Search papers, labs, and topics across Lattice.
This paper investigates the vulnerability of quantized Vision-Language-Action (VLA) models to bit-flip attacks, revealing that targeted gradient-selected flips can reduce closed-loop success rates to 0%. The study finds that damaging bit flips are concentrated in specific action-generating layers, with the number of flips required for effective attacks varying significantly across different action-head architectures. By employing a fixed-direction manifold-escape loss, the authors demonstrate a reduction in the number of necessary flips for successful attacks, highlighting the critical importance of weight integrity in ensuring the security of embodied foundation models.
Targeted bit-flip attacks can cripple Vision-Language-Action models, reducing their success rates to zero with just a few flips in key layers.
Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0\%$, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in $1$--$5$ flips, whereas the evaluated flow-matching policies require ${\sim}100$--$300$. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from ${\sim}1000$ to ${\sim}100$ flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting $3.1\%$ of weights preserves $60\%$ success at $K{=}100$, and protecting $5.3\%$ moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated $K{=}100$ flips yield $0/20$ real-robot successes, versus $14/20$ clean and $16/20$ global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.
