{"id":"97cce062-d7f4-4bfe-ab1f-124804c2c42b","arxiv_id":"2411.15222","paper_version":1,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":2,"one_line_summary":"An adversarial text prefix optimized on continuous action and self-attention features misleads VIMA language-conditioned robotic policies across 13 manipulation tasks, beating GCG-based baselines.","lead":"Researchers show that adding a short, optimized string of text to a robot's instruction can make a language-guided robot model perform the wrong action. The attack works by targeting the model's internal continuous action signals and attention features, rather than the final output, and it transfers to a smaller robot model.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Self-attention loss reduces ASR at the 25-token setting used for the headline result (Table II: 0.51 vs 0.47), so the central adversarial-distillation claim is not supported at the reported operating point.","rationale":"The reader identified the missing clean-task baseline, which is a genuine validity issue for interpreting absolute ASR. My load-bearing concern is different and, to me, more directly damaging: the paper's own ablation, at the same token count used for the main comparison, shows the headline self-attention contribution decreasing performance relative to continuous-feature-only optimization. This is an internal numerical inconsistency, not merely a question of the reference against which the attack is measured. If the numbers are correct, the stated 'adversarial distillation' mechanism is not responsible for the reported improvement, and the advantage over M GCG would rest on continuous features alone; if the table is a typo, it still needs correction before the claim can be verified. Because this can be settled by a rerun and does not necessarily invalidate the whole approach, I retain the reader's conditional posture rather than moving to rejection, while noting that the specific contribution wording likely needs revision. The paper also provides no code or error bars, so independent verification is limited, but the specific table contradiction is the clearest load-bearing weakness.","tokens_in":12953,"tokens_out":8501,"duration_ms":73863,"concrete_test":"Re-run the Section IV-D ablation at exactly 25 adversarial tokens with the same three seeds (42, 22, 76) and the same 13-task protocol as Table I, reporting per-task ASR and standard deviations for Lcontinuous alone and for Lcontinuous + Lself-attn. If the combined loss is not at least as high as Lcontinuous alone at 25 tokens, then the self-attention term does not 'further enhance' the attack at the headline configuration; the main comparison should then be repeated at 48 tokens with GCG and M GCG re-run at that length, or the claim revised to attribute the result to continuous features only. If the two numbers instead match Table I after correcting a row/column transpose, that would confirm a typographical error rather than a substantive contradiction.","verdict_should_be":"UNCHANGED","load_bearing_attack":"At the exact configuration used for the headline comparison, the ablation data contradict the central claim that intermediate self-attention features further enhance the attack. Section IV-B states that all main results use 25 adversarial tokens, where the full method (Lcontinuous + Lself-attn) achieves 47.08% average ASR (Table I). In Table II, the same 25-token column reports Lcontinuous alone at 0.51 and Lcontinuous + Lself-attn at 0.47. Adding the self-attention loss therefore decreases average attack success at the operating point where the paper claims superiority over GCG and M GCG. Self-attention does improve at 10 tokens (0.29 -> 0.34) and at 48 tokens (0.53 -> 0.69), but no baseline comparison is run at 48 tokens, and the 25-token column remains unexplained. As printed, either the table rows/columns are mislabeled or the headline 47.08% result is not attributable to the full proposed loss, since a one-component ablation already exceeds it. Either way, the conclusion in Section V that intermediate feature misalignment 'further enhance[s] attack efficacy' is not established at the evaluated token count. This concern is separate from the missing clean success baseline because the comparison is internal to the method.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"This paper proposes a white-box adversarial prompt attack against language-conditioned robotic manipulation models, specifically VIMA. The attack optimizes a universal adversarial prefix with a GCG-style discrete search, using a weighted loss over continuous action features from the controller decoder and intermediate self-attention features, with the stated goal of bypassing the robustness conferred by the action discretization module. Experiments on 13 VIMA-Bench Level 1 tasks report an average attack success rate of 47.08% with 25-token prefixes, compared with 39.59% for M GCG and 35.26% for GCG, plus transfer experiments to a 92M VIMA variant. The paper also reports ablations over token count and loss components, and concludes that intermediate feature misalignment further enhances attack efficacy.","tokens_in":13167,"tokens_out":4905,"duration_ms":47133,"significance":"Adversarial attacks on language-conditioned robot policies are understudied, and the paper identifies a plausible and practically relevant mechanism: optimizing against continuous action representations instead of the final discrete output distribution improves attack success. If the reported numbers are not confounded, the universal-prefix attack and its cross-model transferability would be a useful contribution to the robotics-security literature. The paper is also honest about its simulation-only evaluation and the one-time offline cost of optimization. However, the missing attack-free task-success baseline, the internal inconsistency in the ablation table, and the absence of variance reporting currently prevent the empirical claims from being accepted as stated.","major_comments":[{"comment":"Attack success is defined as the model failing to complete the task, yet no clean (attack-free) task success rate is reported for any of the 13 tasks. Because Random already achieves ASRs as high as 84.67% on Twist and 65.11% on Rearrange then Restore, a high ASR does not by itself demonstrate that the adversarial prefix caused the failure. Please report clean success rates per task and, preferably, attack-induced degradation relative to clean performance; otherwise the headline 47.08% average and the claimed superiority over GCG/M GCG are confounded by natural task failures.","section":"IV-A2, Table I"},{"comment":"The central claim that self-attention feature misalignment further enhances attack efficacy is contradicted at the operating point used for the headline result. Main results use 25 adversarial tokens (Section IV-B), where Table II reports L_continuous = 0.51 and L_continuous + L_self-attn = 0.47, i.e., adding the self-attention loss lowers ASR. Self-attention only helps at 10 tokens (0.29 to 0.34) and at 48 tokens (0.53 to 0.69), neither of which is the setting for the main comparison. Please clarify the table or the operating point; as printed, the conclusion in Section V that intermediate feature misalignment further enhances attack efficacy is not supported by the reported ablation.","section":"IV-D, Table II vs IV-B"},{"comment":"The average ASR comparison (47.08% vs 39.59%) is reported without error bars, confidence intervals, or significance tests, even though the manuscript states that results come from three random seeds. Given that some task-level differences are very small (e.g., Twist: Ours 85.56 vs M GCG 85.33; Pick in Order then Restore: Ours 46.44 vs M GCG 47.33), the 7.49-point average gap may be within seed-to-seed noise. Please report per-seed results or standard deviations and test the significance of the average difference.","section":"IV-A2, Table I"}],"minor_comments":[{"comment":"Equations (4) and (5) define losses as negative L2 norms, but Section IV-A4 states that cosine similarity is used to calculate the loss between features; please align the mathematical definitions with the actual implementation.","section":"III-C and IV-A4"},{"comment":"There is a typo in Equation (1): \"grounth-truth\" should be \"ground-truth\".","section":"Equation (1)"},{"comment":"The reference list contains uncited template references [1] through [10] and a duplicate of the Vaswani et al. paper ([11] and [24]); please clean up the bibliography.","section":"References"},{"comment":"When reporting improvements such as \"a substantial 28% improvement\" and \"a 17% improvement,\" please specify whether the numbers are absolute percentage points or relative improvements, since the baseline values make the two interpretations differ substantially.","section":"IV-B and IV-D"},{"comment":"The gray-box transferability claim would also benefit from clean task-success rates on the 92M model, and from variance reporting, since the comparison to the white-box number appears to be a single point estimate.","section":"IV-E, Figure 5"},{"comment":"Please describe in the captions whether the plotted curves are averages over the three seeds and whether error bars or shading are shown; currently no uncertainty information is visible.","section":"Figures 4 and 5"}],"recommendation":"major_revision","confidential_remarks":null},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core idea here is worth taking seriously. The authors target continuous action features to bypass the discretization module in VIMA, and add a self-attention feature misalignment loss. That is a sensible response to a real problem: attacking the final discrete action distribution is blunt, and the continuous controller output is where the model is actually pliable. The universal prefix trained on one Visual Manipulation demonstration and transferred to 13 tasks and to a smaller 92M model is a legitimate demonstration, and the transfer result at 10 tokens is genuinely interesting. The paper also deserves credit for stating its own limitations: simulation-only evaluation and offline optimization cost are acknowledged honestly.\n\nThe evaluation has two soft spots that matter. First, the ablation table contradicts the central claim at the operating point used for the headline result. Table I reports 47.08% average ASR with 25 adversarial tokens, and Section IV.B says all main results use 25 tokens. But Table II, 25-token column, shows Lcontinuous alone at 0.51 and Lcontinuous + Lself-attn at 0.47. As printed, adding the self-attention loss decreases performance at the exact setting where the paper claims superiority over GCG and M GCG. The self-attention loss does help at 10 and 48 tokens, but no baselines are reported at 48 tokens, so the claim that intermediate features \"further enhance attack efficacy\" is not established at the headline configuration. This could be a mislabeled table or a row-column mix-up, but it needs to be fixed before the results are credible. Second, there is no attack-free task success rate reported. On Twist, a random prefix already gives 84.67% ASR, which implies high natural failure rates. Without the clean success rate, the absolute ASR numbers are not cleanly attributable to the adversarial prefix, and even the relative gain over baselines is confounded. The paper also gives no error bars or variance, even though it says experiments were repeated over three seeds.\n\nThere is a smaller but real cleanliness problem: the reference list includes [1]–[12], which are unrelated to this paper (Engelmore, Clancey, Robinson, NASA, etc.), apparently leftover from another manuscript. That should have been caught before submission. No code or artifacts are provided, which is disappointing given the contradictions in the tables.\n\nNet: the idea is novel enough and the direction is sound, and I would not desk-reject. But the evidence as printed does not support the headline claim. A serious referee should send this back with a request for a corrected ablation, clean-task success rates, error bars, and a cleaned reference list. If the numbers hold up after those fixes, this is a useful contribution to the security side of robot learning.","headline":"A plausible new attack idea for language-conditioned robot policies, but the ablation table contradicts the headline claim at the 25-token setting and the evaluation lacks clean baselines; worth peer review after the authors fix the evidence.","tokens_in":13753,"tokens_out":2035,"would_cite":false,"duration_ms":87792,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A fixed adversarial text prefix, optimized against continuous action features and intermediate self-attention features, makes a language-conditioned robot policy fail at the commanded task; across 13 VIMA-Bench tasks the average attack…","keywords":["adversarial attacks","language-conditioned robotics","universal adversarial prefix","intermediate features","self-attention features","action discretization","adversarial distillation","VIMA benchmark"],"falsifier":"Re-run the evaluation on the same 13 VIMA tasks and report the clean (no-prefix) task success rate alongside the random-prefix and adversarial-prefix attack success rates; if the clean success rate is close to the adversarial ASR on several tasks, the central claim of superior attack performance is not supported.","tokens_in":12712,"feed_emoji":"🤖","tokens_out":6009,"duration_ms":54480,"temperature":0.7,"pith_summary":"This paper tries to establish that language-conditioned robotic models, which translate text commands into discrete robot actions, are vulnerable to a universal adversarial preamble: a fixed string of text that, when prepended to any instruction, makes the model perform unintended actions. It argues that existing adversarial prompt attacks from natural language processing fail in this setting because the model's discretization of continuous action outputs absorbs small input perturbations. The proposed remedy is to optimize the prefix against continuous action features before discretization and to add a negative-gradient term that misaligns intermediate self-attention features, a procedure the paper calls adversarial distillation. If the claim holds, a single offline-computed prefix can undermine an instruction-following robot across many tasks, which matters because such robots act in the physical world.","feed_headline":"Universal text prefix misleads robots in 47% of attacks","feed_subtitle":"A 25-token prefix trained on one demo beats NLP attack baselines by targeting continuous action and self-attention features.","key_machinery":"The central machinery is the adversarial-distillation objective, a composite loss over two intermediate feature representations. The first term, $L_{\\mathrm{continuous}} = -\\lVert D_c(p_a\\oplus p,h) - D_c(p,h)\\rVert_2$, maximizes the distance between continuous action vectors produced by the controller decoder with and without the adversarial prefix, bypassing the robust discretized action decoder. The second term, $L_{\\mathrm{self\\text{-}attn}} = -\\lVert F_s(p_a\\oplus p,h) - F_s(p,h)\\rVert_2$, maximizes the distance between self-attention feature maps across intermediate layers, which the paper argues are particularly susceptible to perturbation because attention weights propagate small input changes through the whole sequence. The full loss is $L = \\alpha L_{\\mathrm{continuous}} + \\beta L_{\\mathrm{self\\text{-}attn}}$, and the prefix tokens are optimized with the Greedy Coordinate Gradient algorithm.","core_discovery":"The paper's central discovery is that attacking the right intermediate representations, rather than the final output distribution, is what makes adversarial text work against robotic policies. Concretely, the optimization loss is the negative alignment between (i) the controller decoder's continuous action vector with and without the adversarial prefix and (ii) the self-attention feature maps of all intermediate layers; optimizing this composite loss with a coordinate-gradient search yields a universal prefix. On the VIMA model across 13 Level 1 tasks, the method reports an average attack success rate of 47.08%, compared with 39.59% for M GCG, 35.26% for GCG, 20.79% for random prefixes, and 18.96% for gradient descent. The authors further report that a prefix optimized on a single Visual Manipulation demonstration transfers to the other 12 task types and, in a gray-box setting, attacks a smaller 92M-parameter VIMA variant.","pith_inferences":["The paper does not report the clean, attack-free task success rate, so part of the reported ASR on high-random-failure tasks such as Twist (84.67% under a random prefix) may reflect task difficulty rather than the adversarial prefix; a fair comparison would subtract natural failure rates.","The same adversarial-distillation recipe may apply to other multimodal policies with discretized outputs, such as diffusion-based visuomotor policies or action-quantized reinforcement learning agents, wherever a continuous intermediate action representation exists before discretization.","The attack objective suggests a corresponding defense: training a policy to keep self-attention features aligned under input perturbation may directly counteract the vulnerability the paper exploits, turning adversarial distillation into a robustness regularizer.","A testable extension is whether feature-based prefix optimization yields systematically better cross-model transfer than output-based optimization; the paper's gray-box result hints at this, but the mechanism is not isolated."],"forward_implications":["A fixed 25-token prefix trained on one Visual Manipulation demonstration transfers to 12 other task types, so an attacker needs no per-task optimization to disrupt a deployed robot.","Attack success rises with prefix length: the method reports 33.83% average ASR with 10 tokens and 68.75% with 48 tokens, while baselines plateau or falter as token count grows.","Attacking continuous action features before discretization is the key improvement: the ablation shows ASR rises from 34% to 51% at 25 tokens when the loss moves from discrete outputs to continuous action features.","Adding self-attention feature misalignment on top of continuous features gives a 16% ASR gain at 48 tokens, larger than the 3% gain from adding cross-attention features, supporting the paper's emphasis on self-attention as the vulnerable intermediate representation.","Prefixes optimized on a 200M-parameter model also attack a 92M-parameter variant, with 52.2% ASR at only 10 tokens, indicating potential transferability across model sizes."],"supporting_citations":[{"why":"Supplies the VIMA target model, the VIMA-Bench tasks, and the simulator used for all evaluation.","marker":"[13]"},{"why":"Supplies the Greedy Coordinate Gradient algorithm used to optimize the discrete adversarial prefix and serves as the primary NLP attack baseline.","marker":"[16]"},{"why":"Identifies the action-discretization module that maps continuous actions to robot arm poses, which the paper argues makes output-based attacks weak.","marker":"[44]"},{"why":"Provides the knowledge-distillation principle that intermediate feature alignment shapes output alignment, which the paper inverts into adversarial distillation.","marker":"[50]"},{"why":"Additional distillation reference supporting the use of hidden-layer feature alignment as the basis for the adversarial objective.","marker":"[51]"},{"why":"The gradient-descent text-prompt attack baseline that optimizes in continuous token space and then maps back to discrete tokens.","marker":"[65]"},{"why":"The momentum-GCG baseline that adds previous-gradient momentum to GCG and is the strongest baseline in the comparison.","marker":"[66]"},{"why":"Establishes the evaluation protocol that measures attack success as failure to complete the task within predefined constraints.","marker":"[14]"},{"why":"Prior evidence that attacking intermediate features improves adversarial transferability, which the paper extends to self-attention features.","marker":"[67]"}],"fun_headline_variants":["Attack robots via intermediate features, 47% success","Universal prefix misleads robots by attacking attention","Adversarial distillation beats GCG on robot tasks","47% of robot prompts hijacked by single prefix","Robotic models fooled by attacking self-attention"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The evaluation assumes that a failed task under an adversarial prompt is caused by the prompt; because no attack-free success rate is reported, tasks with high natural failure rates could inflate the reported attack success rate.","fun_headline_variants_meta":{"raw":{"variants":["Attack robots via intermediate features, 47% success","Universal prefix misleads robots by attacking attention","Adversarial distillation beats GCG on robot tasks","47% of robot prompts hijacked by single prefix","Robotic models fooled by attacking self-attention"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000155,"raw_usage":{"total_tokens":1199,"prompt_tokens":916,"completion_tokens":283,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":532,"completion_tokens_details":{"reasoning_tokens":208}},"tokens_in":532,"tokens_out":283,"duration_ms":3333,"temperature":1.0,"reasoning_tokens":208,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T15:51:55.880673+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Re-run the evaluation on the same 13 VIMA tasks and report the clean (no-prefix) task success rate alongside the random-prefix and adversarial-prefix attack success rates; if the clean success rate is close to the adversarial ASR on several tasks, the central claim of superior attack performance is not supported.","supporting_citations":[{"cited_title":"Vima: General robot manipula- tion with multimodal prompts,","cited_arxiv_id":null,"evidence_quote":"Supplies the VIMA target model, the VIMA-Bench tasks, and the simulator used for all evaluation."},{"cited_title":"Knowledge transfer via distilla- tion of activation boundaries formed by hidden neurons,","cited_arxiv_id":null,"evidence_quote":"Additional distillation reference supporting the use of hidden-layer feature alignment as the basis for the adversarial objective."},{"cited_title":"On the Multi-modal Vulnerability of Diffusion Models","cited_arxiv_id":"2402.01369","evidence_quote":"The gradient-descent text-prompt attack baseline that optimizes in continuous token space and then maps back to discrete tokens."},{"cited_title":"Enhancing adversarial example transferability with an intermediate level attack,","cited_arxiv_id":null,"evidence_quote":"Prior evidence that attacking intermediate features improves adversarial transferability, which the paper extends to self-attention features."}],"review_version":1}