Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models

Vision-Language-Action (VLA) models have demonstrated strong control capabilities across diverse manipulation tasks, but their adversarial robustness remains largely unexplored — and exploiting this weakness can cause physical-world harm. Prior attacks on VLA models mostly rely on pixel-space perturbations or white-box access, producing noticeable artifacts and limited deployability in real robotic systems.

Core Innovation

DURA is a diffusion-based unrestricted robotic attack that generates visually natural adversarial patches for VLA models. Unlike conventional attacks constrained to imperceptible pixel perturbations, DURA optimizes along the latent trajectory of a pretrained diffusion model, so the resulting patches look natural while still steering the robot toward attacker-specified target actions.

It supports both white-box and black-box settings; the black-box variant requires only the predicted actions of the victim model, no gradients or internal access. This makes the attack practical against deployed VLA systems where only the action output is observable.

Results

• Extensive experiments in both simulation and the real physical world
• DURA consistently outperforms existing attack methods across settings
• The black-box mode demonstrates that action-output-only access is sufficient to mount effective attacks

Limitations

The abstract reports qualitative superiority over existing methods without publishing exact success-rate numbers, so the attack’s absolute efficacy is not yet quantified in the preprint text. Patch-based attacks presuppose the attacker can physically place a patch in the robot’s scene. The work focuses on attacks and explicitly calls for stronger defenses, which remain future work.

Industry Implications

This paper is a red-team wake-up call for the robotics industry: physically deployed VLA systems — from warehouse arms to humanoids — inherit neural-network vulnerabilities, and natural-looking patches can be a realistic attack vector in shared human environments. It argues for adversarial robustness testing as part of VLA deployment pipelines, and motivates defensive research on certified or robustified action policies. For safety-critical robotic deployments, understanding and mitigating this attack surface is becoming a deployment prerequisite rather than an academic nicety.