mlsanityData to 7 Oct 2026

Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models

arXiv 2605.25889 ↗First posted 25 May 2026cs.CR cs.LGcited by 1

On the map: Vision-language-action models → Safety and adversarial attacks

also in 1 more
Abstract (arXiv)

Vision-Language-Action (VLA) models reach high success rates on clean inputs but collapse under small adversarial perturbations: a 16/255 PGD attack drops OpenVLA-7B's LIBERO success from 95% to under 5%. Whether this trade-off has a theoretical floor was open. We prove that it does. For any VLA policy, capability I(Astar;Api) and robustness I(Api;Atildepi)-I(Api;δ) sum to at most H(Astar)+I(X;Xtilde), the task entropy plus adversarial channel capacity. The proof reduces to two applications of the Data Processing Inequality. The pixel-level bound is loose by ~ 103 nats and serves as a ceiling guarantee; an encoder-specific corollary tightens it by over an order of magnitude, into a regime where realized capability already consumes 5--9% of the budget. We validate Theorem~refthm:main with zero violations across 308 cells: 252 closed-form Gaussian-VLA, 48 OpenVLA-7B+LIBERO+PGD (4 suites × 4 eps × 3 seeds), 4 Square-Attack, and 4 multi-step (T=10). A complementary measurability inequality Robdisc ≤ Capdisc further holds across 144 cross-architecture cells spanning OpenVLA, OpenVLA-OFT (continuous-L1), and SmolVLA (flow-matching). The same construction yields three label-free diagnostics: a pre-flight encoder ceiling, a defense-forensics probe that localizes input-side vs. language-model intervention, and a head-agnostic robustness ratio comparable across discrete-token, L1-regression, and flow-matching policies. Together these provide the cross-setting axis defense and architecture comparisons currently lack.

Key facts. Cited by 1 paper in the map (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 23 of its 32 references that are in the map. First posted on arXiv 25 May 2026.

Builds on

23 of 32 references.

Closest ancestors · 3

Same direction, newest first

  1. 2025Explainable Adversarial-Robust Vision-Language-Action Model for Robotic Manipulation5 Dec
  2. 2025Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations23 Sep
  3. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov

Other references · 20

  1. 2023DINOv2: Learning Robust Visual Features without Supervisioncited by 7,764
  2. 2018Representation Learning with Contrastive Predictive Codingcited by 7,662
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2023Sigmoid Loss for Language Image Pre-Trainingcited by 3,048
  5. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
  6. 2019Theoretically Principled Trade-off between Robustness and Accuracycited by 1,510
  7. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  8. 2018Robustness May Be at Odds with Accuracycited by 873
  9. 2015Deep Learning and the Information Bottleneck Principlecited by 793
  10. 2018MINE: Mutual Information Neural Estimationcited by 680
  11. 2019On Variational Bounds of Mutual Informationcited by 550
  12. 2025SmolVLA: A Vision-Language-Action Model for Affordable and Efficient Roboticscited by 507
8 more
  1. 2023Visual Adversarial Examples Jailbreak Aligned Large Language Modelscited by 307
  2. 2017Information-theoretic analysis of generalization capability of learning algorithmscited by 299
  3. 2017Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing their Input Gradientscited by 236
  4. 2016A study of the effect of JPG compression on adversarial imagescited by 196
  5. 2020Adversarial Training and Provable Robustness: A Tale of Two Objectivescited by 12
  6. 2026StableVLA: Towards Robust Vision-Language-Action Models without Extra Datacited by 4
  7. 2026The Compression Gap: Why Discrete Tokenization Limits Vision-Language-Action Model Scalingcited by 3
  8. 2026Information-Theoretic Constraints for Continual Vision-Language-Action Alignmentcited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 1.

1 paper.

  1. 2026Outcome-Conditioned End-Effector Geometry Across Vision-Language-Action Policiescited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025RobustVLA: On Robustness of Vision-Language-Action Model against Multi-Modal Perturbations
  2. 2025High-Entropy Tokens as Multimodal Failure Points in Vision-Language Models
  3. 2024Towards Adversarially Robust Vision-Language Models: Insights from Design Choices and Prompt Formatting Techniques
  4. 2026The Layer Mystery of VLA: An Information-Theoretical Analysis of VLA Latent Interface
  5. 2026SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models
  6. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  7. 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbations
  8. 2025Adversarial Attacks on Robotic Vision Language Action Models