mlsanityData to 7 Oct 2026

Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability

arXiv 2608.15475 ↗First posted 16 Aug 2026cs.CR cs.AIcited by 0

Not on the map. Why?

Abstract (arXiv)

Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to 0%, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in 1--5 flips, whereas the evaluated flow-matching policies require ~100--300. Our fixed-direction manifold-escape loss cuts pizero's budget from ~1000 to ~100 flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting 3.1% of weights preserves 60% success at K=100, and protecting 5.3% moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated K=100 flips yield 0/20 real-robot successes, versus 14/20 clean and 16/20 global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.

Key facts. No citing papers in the map yet (data through 7 Oct 2026). Builds on 27 of its 37 references that are in the map. First posted on arXiv 16 Aug 2026.

Builds on

27 of 37 references.

References · 27

  1. 2022Flow Matching for Generative Modelingcited by 5,426
  2. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
  3. 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
  4. 2023Diffusion Policy: Visuomotor Policy Learning via Action Diffusioncited by 2,730
  5. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
  6. 2025π0.5: a Vision-Language-Action Model with Open-World Generalizationcited by 1,653
  7. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
  8. 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Successcited by 844
  9. 2024Evaluating Real-World Robot Manipulation Policies in Simulationcited by 484
  10. 2025BitVLA: 1-bit Vision-Language-Action Models for Robotics Manipulationcited by 42
  11. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimizationcited by 37
  12. 2026QuantVLA: Scale-Calibrated Post-Training Quantization for Vision-Language-Action Modelscited by 25
15 more
  1. 2021RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recoverycited by 18
  2. 2024Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policiescited by 17
  3. 2021Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomescited by 16
  4. 2023A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectivescited by 13
  5. 2021RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracycited by 11
  6. 2025GPUHammer: Rowhammer Attacks on GPU Memories are Practicalcited by 11
  7. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Modelscited by 10
  8. 2026ActQuant: Sub-4-bit Action-Guided Quantization for Vision-Language-Action Modelscited by 7
  9. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Modelscited by 5
  10. 2025Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flipscited by 4
  11. 2026PathMark: Protecting Intellectual Property of Mixture-of-Expert LLMs via Path Watermarkscited by 3
  12. 2026Attacking the Trusted Imagination: Oracle-Level Integrity Attacks on Imagine-then-Act World Modelscited by 2
  13. 2024TrojFlow: Flow Models are Natural Targets for Trojan Attackscited by 1
  14. 2025FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learningcited by 1
  15. 2025REMISVFU: Vertical Federated Unlearning via Representation Misdirection for Intermediate Output Featurecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025Adversarial Attacks on Robotic Vision Language Action Models
  2. 2024PrisonBreak: Jailbreaking Large Language Models with at Most Twenty-Five Targeted Bit-flips
  3. 2026SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models
  4. 2026Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models
  5. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics
  6. 2026SilentDrift: Exploiting Action Chunking for Stealthy Backdoor Attacks on Vision-Language-Action Models
  7. 2026FoldQuantVLA: Native Low-Bit Quantization of Vision-Language-Action Models via Consistent Folding
  8. 2026Inject Once Survive Later: Backdooring Vision-Language-Action Models to Persist Through Downstream Fine-tuning