studies examine image or state inputs and report task-success drops, but mainly assume perturbations persist throughout an episode.The present work instead evaluates a perturbation at only one step.Source: §2 · pp. 2–3
  • Existing adaptive execution-length methods address action chunking but do not consider observation perturbations.Action chunking predicts multiple future actions per inference and executes a fixed number of them.Source: §2 · p. 3
  • CARE uses temporal consistency between action predictions for adaptive execution-length selection, a use not addressed by the cited prior consistency methods.Those prior methods applied temporal consistency for other purposes.Source: §2 · p. 3

3 PRELIMINARIES

A VLA policy receives visual, robot-state, and language inputs and predicts a chunk of future actions. The robot executes only part of that chunk before the next policy inference.

3 PRELIMINARIES

  • At each step, the policy takes RGB images, robot state such as end-effector pose and gripper state, and a language instruction as inputs.Source: §3 · p. 3
  • The policy outputs an action chunk containing K future actions.Source: §3 · p. 3
  • The robot executes H actions, where H ≤ K, before the next inference; H is the execution length.The next chunk is generated from the subsequent image and robot state.Source: §3 · p. 3

4 ROBUSTNESS EVALUATION TO ONE-STEP PERTURBATIONS

The section evaluates single-step observation corruption across VLA models and finds that vulnerability depends on both intervention timing and action execution length. Longer execution lengths generally amplify the perturbation effect.

4.1 EXPERIMENTAL SETUP

  • The evaluation tests eight image, state, or combined-input perturbations at one inference step across five VLA models and four LIBERO task suites.Each intervention time is tested in a separate rollout; Bottom10%-SR averages the lowest 10% of success rates across evaluated intervention steps.Source: §4.1 · pp. 3–4, Figure 2 · p. 4

4.2 EXISTING VLA MODELS ARE VULNERABLE TO ONE-STEP PERTURBATIONS

  • Success rates vary substantially with perturbation timing; earlier perturbations tend to cause larger reductions, though the most vulnerable steps differ across models and tasks.Figure 3 shows LIBERO-Goal success under data loss, with black boxes marking task-wise minima.Source: Figure 3 · p. 4, §4.2 · p. 4
  • Every evaluated model’s Bottom10%-SR falls more than 50 percentage points below its clean success rate under at least one perturbation.The vulnerabilities differ by model: π0-FAST and SmolVLA are particularly sensitive to image perturbations, while π0 and X-VLA are especially vulnerable to state perturbations.Source: §4.2 · p. 4, Table 1 · p. 5

4.3 EXECUTION LENGTH AMPLIFIES PERTURBATION EFFECTS

  • For most models, the gap between clean success and perturbed Bottom10%-SR widens as execution length H increases; at H = 1, replanning each step limits erroneous-action persistence.π0-FAST is an exception because its clean performance declines at longer execution lengths, leaving less room for further degradation.Source: §4.3 · pp. 4–5, Figure 4 · p. 5

5 METHOD

CARE adapts action execution length to balance robustness, task performance, and computational efficiency. It compares consecutive action predictions to identify instability, using a discounted discrepancy to stabilize execution-length selection under clean observations.

5 METHOD

  • CARE selects short execution lengths under perturbations and long ones for clean observations, balancing robustness, task performance, and computational efficiency.It reuses the unexecuted portion of the previous action chunk, requiring neither extra policy inference nor additional training for execution-length selection.Source: §5 · p. 5, §5.1 · p. 6

5.1 FORMULATION

  • CARE uses the unexecuted portion of the previous action chunk as a reference for the current prediction and limits execution to at most ⌊K/2⌋ actions per chunk.The cap ensures at least H unexecuted actions remain available for comparison at every candidate execution length; it often fits existing VLA deployment settings without extending the model’s native action chunk.Source: §5.1 · pp. 5–6

5.2 DESIGN OF THE DISCREPANCY FUNCTION

  • CARE computes normalized Euclidean discrepancies between corresponding predicted actions, then discounts and accumulates them across steps.Accumulation emphasizes discrepancies persisting across several steps, while discounting reduces the influence of isolated discrepancies and natural surrogate-prediction errors at distant steps.Source: §5.2 · p. 6

6 EXPERIMENTS

The experiments evaluate CARE on LIBERO and a real robot, finding improved robustness to one-step perturbations while largely preserving clean performance for most models. They also examine execution-length selection and computational cost.

6 EXPERIMENTS

  • The experiments cover LIBERO and Meta-World benchmarks and a real robot, with the reported section presenting LIBERO and real-world results.The robot evaluation uses a pick-and-place task with π0.5 fine-tuned on 100 demonstrations and execution length H = 25; perturbations are applied at a randomly selected step in one of four task phases.Source: §6 · p. 6, §6.1 · p. 6, §6.4 · pp. 8–9

6.2 ROBUSTNESS AND CLEAN TASK PERFORMANCE

  • CARE improves LIBERO robustness to one-step perturbations across diverse VLA models, particularly where perturbations substantially degrade Vanilla performance.The evaluation reports clean success rate and Bottom10%-SR across 40 tasks.Source: §6.2 · p. 7, Table 2 · p. 7
  • For all models except π0-FAST, CARE's clean-performance drop versus Vanilla is at most 1.8 points, while it retains higher clean performance than fixed H = 1 on π0-FAST and X-VLA.On π0-FAST, CARE's clean-performance drop is 11.6 points.Source: §6.2 · pp. 7–8

6.3 EXECUTION LENGTH SELECTION AND COMPUTATIONAL COST ANALYSIS

  • CARE keeps execution lengths long for clean observations and shortens them for perturbed observations, with comparable-to-Vanilla computational costs and only a slight increase.The selection pattern is illustrated for π0.5 around a single perturbed step; CARE uses the already generated action chunk rather than additional VLA inference.Source: §6.3 · p. 8, Table 3 · p. 8, Figure 5 · p. 8

6.4 REAL-WORLD ROBOT EXPERIMENTS

  • In real-robot trials, each perturbation type reduced Vanilla success to 33.3% or lower in at least one task phase, while CARE improved robustness but had limited gains against blur.Blur could cause a gripper release within one control step, which even the shortest execution length may not prevent.Source: §6.4 · p. 9, Figure 7 · p. 9, Figure 8 · p. 9

7 CONCLUSION

The conclusion reports that a single corrupted observation can substantially reduce VLA task success and that long execution lengths can prolong the effect. CARE adapts execution length from action-chunk consistency, improving robustness while largely preserving clean performance for most models.

7 CONCLUSION

  • CARE adapts execution length based on consistency between action chunks, improving robustness while largely preserving clean performance for most models.The conclusion also identifies long execution lengths as a way one-step corruption effects can persist into later steps.Source: §7 · p. 9
  • The study focuses on naturally occurring corruptions; temporally localized backdoors and adversarial attacks are proposed as future research directions.The conclusion also points to defenses against momentary interventions as a future direction.Source: §7 · p. 10

A.2 ROBUSTNESS TO INPUT PERTURBATIONS

This section motivates one-step observation perturbations as a safety concern and reports that action chunking can prolong their effects. It presents CARE as an adaptive execution-length method based on action-chunk information and consistency.

A.2 ROBUSTNESS TO INPUT PERTURBATIONS

  • The work evaluates perturbations at a single inference step and identifies action chunking as one factor that prolongs their effects into later steps.The section frames this as a vulnerability relevant to VLA safety in physical environments.Source: §A.2 · p. 14

A.3 ACTION CHUNKING

  • CARE selects execution length using information from the predicted action chunk, without additional model inference or training, and is independent of the action-generation method.The method is intended to apply to VLAs that output action chunks.Source: §A.3 · p. 14

A.4 CONSISTENCY-BASED METHODS

  • BID (Liu et al., 2025b) uses consistency when selecting among candidate chunks; SGAC (So et al., 2025) updates plans by comparing actions, while the proposed method uses cross-chunk consistency to adapt execution length without querying policy every step.SGAC requires policy inference at every step, incurring greater inference demand than executing multiple actions between policy calls.Source: §A.4 · p. 15

B DISCUSSION AND LIMITATIONS

The discussion identifies finite-horizon evaluation and persistent multi-step corruption as boundaries on the findings. The appendices document the perturbation, baseline, and CARE implementation choices.

B DISCUSSION AND LIMITATIONS

  • The evaluation covers finite-horizon tasks; irreversible failures may remain consequential even in infinite-horizon settings where an agent could recover.The authors identify infinite-horizon evaluation as future work.Source: B DISCUSSION AND LIMITATIONS · p. 15

C.1 COMPUTATIONAL ENVIRONMENT

  • Experiments ran on a single NVIDIA H100 with NVIDIA driver 575.57.08 and CUDA 12.9.Source: §C.1 · p. 15

C.2 PERTURBATION IMPLEMENTATION

  • Perturbations were applied after environment preprocessing and before inference; the eight designs include image, state, and combined data-loss corruptions.Image corruptions affect every input image, while state corruptions affect state observations; each is active for one specified inference step unless noted otherwise.Source: §C.2 · pp. 15–16

C.3 BASELINE IMPLEMENTATION

  • The experiments compare RobustVLA, VLA-Corrector, and AAC as representative robustness or adaptive-execution baselines.Their implementations respectively use adversarial fine-tuning, visual-feature change correction, and action-chunk entropy to select execution length.Source: §C.3 · p. 16

C.4 PROPOSED METHOD IMPLEMENTATION

  • CARE compares aligned consecutive action predictions and chooses the longest prefix whose cumulative discounted discrepancy stays within τ, capped by the maximum execution length.At episode start, CARE uses Hinit = 1; the LIBERO setup uses γ = 0.85 and a 15-step cap.Source: §C.4 · p. 17

C.5 REAL-WORLD EXPERIMENT DETAILS

The real-world appendix details a two-arm handover-and-placement task and its evaluation protocol. Perturbations are synthetic, applied at inference, and timed by task phase.

C.5 REAL-WORLD EXPERIMENT DETAILS

  • The real-world setup uses two 6-DoF WidowX follower arms, four RealSense D405 cameras, and a pick-and-place task requiring a red-block handover.An episode succeeds when the block is placed at the designated location after handover; episodes last 40 seconds.Source: §C.5 · p. 17, Figure 9 · p. 18
  • π0.5 was fine-tuned with LoRA on 100 demonstration episodes, and predicted joint targets were constrained before execution.Targets were clipped to SDK joint limits and each revolute-joint target was constrained to within ±0.10 rad of its current measured position in all evaluations.Source: §C.5 · pp. 17–18
  • Three synthetic perturbations—data loss, random state, and blur—were applied at inference and evaluated across four fixed task phases.Each phase spans 100 control steps, and success rates were computed over 15 episodes for each perturbation type and phase.Source: §C.5 · p. 18

D.1 PERTURBATION TIMING ANALYSIS

Across LIBERO suites, vulnerability to one-step data loss varies with intervention timing and model. The appendix discusses critical task moments and compounding errors as possible explanations.

D.1 PERTURBATION TIMING ANALYSIS

  • Performance drops are concentrated at particular timings: π0.5 can approach zero success within a single 10% interval, while vulnerable intervals vary across models.Drops tend to occupy shorter intervals for π0.5 and π0-FAST than for other models.Source: §D.1 · p. 18
  • Critical task moments and compounding errors are proposed as possible explanations for timing-dependent vulnerability, including larger effects from early errors.An early erroneous action can shift later states away from the demonstration distribution, increasing the likelihood of further errors.Source: §D.1 · pp. 18–19

D.2 EXPERIMENTS ON META-WORLD BENCHMARK

On Meta-World, one-step perturbations reduce performance, and CARE generally improves clean and perturbed results, though gains vary by setting. The appendices examine threshold sensitivity, multi-step corruption, and CARE’s cold start.

D.2 EXPERIMENTS ON META-WORLD BENCHMARK

  • Meta-World timing effects resemble LIBERO’s, but vulnerability is more concentrated at early steps; zero-clean-success tasks are excluded from the relative-success analysis.The authors note that the environment may influence which steps are vulnerable.Source: §D.2 · pp. 19–20, Figure 11 · p. 20
  • One-step perturbations reduce Vanilla performance for all three models; data loss lowers success from 71.6%, 62.0%, and 49.4% to 23.5%, 17.5%, and 21.7%, respectively.Random-state perturbations cause larger drops than motion blur for all three models.Source: §D.2 · p. 20
  • CARE achieves the highest clean success rate and the highest Bottom10%-SR under random-state and data-loss perturbations for all three models on Meta-World.It also has the highest motion-blur score for π0 and π0.5, while SmolVLA is slightly below Vanilla at 46.8% versus 47.0%.Source: §D.2 · pp. 20–21, Table 4 · p. 21

D.3 HYPERPARAMETER SENSITIVITY

  • Clean performance remains relatively stable across most tested τ values, while data-loss robustness generally decreases at larger thresholds; threshold sensitivity varies by model.The analysis tests τ from 0.5 to 2.5 in increments of 0.5; robustness varies little from 0.5–1.5 for π0, π0.5, and SmolVLA, while X-VLA drops more at 1.5 and π0-FAST has lower clean performance at 0.5.Source: §D.3 · pp. 21–22, Figure 12 · p. 21

D.4 ROBUSTNESS TO MULTI-STEP PERTURBATIONS.

  • CARE becomes less effective as perturbations last longer because corrupted observations persist at the next inference step, limiting execution-length selection alone.The authors identify recovery mechanisms as complementary methods for multi-step perturbations.Source: §D.4 · p. 22, Figure 13 · p. 22

D.5 ANALYSIS OF COLD START IN CARE

  • The initial H = 1 baseline provides much smaller robustness gains than CARE and is comparable to Vanilla for many models, so cold start alone is insufficient.CARE’s gains are attributed to adaptive execution-length selection under perturbations.Source: Figure 14 · p. 22, §D.5 · p. 23

Related papers

Loading 2609.32550v1…