DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack

2026-08-04

AI Summary

This work uncovers a critical vulnerability in current adversarially robust flow-matching vision-language-action (VLA) models: perturbing only the initial denoising step suffices to efficiently degrade policy performance. To exploit this weakness, the authors propose DRIFT, a method that deploys a universal adversarial patch on robotic grippers, optimizing input-space perturbations to disrupt the denoising trajectory of the flow-matching ordinary differential equation (ODE). The study demonstrates that attacks targeting the first denoising step are both most effective and computationally cheapest, revealing a gradient conflict mechanism distinct from backdoor attacks during training. Evaluated on pi0/pi0.5 models across four LIBERO benchmarks, a single patch nearly abolishes performance on all previously solvable tasks, substantially outperforming baseline attacks in action and embedding spaces.

Abstract

Flow-matching vision-language-action (VLA) models such as pi0 generate robot actions by integrating a learned denoising velocity field, and have been reported to resist adversarial perturbations that readily fool autoregressive VLAs. We show that this robustness is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE. We introduce DRIFT (Denoising Redirection via Input perturbation of the Flow-matching Trajectory), a test-time universal adversarial patch placed on the robot's gripper that attacks the denoising velocity field of an off-the-shelf policy. Our central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps, which we explain through a gradient conflict unique to input-space optimization and which is exactly opposite to the training-time backdoor regime. On pi0 and pi0.5 across four LIBERO suites, DRIFT breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embedding-space attack baselines.

Problem

• flow-matching
• vision-language-action
• adversarial attack
• denoising trajectory
• robotic policy

Innovation

• flow-matching
• adversarial patch
• denoising trajectory
• vision-language-action
• input-space attack