UniTexture is introduced, a cross-task universal adversarial texture attack that uses a single textured 3D object to induce targeted deviations in VLA action predictions across multiple tasks and reveals shared cross-task vulnerabilities in multitask VLAs that can be systematically exploited through a single adversarial surface texture.
Abstract
Vision-Language-Action (VLA) models have emerged as generalist robotic policies capable of following diverse language instructions and performing a wide range of manipulation tasks. However, their direct control over embodied agents also exposes them to adversarial interference that may cause unsafe physical behaviors. Existing attacks on robotic policies are typically optimized for a single task or instruction, leaving the cross-task vulnerabilities of multitask VLAs largely unexplored. We introduce UniTexture, a cross-task universal adversarial texture attack that uses a single textured 3D object to induce targeted deviations in VLA action predictions across multiple tasks. UniTexture backpropagates gradients from the policy's action outputs to surface texture parameters through a differentiable renderer. It jointly optimizes the shared texture over a distribution of tasks, instructions, states, and viewpoints using a targeted action-space objective, steering predicted actions toward attacker-defined targets without optimizing a separate texture for each task. We evaluate UniTexture on OpenVLA and $\pi_{0.5}$ across diverse manipulation tasks and multiple evaluation settings. UniTexture reduces the mean task success rate from 90.0% under benign conditions to 48.4% under attack, induces target-aligned action shifts, and further exhibits cross-suite and cross-model transfer without re-optimization. Together, these findings reveal shared cross-task vulnerabilities in multitask VLAs that can be systematically exploited through a single adversarial surface texture.
Vision–Language–Action (VLA) policies remain brittle under modest distribution shift. On LIBERO-Plus, contemporary models that solve clean tasks at high rates can fall below 30% success when the camera’s viewpoint or the robot’s initial pose is perturbed. Most training-free test-time remedies address this problem through the image stream, for example, by augmenting, purifying, or selecting visual observations. In our controlled evaluation, this family of methods improves mean success by only about three points and leaves the robot-initial-state failure largely unresolved. This paper studies the failure at the level of input streams. A VLA receives visual tokens, a proprioceptive state token, and language tokens; different perturbations can move different streams away from their training manifold. In particular, the robot-initial-state perturbation directly shifts the proprioceptive token; therefore, image-space interventions have limited leverage. We introduce Gated Per-Stream Manifold Restoration (G-PSMR), a training-free wrapper for a frozen policy. For each stream, a lightweight gate detects off-manifold inputs and applies a stream-specific restoration before the policy forward pass. We instantiate the framework with entropy-gated visual consensus and gated relative-orientation debiasing, which preserves the within-episode orientation trajectory. In the original 280-episode paired evaluation, the joint method improves total success by +5.3 points compared with a +3.2 image-only gain and raises the most fragile factor from 20% to 38%. On 1120 previously unevaluated, manifest-disjoint task instances, the state restoration improves robot-initial-state success from 23.8% to 28.7%; a separate prospectively specified confirmation on 600 new gate-active instances yields 26.3%→32.2% (+5.8 points; 95% CI [+3.2,+8.5]; p<0.001). Together, the original cross-stream results and two independent state-stream evaluations support the central principle of matching the restoration to the input stream carrying the shift.
DiMaS is proposed, a Distribution-Matching Steering strategy tailored to flow-matching VLAs, which transports between representation distributions rather than shifting along a fixed direction, and it effectively controls behavior across two state-of-the-art VLAs.
Pegah Khayatan, Sara Meziane, Jayneel Parekh et al.· arXiv.org· 0 citations
Finetuning a pretrained vision-language model (VLM) on robot demonstrations via behavior cloning (BC) has become the standard recipe for vision-language-action (VLA) policies. However, BC finetuning progressively overwrites the pretrained representations that support visual and semantic generalization. Co-training on web image-text data, a common remedy, does not prevent this; it applies language and action losses to separate observations, leaving VLAs with language-action misalignment that standard manipulation benchmarks do not expose. We propose Anchor-Align, which augments BC with two objectives: Vision-Language Anchoring distills layer-wise representations from a frozen VLM copy to prevent this drift, while Language-Action Alignment converts each action target into a discrete motion-direction label and jointly trains language and action prediction on the same robot observation. On a physical xArm7 robot, across two widely used VLA architectures, Anchor-Align improves real-robot success on both (28% to 54% and 37% to 60%). At scale in simulation, we demonstrate consistent improvements on OOD perturbations, perceptual robustness, and long-horizon control across LIBERO-PRO, LIBERO-Plus, and CALVIN, respectively, suggesting that preserving pretrained representations and effective action learning are not fundamentally at odds. Project page: anchoralignvla.github.io
The prevailing recipe for Vision-Language-Action (VLA) models couples a pretrained VLM with a separately trained flow-matching action expert. This makes the VLM a context encoder rather than a decision-maker. We introduce G0.5, a pretrained autoregressive VLA in which a single transformer decoder emits reasoning and action tokens under a single objective. Three components make this tractable at foundation-model scale: a learnable cross-embodiment action tokenizer that maps heterogeneous robot actions into a shared vocabulary; a native chain-of-thought stream interleaving task decomposition, object grounding, and action hints with action tokens; and a visual memory module that injects multi-second history through the vision encoder. Because reasoning and action share a single set of weights, the pretrained VLM's capabilities carry over to physical behavior: the model follows instructions closely, and prompts directly steer action granularity, task horizon, and out-of-distribution scene handling without further training. Pretrained on a large collection of robot datasets together with VQA samples, G0.5 surpasses state-of-the-art models across 7 independent regimes: real-world fine-tuning on R1lite and R1pro robots (76.7\% vs.\ 53.3\% for $\pi_{0.5}$ and 24.4\% for GR00T-N1.7), the 2025 BEHAVIOR Challenge on 50 long-horizon household mobile manipulation tasks using a generalist policy (31.4\% vs.\ 26.3\% for $\pi_{0.5}$ and 26.1\% for the challenge winner), DROID post-training followed by zero-shot transfer to an unseen environment and objects (82.5\%), a language-following Pick-and-Place benchmark, LIBERO (98.9\%), RoboTwin 2.0 (93.3\%), and SimplerEnv-Bridge (87.3\%).
Yicheng Liu, Zibin Dong, Baijun Ye et al.· 4 citations· ⚡1
Attention-Guided Semantic Disruption (AGSD), an Expectation-over-Transformation optimized printable patch that jointly concentrates action-to-vision attention on the patch and disrupts vision-language semantic alignment, yielding strong cross-task and cross-architecture transfer is proposed.
Jinquan Zhang, Dongfu Yin, Run Yang et al.· 0 citations
The real-robot benchmark demonstrates that StellaVLA can use both human/robot demos and human-to-robot (XR) demos as in-context structured demonstration to help VLA model adapt to OOD tasks.
Siyu Xu, Yunke Wang, Zijian Wang et al.· 0 citations
We use cookies to run the site and, with your consent, for analytics and to show ads.
See our Cookie Policy.
