AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models

TL;DR

This paper introduces AttackVLA, a comprehensive benchmarking framework for evaluating adversarial and backdoor attacks on vision-language-action models, highlighting vulnerabilities and proposing a targeted backdoor attack with promising results.

Contribution

It presents AttackVLA, a unified evaluation framework for VLA attacks, and introduces BackdoorVLA, a novel targeted backdoor attack for long-horizon action sequences.

Findings

Current attacks often cause untargeted failures or static states.

BackdoorVLA achieves an average success rate of 58.4%.

Evaluation in real-world settings demonstrates practical vulnerabilities.

Abstract

Vision-Language-Action (VLA) models enable robots to interpret natural-language instructions and perform diverse tasks, yet their integration of perception, language, and control introduces new safety vulnerabilities. Despite growing interest in attacking such models, the effectiveness of existing techniques remains unclear due to the absence of a unified evaluation framework. One major issue is that differences in action tokenizers across VLA architectures hinder reproducibility and fair comparison. More importantly, most existing attacks have not been validated in real-world scenarios. To address these challenges, we propose AttackVLA, a unified framework that aligns with the VLA development lifecycle, covering data construction, model training, and inference. Within this framework, we implement a broad suite of attacks, including all existing attacks targeting VLAs and multiple adapted attacks originally developed for vision-language models, and evaluate them in both simulation and real-world settings. Our analysis of existing attacks reveals a critical gap: current methods tend to induce untargeted failures or static action states, leaving targeted attacks that drive VLAs to perform precise long-horizon action sequences largely unexplored. To fill this gap, we introduce BackdoorVLA, a targeted backdoor attack that compels a VLA to execute an attacker-specified long-horizon action sequence whenever a trigger is present. We evaluate BackdoorVLA in both simulated benchmarks and real-world robotic settings, achieving an average targeted success rate of 58.4% and reaching 100% on selected tasks. Our work provides a standardized framework for evaluating VLA vulnerabilities and demonstrates the potential for precise adversarial manipulation, motivating further research on securing VLA-based embodied systems.