mlsanityData to 14 Oct 2026

CertVLA: Certified Defense against Physical Visual Attacks for Vision-Language-Action Models

arXiv 2608.20791 ↗First posted 21 Aug 2026cs.CV cs.AIcited by 0

On the map: Vision-language-action models → Safety and adversarial attacks

Abstract (arXiv)

Vision-Language-Action (VLA) policies are vulnerable to localized physical perturbations, yet existing certified patch defenses target discrete labels and cannot directly certify continuous, temporally correlated actions. We introduce CertVLA, a certified defense for closed-loop VLA control under bounded patch and texture attacks. CertVLA proposes a calibrated region of behaviorally consistent actions, while deterministic covering masks ensure that at least one checked prediction is attack-free. Specifically, CertVLA normalizes action disagreement by the benign variation of each mask pair and accepts a single-mask anchor only when it remains consistent under every second mask. It then calibrates the resulting max-min-max episode score to provide finite-sample clean coverage. Conjoining query-level decisions extends the action certificate to the complete closed-loop rollout. Furthermore, we prove that against any adaptive attacker satisfying the bounded-support threat model, every rollout certified by CertVLA executes only action chunks consistent with attack-erased clean predictions. Under dual-mask rollout correctness, this consistency certificate further guarantees task success. The certificate is independent of patch content, generation method, and physical transformation. Experiments in simulation and the real world demonstrate the empirical and certified effectiveness of CertVLA against patch attacks, with additional simulation validation on texture attacks.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 38 of its 46 references that are in the map. First posted on arXiv 21 Aug 2026.

Builds on

38 of 46 references.

Closest ancestors · 2

Same direction, newest first

  1. 2026STRONG-VLA: Decoupled Robustness Learning for Vision-Language-Action Models under Multimodal Perturbations11 Apr
  2. 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov

Other references · 36

  1. 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 3,080
  2. 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,407
  3. 2023PaLM-E: An Embodied Multimodal Language Modelcited by 2,071
  4. 2022RT-1: Robotics Transformer for Real-World Control at Scalecited by 2,061
  5. 2024Octo: An Open-Source Generalist Robot Policycited by 1,484
  6. 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,410
  7. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,340
  8. 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Successcited by 883
  9. 2017Adversarial Patchcited by 517
  10. 2023Vision-Language Foundation Models as Effective Robot Imitatorscited by 349
  11. 2020Certified Defenses for Adversarial Patchescited by 101
  12. 2020(De)Randomized Smoothing for Certifiable Defense against Patch Attackscited by 98
24 more
  1. 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 65
  2. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 60
  3. 2023Panoptic Scene Graph Generation with Semantics-Prototype Learningcited by 42
  4. 2020Minority Reports Defense: Defending Against Adversarial Patchescited by 36
  5. 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
  6. 2025Treble Counterfactual VLMs: A Causal Approach to Hallucinationcited by 35
  7. 2022PatchZero: Defending against Adversarial Patch Attacks by Detecting and Zeroing the Patchcited by 30
  8. 2021PatchGuard++: Efficient Provable Attack Detection against Adversarial Patchescited by 29
  9. 2025Secure On-Device Video OOD Detection Without Backpropagationcited by 19
  10. 2022A Unified End-to-End Retriever-Reader Framework for Knowledge-based VQAcited by 18
  11. 2026ActiveVLA: Injecting Active Perception into Vision-Language-Action Models for Precise 3D Robotic Manipulationcited by 18
  12. 2021ScaleCert: Scalable Certified Defense against Adversarial Patches with Sparse Superficial Layerscited by 15
  13. 2024Backdoor Attacks against No-Reference Image Quality Assessment Models via a Scalable Triggercited by 12
  14. 2023PatchCURE: Improving Certifiable Robustness, Model Utility, and Computation Efficiency of Adversarial Patch Defensescited by 11
  15. 2025Towards Model Resistant to Transferable Adversarial Examples via Trigger Activationcited by 10
  16. 2024Unlearnable Examples Detection via Iterative Filteringcited by 9
  17. 2025From Pretrain to Pain: Adversarial Vulnerability of Video Foundation Models Without Task Knowledgecited by 9
  18. 2024SCAN: Bootstrapping Contrastive Pre-training for Data Efficiencycited by 6
  19. 2025VidLBEval: Benchmarking and Mitigating Language Bias in Video-Involved LVLMscited by 4
  20. 2026StableVLA: Towards Robust Vision-Language-Action Models without Extra Datacited by 4
  21. 2023Efficient Temporal Sentence Grounding in Videos with Multi-Teacher Knowledge Distillationcited by 3
  22. 2025CertMask: Certifiable Defense Against Adversarial Patches via Theoretically Optimal Mask Coveragecited by 2
  23. 2025PatchDEMUX: A Certifiably Robust Framework for Multi-label Classifiers Against Adversarial Patchescited by 1
  24. 2026Universal Adversarial Attacks against Closed-Source MLLMs via Target-View Routed Meta Optimizationcited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way

  1. 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models
  2. 2025BadVLA: Towards Backdoor Attacks on Vision-Language-Action Models via Objective-Decoupled Optimization
  3. 2025DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models
  4. 2026TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors
  5. 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models
  6. 2025Phantom Menace: Exploring and Enhancing the Robustness of VLA Models Against Physical Sensor Attacks
  7. 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Robotics
  8. 2026Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models