Beyond Patch Removal: Persistent Adversarial Effects in Vision-Language-Action Policies

2026-09-17

AI Summary

研究解决了视觉-语言-动作策略中对抗补丁移除后的持续影响问题，通过引入状态恢复协议和评估恢复适配器的方法来应对。

Abstract

Adversarial patches to Vision-Language-Action (VLA) policies can cause both immediate action corruption and persistent state effects that remain after the patch is removed. Existing evaluations largely focus on continuous attacks and do not separate these two effects. We introduce a state-restoration protocol that removes the patch at matched action-chunk boundaries and measures subsequent recoverability under the same remaining step budget. Clean, random-patch, deviation-matched, and fixed-direction controls distinguish adversarial effects from occlusion, action-error magnitude, and directional persistence. We also evaluate a recovery adapter trained on attack-induced states under controlled intervention latency. On OpenVLA-OFT with EDPA attacks, only 36.2% of LIBERO-Long episodes remain recoverable after five chunks, compared with 89.9% and 87.0% for the deviation-matched and fixed-direction controls. Similar persistent effects are observed on autoregressive OpenVLA. The recovery adapter improves recovery from 7.7% to 47.4% at one-chunk latency, but its benefit decreases substantially with delayed intervention. These results show that adversarial effects can persist after patch removal and that timely intervention is critical for recovery.

Problem

• Adversarial Patches
• Vision-Language-Action Policies
• Persistent Effects
• State Restoration
• Recovery

Innovation

• state-restoration protocol
• recovery adapter
• persistent adversarial effects