mlsanityData to 7 Oct 2026

FreezeVLA: Action-Freezing Attacks against Vision-Language-Action Models

arXiv 2509.19870 ↗First posted 24 Sep 2025cs.CVcited by 19

On the map: Vision-language-action models → Safety and adversarial attacks

Abstract (arXiv)

Vision-Language-Action (VLA) models are driving rapid progress in robotics by enabling agents to interpret multimodal inputs and execute complex, long-horizon tasks. However, their safety and robustness against adversarial attacks remain largely underexplored. In this work, we identify and formalize a critical adversarial vulnerability in which adversarial images can "freeze" VLA models and cause them to ignore subsequent instructions. This threat effectively disconnects the robot's digital mind from its physical actions, potentially inducing inaction during critical interventions. To systematically study this vulnerability, we propose FreezeVLA, a novel attack framework that generates and evaluates action-freezing attacks via min-max bi-level optimization. Experiments on three state-of-the-art VLA models and four robotic benchmarks show that FreezeVLA attains an average attack success rate of 76.2%, significantly outperforming existing methods. Moreover, adversarial images generated by FreezeVLA exhibit strong transferability, with a single image reliably inducing paralysis across diverse language prompts. Our findings expose a critical safety risk in VLA models and highlight the urgent need for robust defense mechanisms.

Key facts. Cited by 19 papers in the map (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 47 of its 53 references that are in the map. First posted on arXiv 24 Sep 2025.

Builds on

47 of 53 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Adversarial Attacks on Robotic Vision Language Action Models3 Jun
  2. 2025SafeVLA: Towards Safety Alignment of Vision-Language-Action Model via Constrained Learning5 Mar
  3. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov

Other references · 44

  1. 2023Llama 2: Open Foundation and Fine-Tuned Chat Modelscited by 12,865
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2025Qwen2.5-VL Technical Reportcited by 5,418
  5. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  6. 2023Universal and Transferable Adversarial Attacks on Aligned Language Modelscited by 2,914
  7. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  8. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  9. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
  10. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,037
  11. 2022RT-1: Robotics Transformer for Real-World Control at Scalecited by 2,007
  12. 2025InternVL3: Exploring Advanced Training and Test-Time Recipes for Open-Source Multimodal Modelscited by 1,769
32 more
  1. 2023Learning Fine-Grained Bimanual Manipulation with Low-Cost Hardwarecited by 1,490
  2. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  3. 2023Jailbreaking Black Box Large Language Models in Twenty Queriescited by 1,326
  4. 2023Open X-Embodiment: Robotic Learning Datasets and RT-X Modelscited by 849
  5. 2024DROID: A Large-Scale In-The-Wild Robot Manipulation Datasetcited by 801
  6. 2023AutoDAN: Generating Stealthy Jailbreak Prompts on Aligned Large Language Modelscited by 738
  7. 2024PaliGemma: A versatile 3B VLM for transfercited by 679
  8. 2025FAST: Efficient Action Tokenization for Vision-Language-Action Modelscited by 643
  9. 2025SmolVLA: A Vision-Language-Action Model for Affordable and Efficient Roboticscited by 507
  10. 2025SpatialVLA: Exploring Spatial Representations for Visual-Language-Action Modelcited by 502
  11. 2024DriveVLM: The Convergence of Autonomous Driving and Large Vision-Language Modelscited by 482
  12. 2025UniVLA: Learning to Act Anywhere with Task-centric Latent Actionscited by 386
  13. 2025WorldVLA: Towards Autoregressive Action World Modelcited by 351
  14. 2024Prismatic VLMs: Investigating the Design Space of Visually-Conditioned Language Modelscited by 336
  15. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  16. 2023On Evaluating Adversarial Robustness of Large Vision-Language Modelscited by 281
  17. 2023How Robust is Google's Bard to Adversarial Image Attacks?cited by 177
  18. 2023RH20T: A Comprehensive Robotic Dataset for Learning Diverse Skills in One-Shotcited by 173
  19. 2025OpenDriveVLA: Towards End-to-end Autonomous Driving with Large Vision Language Action Modelcited by 172
  20. 2020Torchattacks: A PyTorch Repository for Adversarial Attackscited by 156
  21. 2023Dolphins: Multimodal Language Model for Drivingcited by 124
  22. 2025A Comprehensive Survey in LLM(-Agent) Full Stack Safety: Data, Training and Deploymentcited by 110
  23. 2024What Matters in Building Vision-Language-Action Models for Generalist Robotscited by 88
  24. 2025SAFE: Multitask Failure Detection for Vision-Language-Action Modelscited by 74
  25. 2024Mobility VLA: Multimodal Instruction Navigation with Long-Context VLMs and Topological Graphscited by 72
  26. 2025Vision-Language-Action (VLA) Models: Concepts, Progress, Applications and Challengescited by 72
  27. 2024A Dual Process VLA: Efficient Robotic Manipulation Leveraging VLMcited by 44
  28. 2023A Survey on Transferability of Adversarial Examples across Deep Neural Networkscited by 43
  29. 2024TAPT: Test-Time Adversarial Prompt Tuning for Robust Inference in Vision-Language Modelscited by 22
  30. 2025SafeVid: Toward Safety Aligned Video Large Multimodal Modelscited by 9
  31. 2024AdvQDet: Detecting Query-Based Adversarial Attacks with Adversarial Contrastive Prompt Tuningcited by 7
  32. 2024Enhancing Cross-Prompt Transferability in Vision-Language Models through Contextual Injection of Target Tokenscited by 4

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2025: 2; 2026: 17.

19 papers.

Sort:

By area:

  1. 2026OpenRT: An Open-Source Red Teaming Framework for Multimodal LLMscited by 18
  2. 2026Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanismscited by 12
  3. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Modelscited by 10
  4. 2026HazardArena: Evaluating Semantic Safety in Vision-Language-Action Modelscited by 6
  5. 2025T2VAttack: Adversarial Attack on Text-to-Video Diffusion Modelscited by 5
  6. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patchescited by 5
  7. 2026SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Modelscited by 2
  8. 2026Security of World-Model-Based Embodied AI: A Lifecycle of Threats, Defenses, and Evaluationcited by 2
  9. 2026FlowHijack: A Dynamics-Aware Backdoor Attack on Flow-Matching Vision-Language-Action Modelscited by 1
  10. 2026Semantic Denial of Service in LLM-controlled robotscited by 1
  11. 2026RedVLA: Physical Red Teaming for Vision-Language-Action Modelscited by 0
  12. 2026TAME: Test-Time Adversarial Prompt Tuning via Mixture-of-Experts for Vision-Language Modelscited by 0
7 more
  1. 2026Not What You Asked For: Typographic Attacks in Household Robot Manipulationcited by 0
  2. 2026ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Drivingcited by 0
  3. 2026Trajectory-Level Redirection Attacks on Vision-Language-Action Modelscited by 0
  4. 2026Self-Evolving Just-In-Time Memory for Proactive Embodied Safetycited by 0
  5. 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networkscited by 0
  6. 2026Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Modelscited by 0
  7. 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models
  2. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Robotics
  3. 2026Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
  4. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
  5. 2026Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models
  6. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models
  7. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
  8. 2025When Alignment Fails: Multimodal Adversarial Attacks on Vision-Language-Action Models