Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations
On the map: Vision-language-action models → Safety and adversarial attacks
Abstract (arXiv)
Vision-Language-Action (VLA) models have emerged as promising solutions for robotic manipulation, yet their robustness to real-world physical variations remains critically underexplored. To bridge this gap, we propose Eva-VLA, the first unified framework to systematically evaluate the robustness of VLA models by formulating uncontrollable physical variations as continuous optimization problems. Specifically, our framework addresses two fundamental challenges in VLA models' physical robustness evaluation: 1) how to systematically characterize diverse physical perturbations encountered in real-world deployment while maintaining reproducibility, and 2) how to efficiently discover worst-case scenarios without incurring prohibitive real-world data collection costs. To tackle the first challenge, we decouple real-world variations into three key dimensions: 3D object transformations that affect spatial reasoning, illumination changes that challenge visual perception, and adversarial regions that disrupt scene understanding. For the second challenge, we introduce a continuous black-box optimization mechanism that maps these perturbations into a continuous parameter space, enabling the systematic exploration of worst-case scenarios. Extensive experiments validate the effectiveness of our approach. Notably, OpenVLA exhibits an average failure rate of over 90% across three physical variations on the LIBERO-Long task, exposing critical systemic fragilities. Furthermore, applying the generated worst-case scenarios during adversarial training quantifiably increases model robustness, validating the effectiveness of this approach. Our evaluation exposes the gap between laboratory and real-world conditions, while the Eva-VLA framework can serve as an effective data augmentation method to enhance the resilience of robotic manipulation systems.
Key facts. Cited by 24 papers in the map (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 31 of its 37 references that are in the map. First posted on arXiv 23 Sep 2025.
Builds on
31 of 37 references.
Closest ancestors · 2
Same direction, newest first
- 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov
- 2024Manipulation Facing Threats: Evaluating Physical Vulnerabilities in End-to-End Vision Language Action Models20 Sep
Other references · 29
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
- 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
- 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
- 2025π0.5: a Vision-Language-Action Model with Open-World Generalizationcited by 1,653
- 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
- 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Successcited by 844
- 2025FAST: Efficient Action Tokenization for Vision-Language-Action Modelscited by 643
- 2017One pixel attack for fooling deep neural networkscited by 579
- 2017Adversarial Patchcited by 514
- 2025SpatialVLA: Exploring Spatial Representations for Visual-Language-Action Modelcited by 502
17 more
- 2025RoboTwin 2.0: A Scalable Data Generator and Benchmark with Strong Domain Randomization for Robust Bimanual Robotic Manipulationcited by 477
- 2024CogACT: A Foundational Vision-Language-Action Model for Synergizing Cognition and Action in Robotic Manipulationcited by 411
- 2025UniVLA: Learning to Act Anywhere with Task-centric Latent Actionscited by 386
- 2024Mobile ALOHA: Learning Bimanual Mobile Manipulation with Low-Cost Whole-Body Teleoperationcited by 377
- 2016The CMA Evolution Strategy: A Tutorialcited by 364
- 2023Vision-Language Foundation Models as Effective Robot Imitatorscited by 344
- 2024Prismatic VLMs: Investigating the Design Space of Visually-Conditioned Language Modelscited by 336
- 2024TraceVLA: Visual Trace Prompting Enhances Spatial-Temporal Awareness for Generalist Robotic Policiescited by 298
- 2024A Survey on Vision-Language-Action Models for Embodied AIcited by 274
- 2023PaLI-X: On Scaling up a Multilingual Vision and Language Modelcited by 254
- 2023RoboAgent: Generalization and Efficiency in Robot Manipulation via Semantic Augmentations and Action Chunkingcited by 167
- 2023AnyTeleop: A General Vision-Based Dexterous Robot Arm-Hand Teleoperation Systemcited by 136
- 2025Universal Actions for Enhanced Embodied Foundation Modelscited by 80
- 2021Physical Adversarial Attacks on an Aerial Imagery Object Detectorcited by 35
- 2024RoboNurse-VLA: Robotic Scrub Nurse System based on Vision-Language-Action Modelcited by 28
- 2025When Lighting Deceives: Exposing Vision-Language Models' Illumination Vulnerability Through Illumination Transformation Attackcited by 10
- 2024AdvDreamer Unveils: Are Vision-Language Models Truly Ready for Real-World 3D Variations?cited by 5
Built on by
Citing papers per year: 2025: 3; 2026: 21.
24 papers.
Sort:
By area:
- 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Modelscited by 16
- 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbationscited by 8
- 2025Experiences from Benchmarking Vision-Language-Action Models for Robotic Manipulationcited by 5
- 2026Lost in Fog: Sensor Perturbations Expose Reasoning Fragility in Driving VLAscited by 3
- 2026When Does Language Matter? Multilingual Instructions Reveal Step-wise Language Sensitivity in Vision-Language-Action Modelscited by 3
- 2025Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systemscited by 2
- 2026Overcoming Visual Clutter in Vision Language Action Models via Concept-Gated Visual Distillationcited by 2
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 2
- 2026RoboStressBench: Benchmarking VLM Robustness to Physical Visual Stress in Embodied Scenescited by 2
- 2026Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faultscited by 2
- 2026Sequential Planning via Anchored Robotic Keypointscited by 2
- 2026Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluationcited by 2
12 more
- 2026ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistencycited by 2
- 2026Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Modelscited by 1
- 2026FATE-VLA:Failue-aware test generation for vision-language-action modelscited by 1
- 2026VLAMotor: Test-Guided Enhancement of Vision-Language-Action Models via Agent-BasedData Synthesiscited by 0
- 2026Position: Vision-Language-Action Models Cannot Be Verified to Perform Physical Reasoningcited by 0
- 2026VistaVLA: Geometry- and Semantic-Aware 3D Gaussian-Grounded VLA for Robotic Manipulationcited by 0
- 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networkscited by 0
- 2026Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijackingcited by 0
- 2026From Vision to Harvest: Benchmarking Vision-Language Models for Multi-Arm Robotic Fruit Harvestingcited by 0
- 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policiescited by 0
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0
- 2026Taming VLAs under Robot Execution Errors: Self-Compensation and Stress Testingcited by 0
- 2026Taming VLAs under Robot Execution Errors: Self-Compensation and Stress Testing29 Sep 2026
- 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policies17 Sep 2026
- 2026From Vision to Harvest: Benchmarking Vision-Language Models for Multi-Arm Robotic Fruit Harvesting11 Sep 2026
- 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directions19 Aug 2026
- 2026Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking4 Aug 2026
- 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks2 Aug 2026
- 2026ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency31 Jul 2026
- 2026Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluation30 Jul 2026
- 2026VistaVLA: Geometry- and Semantic-Aware 3D Gaussian-Grounded VLA for Robotic Manipulation14 Jul 2026
- 2026Sequential Planning via Anchored Robotic Keypoints29 Jun 2026
- 2026Position: Vision-Language-Action Models Cannot Be Verified to Perform Physical Reasoning28 Jun 2026
- 2026When Does Language Matter? Multilingual Instructions Reveal Step-wise Language Sensitivity in Vision-Language-Action Models10 Jun 2026
12 more
- 2026Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faults9 Jun 2026
- 2026FATE-VLA:Failue-aware test generation for vision-language-action models1 Jun 2026
- 2026RoboStressBench: Benchmarking VLM Robustness to Physical Visual Stress in Embodied Scenes30 May 2026
- 2026Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models25 May 2026
- 2026Lost in Fog: Sensor Perturbations Expose Reasoning Fragility in Driving VLAs20 May 2026
- 2026VLAMotor: Test-Guided Enhancement of Vision-Language-Action Models via Agent-BasedData Synthesis16 May 2026
- 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbations11 Apr 2026
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Models2 Apr 2026
- 2026Overcoming Visual Clutter in Vision Language Action Models via Concept-Gated Visual Distillation11 Mar 2026
- 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Models20 Nov 2025
- 2025Experiences from Benchmarking Vision-Language-Action Models for Robotic Manipulation14 Nov 2025
- 2025Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systems13 Nov 2025
- 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Modelscited by 16
- 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbationscited by 8
- 2025Experiences from Benchmarking Vision-Language-Action Models for Robotic Manipulationcited by 5
- 2026When Does Language Matter? Multilingual Instructions Reveal Step-wise Language Sensitivity in Vision-Language-Action Modelscited by 3
- 2026Overcoming Visual Clutter in Vision Language Action Models via Concept-Gated Visual Distillationcited by 2
- 2026Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faultscited by 2
- 2026Sequential Planning via Anchored Robotic Keypointscited by 2
- 2026ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistencycited by 2
- 2026Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Modelscited by 1
- 2026FATE-VLA:Failue-aware test generation for vision-language-action modelscited by 1
- 2026VLAMotor: Test-Guided Enhancement of Vision-Language-Action Models via Agent-BasedData Synthesiscited by 0
- 2026VistaVLA: Geometry- and Semantic-Aware 3D Gaussian-Grounded VLA for Robotic Manipulationcited by 0
12 most cited of 15 All 15 (JSON)
- 2026Taming VLAs under Robot Execution Errors: Self-Compensation and Stress Testing29 Sep 2026
- 2026Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policies17 Sep 2026
- 2026Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijacking4 Aug 2026
- 2026ActFovea: Runtime Safeguarding for VLA Policies via Spatiotemporal Visual-Action Consistency31 Jul 2026
- 2026VistaVLA: Geometry- and Semantic-Aware 3D Gaussian-Grounded VLA for Robotic Manipulation14 Jul 2026
- 2026Sequential Planning via Anchored Robotic Keypoints29 Jun 2026
- 2026When Does Language Matter? Multilingual Instructions Reveal Step-wise Language Sensitivity in Vision-Language-Action Models10 Jun 2026
- 2026Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faults9 Jun 2026
- 2026FATE-VLA:Failue-aware test generation for vision-language-action models1 Jun 2026
- 2026Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models25 May 2026
- 2026VLAMotor: Test-Guided Enhancement of Vision-Language-Action Models via Agent-BasedData Synthesis16 May 2026
- 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbations11 Apr 2026
12 newest of 15 All 15 (JSON)
- 2025Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systemscited by 2
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 2
- 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networkscited by 0
- 2026From Vision to Harvest: Benchmarking Vision-Language Models for Multi-Arm Robotic Fruit Harvestingcited by 0
- 2026From Vision to Harvest: Benchmarking Vision-Language Models for Multi-Arm Robotic Fruit Harvesting11 Sep 2026
- 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks2 Aug 2026
- 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Models2 Apr 2026
- 2025Thermally Activated Dual-Modal Adversarial Clothing against AI Surveillance Systems13 Nov 2025
Similar, not cited
Close in wording, no citation either way
- 2025LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Models
- 2024Benchmarking Vision, Language, & Action Models on Robotic Learning Tasks
- 2026VLA-REPLICA: A Low-Cost, Reproducible Benchmark for Real-World Evaluation of Vision-Language-Action Models
- 2025Vision Language Action Models in Robotic Manipulation: A Systematic Review
- 2025VLA-Arena: An Open-Source Framework for Benchmarking Vision-Language-Action Models
- 2026SimVLA: A Simple VLA Baseline for Robotic Manipulation
- 2025An Anatomy of Vision-Language-Action Models: From Modules to Milestones and Challenges
- 2025VLA-0: Building State-of-the-Art VLAs with Zero Modification