Technical Summary: Trajectory-Level Redirection Attacks on Vision-Language-Action Models

Problem Statement

Vision-Language-Action (VLA) models enable robots to execute manipulation tasks directly from natural language instructions by mapping text and camera observations to actions. A critical safety concern arises because the language instruction acts as a persistent conditioning signal in the closed-loop control system; it is reused at every replanning step. While existing adversarial research on VLAs has focused on eliciting targeted low-level actions or making such actions persist across changing images, these approaches do not necessarily control the robot's final physical outcome.

This paper identifies a stronger failure mode: Command-Preserving Trajectory Redirection. The problem is defined as finding a single text prompt, issued once at the start of an episode, that:

1. Preserves the command: Remains textually close to the benign instruction (e.g., "put the bowl on the stove"), is readable, and contains no explicit target task or correction language.
2. Redirects the trajectory: Despite appearing benign, the prompt causes the frozen VLA policy to execute a sequence of actions that results in a different, adversary-specified physical outcome (e.g., placing the bowl on a plate instead of the stove).

The core challenge is that the relevant observations for the policy are not fixed; they are induced by the actions taken under the candidate prompt. Therefore, optimizing a prompt based on a static set of pre-collected observations fails because the state distribution shifts as the robot's behavior changes.

Methodology

The authors propose an On-Policy Teacher-Matching Prompt Search algorithm to discover such redirection prompts. The method treats the attack as a trajectory-level optimization problem rather than a static input perturbation.

1. Threat Model and Constraints

The adversary controls only the text instruction $\tau$ before the episode begins. The prompt must satisfy the Command-Preserving constraint set $T_{cp}(\tau_b, \Gamma_e)$, which includes:

• Small Text Change: Bounded character edit distance ($C_{text} \le \epsilon$) from the benign prompt $\tau_b$.
• Validity: The prompt must be a readable natural language instruction.
• No Leakage: The prompt must not contain words or phrases from the attacker's target lexicon $\Gamma_e$ (e.g., "plate" in a "stove" task) or override/correction language.
• Preservation: The prompt must remain interpretable as the benign command after normalization and spell correction.

2. On-Policy Search Algorithm

The search iteratively refines candidate prompts using the following loop:

• Teacher Labels: The frozen VLA is queried under the benign prompt ($\tau_b$) and a direct target prompt ($\tau_t$, used only for construction) to generate "teacher" action chunks ($A_b$ and $A_t$) for observed states.
• Candidate Generation: New prompts are generated via character-level mutations (substitutions, insertions, swaps, typos) and token-level perturbations of high-scoring candidates.
• Constraint Filtering: Candidates are filtered to ensure they meet the command-preserving constraints.
• Scoring: Candidates are scored based on a target-vs-benign margin loss. The algorithm seeks prompts whose actions are closer to the target teacher ($A_t$) than the benign teacher ($A_b$) at the same observation, while minimizing text cost.
• On-Policy Aggregation: Crucially, the search aggregates data from the states induced by the current candidate prompts (rollouts), not just the initial benign trajectory. This mimics the DAgger algorithm in imitation learning, ensuring the search accounts for the sequential distribution shift caused by the perturbation.
• Rollout Selection: Top candidates are evaluated in closed-loop rollouts. The best prompt is selected based on a score that rewards reaching the target, failing the benchmark, and minimizing text perturbation.
• Minimization: Once a successful prompt is found, a greedy minimization process removes unnecessary edits to find the shortest effective perturbation.

Key Contributions

1. Formalization of Command-Preserving Trajectory Redirection: The paper mathematically defines a threat model where a single, near-benign prompt redirects a frozen VLA to an adversary-specified physical goal without explicit target instructions.
2. On-Policy Prompt Search: Introduction of a search method that uses closed-loop rollouts to discover perturbations, addressing the limitation of fixed-observation attacks which fail to account for state distribution shifts.
3. Comprehensive Evaluation: The method is evaluated across nine diverse VLA architectures (including OpenVLA, $\pi0.5$, Octo, SmolVLA, GR00T-N1) spanning discrete-token, flow-matching, diffusion, and action-as-text designs, in both simulation (LIBERO) and real-world hardware (SO-100 arm).
4. Defense Analysis: An evaluation of preprocessing defenses (whitespace normalization, spell correction, canonicalization), demonstrating that surface-level cleaning is insufficient and that command-level normalization is required.

Results

• High Success Rates: The attacks achieved success rates (ASR) above 90% on seven of the nine evaluated VLA architectures. For example, $\pi0.5$ had a 97.5% ASR, and MolmoAct had 93.4%.
• Minimal Perturbations: Successful attacks required very small text changes, with a median character edit distance of only 3.4 characters (e.g., changing "stove" to "staove").
• Hardware Validation: The vulnerability persists on real hardware. Experiments on the SO-100 arm showed that near-benign perturbations caused the original task success rate to collapse (e.g., dropping from ~90% to near 0%) while successfully redirecting the robot to the attacker's target.
• Causal Analysis: Causal tracing revealed that the attack effect is concentrated in the destination representation. Perturbing the destination word (e.g., "stove") creates hidden states that steer the action head toward the alternate behavior, while perturbing other words (e.g., "put") has little effect.
• Defense Effectiveness: Lightweight defenses like whitespace normalization or punctuation stripping failed to stop the attacks. Spell correction reduced success rates but was not robust. Only nearest-task canonicalization (mapping prompts to a finite set of validated commands) significantly reduced attack success, though it risks reducing usability for open-vocabulary instructions.

Significance and Claims

The paper claims to expose a fundamental trajectory-level vulnerability in VLA instruction grounding. The authors argue that text appearing to preserve the intended command can still grant an adversary control over the robot's final physical outcome.

The significance lies in demonstrating that:

• Persistence is not enough: Simply making an action persist across images is insufficient to control the final outcome; the entire closed-loop trajectory must be redirected.
• Static evaluation is flawed: Evaluating prompts on fixed observations is inadequate because the prompt controls the future state distribution.
• Robustness requires structural changes: Surface-level text cleanup is insufficient. Robust deployment requires treating language grounding as part of the closed-loop control system, potentially necessitating command normalization layers that map noisy inputs to a validated set of tasks before action generation.

The authors remain modest regarding the scope, noting that their evaluation focuses on manipulation tasks in specific environments (LIBERO and SO-100) and that the search assumes query access, which may overestimate attacker capabilities in fully locked-down deployments. Future work is suggested to develop certified prompt-preservation defenses.