Pith. sign in

REVIEW 3 major objections 5 minor 73 references

UniTexture: Cross-Task Universal Adversarial Textures for Vision-Language-Action Models

T0 review · 3 major / 5 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A single repainted object texture, optimized once across a task suite, steers a frozen vision-language-action policy's actions toward attacker-chosen targets and cuts mean task success from 90.0% to 48.4%.

desk verdict A well-built cross-task universal texture attack with large empirical effects, but the evaluation and optimization share the same differentiable renderer, so the headline numbers are not yet deployment evidence. read the letter →

arxiv 2608.13453 v1 pith:DULABDTS submitted 2026-08-13 cs.CV cs.AI

Yukun Dai , Mingzhe Dai , Tianshi Wang , Fengling Li , Jingjing Li , Lei Zhu This is my paper · ORCID
classification cs.CVcs.AI
keywords adversarialattackvision-language-actionmodeltexturedifferentiablerenderingcross-tasktransferrobotmanipulationpolicysafety
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

UniTexture claims that one object's surface texture, optimized once across many manipulation tasks, can become a universal adversarial attack on a frozen vision-language-action policy. The texture is learned by pushing gradients from the policy's action output back through a differentiable renderer into the texture map, using a targeted action-space loss rather than feature-space proxies. Across two policies and two task suites, the single shared texture lowered mean task success from 90.0% to 48.4%, shifted predicted actions toward the attacker's chosen direction, and transferred to new task suites and partly to a different policy without re-optimization. The point of the result is that task diversity does not protect a multitask robot policy from a persistent adversarial object appearance.

What carries the argument

The load-bearing object is the shared texture map $\theta$, the pixel values painted on the target object's surface, and the compositing rule $\tilde{I} = M \odot R_\psi(\theta; C,P) + (1-M)\odot I$ that inserts the rendered object into each observation. Before optimization, the renderer's per-view lighting and per-object material parameters $\psi$ are calibrated against clean simulator frames and frozen, so gradients reaching $\theta$ through the frozen policy encode action-space error rather than rendering artifacts. The loss functions make the attack targeted: for token-based action interfaces the objective maximizes the probability of attacker-chosen action tokens, and for flow-matching interfaces it minimizes the velocity residual on one selected action dimension.

What would settle it

Take the optimized texture, print it on a real or simulator-native object, and run the same task protocol; if task success stays near the clean baseline or the steering does not show up, the effect lives in the attack's own image pipeline.

Watch

Extended reading notes

Core claim

The central discovery is that cross-task universality does not require a 2D image patch: a geometry-bound texture can carry the attack. UniTexture unifies per-task texture attacks and universal patches by optimizing a single UV texture map and composing it into task-conditioned observations through a calibrated differentiable renderer, backpropagating from an action-space objective. For autoregressive action-token policies, the objective maximizes the probability of attacker-chosen action tokens; for flow-matching policies, it minimizes the residual between the predicted and target velocity on the selected action dimension. The paper reports that the same texture reduces mean task success from 90.0% to 48.4%, produces positive target-direction shifts on every task in one task suite, and transfers across task suites and, in one direction, across models.

Load-bearing premise

The attack works only if the computer-generated image used to design the texture is faithful enough to what the robot actually sees that a texture designed there still works at deployment.

Editorial extensions

If this is right

  • A single object-bound texture can degrade multiple manipulation tasks without per-task refinement, so a repainted object acts as a persistent cross-task attack surface.
  • Both autoregressive-token and flow-matching vision-language-action policies are affected, indicating the attack is not tied to one action interface.
  • The same texture remains effective when moved to a different task suite or, asymmetrically, to a different policy, so attackers can precompute textures in one setting and deploy them elsewhere.
  • Directional action shifts and task success can move apart: strong steering need not produce task failure, and strong task failure need not involve coherent steering.
  • Robustness evaluation of multitask robot policies should include persistent perturbations shared across tasks, not only task-specific attacks.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorially, a decisive test of the claim is a physical print: if printed textures do not reproduce the reported steering, the vulnerability is a simulation-pipeline artifact rather than a real-world policy failure.
  • Editorially, the same calibration-and-optimize recipe could be repurposed as a defense by training vision-language-action policies on randomized object textures to reduce sensitivity to appearance-level perturbations.
  • Editorially, because the paper optimizes one action dimension at a time, targeting several dimensions or per-task directions could produce more choreographed failures than the single upward target shown here.
  • Editorially, the model asymmetry suggests that sensitivity to object appearance, not task diversity, is the stronger predictor of vulnerability to this attack family.
Share X Bluesky LinkedIn Reddit HN

Signed reviews

No signed human review yet.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper introduces UniTexture, a method that jointly optimizes a single object-bound adversarial texture over a distribution of manipulation tasks so that a multitask vision-language-action (VLA) policy's predictions are steered toward an attacker-specified action target. The authors first calibrate a differentiable renderer's per-view lighting and per-object material parameters against clean simulator frames (Eq. (4)), then optimize the texture through this frozen renderer using task-balanced sampling and model-specific objectives: token supervision for autoregressive OpenVLA (Eq. (5)) and a flow-matching residual for the π0.5 action expert (Eq. (8)). Evaluation on LIBERO-Spatial and LIBERO-Goal reports a mean success-rate drop from 90.0% under clean conditions to 48.4% under attack, positive target-direction shifts for π0.5, task-level coverage across all ten tasks in a suite, and cross-suite and cross-model transfer without re-optimization. Non-adversarial controls (rendered original texture and Gaussian noise) are included to separate rendering artifacts from the optimized attack.

Significance. If the results hold outside the optimization pipeline, this is a significant contribution: it provides evidence that a single physical object surface can persistently influence a multitask VLA across tasks, suites, and partly across models, and it offers concrete action-space objectives for two different VLA action interfaces. The paper is commendably explicit about the threat model, includes non-adversarial controls, reports per-task breakdowns, and separates disruption from targeted control. The main limitation is that every attacked evaluation uses the same differentiable renderer and mask-compositing pipeline through which the texture was optimized; the renderer-fidelity concern raised by the reviewer is therefore genuine and is the principal reason this paper needs revision rather than acceptance in its current form.

major comments (3)
  1. [Calibrating and Freezing the Renderer, Eq. (4) and Eq. (1)] The central claim is evaluated through the same differentiable compositing pipeline used for optimization, and this is the load-bearing weakness. The calibration objective in Eq. (4) matches only clean frames containing the original texture, so it does not constrain the renderer's behavior on high-frequency adversarial textures; the compositing operation in Eq. (1) additionally relies on a ground-truth mask that a physically repainted object would not provide. The 'Rendered original texture' and Gaussian-noise controls do not close this gap because neither was optimized against renderer-specific artifacts. As written, the headline reduction from 90.0% to 48.4% and the cross-task, cross-suite, and cross-model transfer results are all measured inside the attack's own generation pipeline, so the 'deployment-level vulnerability' framing in the Introduction is not yet supported. Please add an evaluation in which the optimized texture replaces the object's material/texture in the simulator's native renderer, or at minimum in a differently configured differentiable renderer (different faces-per-pixel, no mask compositing, different shading), and report SR, TDS, and pDHR under that evaluation.
  2. [Model-Specific Targeted Objectives, Eq. (7)-(8)] The flow-matching objective is not fully specified because the distribution over flow time t used during optimization is never stated. The π0.5 velocity field is conditioned on t, and the paper's paired evaluation says clean and attacked queries use 'the same flow-sampling noise,' but it does not say how t is drawn or fixed across the pair. Without this, the method cannot be reproduced, and the reported TDS and pDHR for π0.5 could depend on a favorable t-sampling schedule. Please state the exact t sampling (for example, uniform on [0,1] with a fixed random seed per episode) used in both optimization and evaluation.
  3. [Experiments, Evaluation Protocol] The success-rate differences are reported as single 100-episode numbers without variance, confidence intervals, or significance tests. For a few settings the differences are moderate (for example, π0.5 Goal-bowl: Clean 97, Original 95, Gaussian 95, UniTexture 72), so a small number of rollouts could change the conclusion in those cells. Adding standard errors or per-task variance across seeds would make the comparisons more robust. This is secondary to the renderer-fidelity issue, but it affects the strength of the quantitative claims.
minor comments (5)
  1. [Table 1] The metric rows labeled 'TDS / TDA' and 'pDHR / DHR' are confusing; please make explicit that the Clean rows report TDA and DHR while the rendered conditions report TDS and pDHR, and align the column spans accordingly.
  2. [Eq. (3)] The text says each material coefficient m_q^o is broadcast across RGB channels, but this broadcast is not visible in the notation of Eq. (3); please clarify the notation or add a sentence specifying the tensor shapes.
  3. [Figures 1 and 2] Several labels in the figure text are garbled in the manuscript, including 'FrozenFrozen22' and 'UniTexture:UniTexture:' in Figure 2; please fix the figure panels so the pipeline stages are legible.
  4. [Evaluation Protocol] The description 'execute 10 dummy actions after resetting the simulator and begin evaluation only after objects settle' is vague; please specify what these dummy actions are and whether they are policy actions, zero actions, or scripted actions.
  5. [Abstract and Conclusion] The aggregate comparison '90.0% under benign conditions to 48.4% under attack' should state the exact averaging procedure over the eight model-object-suite settings and should also report the corresponding aggregate values for the original and Gaussian controls for context.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the texture is optimized against an explicit attack objective and evaluated by independent rollouts; the shared-renderer concern is a deployment-fidelity risk, not a circular derivation.

full rationale

The paper's chain is an empirical attack pipeline rather than a derivation of a prediction from fitted inputs. In Eq. (1) the attacked observation is defined as a composite, and Eq. (2) optimizes the texture against an explicit targeted action loss; success is then measured by rollout success rate (SR), TDS, and pDHR, which are not the training objective and are computed from policy rollouts on LIBERO. No parameter fitted to the headline result is later renamed as a prediction: the renderer calibration in Eq. (4) fits lighting and material parameters to clean frames and freezes them before texture optimization, and the reported 90.0% to 48.4% figure is an empirical outcome, not a fitted value. The only self-reference is that attacked evaluation uses the same calibrated PyTorch3D compositing pipeline used in optimization; this is a deployment-fidelity or soundness risk (the attack may exploit renderer artifacts), not a circularity, because the non-adversarial 'Rendered original texture' and Gaussian-noise controls are passed through the same pipeline and the attack still outperforms them. The citation of Wang et al. (2024) for targeted token supervision involves an overlapping author (T. Wang), but it is not load-bearing: Eq. (5) states the token-level loss explicitly, and the central cross-task universality claim is evaluated against external benchmarks (OpenVLA, pi0.5, LIBERO-Spatial/Goal) rather than being justified by that citation. No uniqueness theorem, ansatz, or renamed empirical pattern is invoked. Therefore no circular step is exhibited.

Assumptions & free parameters 2 free parameters · 5 assumptions · 0 invented entities

The paper's contribution is empirical, so the ledger is short. The texture itself is the output, not a free parameter. The main uncharged load is the renderer-fidelity assumption, plus the standard white-box access and the empirical assumption that the two action-space objectives steer behaviors as intended. No new physical entities are introduced.

free parameters (2)
  • Renderer calibration parameters psi* (per-view light position and colors, per-object material coefficients and… = optimized by Eq. (4) on clean frames; values not reported
    These parameters define how texture gradients reach the policy through Eq. (1). If the fit is inaccurate, the optimized texture may exploit the renderer rather than generalize.
  • Gaussian-noise control texture statistics = drawn once from N(0.5, 0.2^2)
    A non-adversarial control whose statistics are hand-chosen; the comparison with UniTexture depends on this arbitrary choice.
assumptions (5)
  • domain assumption The calibrated differentiable renderer R_psi faithfully approximates the policy's observation pipeline at deployment, so gradients through it and textures optimized with it are effective against the true target pipeline.
    Central to Eqs. (1)-(2); if false, the attack optimizes against renderer artifacts rather than the VLA. Appears in "Calibrating and Freezing the Renderer".
  • domain assumption The frozen policy's gradients are available and the attacker can composite arbitrary textures into every visual stream (agent and wrist) without changing anything else.
    Stated threat model in "Threat Model and Problem Formulation"; implicitly assumes repainting and render compositing are physically possible.
  • domain assumption Minimizing the flow-matching residual in Eq. (8) on the targeted dimension steers the policy's sampled actions toward A*.
    This is a standard but unproved assumption for flow-matching attack objectives; the paper's evidence is empirical and shown only in simulation.
  • domain assumption Maximizing the targeted token probability in Eq. (5) for the autoregressive interface yields target-aligned actions, not merely token-level disturbance.
    The OpenVLA results show this assumption is only partially true (negative TDS in the Spatial-bowl setting), so the paper's own data stress this axiom.
  • domain assumption Task-balanced sampling from demonstration distributions D_tau covers the deployment distribution of tasks, instructions, states, and viewpoints.
    Used in Eq. (2) and Algorithm 1; if the sampling distribution differs from evaluation distribution, reported transfer results may not hold.

how reviews work

0 comments
Cite this review

Pith. "Pith review of UniTexture: Cross-Task Universal Adversarial Textures for Vision-Language-Action Models." pith.science (2026). https://pith.science/paper/DULABDTS

@misc{pith2026260813453,
  author       = {Pith},
  title        = {Pith review of: UniTexture: Cross-Task Universal Adversarial Textures for Vision-Language-Action Models},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/DULABDTS}},
  note         = {Machine review of arXiv:2608.13453}
}
abstract

Vision-Language-Action (VLA) models have emerged as generalist robotic policies capable of following diverse language instructions and performing a wide range of manipulation tasks. However, their direct control over embodied agents also exposes them to adversarial interference that may cause unsafe physical behaviors. Existing attacks on robotic policies are typically optimized for a single task or instruction, leaving the cross-task vulnerabilities of multitask VLAs largely unexplored. We introduce UniTexture, a cross-task universal adversarial texture attack that uses a single textured 3D object to induce targeted deviations in VLA action predictions across multiple tasks. UniTexture backpropagates gradients from the policy's action outputs to surface texture parameters through a differentiable renderer. It jointly optimizes the shared texture over a distribution of tasks, instructions, states, and viewpoints using a targeted action-space objective, steering predicted actions toward attacker-defined targets without optimizing a separate texture for each task. We evaluate UniTexture on OpenVLA and $\pi_{0.5}$ across diverse manipulation tasks and multiple evaluation settings. UniTexture reduces the mean task success rate from 90.0% under benign conditions to 48.4% under attack, induces target-aligned action shifts, and further exhibits cross-suite and cross-model transfer without re-optimization. Together, these findings reveal shared cross-task vulnerabilities in multitask VLAs that can be systematically exploited through a single adversarial surface texture.

Figures

Figures reproduced from arXiv: 2608.13453 by the authors.

Figure 1
Figure 1. Overview and comparison of UniTexture. (A) Uni [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Overview of UniTexture. (1) A task suite induces a cross-task distribution: rather than fitting a separate texture per task, UniTexture optimizes one shared texture θ for all tasks. Before joint optimization, an offline calibration stage fits per-view lighting ψ L v and per-object material ψ m o so that the rendered clean object matches the simulator’s appearance; the resulting ψ ⋆ is then frozen. (2) During joint o… view at source ↗
Figure 3
Figure 3. Representative failed π0.5 rollout under a UniTexture attack on the plate in LIBERO-Spatial. The leftmost agent view shows projected gripper-center trajectories for the clean rollout (green; TDA = −12.4, DHR = 12.5%) and attacked rollout (red; TDS = 18.3, pDHR = 58.6%), interpolated from centers tracked every 20 frames. The remaining panels show the attacked rollout in temporal order, with agent views above wrist vi… view at source ↗
Figures from the paper (1 more)
Figure 4
Figure 4. Figure 4: Per-task results of the two object-specific UniTex [PITH_FULL_IMAGE:figures/full_fig_p006_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

73 extracted references · 46 canonical work pages

  1. [1]

    LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning , volume =

    Liu, Bo and Zhu, Yifeng and Gao, Chongkai and Feng, Yihao and Liu, Qiang and Zhu, Yuke and Stone, Peter , booktitle =. LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning , volume =

    work page

  2. [2]

    OpenVLA: An Open-Source Vision-Language-Action Model , series =

    Kim, Moo Jin and Pertsch, Karl and Karamcheti, Siddharth and Xiao, Ted and Balakrishna, Ashwin and Nair, Suraj and Rafailov, Rafael and Foster, Ethan P and Sanketi, Pannag R and Vuong, Quan and others , editor =. OpenVLA: An Open-Source Vision-Language-Action Model , series =. 2024 , booktitle =

    work page 2024

  3. [3]

    arXiv preprint arXiv:2007.08501 , year =

    Accelerating 3d deep learning with pytorch3d , author =. arXiv preprint arXiv:2007.08501 , year =

    arXiv 2007

  4. [4]

    Proceedings of The 7th Conference on Robot Learning , pages =

    RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control , author =. Proceedings of The 7th Conference on Robot Learning , pages =. 2023 , editor =

    2023

  5. [5]

    Technical Report, Tech

    Pddl| the planning domain definition language , author =. Technical Report, Tech. Rep. , year =

    work page

  6. [6]

    Conference on robot learning , pages =

    Behavior: Benchmark for everyday household activities in virtual, interactive, and ecological environments , author =. Conference on robot learning , pages =. 2022 , publisher =

    work page 2022

  7. [7]

    arXiv preprint arXiv:2009.12293 , year =

    robosuite: A modular simulation framework and benchmark for robot learning , author =. arXiv preprint arXiv:2009.12293 , year =

    arXiv 2009

  8. [8]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages =

    Ego4d: Around the world in 3,000 hours of egocentric video , author =. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages =

    work page

Show all 73 references
  1. [9]

    arXiv preprint arXiv:2111.02767 , year =

    Rlds: an ecosystem to generate, share and use datasets in reinforcement learning , author =. arXiv preprint arXiv:2111.02767 , year =

    arXiv

  2. [10]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages =

    Neural 3d mesh renderer , author =. Proceedings of the IEEE conference on computer vision and pattern recognition , pages =

  3. [11]

    Proceedings of the IEEE/CVF international conference on computer vision , pages =

    Soft rasterizer: A differentiable renderer for image-based 3d reasoning , author =. Proceedings of the IEEE/CVF international conference on computer vision , pages =

  4. [12]

    Seminal graphics: pioneering efforts that shaped the field , pages =

    Illumination for computer generated pictures , author =. Seminal graphics: pioneering efforts that shaped the field , pages =

  5. [13]

    Proceedings of the IEEE conference on computer vision and pattern recognition , pages =

    Robust physical-world attacks on deep learning visual classification , author =. Proceedings of the IEEE conference on computer vision and pattern recognition , pages =

  6. [14]

    IEEE transactions on pattern analysis and machine intelligence , volume =

    Simultaneously Optimizing Perturbations and Positions for Black-Box Adversarial Patch Attacks , author =. IEEE transactions on pattern analysis and machine intelligence , volume =

  7. [15]

    Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages =

    Adversarial camouflage: Hiding physical-world attacks with natural styles , author =. Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages =

  8. [16]

    Proceedings of the 2016 acm sigsac conference on computer and communications security , pages =

    Accessorize to a crime: Real and stealthy attacks on state-of-the-art face recognition , author =. Proceedings of the 2016 acm sigsac conference on computer and communications security , pages =

    2016

  9. [17]

    IEEE Access , volume =

    Advances in adversarial attacks and defenses in computer vision: A survey , author =. IEEE Access , volume =. 2021 , publisher =

    2021

  10. [18]

    International conference on machine learning , pages =

    Synthesizing robust adversarial examples , author =. International conference on machine learning , pages =. 2018 , organization =

    2018

  11. [19]

    IEEE Transactions on Emerging Topics in Computational Intelligence , volume =

    A survey of embodied ai: From simulators to research tasks , author =. IEEE Transactions on Emerging Topics in Computational Intelligence , volume =. 2022 , publisher =

    2022

  12. [20]

    International Conference on Learning Representations , year =

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale , author =. International Conference on Learning Representations , year =

  13. [21]

    International conference on machine learning , pages =

    Learning transferable visual models from natural language supervision , author =. International conference on machine learning , pages =. 2021 , organization =

    2021

  14. [22]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    On scaling up a multilingual vision and language model , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  15. [23]

    First Workshop on Vision-Language Models for Navigation and Manipulation at ICRA 2024 , year =

    Octo: An Open-Source Generalist Robot Policy , author =. First Workshop on Vision-Language Models for Navigation and Manipulation at ICRA 2024 , year =

    2024

  16. [24]

    IEEE Robotics and Automation Letters , year =

    Tinyvla: Towards fast, data-efficient vision-language-action models for robotic manipulation , author =. IEEE Robotics and Automation Letters , year =

  17. [25]

    arXiv preprint arXiv:2411.13587 , year =

    Exploring the adversarial vulnerabilities of vision-language-action models in robotics , author =. arXiv preprint arXiv:2411.13587 , year =

    arXiv

  18. [26]

    Chen, Jiawei and Huang, Simin and Du, Jiawei and Chen, Shuaihang and Tian, Yu and Wei, Mingjie and Yu, Chao and Yin, Zhaoxia , journal =

  19. [27]

    2026 , eprint =

    When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models , author =. 2026 , eprint =

    2026

  20. [28]

    Robotics: Science and Systems , year =

    Rt-1: Robotics transformer for real-world control at scale , author =. Robotics: Science and Systems , year =

  21. [29]

    2024 IEEE International Conference on Robotics and Automation (ICRA) , pages =

    Open x-embodiment: Robotic learning datasets and rt-x models: Open x-embodiment collaboration 0 , author =. 2024 IEEE International Conference on Robotics and Automation (ICRA) , pages =. 2024 , organization =

    2024

  22. [30]

    DINOv2: Learning Robust Visual Features without Supervision , author=. Trans. Mach. Learn. Res. , year=

  23. [31]

    arXiv preprint arXiv:2410.24164 , year =

    _0 : A Vision-Language-Action Flow Model for General Robot Control , author =. arXiv preprint arXiv:2410.24164 , year =

    arXiv

  24. [32]

    Physical Intelligence and Kevin Black and Noah Brown and James Darpinian and Karan Dhabalia and Danny Driess and Adnan Esmail and Michael Equi and Chelsea Finn and Niccolo Fusai and Manuel Y. Galliker and Dibya Ghosh and Lachy Groom and Karol Hausman and Brian Ichter and Szymo...

    arXiv

  25. [33]

    arXiv preprint arXiv:2412.14058 , year =

    Towards generalist robot policies: What matters in building vision-language-action models , author =. arXiv preprint arXiv:2412.14058 , year =

    arXiv

  26. [34]

    International Conference on Machine Learning , pages=

    3D-VLA: A 3D Vision-Language-Action Generative World Model , author=. International Conference on Machine Learning , pages=. 2024 , organization=

    2024

  27. [35]

    The International Journal of Robotics Research , pages=

    Diffusion policy: Visuomotor policy learning via action diffusion , author=. The International Journal of Robotics Research , pages=. 2023 , publisher=

    2023

  28. [36]

    Multimodal Diffusion Transformer: Learning Versatile Behavior from Multimodal Goals , author=

  29. [37]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Sigmoid loss for language image pre-training , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  30. [38]

    arXiv preprint arXiv:2307.09288 , year=

    Llama 2: Open foundation and fine-tuned chat models , author=. arXiv preprint arXiv:2307.09288 , year=

    arXiv

  31. [39]

    International Conference on Learning Representations , year=

    Explaining and harnessing adversarial examples , author=. International Conference on Learning Representations , year=

  32. [40]

    International Conference on Learning Representations , year=

    Towards Deep Learning Models Resistant to Adversarial Attacks , author=. International Conference on Learning Representations , year=

  33. [41]

    2017 ieee symposium on security and privacy (sp) , pages=

    Towards evaluating the robustness of neural networks , author=. 2017 ieee symposium on security and privacy (sp) , pages=. 2017 , organization=

    2017

  34. [42]

    IEEE Transactions on Information Forensics and Security , year=

    Efficient Generation of Targeted and Transferable Adversarial Examples for Vision-Language Models Via Diffusion Models , author=. IEEE Transactions on Information Forensics and Security , year=

  35. [43]

    2nd International Conference on Learning Representations, ICLR 2014 , year=

    Intriguing properties of neural networks , author=. 2nd International Conference on Learning Representations, ICLR 2014 , year=

    2014

  36. [44]

    Pattern Recognition Letters , volume=

    Consistent attack: Universal adversarial perturbation on embodied vision navigation , author=. Pattern Recognition Letters , volume=. 2023 , publisher=

    2023

  37. [45]

    Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part XVII 16 , pages=

    Spatiotemporal attacks for embodied agents , author=. Computer Vision--ECCV 2020: 16th European Conference, Glasgow, UK, August 23--28, 2020, Proceedings, Part XVII 16 , pages=. 2020 , organization=

    2020

  38. [46]

    arXiv preprint arXiv:2409.10071 , year=

    Towards Physically-Realizable Adversarial Attacks in Embodied Vision Navigation , author=. arXiv preprint arXiv:2409.10071 , year=

    arXiv

  39. [47]

    arXiv preprint arXiv:2410.07864 , year=

    Rdt-1b: a diffusion foundation model for bimanual manipulation , author=. arXiv preprint arXiv:2410.07864 , year=

    arXiv

  40. [48]

    Proceedings of the IEEE/CVF international conference on computer vision , pages=

    Scalable diffusion models with transformers , author=. Proceedings of the IEEE/CVF international conference on computer vision , pages=

  41. [49]

    Robotics: Science and Systems , year=

    Language-driven representation learning for robotics , author=. Robotics: Science and Systems , year=

  42. [50]

    Forty-first International Conference on Machine Learning , year=

    Prismatic vlms: Investigating the design space of visually-conditioned language models , author=. Forty-first International Conference on Machine Learning , year=

  43. [51]

    ICLR , year=

    Vision-Language Foundation Models as Effective Robot Imitators , author=. ICLR , year=

  44. [52]

    Advances in neural information processing systems , volume=

    Flamingo: a visual language model for few-shot learning , author=. Advances in neural information processing systems , volume=

  45. [53]

    arXiv preprint arXiv:2308.01390 , year=

    Openflamingo: An open-source framework for training large autoregressive vision-language models , author=. arXiv preprint arXiv:2308.01390 , year=

    arXiv

  46. [54]

    on quaternions; or on a new system of imaginaries in algebra , author=

    Ii. on quaternions; or on a new system of imaginaries in algebra , author=. The London, Edinburgh, and Dublin Philosophical Magazine and Journal of Science , volume=. 1844 , publisher=

  47. [55]

    Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

    Semantic audio-visual navigation , author=. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages=

  48. [56]

    International Conference on Machine Learning , pages=

    PaLM-E: An Embodied Multimodal Language Model , author=. International Conference on Machine Learning , pages=. 2023 , organization=

    2023

  49. [57]

    International conference on machine learning , pages=

    Visualizing and understanding atari agents , author=. International conference on machine learning , pages=. 2018 , organization=

    2018

  50. [58]

    Soft rasterizer: a differentiable renderer for image-based

    Liu, Shichen and Li, Tianye and Chen, Weikai and Li, Hao , year =. Soft rasterizer: a differentiable renderer for image-based

  51. [59]

    IEEE Journal on Robotics and Automation , volume=

    Introduction to robotics: Mechanics and control , author=. IEEE Journal on Robotics and Automation , volume=. 1987 , publisher=

    1987

  52. [60]

    1955 , publisher=

    A kinematic notation for lower-pair mechanisms based on matrices , author=. 1955 , publisher=

    1955

  53. [61]

    Robotics: Science and Systems , year =

    Fine-Tuning Vision-Language-Action Models: Optimizing Speed and Success , author =. Robotics: Science and Systems , year =

  54. [62]

    Pertsch, Karl and Stachowicz, Kyle and Ichter, Brian and Driess, Danny and Nair, Suraj and Vuong, Quan and Mees, Oier and Finn, Chelsea and Levine, Sergey , journal =

  55. [63]

    arXiv preprint arXiv:2503.14734 , year =

    arXiv

  56. [64]

    arXiv preprint arXiv:2503.20020 , year =

    Gemini Robotics: Bringing. arXiv preprint arXiv:2503.20020 , year =

    arXiv

  57. [65]

    Shukor, Mustafa and Aubakirova, Dana and Capuano, Francesco and Kooijmans, Pepijn and Palma, Steven and Zouitine, Adil and Aractingi, Michel and Pascal, Caroline and Russi, Martino and Marafioti, Andres and Alibert, Simon and Cord, Matthieu and Wolf, Thomas and Cadene, Remi , ...

  58. [66]

    Zhou, Xueyang and Tie, Guiyao and Zhang, Guowen and Wang, Hechang and Zhou, Pan and Sun, Lichao , journal =

  59. [67]

    arXiv preprint arXiv:2506.03350 , year =

    Adversarial Attacks on Robotic Vision Language Action Models , author =. arXiv preprint arXiv:2506.03350 , year =

    arXiv

  60. [68]

    arXiv preprint arXiv:2510.00037 , year =

    On Robustness of Vision-Language-Action Model against Multi-Modal Perturbations , author =. arXiv preprint arXiv:2510.00037 , year =

    arXiv

  61. [69]

    arXiv preprint arXiv:2409.13174 , year =

    Manipulation Facing Threats: Evaluating Physical Vulnerabilities in End-to-End Vision Language Action Models , author =. arXiv preprint arXiv:2409.13174 , year =

  62. [70]

    Phantom Menace: Exploring and Enhancing the Robustness of

    Lu, Xuancun and Chen, Jiaxiang and Xiao, Shilin and Jin, Zizhi and Chen, Zhangrui and Yu, Hanwen and Qian, Bohan and Zhou, Ruochen and Ji, Xiaoyu and Xu, Wenyuan , booktitle =. Phantom Menace: Exploring and Enhancing the Robustness of

  63. [71]

    Cui, Rongxu and Zhang, Zongzheng and Pang, Jingrui and Chi, Haohan and Guo, Jinbang and Zhang, Saining and Xie, Shaoxuan and Jin, Xin and Mu, Yao and Yang, Jiaolong and Yao, Guocai and Zhan, Xianyuan and Zhang, Ya-Qin and Zhao, Hao , booktitle =

  64. [72]

    Fu, Jiyuan and Jiang, Kaixun and Jia, Jingkai and Chen, Zhaoyu and Chen, Xueyao and Hong, Lingyi and Gao, Shuyong and Tan, Chenzhi and Yang, Dingkang and Zhang, Wenqiang , journal =

  65. [73]

    Zhang, Yuhao and Zhang, Borong and Fan, Jiaming and Shen, Jiachen and Cai, Yishuai and Yang, Yaodong and Ji, Jiaming , journal =

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.