Search papers, labs, and topics across Lattice.
This paper introduces FLARE, a novel physical spotlight attack framework that reveals significant vulnerabilities in Vision-Language-Action (VLA) models when exposed to targeted illuminations, leading to a complete failure in task success rates. The authors highlight a critical flaw in existing defenses, where naive data augmentations cause VLA models to misinterpret color as noise, resulting in a drastic drop in performance on color-dependent tasks. To counteract this issue, they propose ChromaGuard, a chroma-preserving adversarial training method that significantly enhances model robustness, achieving high success rates even under adversarial conditions.
Targeted illumination attacks can reduce VLA model task success rates to zero, exposing a critical flaw in current defense strategies that misinterpret color information.
Vision-Language-Action (VLA) models have emerged as a powerful paradigm for general-purpose robot manipulation; however, their transition to real-world environments reveals vulnerabilities to minor environmental perturbations. We propose FLARE, an optimized physical spotlight attack framework that exploits these vulnerabilities via targeted illuminations, dropping baseline task success rates to zero without any access to model internals. While adversarial training is the standard countermeasure, we identify a critical and previously underestimated defensive pitfall: naive data augmentations incorrectly condition VLA models to discard color as noise, collapsing their visual perception into a purely shape-biased processor. We expose this degradation through a diagnostic grayscale evaluation, in which the defended model maintains high success rates on grayscale inputs, while its success rate on benign, color-dependent real-world tasks drops to at most 47.5%, well below the undefended baseline. To address this, we propose ChromaGuard, a chroma-preserving adversarial training method. On a physical 6-DoF robotic platform, we demonstrate that ChromaGuard achieves 97.5% and 92.5% success rates in benign and attacked color-dependent tasks, respectively.
