mlsanityData to 7 Oct 2026

Adversarial Attacks on Robotic Vision Language Action Models

arXiv 2506.03350 ↗First posted 3 Jun 2025cs.RO cs.AIcited by 31

On the map: Vision-language-action models → Safety and adversarial attacks

also in 1 more
Abstract (arXiv)

The emergence of vision-language-action models (VLAs) for end-to-end control is reshaping the field of robotics by enabling the fusion of multimodal sensory inputs at the billion-parameter scale. The capabilities of VLAs stem primarily from their architectures, which are often based on frontier large language models (LLMs). However, LLMs are known to be susceptible to adversarial misuse, and given the significant physical risks inherent to robotics, questions remain regarding the extent to which VLAs inherit these vulnerabilities. Motivated by these concerns, in this work we initiate the study of adversarial attacks on VLA-controlled robots. Our main algorithmic contribution is the adaptation and application of LLM jailbreaking attacks to obtain complete control authority over VLAs. We find that textual attacks, which are applied once at the beginning of a rollout, facilitate full reachability of the action space of commonly used VLAs and often persist over longer horizons. This differs significantly from LLM jailbreaking literature, as attacks in the real world do not have to be semantically linked to notions of harm. We make all code available at https://github.com/eliotjones1/robogcg .

Key facts. Cited by 31 papers in the map (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 75 of its 89 references that are in the map. First posted on arXiv 3 Jun 2025.

Builds on

75 of 89 references.

References · 75

  1. 2017Attention Is All You Needcited by 59,932
  2. 2022Training language models to follow instructions with human feedbackcited by 15,712
  3. 2024The Llama 3 Herd of Modelscited by 14,192
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2022PaLM: Scaling Language Modeling with Pathwayscited by 5,304
  6. 2013Intriguing properties of neural networkscited by 5,114
  7. 2017Deep reinforcement learning from human preferencescited by 3,846
  8. 2017Outrageously Large Neural Networks: The Sparsely-Gated Mixture-of-Experts Layercited by 3,413
  9. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  10. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  11. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  12. 2022Do As I Can, Not As I Say: Grounding Language in Robotic Affordancescited by 2,302
38 more
  1. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,037
  2. 2023Jailbroken: How Does LLM Safety Training Fail?cited by 1,565
  3. 2024Octo: An Open-Source Generalist Robot Policycited by 1,427
  4. 2024HarmBench: A Standardized Evaluation Framework for Automated Red Teaming and Robust Refusalcited by 1,330
  5. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  6. 2022Code as Policies: Language Model Programs for Embodied Controlcited by 1,172
  7. 2021A General Language Assistant as a Laboratory for Alignmentcited by 1,023
  8. 2015End-to-End Training of Deep Visuomotor Policiescited by 847
  9. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  10. 2023Scaling Vision Transformers to 22 Billion Parameterscited by 690
  11. 2023Baseline Defenses for Adversarial Attacks Against Aligned Language Modelscited by 608
  12. 2023Prompt Injection attack against LLM-integrated Applicationscited by 568
  13. 2024JailbreakBench: An Open Robustness Benchmark for Jailbreaking Large Language Modelscited by 494
  14. 2024Evaluating Real-World Robot Manipulation Policies in Simulationcited by 484
  15. 2018Scalable agent alignment via reward modeling: a research directioncited by 438
  16. 2023SmoothLLM: Defending Large Language Models Against Jailbreaking Attackscited by 434
  17. 2024CogACT: A Foundational Vision-Language-Action Model for Synergizing Cognition and Action in Robotic Manipulationcited by 411
  18. 2024AgentHarm: A Benchmark for Measuring Harmfulness of LLM Agentscited by 406
  19. 2023Jailbreak and Guard Aligned Language Models with Only Few In-Context Demonstrationscited by 401
  20. 2024Great, Now Write an Article About That: The Crescendo Multi-Turn LLM Jailbreak Attackcited by 364
  21. 2023ConceptGraphs: Open-Vocabulary 3D Scene Graphs for Perception and Planningcited by 357
  22. 2023An Embodied Generalist Agent in 3D Worldcited by 355
  23. 2016Deep Reinforcement Learning for Robotic Manipulation with Asynchronous Off-Policy Updatescited by 342
  24. 2024Alignment faking in large language modelscited by 316
  25. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  26. 2023Are aligned neural networks adversarially aligned?cited by 305
  27. 2024Improving Alignment and Robustness with Circuit Breakerscited by 302
  28. 2024TraceVLA: Visual Trace Prompting Enhances Spatial-Temporal Awareness for Generalist Robotic Policiescited by 298
  29. 2023ChatGPT for Robotics: Design Principles and Model Abilitiescited by 296
  30. 2023SayPlan: Grounding Large Language Models using 3D Scene Graphs for Scalable Robot Task Planningcited by 289
  31. 2025Defeating Prompt Injections by Designcited by 256
  32. 2024Frontier Models are Capable of In-context Schemingcited by 252
  33. 2019Risks from Learned Optimization in Advanced Machine Learning Systemscited by 250
  34. 2023AI Control: Improving Safety Despite Intentional Subversioncited by 207
  35. 2023Scalable and Transferable Black-Box Jailbreaks for Language Models via Persona Modulationcited by 202
  36. 2024LLM Defenses Are Not Robust to Multi-Turn Human Jailbreaks Yetcited by 145
  37. 2023Dolphins: Multimodal Language Model for Drivingcited by 124
  38. 2024BadAgent: Inserting and Activating Backdoor Attacks in LLM Agentscited by 106

50 most cited of 75 All 75 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 8; 2026: 23.

31 papers.

Sort:

By area:

  1. 2025FreezeVLA: Action-Freezing Attacks against Vision-Language-Action Modelscited by 19
  2. 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Modelscited by 16
  3. 2026Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanismscited by 12
  4. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Modelscited by 10
  5. 2025CHAI: Command Hijacking against embodied AIcited by 9
  6. 2025Attention-Guided Patch-Wise Sparse Adversarial Attacks on Vision-Language-Action Modelscited by 9
  7. 2026HazardArena: Evaluating Semantic Safety in Vision-Language-Action Modelscited by 6
  8. 2025Embodied AI: Emerging Risks and Opportunities for Policy Actioncited by 3
  9. 2025Measuring Physical-World Privacy Awareness of Large Language Models: An Evaluation Benchmarkcited by 2
  10. 2026SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Modelscited by 2
  11. 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 2
  12. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Roboticscited by 2
19 more
  1. 2026ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Controlcited by 2
  2. 2026Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluationcited by 2
  3. 2026Extended to Reality: Prompt Injection in 3D Environmentscited by 1
  4. 2026FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Modelscited by 1
  5. 2026Semantic Denial of Service in LLM-controlled robotscited by 1
  6. 2026Uncovering and Mitigating Positional Blind Spots in Vision-Language-Action Modelscited by 1
  7. 2026DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attackcited by 1
  8. 2025Microsaccade-Inspired Probing: Positional Encoding Perturbations Reveal LLM Misbehaviourscited by 0
  9. 2026Altered Thoughts, Altered Actions: Probing Chain-of-Thought Vulnerabilities in VLA Robotic Manipulationcited by 0
  10. 2026ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Drivingcited by 0
  11. 2026Test-time Adversarial Takeover: A Real-time Hijacking Interface against Robotic Diffusion Policiescited by 0
  12. 2026Trajectory-Level Redirection Attacks on Vision-Language-Action Modelscited by 0
  13. 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networkscited by 0
  14. 2026Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Modelscited by 0
  15. 2026Security of Foundation-Model-Powered Embodied Agents: Attack Surfaces, Attacks, Defenses, and Evaluationcited by 0
  16. 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policiescited by 0
  17. 2026Statistical Inference for Adversarial Training: Central Limit Theorems via Optimal Transportcited by 0
  18. 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0
  19. 2026Are Vision-Language-Action Models Robust to One-Step Observation Perturbations?cited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics
  2. 2025Phantom Menace: Exploring and Enhancing the Robustness of VLA Models Against Physical Sensor Attacks
  3. 2026Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
  4. 2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models
  5. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
  6. 2026VLALeaks: Membership Inference Attacks against Vision-Language-Action Models
  7. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models
  8. 2026Hijacking Robots with a Piece of Paper: A Systematic Study of Physical Prompt Injection in VLM-Controlled Robots