Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability

Abstract:Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0\%$, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in $1$--$5$ flips, whereas the evaluated flow-matching policies require ${\sim}100$--$300$. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from ${\sim}1000$ to ${\sim}100$ flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting $3.1\%$ of weights preserves $60\%$ success at $K{=}100$, and protecting $5.3\%$ moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated $K{=}100$ flips yield $0/20$ real-robot successes, versus $14/20$ clean and $16/20$ global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.

Cryptography and Security (cs.CR); Artificial Intelligence (cs.AI)

arXiv:2608.15475 [cs.CR]

(or arXiv:2608.15475v1 [cs.CR] for this version)

https://doi.org/10.48550/arXiv.2608.15475 Focus to learn more arXiv-issued DOI via DataCite (pending registration)

code/analysis/analyze_cancellation_multiseed.py

code/bfa_vla/__init__.py

code/bfa_vla/int8_attack.py

code/openvla/discrete_defense.py

code/openvla/discrete_full_int8.py

code/openvla/discrete_spatial_attack.py

code/openvla/discrete_suite_attack.py

code/openvla/libero_eval_adapter.py

code/openvla/simplerenv_attack.py

code/pi0/direction_sweep.py

code/pi0/eval_adapter.py

code/pi0/step_cancellation.py

code/pi05/attack_pi05.py

code/pi05/load_pi05.py

code/pyproject.toml

code/real_robot/apply_logical_flips.py

code/requirements.txt

(13 additional files not shown) You must enabled JavaScript to view entire file list.

arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs.