Pith. sign in

REVIEW 5 major objections 5 minor 42 references

VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks

T0 review · 5 major / 5 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read A printable physical patch can hijack the action-to-vision attention of VLA robot policies, driving simulated failure to 100 percent, and a visual-encoder-only fine-tuning defense, APFT, restores most of the lost performance with zero infer

desk verdict A solid attack/defense package for attention-based VLA robots, with an unusually large physical evaluation, but the causal attention story is asserted more than proven. read the letter →

arxiv 2608.01028 v1 pith:6QYYPL6N submitted 2026-08-02 cs.RO cs.AI

Dongfu Yin , Jinquan Zhang This is my paper
classification cs.ROcs.AI
keywords vision-language-actionmodelsphysicaladversarialpatchesattentionhijackingcross-attentionrobotmanipulationsecurityrobustfine-tuningwirelesssensornetworksclosed-loopcontrol
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

VLAGuard claims a mechanism-level vulnerability in Vision-Language-Action (VLA) robot policies: a small printable patch, optimized under the VASA attack, can capture the cross-attention that latent action tokens use to read visual evidence, diverting it from the gripper, target object, and affordance regions to the patch itself. Once that action-conditioned attention is hijacked, the policy loses the spatial grounding needed for manipulation and collapses—to 100% failure in LIBERO simulation even though the patch occupies only a few percent of the field of view. The framework's defense, APFT, fine-tunes only the visual encoder in a teacher–student setup to distill clean attention patterns and stabilize how attention moves across timesteps, with no added inference cost. Reported results: APFT cuts VASA-induced failure from 100% to 25.9% in simulation and, across 2,000 physical trials, raises average success from 23.0% to 67.4%. If correct, the work shows that the attention pathway itself—not just semantic features—is the load-bearing target for physical attacks on embodied policies, and that protecting it is both necessary and cheap.

What carries the argument

The carrying mechanism is the action-to-vision cross-attention interface: action-query tokens $Q_{\text{act}}$ attend to visual tokens through $\text{Softmax}(Q_{\text{act}}K_v^{\top}/\sqrt{d_k})V_v$, and the paper treats the resulting attention distribution over visual regions as the policy's spatial grounding for control. On the attack side the workhorse is the attention-guidance term $L_{\text{attn}}$ (Equation 6), which minimizes the negative mean cross-attention weight from action queries to patch-region tokens under Expectation-over-Transformation, making the patch a dominant attention attractor that is physically robust. On the defense side the workhorse is policy-critical attention d

What would settle it

Run a causal intervention on a VASA-attacked policy: at inference, force the action queries' cross-attention to stay pinned to the gripper and target object while leaving every other activation—patched visual features, language instruction—identical. If the policy still fails, attention hijacking is not the operative mechanism and APFT's gains must come from feature-level changes. A cheaper partial check: measure across APFT trials the correlation between residual attention mass on the patch and task outcome; a null correlation would contradict the mechanism claim.

Watch

Extended reading notes

Core claim

The paper's central claim is that in VLA architectures where action generation proceeds through a small set of latent action-query tokens attending to visual patch tokens, the cross-attention interface is a 'key bottleneck' that a localized printable patch can maliciously dominate. The VASA attack minimizes an EOT-optimized objective whose dominant term drives action-to-vision attention mass onto the patch while separately dispersing visual features and misaligning image–text semantics; attention-only optimization already outperforms semantic-only disruption, and the full attack drives the undefended OpenVLA policy to 100% failure across all four LIBERO suites and transfers strongly to other

Load-bearing premise

The load-bearing premise is that the action-to-vision cross-attention maps are a faithful, controllable proxy for the visual evidence the policy truly relies on: the attack is optimized on those maps, and the defense aligns them. If attention is epiphenomenal—a byproduct rather than a causal channel for action selection—then VASA could be breaking the policy through feature-level corruption instead, and APFT's re-centering of attention would be treating a symptom.

Editorial extensions

If this is right

  • If the cross-architecture transfer results hold, every VLA policy that generates actions through cross-attention—autoregressive or flow-matching—shares a structural weakness that a printable patch can exploit; collapse begins at roughly 2–3% patch area and is total at 5% of the field of view.
  • If the zero-inference-overhead claim holds, attention-pathway fine-tuning is deployable on resource-constrained edge hardware where test-time purification or detection latency is unacceptable for closed-loop control.
  • The ablation ordering—attention-only attacks beat semantic-only attacks, and removing $L_{\text{pcad}}$ spikes adaptive-attack failure to 87.5%—implies that global feature alignment is insufficient: robustness work on VLA policies should target the action-conditioned attention pathway directly.
  • The residual Long-suite failure (51.4% under adaptive attack) implies that attention stabilization reduces but does not eliminate long-horizon error accumulation, so safe deployment would still need complementary safeguards such as multi-view sensing or temporal memory.
  • APFT leaves clean-task competence essentially unchanged (23.3% vs 23.2% average failure in simulation), suggesting the robustness gains do not come at the price of a large clean-performance tax on this benchmark.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Beyond manipulation, the same hijacking mechanism should generalize to other embodied settings that condition actions on visual attention—navigation, human-robot interaction, or surgical robots—where a printable patch could redirect policy-critical grounding; this is directly testable by running VASA-style optimization on those policies.
  • The paper reports the patch-area failure curve for undefended policies but not for APFT; a direct extension would be to test whether the defense shifts the curve rightward (raising the collapse threshold), which would give a quantitative 'attention budget' per task.
  • Because the defense constrains attention as observed through the frozen action head, a stronger adaptive attacker could target the visual encoder's features directly rather than the attention map; the paper raises this possibility only in passing, leaving APFT's robustness against feature-level attacks as an open test.
  • The paper itself flags its boundary (Section 8.1): under single-view RGB, full occlusion of the target by the robot arm and severe sensor saturation still defeat APFT; the authors' own conclusion is that attention defense must be paired with multi-view sensing, temporal memory, or network-level cross-verification within the WSN (Section 9.4).
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

5 major / 5 minor

Summary. The paper proposes VLAGuard, a red-blue teaming framework for physical adversarial patches that target Vision-Language-Action (VLA) robots. The red-team module VASA optimizes a printable patch with an attention-guidance objective (Eq. 6) alongside feature-dispersion and language-misalignment terms, claiming to hijack policy-critical action-to-vision cross-attention and cause task failure. The blue-team module APFT fine-tunes only the visual encoder via a teacher–student scheme with feature anchoring, attention distillation, geometric consistency, and a temporal attention consistency loss (Eqs. 11–15), claiming to restore attention grounding with zero inference overhead. Experiments are reported in LIBERO simulation (OpenVLA failure rate 100.0% under VASA, reduced to 25.9% by APFT) and on a PiPER physical platform (2,000 trials, average success rate from 23.0% to 67.4% under VASA). The paper also presents attack/defense ablations, patch-size threshold analysis, and attention visualizations.

Significance. If the mechanism claim is validated, the work has notable significance: it identifies a pathway-specific vulnerability in VLA control distinct from global representation corruption, and proposes a training-time defense with no added inference latency. The paper has several strengths: the attack ablation in Fig. 5 shows that attention-guidance alone is far more destructive than dispersion/misalignment alone; the defense is evaluated under adaptive VASA attacks with gradient access; cross-architecture transfer to OpenVLA-OFT and pi0 is reported; and a large physical trial count (2,000) is a serious attempt at real-world validation. However, the central mechanistic conclusion is supported only by correlational evidence: both VASA and APFT optimize attention tensors, and no intervention on the attention mechanism itself is performed. The physical validation also lacks error bars and trial-level transparency, and no code or data artifacts are provided. The contribution is substantial if the causality gap can be closed, but as it stands the mechanism-level framing is not fully established.

major comments (5)
  1. [Sec. 3.2, Eq. (2); Sec. 5.2, Eq. (13); Sec. 7.4] The central claim that VASA causes and APFT repairs 'policy-critical attention hijacking' is correlational. Both the attack and the defense directly optimize attention summaries: Eq. (6) minimizes cross-attention weights on the patch, and Eq. (13) distills the teacher's clean attention distribution. No experiment intervenes on attention independently of the visual features or the full network. Thus the observed failures/restorations could be mediated by feature-space corruption (or by correlated changes in the encoder) rather than by the attention tensor itself. To support the mechanism-level contribution, the authors should perform a causal intervention, e.g., reweighting or clamping action-to-vision attention at inference while keeping features fixed, or training with an attention target that is randomized or decoupled from the patch. Without such an experiment, phrases like 'the key b
  2. [Table 5 and Sec. 8] The physical results are reported as point estimates only, with no error bars, confidence intervals, or significance tests. For 100 trials per cell, binomial 95% CIs are nontrivial (e.g., 76/100 gives roughly 66.4–84.0 and 14/100 gives roughly 8.0–22.0), and they matter for comparing APFT (e.g., 64.0 on Pour Liquid) with EDPA-AF (36.0). The paper should report per-condition success counts, CIs or standard errors, and the number of trials per task, and ideally release trial logs or video to substantiate the '2,000 independent physical trials' claim.
  3. [Sec. 7.2, Fig. 5; Sec. 7.5, Table 4] The ablations do not isolate the attention mechanism as the causal controller. In Fig. 5, 'Attn only' still backpropagates through the entire OpenVLA network, so the attention-guidance term can simultaneously alter feature representations. In Table 4, removing L_pcad changes the full training objective and therefore changes the visual encoder, so the resulting failure-rate spike is not a pure test of attention causality. A direct comparison should hold the encoder/features fixed and manipulate only the attention tensor (e.g., attention dropout, attention swapping, or a teacher-student setup where only attention is clamped). The current evidence supports correlation, not the claimed mechanism.
  4. [Tables 2–4 and Sec. 6.1] Simulation results are reported as mean±SE over 3 runs, but the number of tasks per LIBERO suite and the total rollouts per cell are not stated. The saturated values 100.0±0.0 in Tables 2 and 3 imply every rollout in every run failed, which is plausible for a strong attack but should be auditable: please give the number of episodes per suite and per condition, or provide per-task breakdowns. As reported, the reader cannot assess the width of confidence intervals for the headline 100.0% and 25.9% numbers.
  5. [Reproducibility] No code, data, trained checkpoints, optimized patch images, or physical trial logs are provided, and no artifacts statement appears. Given the paper's strong quantitative claims (100.0% attack success, 74.1-point FR reduction, 2,000 physical trials), the absence of artifacts makes independent verification difficult. The authors should release the VASA optimizer, APFT training code, the exact OpenVLA/pi0 checkpoints, patch files, and at least per-trial success logs for the physical experiments.
minor comments (5)
  1. [Throughout] The attack name is rendered inconsistently as 'V ASA' and 'VASA'. Pick one spelling and use it consistently in text, equations, and captions.
  2. [Eq. (8)] The formula contains extra vertical bars in the L1 expression, which makes it hard to parse. Please rewrite the objective cleanly, e.g., L_misalign = (1/B) Σ |sim(z_adv, z_text) − sim(z_clean, z_text)|.
  3. [Sec. 6.1] The term 'OpenVLA-OFT' is not defined. If it is an 'officially fine-tuned' variant, provide the checkpoint source or a citation; otherwise, specify the fine-tuning procedure and data.
  4. [Table 1 and Fig. 7] Table 1 says 50 evaluation episodes per task, but the number of tasks per LIBERO suite is not given; this matters for interpreting per-suite averages. Also, Fig. 7's x-axis ('patch area %') should state whether this is percentage of image pixels or of the physical workspace.
  5. [Sec. 5.3, Eq. (14)] The derivation of the text-guided relevance mask M_t,ij and the correlation entries G_t,ij is described only briefly. Please specify how these are computed (e.g., attention weights thresholds, feature normalization) so the loss is reproducible.

Circularity Check

1 steps flagged · score 2.0 of 10

No significant circularity in core results; attention-map mechanism validation is partly by construction but task-success evidence is independent.

  1. fitted input called prediction [Section 7.4 (Mechanism Validation) with Eqs. (6) and (13)]
    "To verify that the robustness gains of APFT arise from the proposed mechanism, we visualize action-to-vision cross-attention maps from the final Transformer layers. ... Under V ASA, the original policy exhibits persistent patch fixation: attention collapses onto the adversarial patch from the first timestep and remains trapped there throughout execution. In contrast, under the same physical patch, the APFT-tuned policy suppresses patch fixation and re-centers attention onto task-relevant evidence."

    VASA's L_attn (Eq. 6) is defined as negative mean attention to patch tokens, so minimizing it forces attention onto the patch by construction. APFT's L_pcad (Eq. 13) directly minimizes the JS divergence between the Student's attention and the Teacher's clean attention, so it forces re-centering by construction. Thus the Sec. 7.4 attention maps re-display the training objectives rather than independently validating the attention-hijacking mechanism. The paper's external evidence (task failure/success in Tables 3/5, generalization to UADA/UPA/EDPA, and the attack ablation) is not circular, but the attention-map 'mechanism validation' is partly a restatement of the loss functions.

full rationale

The paper's central derivation is not circular: the attack is designed to maximize patch attention and the defense is trained to restore clean attention, but the main claims are supported by external task metrics (LIBERO failure rates and 2,000 real-robot trials), cross-attack generalization to attacks not used in APFT training, and an ablation showing attention guidance alone is more destructive than dispersion/misalignment alone. These results are not forced by the loss definitions. The only by-construction element is the Section 7.4 attention-map visualization, which essentially re-demonstrates the optimization objectives of Eq. (6) and Eq. (13); however, the paper does not rely solely on those maps for its quantitative conclusions. Self-citations ([35], [6]) are peripheral and not load-bearing. The causal-interpretation weakness flagged by the skeptic is a scientific limitation about intervention testing, not a circularity: the paper never directly intervenes on the attention tensor, but that does not make the derivation equivalent to its inputs. Overall, the framework shows partial construction in its mechanism-validation figures but retains independent empirical content.

Assumptions & free parameters 5 free parameters · 4 assumptions · 0 invented entities

The central claim rests on four domain assumptions (causal attention bottleneck, teacher attention as target, EOT transfer to physical, benchmark representativeness) and several hand-tuned hyperparameters. No invented entities are introduced. The results therefore depend on unverified assumptions about the VLA architecture and the physical setup.

free parameters (5)
  • VASA attention weight lambda_attn = 0.8
    Chosen to make attention hijacking the dominant attack objective; the paper states loss weights were set with attention as the dominant objective.
  • APFT loss weights lambda_feat, lambda_pcad, lambda_geo, lambda_tac = 0.5, 1.0, 0.3, 0.3
    The paper says weights were set empirically based on pilot runs and kept fixed across all reported experiments.
  • Trajectory window length K = 4
    Chosen for APFT temporal consistency; value fixed across experiments.
  • EOT transformation ranges = rotation +/-30 deg, translation <=10%, scale 0.85 to 1.15
    Physical transformation distribution chosen for patch optimization; follows prior EOT work.
  • Physical patch sizes = 5, 8, 15, 20 cm
    Evaluated patch sizes; final results presumably use a selected size but it is not reported per experiment.
assumptions (4)
  • domain assumption Cross-attention between action queries and visual tokens is the causal bottleneck for action generation in VLA policies (Section 3.2).
    The framework and both attack and defense are built on this premise; if attention maps are not causally responsible for actions, the mechanism claim collapses.
  • domain assumption The frozen Teacher's clean attention maps are the correct distillation target for robust control (Sections 5.2, 7.4).
    APFT assumes that matching the clean model's attention restores task-relevant grounding; the paper does not test whether the teacher's attention is itself optimal or free of bias.
  • domain assumption Adversarial patches optimized under EOT with the listed transformations transfer to printed physical patches (Sections 3.3, 6.4).
    Physical trials assume that simulation-optimized patch patterns remain effective when printed and placed in the real scene; this is the standard EOT assumption from prior patch work.
  • domain assumption LIBERO and the PiPER platform are representative of real VLA deployment for assessing robustness (Section 6).
    Generalization of the failure-rate and success-rate numbers to other environments and embodiments is assumed, not demonstrated.

how reviews work

0 comments
Cite this review

Pith. "Pith review of VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks." pith.science (2026). https://pith.science/paper/6QYYPL6N

@misc{pith2026260801028,
  author       = {Pith},
  title        = {Pith review of: VLAGuard: A Framework for Evaluating and Mitigating Physical Attention Hijacking in Vision-Language-Action Robots within Wireless Sensor Networks},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/6QYYPL6N}},
  note         = {Machine review of arXiv:2608.01028}
}
read the original abstract

Deploying Vision-Language-Action (VLA) robots as mobile edge nodes within wireless sensor networks (WSNs) requires robust protection against physical adversarial threats. We present VLAGuard, a framework to assess and mitigate a critical vulnerability: policy-critical action-to-vision attention hijacking. We first introduce a stress-test module, Visuomotor Attention-guided Semantic Attack (VASA), using printable patches to severely distract the robot's action-conditioned cross-attention. To counter this, we propose Attention-Protective Fine-Tuning (APFT), a defense that stabilizes spatiotemporal attention and enforces geometric consistency with zero inference overhead. Evaluations across simulated and physical WSN-assisted smart environments demonstrate significant robustness gains. APFT reduces the OpenVLA failure rate from 100.0% to 25.9% in LIBERO simulations. Furthermore, across 2,000 real-world trials, APFT improves the average success rate from 23.0% to 67.4% under severe patch attacks. This highlights that protecting attention pathways is important for improving the robustness of VLA-driven edge nodes in sensor networks.

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

42 extracted references · 18 canonical work pages

  1. [38]

    Naifu Zhang, Wei Tao, Xi Xiao, Qianpu Sun, Yuxin Zheng, Wentao Mo, Peiqiang Wang, and Nan Zhang. (2025). Attention-guided patch-wise sparse adversarial attacks on vision- language-action models.arXiv preprint arXiv:2511.21663

    arXiv 2025

  2. [1]

    Anish Athalye, Nicholas Carlini, and David Wagner. (2018). Obfuscated gradients give a false sense of security: Circumventing defenses to adversarial examples. InInternational conference on machine learning, pages 274–283. PMLR

    work page 2018

  3. [2]

    Anish Athalye, Logan Engstrom, Andrew Ilyas, and Kevin Kwok. (2018). Synthesizing robust adversarial examples. InInternational conference on machine learning, pages 284–

    work page 2018

  4. [3]

    (2024).π 0: A vision-language-action flow model for general robot control

    Kevin Black, Noah Brown, Danny Driess, Adnan Esmail, Michael Equi, Chelsea Finn, Nic- colo Fusai, Lachy Groom, Karol Hausman, Brian Ichter, Szymon Jakubczak, Tim Jones, Liyiming Ke, Sergey Levine, Adrian Li-Bell, Mohith Mothukuri, Suraj Nair, Karl Pertsch, Lucy Xiaoyang Shi, James Tanner, Quan Vuong, Anna Walling, Haohuan Wang, and Ury Zhilinsky. (2024).π...

    arXiv 2024

  5. [4]

    Rt-1: Robotics transformer for real-world control at scale.arXiv preprint arXiv:2212.06817

    Anthony Brohan, Noah Brown, Justice Carbajal, Yevgen Chebotar, Joseph Dabis, Chelsea Finn, Keerthana Gopalakrishnan, Karol Hausman, Alex Herzog, Jasmine Hsu,et al.(2022). Rt-1: Robotics transformer for real-world control at scale.arXiv preprint arXiv:2212.06817

    arXiv 2022

  6. [5]

    Tom B Brown, Dandelion Man ´e, Aurko Roy, Mart ´ın Abadi, and Justin Gilmer. (2017). Adversarial patch.arXiv preprint arXiv:1712.09665

    arXiv 2017

  7. [6]

    Haojie Cai, Dongfu Yin, Fei Richard Yu, and SiTing Xiong. (2025). Dstr: Dual scenes transformer for cross-modal fusion in 3d object detection. In2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pages 3064–3073

    work page 2025

  8. [7]

    Nicholas Carlini and David Wagner. (2017). Adversarial examples are not easily detected: Bypassing ten detection methods. InProceedings of the 10th ACM workshop on artificial intelligence and security, pages 3–14

    work page 2017

Show all 42 references
  1. [8]

    Manipulation facing threats: Evalu- ating physical vulnerabilities in end-to-end vision language action models.arXiv preprint arXiv:2409.13174

    Hao Cheng, Erjia Xiao, Yichi Wang, Chengyuan Yu, Mengshu Sun, Qiang Zhang, Jiahang Cao, Yijie Guo, Ning Liu, Kaidi Xu,et al.(2024). Manipulation facing threats: Evalu- ating physical vulnerabilities in end-to-end vision language action models.arXiv preprint arXiv:2409.13174

    2024

  2. [9]

    Cheng Chi, Zhenjia Xu, Siyuan Feng, Eric Cousineau, Yilun Du, Benjamin Burchfiel, Russ Tedrake, and Shuran Song. (2025). Diffusion policy: Visuomotor policy learning via action diffusion.The International Journal of Robotics Research, 44(10-11):1684–1704

    2025

  3. [10]

    Kevin Eykholt, Ivan Evtimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. (2018). Robust physical-world attacks on deep learning visual classification. In2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition...

    2018

  4. [11]

    Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. (2014). Explaining and harnessing adversarial examples.arXiv preprint arXiv:1412.6572

    2014 arXiv

  5. [12]

    Zeyu Han, Chao Gao, Jinyang Liu, Jeff Zhang, and Sai Qian Zhang. (2024). Parameter- efficient fine-tuning for large models: A comprehensive survey.arXiv preprint arXiv:2403.14608

    2024 arXiv

  6. [13]

    Lora: Low-rank adaptation of large language models.Iclr, 1(2):3

    Edward J Hu, Yelong Shen, Phillip Wallis, Zeyuan Allen-Zhu, Yuanzhi Li, Shean Wang, Liang Wang, Weizhu Chen,et al.(2022). Lora: Low-rank adaptation of large language models.Iclr, 1(2):3. 30

    2022

  7. [14]

    Eliot Krzysztof Jones, Alexander Robey, Andy Zou, Zachary Ravichandran, George J Pap- pas, Hamed Hassani, Matt Fredrikson, and J Zico Kolter. (2025). Adversarial attacks on robotic vision language action models.arXiv preprint arXiv:2506.03350

    2025 arXiv

  8. [15]

    Openvla: An open-source vision-language-action model.arXiv preprint arXiv:2406.09246

    Moo Jin Kim, Karl Pertsch, Siddharth Karamcheti, Ted Xiao, Ashwin Balakrishna, Suraj Nair, Rafael Rafailov, Ethan Foster, Grace Lam, Pannag Sanketi,et al.(2024). Openvla: An open-source vision-language-action model.arXiv preprint arXiv:2406.09246

    2024 arXiv

  9. [16]

    Subaru Kimura, Ryota Tanaka, Shumpei Miyawaki, Jun Suzuki, and Keisuke Sakaguchi. (2024). Empirical analysis of large vision-language models against goal hijacking via visual prompt injection.arXiv preprint arXiv:2408.03554

    2024 arXiv

  10. [17]

    Jiayu Li, Yunhan Zhao, Xiang Zheng, Zonghuan Xu, Yige Li, Xingjun Ma, and Yu-Gang Jiang. (2025). Attackvla: Benchmarking adversarial and backdoor attacks on vision- language-action models.arXiv preprint arXiv:2511.12149

    2025

  11. [18]

    Zhizhong Li and Derek Hoiem. (2017). Learning without forgetting.IEEE transactions on pattern analysis and machine intelligence, 40(12):2935–2947

    2017

  12. [19]

    Bo Liu, Yifeng Zhu, Chongkai Gao, Yihao Feng, Qiang Liu, Yuke Zhu, and Peter Stone. (2023). Libero: Benchmarking knowledge transfer for lifelong robot learning.Advances in Neural Information Processing Systems, 36:44776–44791

    2023

  13. [20]

    Hanqing Liu, Shouwei Ruan, Jiahuan Long, Junqi Wu, Jiacheng Hou, Huili Tang, Tingsong Jiang, Weien Zhou, and Wen Yao. (2025). Eva-vla: Evaluating vision-language-action models’ robustness under real-world physical variations.arXiv preprint arXiv:2509.18953

    2025

  14. [21]

    (June 2025)

    Shaoyu Liu, Jianing Li, Guanghui Zhao, Yunjian Zhang, Xin Meng, Fei Richard Yu, Xi- angyang Ji, and Ming Li. (June 2025). Eventgpt: Event stream understanding with multimodal large language models. InProceedings of the Computer Vision and Pattern Recognition Conference (CVPR),...

    2025

  15. [22]

    Songming Liu, Lingxuan Wu, Bangguo Li, Hengkai Tan, Huayu Chen, Zhengyi Wang, Ke Xu, Hang Su, and Jun Zhu. (2024). Rdt-1b: a diffusion foundation model for bimanual manipulation.arXiv preprint arXiv:2410.07864

    2024 arXiv

  16. [23]

    Hui Lu, Yi Yu, Yiming Yang, Chenyu Yi, Qixin Zhang, Bingquan Shen, Alex C Kot, and Xudong Jiang. (2025). When robots obey the patch: Universal transferable patch attacks on vision-language-action models.arXiv preprint arXiv:2511.21192

    2025

  17. [24]

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. (2017). Towards deep learning models resistant to adversarial attacks.arXiv preprint arXiv:1706.06083

    2017 arXiv

  18. [25]

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandku- mar. (2022). Diffusion models for adversarial purification.arXiv preprint arXiv:2205.07460

    2022 arXiv

  19. [26]

    Open x-embodiment: Robotic learning datasets and rt-x models: Open x-embodiment col- laboration 0

    Abby O’Neill, Abdul Rehman, Abhiram Maddukuri, Abhishek Gupta, Abhishek Padalkar, Abraham Lee, Acorn Pooley, Agrim Gupta, Ajay Mandlekar, Ajinkya Jain,et al.(2024). Open x-embodiment: Robotic learning datasets and rt-x models: Open x-embodiment col- laboration 0. In2024 IEEE I...

    2024

  20. [27]

    (October 2025)

    Yufei Shi, Weilong Yan, Gang Xu, Yumeng Li, Yucheng Chen, Zhenxi Li, Fei Yu, Ming Li, and Si Yong Yeo. (October 2025). Pvchat: Personalized video chat with one-shot learning. InProceedings of the IEEE/CVF International Conference on Computer Vision (ICCV), pages 23321–23331

    2025

  21. [28]

    Octo: An open- source generalist robot policy.arXiv preprint arXiv:2405.12213

    Octo Model Team, Dibya Ghosh, Homer Walke, Karl Pertsch, Kevin Black, Oier Mees, Sudeep Dasari, Joey Hejna, Tobias Kreiman, Charles Xu,et al.(2024). Octo: An open- source generalist robot policy.arXiv preprint arXiv:2405.12213. 31

    2024 arXiv

  22. [29]

    Taowen Wang, Cheng Han, James Liang, Wenhao Yang, Dongfang Liu, Luna Xinyu Zhang, Qifan Wang, Jiebo Luo, and Ruixiang Tang. (2025). Exploring the adversarial vulnera- bilities of vision-language-action models in robotics. InProceedings of the IEEE/CVF International Conference ...

    2025

  23. [30]

    Freezevla: Action-freezing attacks against vision-language-action models.arXiv preprint arXiv:2509.19870

    Xin Wang, Jie Li, Zejia Weng, Yixu Wang, Yifeng Gao, Tianyu Pang, Chao Du, Yan Teng, Yingchun Wang, Zuxuan Wu,et al.(2025). Freezevla: Action-freezing attacks against vision-language-action models.arXiv preprint arXiv:2509.19870

    2025

  24. [31]

    (2021).{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and mask- ing

    Chong Xiang, Arjun Nitin Bhagoji, Vikash Sehwag, and Prateek Mittal. (2021).{PatchGuard}: A provably robust defense against adversarial patches via small receptive fields and mask- ing. In30th USENIX Security Symposium (USENIX Security 21), pages 2237–2254

    2021

  25. [32]

    Haochuan Xu, Yun Sing Koh, Shuhuai Huang, Zirun Zhou, Di Wang, Jun Sakuma, and Jingfeng Zhang. (2025). Model-agnostic adversarial attack and defense for vision- language-action models.arXiv preprint arXiv:2510.13237

    2025

  26. [33]

    Zonghuan Xu, Xiang Zheng, Xingjun Ma, and Yu-Gang Jiang. (2025). Tabvla: Targeted backdoor attacks on vision-language-action models.arXiv preprint arXiv:2510.10932

    2025

  27. [34]

    Yuping Yan, Yuhan Xie, Yixin Zhang, Lingjuan Lyu, Handing Wang, and Yaochu Jin. (2025). When alignment fails: Multimodal adversarial attacks on vision-language-action models.arXiv preprint arXiv:2511.16203

    2025

  28. [35]

    Richard Yu, Ji Chen, and Bing Dai

    Dongfu Yin, Run Yang, Lei Xie, F. Richard Yu, Ji Chen, and Bing Dai. (2025). A low-cost sensing glove for robust and dexterous human-robot interaction. In2025 IEEE International Conference on Robotics and Biomimetics (ROBIO), pages 2093–2098

    2025

  29. [36]

    Zonghao Ying, Aishan Liu, Tianyuan Zhang, Zhengmin Yu, Siyuan Liang, Xianglong Liu, and Dacheng Tao. (2025). Jailbreak vision language models via bi-modal adversarial prompt.IEEE Transactions on Information Forensics and Security

    2025

  30. [37]

    Yu and Amiya Nayak

    Angela W. Yu and Amiya Nayak. (2026). The internet of humanoids: A survey of technologies, applications, and challenges.IEEE Internet of Things Journal, 13(6):10498– 10521

    2026

  31. [39]

    Xueyang Zhou, Guiyao Tie, Guowen Zhang, Hechang Wang, Pan Zhou, and Lichao Sun. (2025). Badvla: Towards backdoor attacks on vision-language-action models via objective- decoupled optimization.arXiv preprint arXiv:2505.16640

    2025 arXiv

  32. [40]

    Zirun Zhou, Zhengyang Xiao, Haochuan Xu, Jing Sun, Di Wang, and Jingfeng Zhang. (2025). Goal-oriented backdoor attack against vision-language-action models via physical objects.arXiv preprint arXiv:2510.09269

    2025

  33. [41]

    Rt-2: Vision-language-action models transfer web knowledge to robotic control

    Brianna Zitkovich, Tianhe Yu, Sichun Xu, Peng Xu, Ted Xiao, Fei Xia, Jialin Wu, Paul Wohlhart, Stefan Welker, Ayzaan Wahid,et al.(2023). Rt-2: Vision-language-action models transfer web knowledge to robotic control. InConference on Robot Learning, pages 2165–2183. PMLR

    2023

  34. [42]

    Andy Zou, Zifan Wang, Nicholas Carlini, Milad Nasr, J Zico Kolter, and Matt Fredrikson. (2023). Universal and transferable adversarial attacks on aligned language models.arXiv preprint arXiv:2307.15043. 32

    2023 arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.