Search papers, labs, and topics across Lattice.
VLA-Hijack is introduced as a novel adversarial patch attack framework against Vision-Language-Action (VLA) models, designed to overcome the poor transferability of existing attacks. The method exploits the VLA model's reliance on visual self-localization by suppressing the real robotic arm's features while injecting a "phantom embodiment" via the adversarial patch. Experiments across OpenVLA, UniVLA, and CronusVLA show VLA-Hijack achieves state-of-the-art cross-architecture and cross-domain black-box transferability, along with improved white-box optimization efficiency.
VLA models are surprisingly susceptible to a single adversarial patch that hijacks their visual self-localization, creating a "phantom embodiment" that completely derails their control policy across different architectures and domains.
While Vision-Language-Action (VLA) models have emerged as powerful generalist policies, their severe vulnerability to adversarial patches significantly hinders their deployment in safety-critical domains. Moreover, existing patch attacks primarily focus on white-box settings, heavily overfitting to the specific action output space of the target model, which results in poor cross-architecture transferability. To overcome this limitation, we propose VLA-Hijack, a unified adversarial framework that breaks the transferability bottleneck by exploiting a fundamental vulnerability identified in this work: before planning any motion, a VLA model must first use visual information to locate its own robotic arm within the environment. Targeting this shared visual self-localization process, our approach concurrently optimizes Attention-Guided Proprioceptive Suppression to inhibit the real robotic arm's features, and Multimodal Proprioceptive Injection to establish the patch as a surrogate"phantom embodiment". By alternating between semantic concept anchoring and visual prototype projection, VLA-Hijack effectively severs the semantic relationship between the agent's true embodiment and its control policy. Extensive experiments across diverse architectures (OpenVLA, UniVLA, and CronusVLA) demonstrate that VLA-Hijack achieves superior optimization efficiency in white-box settings and sets a new SOTA for cross-architecture and cross-domain black-box transferability.
