mlsanityData to 7 Oct 2026

When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models

arXiv 2511.21192 ↗First posted 26 Nov 2025cs.CV cs.AIcited by 9

On the map: Vision-language-action models → Safety and adversarial attacks

Abstract (arXiv)

Vision-Language-Action (VLA) models are vulnerable to adversarial attacks, yet universal and transferable attacks remain underexplored, as most existing patches overfit to a single model and fail in black-box settings. To address this gap, we present a systematic study of universal, transferable adversarial patches against VLA-driven robots under unknown architectures, finetuned variants, and sim-to-real shifts. We introduce UPA-RFAS (Universal Patch Attack via Robust Feature, Attention, and Semantics), a unified framework that learns a single physical patch in a shared feature space while promoting cross-model transfer. UPA-RFAS combines (i) a feature-space objective with an ℓ1 deviation prior and repulsive InfoNCE loss to induce transferable representation shifts, (ii) a robustness-augmented two-phase min-max procedure where an inner loop learns invisible sample-wise perturbations and an outer loop optimizes the universal patch against this hardened neighborhood, and (iii) two VLA-specific losses: Patch Attention Dominance to hijack text→vision attention and Patch Semantic Misalignment to induce image-text mismatch without labels. Experiments across diverse VLA models, manipulation suites, and physical executions show that UPA-RFAS consistently transfers across models, tasks, and viewpoints, exposing a practical patch-based attack surface and establishing a strong baseline for future defenses.

Key facts. Cited by 9 papers in the map (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 72 of its 90 references that are in the map. First posted on arXiv 26 Nov 2025.

Builds on

72 of 90 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models15 Oct
  2. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization22 May
  3. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov

Other references · 69

  1. 2020A Simple Framework for Contrastive Learning of Visual Representationscited by 11,979
  2. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,764
  3. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  4. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  5. 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,048
  6. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  7. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  8. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
  9. 2022RT-1: Robotics Transformer for Real-World Control at Scalecited by 2,007
  10. 2016Adversarial examples in the physical worldcited by 1,762
  11. 2019Similarity of Neural Network Representations Revisitedcited by 1,695
  12. 2025π0.5: a Vision-Language-Action Model with Open-World Generalizationcited by 1,653
38 more
  1. 2024Octo: An Open-Source Generalist Robot Policycited by 1,427
  2. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  3. 2016Understanding intermediate layers using linear classifier probescited by 1,279
  4. 2018Obfuscated Gradients Give a False Sense of Security: Circumventing Defenses to Adversarial Examplescited by 1,259
  5. 2025GR00T N1: An Open Foundation Model for Generalist Humanoid Robotscited by 1,167
  6. 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Successcited by 844
  7. 2023VoxPoser: Composable 3D Value Maps for Robotic Manipulation with Language Modelscited by 733
  8. 2024PaliGemma: A versatile 3B VLM for transfercited by 679
  9. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  10. 2025FAST: Efficient Action Tokenization for Vision-Language-Action Modelscited by 643
  11. 2023BridgeData V2: A Dataset for Robot Learning at Scalecited by 634
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
  13. 2016Delving into Transferable Adversarial Examples and Black-box Attackscited by 530
  14. 2017Adversarial Patchcited by 514
  15. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  16. 2024CogACT: A Foundational Vision-Language-Action Model for Synergizing Cognition and Action in Robotic Manipulationcited by 411
  17. 2023LanguageBind: Extending Video-Language Pretraining to N-modality by Language-based Semantic Alignmentcited by 366
  18. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  19. 2024TinyVLA: Towards Fast, Data-Efficient Vision-Language-Action Models for Robotic Manipulationcited by 331
  20. 2018Insights on representational similarity in neural networks with canonical correlationcited by 318
  21. 2025LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Modelscited by 278
  22. 2021Enhancing the Transferability of Adversarial Attacks through Variance Tuningcited by 242
  23. 2024PaliGemma 2: A Family of Versatile VLMs for Transfercited by 204
  24. 2025VLA-RL: Towards Masterful and General Robotic Manipulation with Scalable Reinforcement Learningcited by 166
  25. 2023ManipLLM: Embodied Multimodal Large Language Model for Object-Centric Robotic Manipulationcited by 157
  26. 2021Admix: Enhancing the Transferability of Adversarial Attackscited by 155
  27. 2017EAD: Elastic-Net Attacks to Deep Neural Networks via Adversarial Examplescited by 154
  28. 2025Interactive Post-Training for Vision-Language-Action Modelscited by 129
  29. 2021Feature Importance-aware Transferable Adversarial Attackscited by 125
  30. 2025Improving Vision-Language-Action Model with Online Reinforcement Learningcited by 107
  31. 2023AdvCLIP: Downstream-agnostic Adversarial Examples in Multimodal Contrastive Learningcited by 101
  32. 2022Improving Adversarial Transferability via Neuron Attribution-Based Attackscited by 92
  33. 2021Improving Transferability of Adversarial Patches on Face Recognition with Generative Modelscited by 80
  34. 2023Boosting Adversarial Transferability by Block Shuffle and Rotationcited by 64
  35. 2022T-SEA: Transfer-based Self-Ensemble Attack on Object Detectioncited by 59
  36. 2019FDA: Feature Disruptive Attackcited by 55
  37. 2022Towards Robust Rain Removal Against Adversarial Attacks: A Comprehensive Benchmark Analysis and Beyondcited by 48
  38. 2021Detecting Adversarial Examples Is (Nearly) As Hard As Classifying Themcited by 46

50 most cited of 69 All 69 (JSON)

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 9.

9 papers.

  1. 2026TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patchescited by 5
  2. 2026VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijackingcited by 3
  3. 2026Tex3D: Objects as Attack Surfaces via Adversarial 3D Textures for Vision-Language-Action Modelscited by 2
  4. 2026DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attackcited by 1
  5. 2026ReasonBreak: Probing Vulnerabilities in Reasoning-Enabled Vision-Language-Action Models for Autonomous Drivingcited by 0
  6. 2026Trajectory-Level Redirection Attacks on Vision-Language-Action Modelscited by 0
  7. 2026VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networkscited by 0
  8. 2026Structure-Aware Robust Fine-Tuning: Defending Vision-Language-Action Robots Against Physical Attention Hijackingcited by 0
  9. 2026Security and Privacy in Large-Model-Driven Embodied Agents: Attacks, Defenses, and Future Directionscited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Robotics
  2. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  3. 2026SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models
  4. 2026Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models
  5. 2026Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models
  6. 2026Exploiting Vulnerabilities: Universal Adversarial Attacks on Vision-Language-Action Models in Robotics
  7. 2025Adversarial Attacks on Robotic Vision Language Action Models
  8. 2025Attention-Guided Patch-Wise Sparse Adversarial Attacks on Vision-Language-Action Models