Pith. sign in

REVIEW 4 major objections 5 minor 61 references

Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models

T0 review · 4 major / 5 minor · reviewed 2026-08-12 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A natural-looking printed patch can steer a Vision-Language-Action robot to attacker-chosen actions, even with no access to the model's internals.

desk verdict Solid attack paper with a real method, but the headline ASR overstates targeted steering; AP should be front and center. read the letter →

arxiv 2608.10393 v1 pith:RRZTC5KV submitted 2026-08-11 cs.AI cs.RO

Jiahui Han , Yuhui Yao , Xin Wang , Jiafei Cao , Mingxuan Zhang , Danfeng Shan , Huiqi Deng , Guanchu Wang
show 1 more author
Xia Hu
This is my paper · ORCID
classification cs.AIcs.RO
keywords vision-language-actionmodelsadversarialpatchesdiffusionblack-boxattackroboticmanipulationphysicaltargetactionsteeringunrestricted
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper claims that a visually natural printed patch, placed in a robot's camera view, can reliably steer a Vision-Language-Action (VLA) policy toward an attacker-specified target action. The proposed method, DURA, searches over patch content along the latent trajectory of a frozen diffusion model, so the patch stays natural-looking while the VLA loss pushes behavior toward the target. DURA works in both white-box settings and black-box settings where only predicted actions are visible, achieving 79.3–100% attack success across OpenVLA and π0-FAST on LIBERO and transferring to a real Franka arm. If true, deployed robots can be controlled by an ordinary-looking object in the scene, without modifying the model, instruction, or robot state. The paper argues this exposes a physical safety risk that defenses must address.

What carries the argument

The central object is the diffusion-mixed latent trajectory: a clean anchor trajectory precomputed by DDIM from a benign seed patch, and an adversarial trajectory that is softly tied to it at each step by mixing latents before each DDIM denoising step. The attack update is applied as $z_{t-1} = u_{t-1} - s \cdot g_t$, where $g_t$ is either the backpropagated VLA target loss gradient (white-box) or a score-function estimator over queried action losses (black-box). This keeps the decoded patch near the natural image manifold while the VLA objective shapes its content, which is what lets the patch be both natural and action-steering.

What would settle it

Recompute the paper's headline ASR results using attack precision as the primary metric on the exact settings of Tables 1 and 2: if ASR remains high while AP stays near the clean-patch baseline (19–32% reported), the attacks are mostly breaking the policy rather than steering it, and the central claim of targeted control is not supported.

Watch

Extended reading notes

Core claim

The central claim is that unrestricted, natural-looking adversarial patches can be crafted for VLA models by optimizing in the latent space of a pretrained diffusion model, alternating DDIM denoising steps with an attack update that steers the decoded patch toward a target action. In the white-box setting the update is the gradient of the target-action loss through policy and decoder; in the black-box setting it is a score-function estimate computed from action-output queries alone. The same patch, optimized over diverse frames and instructions, transfers across scenes and, when printed, induces repeatable attacker-chosen behaviors on a physical Franka arm. The result is framed as turning the workspace itself into an attack surface.

Load-bearing premise

The paper treats any rollout that fails the task as an attack success, so the claim that DURA steers the robot toward the attacker-specified action depends on those failures actually matching the target behavior and not just being generic policy breakdowns.

Editorial extensions

If this is right

  • A single printed patch, optimized over diverse frames and instructions, can act as an on-demand switch: inserting it drives the robot toward the target action, removing it lets the robot resume normal behavior, as demonstrated on a real Franka arm.
  • The attack succeeds without modifying the model, the language instruction, or the robot state; only the camera-visible patch is changed.
  • The method attains 79.3–100% ASR across OpenVLA and π0-FAST in both white-box and black-box settings, outperforming the compared baselines in the reported experiments.
  • The attack remains effective under JPEG compression, bit-depth reduction, and Gaussian noise, with ASR staying at 90–100% in the reported settings.
  • Because the black-box variant requires only predicted actions, closed-source VLA systems are also exposed to this class of physical attack.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • A consequence the authors leave implicit is that the same latent-trajectory recipe may transfer to other multimodal policies beyond manipulation; if so, the physical attack surface extends to any camera-driven vision-language system.
  • The headline ASR metric counts any task failure as an attack success; the paper's own Attack Precision (AP) numbers live in Appendix C. A reader who wants the targeted-control claim verified should ask for AP on the main table's settings, since high ASR with low AP would mean the patch mostly degrades the policy rather than steering it.
  • A testable extension the paper does not run: vary the anchor weight $\alpha_w$ and the partial-noise timestep $t_{\text{start}}$ and measure both naturalness and AP; the current choice ($\alpha_w=0.2$, $t_{\text{start}}=0.5$) may not be optimal for out-of-distribution scenes or unusual target actions.
  • The robustness results in the appendix suggest JPEG compression at Q=10 slightly lowers AP on OpenVLA; probing whether a larger patch or a stronger attack step recovers that precision would clarify the trade-off between naturalness and robustness.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

4 major / 5 minor

Summary. The paper introduces DURA, a diffusion-based unrestricted adversarial patch attack for vision-language-action (VLA) models. The method optimizes a single localized patch along the latent trajectory of a pretrained diffusion model, using a clean anchor trajectory to preserve visual naturalness while a VLA loss steers the policy toward an attacker-specified target action. DURA supports white-box backpropagation and black-box action-output estimation, and is evaluated on OpenVLA and π0-FAST across LIBERO simulation suites and on a real Franka arm. The paper reports 79.3–100% attack success rates (ASR), improved visual naturalness relative to pixel-space baselines, and a correct score-function black-box estimator derivation in Appendix A.

Significance. If the targeted-steering claim is substantiated, DURA would be a practically important result: a printed, visually natural patch could repeatedly induce attacker-chosen robot behaviors in deployed VLA systems, including under a realistic black-box threat model. The method is clearly specified, the black-box estimator derivation in Appendix A is a legitimate REINFORCE/score-function estimator, and the evaluation includes multiple baselines, two victim models, robustness to input transformations, and a physical-robot demonstration. The main weakness is that the headline metric, ASR, measures task failure rather than target-action consistency; the only direct evidence of targeted steering, Attack Precision (AP), is relegated to Appendix C and is not compared against baselines. This gap is load-bearing for the central claim and needs to be closed before the results can be accepted as stated.

major comments (4)
  1. [Evaluation Metrics, Eq. (10)] The headline metric ASR is defined as the fraction of rollouts in which the policy fails to complete the task. This is a task-failure rate, not a direct measure of whether the executed behavior matches the attacker-specified target action. The abstract and conclusion claim that DURA 'steers the robot toward attacker-specified target actions,' but the 79.3–100% ASR numbers alone only show that the patch disrupts task completion. Because the central contribution is targeted control rather than generic disruption, the main results should jointly report ASR with a target-matching metric such as AP, or otherwise disentangle steering from out-of-distribution degradation.
  2. [Appendix C vs. Main Results] Attack Precision (AP, Eq. 11) is the only metric that separates targeted steering from incidental failure, yet it appears only in Appendix C, is reported only for DURA, and is not compared against any baseline. A reader cannot tell whether UADA, TMA, or TMA-NES—which also achieve high ASR—would also achieve high AP under the same target-action definition. Without per-baseline AP or an ASR–AP joint table, the claim that DURA's failures 'stem from the intended target action rather than incidental out-of-distribution degradation' (Main Results) is not supported by the presented evidence.
  3. [Table 1, LIBERO-Long physical row] The clean patch baseline, which is just a normal-looking patch inserted without any optimization, already reaches 67% ASR on LIBERO-Long in the physical patch setting. DURA reaches 74% ASR there in the black-box setting, an improvement of only 7 percentage points over patch insertion alone. This suggests that on this suite, much of the measured 'attack success' may be due to the patch itself being out-of-distribution, not to target steering. The paper should report clean-patch AP and per-suite breakdowns so reviewers can assess the marginal effect of the optimized patch.
  4. [Real-Robot Results, Figure 3] The physical Franka result is qualitative: a single illustrative rollout in which the patch causes the arm to freeze and then resume when the patch is removed. The text states the attack is 'controllable and repeatable on real hardware,' but no quantitative counts, number of trials, success rates, or per-step action-match statistics are provided. Given that the physical setting is central to the paper's deployability claim, the authors should either report quantitative real-robot AP/ASR over multiple trials or soften the claim accordingly.
minor comments (5)
  1. [Eq. (11)] The definition of AP says a step is counted if it matches the target action '(e.g., no-action or move-forward)', but no operational threshold or distance criterion is given. Please specify exactly how 'matching the target action' is determined, including tolerance for continuous action dimensions.
  2. [Table 1] The Benign and Clean patch rows are identical under the 'Simulated' and 'Physical' columns. Please clarify what differs between these two settings; as presented, it looks like the same numbers are duplicated.
  3. [Appendix C] The phrase 'over100trials' is missing spaces, and the appendix reports a single run without error bars. Given the 61–99% AP range across suites, seed variance should be reported to support the claim of consistent steering.
  4. [References] Some reference entries contain formatting artifacts, such as 'PMLR.' at the end of the OpenVLA entry. Please proofread the reference list and ensure consistent formatting.
  5. [Appendix E] The radar plots in Figure 11 are visually dense; reporting the numeric AP values in a table would make the robustness claim more precise and easier to verify.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: DURA's attack objective, diffusion-guided optimization, and black-box score-function estimator are externally anchored, and the ASR/AP metrics are independent evaluation measurements.

full rationale

DURA's claimed derivation chain is self-contained. The attack objective (Eqs. 2–4) uses an externally specified target action a*, the victim policy's outputs, and standard CE/MSE losses; the diffusion-guided update (Eqs. 5–7) uses a frozen pretrained diffusion model and a DDIM clean-anchor trajectory. The white-box direction (Eq. 8) is direct backpropagation of this objective. The black-box direction (Eq. 9), derived in Appendix A, is the standard score-function estimator of the gradient of the smoothed attack loss J_t(u) = E[L_attack(Φ_t(z_t))]; the derivation (Eqs. 12–27) uses only the Gaussian perturbation distribution and Williams's REINFORCE identity, with no step that presupposes the target action is achieved. ASR (Eq. 10) and AP (Eq. 11) are measured post-optimization on evaluation rollouts and are not inputs to the optimization; they are external evidence rather than fitted quantities. The self-citations (FreezeVLA, Wang et al. 2025a) appear as baselines the paper runs itself and as names for target behaviors; no load-bearing premise, uniqueness theorem, or fitted parameter is imported from them. The ASR/AP distinction is an evidence-strength caveat about how strongly the headline metric supports targeted steering, not a definitional reduction of the claimed result to its inputs.

Assumptions & free parameters 7 free parameters · 5 assumptions · 0 invented entities

The method's support rests on a standard REINFORCE estimator plus several domain assumptions about diffusion naturalness, physical transfer, and the validity of task failure as a proxy for targeted control. Hyperparameters are hand-chosen and one key parameter (attack step size) is unreported.

free parameters (7)
  • anchor strength alpha_w = 0.2
    Hand-chosen; controls how strongly the adversarial latent is tied to the clean DDIM anchor trajectory (Eq. 6), trading naturalness against attack strength.
  • starting diffusion timestep t_start = 0.5
    Hand-chosen; partial noising level of the seed patch that initializes the adversarial trajectory.
  • number of DDIM optimization steps = 200
    Hand-chosen; length of the latent optimization loop in Algorithm 1.
  • target-action loss weights = translation 1.0, rotation 0.5, gripper 0.2
    Hand-chosen weighting of action dimensions in Eq. 2; affects which action components are steered.
  • black-box query budget K = 2048
    Hand-chosen; number of samples per update in the score-function estimator; Figure 6 shows ASR grows with K.
  • attack step size s = not reported
    Per-step attack strength in Eq. 7; the paper never states its value, a reproducibility gap.
  • default patch size = not stated
    Patch area as a fraction of image; Appendix B sweeps 1-10% and finds a threshold near 2-5%, but the main experiments do not state the default.
assumptions (5)
  • standard math Score-function estimator unbiasedness for losses that are functions of sampled latents (Williams 1992)
    Used in Appendix A to derive the black-box direction g_BB_t (Eq. 9); relies on the REINFORCE identity and the Gaussian forward noising distribution.
  • domain assumption The frozen diffusion prior imposes naturalness, and its latent space is a valid optimization domain for patches
    Core to DURA; naturalness is only assessed with image-quality metrics and qualitative comparisons, not with human studies.
  • domain assumption A single optimized patch transfers to diverse scenes, poses, instructions, and physical printing conditions
    Needed for the black-box and real-world claims; the table labeled 'Physical' still evaluates rendered images, and the Franka results are qualitative.
  • ad hoc to paper Attack Success Rate (task failure) is a valid proxy for targeted attack success
    Eq. 10 defines ASR as rollout failure, which does not by itself show the policy executed the attacker-specified target action; AP (Eq. 11) is the direct measure but is deferred to Appendix C.
  • domain assumption The victim VLA checkpoints and LIBERO/BridgeData evaluation setup are accessible and behave as standard APIs
    Required to reproduce the reported experiments; no code or data are provided to verify.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models." pith.science (2026). https://pith.science/paper/RRZTC5KV

@misc{pith2026260810393,
  author       = {Pith},
  title        = {Pith review of: Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/RRZTC5KV}},
  note         = {Machine review of arXiv:2608.10393}
}
read the original abstract

Vision-Language-Action (VLA) models have shown strong capabilities in controlling robots across diverse manipulation tasks. However, their adversarial robustness remains largely underexplored, and exploiting this weakness can lead to physical-world harm. Existing attacks on VLA models often rely on pixel-space perturbations or white-box access, resulting in noticeable artifacts and limited deployability in real-world robotic systems. In this work, we propose DURA, a diffusion-based unrestricted robotic attack that generates visually natural adversarial patches for VLA models. DURA supports both white-box and black-box attack settings, where the black-box setting requires only the predicted actions of the victim model. By optimizing along the latent trajectory of a pretrained diffusion model, DURA generates visually natural patches while steering the robot toward attacker-specified target actions. Extensive experiments in both simulation and the real physical world show that DURA consistently outperforms existing methods. Our findings expose a safety risk for physically deployed VLA models and call for stronger defenses.

Figures

Figures reproduced from arXiv: 2608.10393 by the authors.

Figure 1
Figure 1. An illustration of unrestricted patch attacks on a [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. The overall framework of DURA, which consists of (a) constructing diverse task scenarios with normal-looking clean [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. Real-robot targeted attack on a Franka arm (task: place the bread slice into the basket). (a) Without the patch, the arm completes the task. (b) Inserting the printed patch into the camera view drives the arm to the target action and it stays still; removing it lets the arm resume; inserting it again drives the arm to the target action once more. Here, △ denotes the position in the previous frame, while ◦ denotes th… view at source ↗
Figures from the paper (6 more)
Figure 4
Figure 4. Figure 4: Qualitative comparison of adversarial patch nat￾uralness. From left to right, we show patches generated by UADA, UPA, TMA, and DURA under the main experimental configuration. Compared with the noise-like or visually ir￾regular patterns produced by the baselines, the DU…
Figure 6
Figure 6. Figure 6: Query budget K. Black-box ASR versus query budget K on LIBERO. DURA already achieves a high ASR at K=512 and improves further as the budget increases, whereas TMA-NES remains at a consistently low ASR. all, DURA is visually closer to the no-patch scene than the pixel-s…
Figure 8
Figure 8. Figure 8: studies the effect of patch size, measured by the fraction of image area occupied by the patch. We conduct this study on OpenVLA with the LIBERO under white-box access, and report the mean ASR over three random seeds with the other settings fixed as in Section:Experime…
Figure 9
Figure 9. Figure 9: AP on OpenVLA across four LIBERO suites. Com [PITH_FULL_IMAGE:figures/full_fig_p011_9.png]
Figure 10
Figure 10. Figure 10: Robustness to input-transformation defenses (ASR). ASR (%, ↑) averaged over the four LIBERO suites on OpenVLA and π0-FAST under JPEG compression, bit-depth reduction, and Gaussian noise at several strengths. OV Goal OV Object OV Long OV Spatial Pi0 Goal Pi0 Object Pi0…
Figure 11
Figure 11. Figure 11: Robustness to input-transformation defenses (AP). AP per suite on OpenVLA(OV) and π0-FAST under JPEG compression, bit-depth reduction, and Gaussian noise at several strengths. The dashed line is the no-defense attack, and each defense stays close to it [PITH_FULL_IMA…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

61 extracted references · 18 canonical work pages

  1. [1]

    Gauss's Theoria Motus , Year =

    Theory of the motion of the heavenly bodies moving about the sun in conic sections , Author =. Gauss's Theoria Motus , Year =

    work page

  2. [2]

    Joseph-Louis Lagrange , publisher =. M

    work page

  3. [3]

    International Conference on Learning Representations , year=

    Denoising Diffusion Implicit Models , author=. International Conference on Learning Representations , year=

  4. [4]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

    High-resolution image synthesis with latent diffusion models , author=. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages=

  5. [5]

    Machine learning , volume=

    Simple statistical gradient-following algorithms for connectionist reinforcement learning , author=. Machine learning , volume=. 1992 , publisher=

    1992

  6. [6]

    Journal of the American Statistical Association , volume=

    Tweedie’s formula and selection bias , author=. Journal of the American Statistical Association , volume=. 2011 , publisher=

    2011

  7. [7]

    arXiv preprint arXiv:2011.13456 , year=

    Score-based generative modeling through stochastic differential equations , author=. arXiv preprint arXiv:2011.13456 , year=

    arXiv 2011

  8. [8]

    arXiv preprint arXiv:2406.09246 , year=

    Openvla: An open-source vision-language-action model , author=. arXiv preprint arXiv:2406.09246 , year=

    arXiv

Show all 61 references
  1. [9]

    arXiv preprint arXiv:2212.06817 , year=

    Rt-1: Robotics transformer for real-world control at scale , author=. arXiv preprint arXiv:2212.06817 , year=

    arXiv

  2. [10]

    Conference on Robot Learning , pages=

    Rt-2: Vision-language-action models transfer web knowledge to robotic control , author=. Conference on Robot Learning , pages=. 2023 , organization=

    2023

  3. [11]

    arXiv preprint arXiv:2405.12213 , year=

    Octo: An open-source generalist robot policy , author=. arXiv preprint arXiv:2405.12213 , year=

    arXiv

  4. [12]

    Black, Kevin and Brown, Noah and Driess, Danny and Esmail, Adnan and Equi, Michael and Finn, Chelsea and Fusai, Niccolo and Groom, Lachy and Hausman, Karol and Ichter, Brian and others , journal=

  5. [13]

    arXiv preprint arXiv:2501.15830 , year=

    Spatialvla: Exploring spatial representations for visual-language-action model , author=. arXiv preprint arXiv:2501.15830 , year=

    arXiv

  6. [14]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    Exploring the adversarial vulnerabilities of vision-language-action models in robotics , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  7. [15]

    arXiv preprint arXiv:2506.03350 , year=

    Adversarial attacks on robotic vision language action models , author=. arXiv preprint arXiv:2506.03350 , year=

    arXiv

  8. [16]

    arXiv preprint arXiv:2509.19870 , year=

    Freezevla: Action-freezing attacks against vision-language-action models , author=. arXiv preprint arXiv:2509.19870 , year=

  9. [17]

    Advances in Neural Information Processing Systems , volume=

    Libero: Benchmarking knowledge transfer for lifelong robot learning , author=. Advances in Neural Information Processing Systems , volume=

  10. [18]

    2024 IEEE International Conference on Robotics and Automation (ICRA) , pages=

    Open x-embodiment: Robotic learning datasets and rt-x models: Open x-embodiment collaboration 0 , author=. 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages=. 2024 , organization=

    2024

  11. [19]

    arXiv preprint arXiv:2403.12945 , year=

    Droid: A large-scale in-the-wild robot manipulation dataset , author=. arXiv preprint arXiv:2403.12945 , year=

    arXiv

  12. [20]

    arXiv preprint arXiv:2506.21539 , year=

    Worldvla: Towards autoregressive action world model , author=. arXiv preprint arXiv:2506.21539 , year=

    arXiv

  13. [21]

    arXiv preprint arXiv:1412.6572 , year=

    Explaining and harnessing adversarial examples , author=. arXiv preprint arXiv:1412.6572 , year=

    arXiv

  14. [22]

    arXiv preprint arXiv:1706.06083 , year=

    Towards deep learning models resistant to adversarial attacks , author=. arXiv preprint arXiv:1706.06083 , year=

    arXiv

  15. [23]

    IEEE Transactions on Information Forensics and Security , volume=

    Efficient generation of targeted and transferable adversarial examples for vision-language models via diffusion models , author=. IEEE Transactions on Information Forensics and Security , volume=. 2024 , publisher=

    2024

  16. [24]

    CVPR , year=

    Tapt: Test-time adversarial prompt tuning for robust inference in vision-language models , author=. CVPR , year=

  17. [25]

    Foundations and Trends in Privacy and Security , year=

    Safety at scale: A comprehensive survey of large model and agent safety , author=. Foundations and Trends in Privacy and Security , year=

  18. [26]

    ACM MM , year=

    Advqdet: Detecting query-based adversarial attacks with adversarial contrastive prompt tuning , author=. ACM MM , year=

  19. [27]

    Advances in Neural Information Processing Systems , volume=

    Safevla: Towards safety alignment of vision-language-action model via constrained learning , author=. Advances in Neural Information Processing Systems , volume=

  20. [28]

    arXiv preprint arXiv:2601.03267 , year=

    Openai gpt-5 system card , author=. arXiv preprint arXiv:2601.03267 , year=

    arXiv

  21. [29]

    arXiv preprint arXiv:2605.17577 , year=

    TAME: Test-Time Adversarial Prompt Tuning via Mixture-of-Experts for Vision-Language Models , author=. arXiv preprint arXiv:2605.17577 , year=

    arXiv

  22. [30]

    arXiv preprint arXiv:2601.01592 , year=

    Openrt: An open-source red teaming framework for multimodal llms , author=. arXiv preprint arXiv:2601.01592 , year=

  23. [31]

    Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

    Advdiffuser: Natural adversarial example synthesis with diffusion models , author=. Proceedings of the IEEE/CVF International Conference on Computer Vision , pages=

  24. [32]

    Conference on Robot Learning , pages=

    Bridgedata v2: A dataset for robot learning at scale , author=. Conference on Robot Learning , pages=. 2023 , organization=

    2023

  25. [33]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    When robots obey the patch: Universal transferable patch attacks on vision-language-action models , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  26. [34]

    arXiv preprint arXiv:2509.18953 , year=

    Eva-VLA: Evaluating Vision-Language-Action Models' Robustness Under Real-World Physical Variations , author=. arXiv preprint arXiv:2509.18953 , year=

  27. [35]

    arXiv preprint arXiv:2603.24935 , year=

    SABER: A Stealthy Agentic Black-Box Attack Framework for Vision-Language-Action Models , author=. arXiv preprint arXiv:2603.24935 , year=

    arXiv

  28. [36]

    arXiv preprint arXiv:2603.23117 , year=

    TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches , author=. arXiv preprint arXiv:2603.23117 , year=

    arXiv

  29. [37]

    arXiv preprint arXiv:2510.13237 , year=

    Model-agnostic adversarial attack and defense for vision-language-action models , author=. arXiv preprint arXiv:2510.13237 , year=

  30. [38]

    ACM MM , year=

    ReToMe-VA: Recursive token merging for video diffusion-based unrestricted adversarial attack , author=. ACM MM , year=

  31. [39]

    arXiv preprint arXiv:2605.28083 , year=

    VLA-Hijack: A Transferable Patch Attack against Vision-Language-Action Models via Visual Proprioception Hijacking , author=. arXiv preprint arXiv:2605.28083 , year=

    arXiv

  32. [40]

    2025 IEEE International Conference on Image Processing (ICIP) , pages=

    Diffusion to confusion: Naturalistic adversarial patch generation based on diffusion model for object detector , author=. 2025 IEEE International Conference on Image Processing (ICIP) , pages=. 2025 , organization=

    2025

  33. [41]

    arXiv preprint arXiv:2312.16401 , year=

    Natural adversarial patch generation method based on latent diffusion model , author=. arXiv preprint arXiv:2312.16401 , year=

    arXiv

  34. [42]

    International conference on machine learning , pages=

    Black-box adversarial attacks with limited queries and information , author=. International conference on machine learning , pages=. 2018 , organization=

    2018

  35. [43]

    Proceedings of the 10th ACM workshop on artificial intelligence and security , pages=

    Zoo: Zeroth order optimization based black-box attacks to deep neural networks without training substitute models , author=. Proceedings of the 10th ACM workshop on artificial intelligence and security , pages=

  36. [44]

    Advances in Neural Information Processing Systems , volume=

    Content-based unrestricted adversarial attack , author=. Advances in Neural Information Processing Systems , volume=

  37. [45]

    arXiv preprint arXiv:2504.11923 , year=

    SemDiff: Generating Natural Unrestricted Adversarial Examples via Semantic Attributes Optimization in Diffusion Models , author=. arXiv preprint arXiv:2504.11923 , year=

    arXiv

  38. [46]

    Advances in Neural Information Processing Systems , volume=

    Diffusion-based adversarial sample generation for improved stealthiness and controllability , author=. Advances in Neural Information Processing Systems , volume=

  39. [47]

    arXiv preprint arXiv:2409.13174 , year=

    Manipulation facing threats: Evaluating physical vulnerabilities in end-to-end vision language action models , author=. arXiv preprint arXiv:2409.13174 , year=

  40. [48]

    arXiv preprint arXiv:2604.01618 , year=

    Tex3D: Objects as attack surfaces via adversarial 3D textures for vision-language-action models , author=. arXiv preprint arXiv:2604.01618 , year=

  41. [49]

    IEEE Robotics and Automation Letters , year=

    Partially Observable Adversarial Patch Attacks on Vision-Language-Action Models in Robotics , author=. IEEE Robotics and Automation Letters , year=

  42. [50]

    IEEE transactions on image processing , volume=

    Image quality assessment: from error visibility to structural similarity , author=. IEEE transactions on image processing , volume=. 2004 , publisher=

    2004

  43. [51]

    completely blind

    Making a “completely blind” image quality analyzer , author=. IEEE Signal processing letters , volume=. 2012 , publisher=

    2012

  44. [52]

    IEEE transactions on pattern analysis and machine intelligence , volume=

    Image quality assessment: Unifying structure and texture similarity , author=. IEEE transactions on pattern analysis and machine intelligence , volume=. 2020 , publisher=

    2020

  45. [53]

    International conference on machine learning , pages=

    Learning transferable visual models from natural language supervision , author=. International conference on machine learning , pages=. 2021 , organization=

    2021

  46. [54]

    arXiv preprint arXiv:1711.00117 , year=

    Countering adversarial images using input transformations , author=. arXiv preprint arXiv:1711.00117 , year=

    arXiv

  47. [55]

    arXiv preprint arXiv:1704.01155 , year=

    Feature squeezing: Detecting adversarial examples in deep neural networks , author=. arXiv preprint arXiv:1704.01155 , year=

    arXiv

  48. [56]

    arXiv preprint arXiv:1312.6114 , year=

    Auto-encoding variational bayes , author=. arXiv preprint arXiv:1312.6114 , year=

    arXiv

  49. [57]

    Jianyi Wang and Kelvin C. K. Chan and Chen Change Loy , editor =. Exploring. Thirty-Seventh

  50. [58]

    Colorimetry --- Part 4: CIE 1976 Lab* Colour Space , author=

    1976

  51. [59]

    Physica D: Nonlinear Phenomena , volume=

    Nonlinear Total Variation Based Noise Removal Algorithms , author=. Physica D: Nonlinear Phenomena , volume=. 1992 , publisher=

    1992

  52. [60]

    CoRR , volume =

    Karl Pertsch and Kyle Stachowicz and Brian Ichter and Danny Driess and Suraj Nair and Quan Vuong and Oier Mees and Chelsea Finn and Sergey Levine , title =. CoRR , volume =

  53. [61]

    Freeman , title =

    Taeg Sang Cho and Shai Avidan and William T. Freeman , title =

Pith tools

Reviewed August 12, 2026 · model on record in the stance chip above.