Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policies
On the map: Vision-language-action models → Safety and adversarial attacks also fits: VLA architectures and generalization
Abstract (arXiv)
Adversarial patches to Vision-Language-Action (VLA) policies can cause both immediate action corruption and persistent state effects that remain after the patch is removed. Existing evaluations largely focus on continuous attacks and do not separate these two effects. We introduce a state-restoration protocol that removes the patch at matched action-chunk boundaries and measures subsequent recoverability under the same remaining step budget. Clean, random-patch, deviation-matched, and fixed-direction controls distinguish adversarial effects from occlusion, action-error magnitude, and directional persistence. We also evaluate a recovery adapter trained on attack-induced states under controlled intervention latency. On OpenVLA-OFT with EDPA attacks, only 36.2% of LIBERO-Long episodes remain recoverable after five chunks, compared with 89.9% and 87.0% for the deviation-matched and fixed-direction controls. Similar persistent effects are observed on autoregressive OpenVLA. The recovery adapter improves recovery from 7.7% to 47.4% at one-chunk latency, but its benefit decreases substantially with delayed intervention. These results show that adversarial effects can persist after patch removal and that timely intervention is critical for recovery.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Safety and adversarial attacks, one of 13 directions in Vision-language-action models. Builds on 37 of its 40 references that are in the map. First posted on arXiv 17 Sep 2026.
Builds on
37 of 40 references.
Closest ancestors · 7
Same direction, newest first
- 2026Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Robotics2 Jun
- 2026VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijacking27 May
- 2025AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models15 Nov
- 2025Model-agnostic Adversarial Attack and Defense for Vision-Language-Action Models15 Oct
- 2025Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations23 Sep
- 2025Adversarial Attacks on Robotic Vision Language Action Models3 Jun
- 2024Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics18 Nov
Other references · 30
- 2015Distilling the Knowledge in a Neural Networkcited by 10,076
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2023RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Controlcited by 2,993
- 2024OpenVLA: An Open-Source Vision-Language-Action Modelcited by 2,777
- 2024π0: A Vision-Language-Action Flow Model for General Robot Controlcited by 2,297
- 2022RT-1: Robotics Transformer for Real-World Control at Scalecited by 2,007
- 2023LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learningcited by 1,338
- 2023Open X-Embodiment: Robotic Learning Datasets and RT-X Modelscited by 849
- 2025Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Successcited by 844
- 2017Adversarial Patchcited by 514
- 2020robosuite: A Modular Simulation Framework and Benchmark for Robot Learningcited by 484
- 2017Adversarial Attacks on Neural Network Policiescited by 314
18 more
- 2025LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Modelscited by 278
- 2020Robust Deep Reinforcement Learning against Adversarial Perturbations on State Observationscited by 235
- 2020Recovery RL: Safe Reinforcement Learning with Learned Recovery Zonescited by 156
- 2020Toward the Fundamental Limits of Imitation Learningcited by 96
- 2017Leave no Trace: Learning to Reset for Safe and Autonomous Reinforcement Learningcited by 86
- 2025SAFE: Multitask Failure Detection for Vision-Language-Action Modelscited by 74
- 2021PatchCleanser: Certifiably Robust Defense against Adversarial Patches for Any Image Classifiercited by 63
- 2024Unpacking Failure Modes of Generative Policies: Runtime Monitoring of Consistency and Progresscited by 63
- 2025Can We Detect Failures Without Failure Data? Uncertainty-Aware Runtime Failure Detection for Imitation Learning Policiescited by 49
- 2024RACER: Rich Language-Guided Failure Recovery Policies for Imitation Learningcited by 46
- 2023Jedi: Entropy-based Localization and Removal of Adversarial Patchescited by 35
- 2025The Pitfalls of Imitation Learning when Actions are Continuouscited by 25
- 2021There Is No Turning Back: A Self-Supervised Approach for Reversibility-Aware Reinforcement Learningcited by 17
- 2023DIFFender: Diffusion-Based Adversarial Defense against Patch Attackscited by 15
- 2023LogoStyleFool: Vitiating Video Recognition Systems via Logo Style Transfercited by 6
- 2026Uncovering Vulnerability of Vision-Language-Action Models under Joint-Level Physical Faultscited by 2
- 2026ARB4WM: An Adversarial Robustness Benchmark for World Models in Continuous Controlcited by 2
- 2025Towards Powerful and Practical Patch Attacks for 2D Object Detection in Autonomous Drivingcited by 1
Built on by
Not cited yet.
Similar, not cited
Close in wording, no citation either way
- 2026Detect and Suppress: A Mechanistic Defense against Adversarial Patches in VLA Models
- 2025When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models
- 2025Attention-Guided Patch-Wise Sparse Adversarial Attacks on Vision-Language-Action Models
- 2024Safeguarding Vision-Language Models Against Patched Visual Prompt Injectors
- 2026Improving Robustness of Vision-Language-Action Models by Restoring Corrupted Visual Inputs
- 2026Steal the Patch Size: Adversarially Manipulate Vision-Language Models
- 2026ConflictVLA-Bench: Benchmarking Behavioral Responses of Vision-Language-Action Models to Premise Conflicts
- 2024Steering Away from Harm: An Adaptive Approach to Defending Vision Language Model Against Jailbreaks