TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches

• URL: http://arxiv.org/abs/2603.23117v1
• Date: Tue, 24 Mar 2026 12:14:12 GMT
• Title: TRAP: Hijacking VLA CoT-Reasoning via Adversarial Patches
• Abstract summary: Chain-of-Thought(CoT) reasoning has demonstrated strong capabilities in robotic manipulation.<n>We show that CoT reasoning introduces a novel attack vector for targeted control hijacking.<n>We propose TRAP, the first targeted adversarial attack framework for CoT-reasoning Vision-Language-Action models.
• Score: 16.543720979135397
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: By integrating Chain-of-Thought(CoT) reasoning, Vision-Language-Action (VLA) models have demonstrated strong capabilities in robotic manipulation, particularly by improving generalization and interpretability. However, the security of CoT-based reasoning mechanisms remains largely unexplored. In this paper, we show that CoT reasoning introduces a novel attack vector for targeted control hijacking--for example, causing a robot to mistakenly deliver a knife to a person instead of an apple--without modifying the user's instruction. We first provide empirical evidence that CoT strongly governs action generation, even when it is semantically misaligned with the input instructions. Building on this observation, we propose TRAP, the first targeted adversarial attack framework for CoT-reasoning VLA models. TRAP uses an adversarial patch (e.g., a coaster placed on the table) to corrupt intermediate CoT reasoning and hijack the VLA's output. By optimizing the CoT adversarial loss, TRAP induces specific and adversary-defined behaviors. Extensive evaluations across 3 mainstream VLA architectures and 3 CoT reasoning paradigms validate the effectiveness of TRAP. Notably, we implemented the patch by printing it on paper in a real-world setting. Our findings highlight the urgent need to secure CoT reasoning in VLA systems.

Related papers

• TrustVLA: Mechanism-Guided Inference-Time Defense Against Vision-Language-Action Backdoors [54.12833308568015]
  Vision-Language-Action (VLA) models are deployed through pipelines that end users cannot audit.<n>A small visual trigger redirects a long-horizon robot policy before any failure becomes observable.<n>We study this gap through two independently proposed VLA attacks from groups with distinct injection strategies.
  arXiv  Detail & Related papers  (2026-07-14T09:43:52Z)
• Revisiting Embodied Chain-of-Thought for Generalizable Robot Manipulation [24.465551417061494]
  Embodied chain-of-thought (CoT) aims to bridge linguistic reasoning and robotic control.<n>We construct the largest embodied CoT corpus to date, comprising 978,743 trajectories, 226.3M samples, and 2592.5 hours of robot data.
  arXiv  Detail & Related papers  (2026-06-02T15:37:59Z)
• Unreal Thinking: Chain-of-Thought Hijacking via Two-stage Backdoor [19.938570872083652]
  Large Language Models (LLMs) are increasingly deployed in settings where Chain-of-Thought (CoT) is interpreted by users.<n>This creates a new safety risk: attackers may manipulate the model's observable CoT to make malicious behaviors.<n>In practice, persistent CoT hijacking faces three main challenges.
  arXiv  Detail & Related papers  (2026-04-10T11:44:27Z)
• DualCoT-VLA: Visual-Linguistic Chain of Thought via Parallel Reasoning for Vision-Language-Action Models [50.07453075750711]
  Vision-Language-Action (VLA) models map visual observations and language instructions directly to robotic actions.<n>Recent efforts have incorporated Chain-of-Thought (CoT) reasoning to endow VLA models with a thinking before acting'' capability.<n>We propose DualCoT-VLA, a visual-linguistic CoT method for VLA models with a parallel reasoning mechanism.
  arXiv  Detail & Related papers  (2026-03-23T17:59:25Z)
• Altered Thoughts, Altered Actions: Probing Chain-of-Thought Vulnerabilities in VLA Robotic Manipulation [27.2709460237741]
  Recent Vision-Language-Action (VLA) models increasingly adopt chain-of-thought (CoT) reasoning, generating a natural-language plan before decoding motor commands.<n>We ask: which properties of this intermediate plan does the action decoder actually rely on, and can targeted corruption of the reasoning trace alone degrade a robot's physical task performance?<n>We design a taxonomy of seven text corruptions organized into three attacker tiers (blind noise, mechanical-semantic, and LLM-adaptive) and apply them to a state-of-the-art reasoning VLA across 40 tabletop manipulation tasks.
  arXiv  Detail & Related papers  (2026-03-13T07:02:51Z)
• TraceGuard: Process-Guided Firewall against Reasoning Backdoors in Large Language Models [19.148124494194317]
  We propose TraceGuard, a process-guided security framework that transforms small-scale models into robust reasoning firewalls.<n>Our approach treats the reasoning trace as an untrusted payload and establishes a defense-in-depth strategy.<n>We demonstrate robustness against adaptive adversaries in a grey-box setting, establishing TraceGuard as a viable, low-latency security primitive.
  arXiv  Detail & Related papers  (2026-03-02T22:19:13Z)
• Sleeper Cell: Injecting Latent Malice Temporal Backdoors into Tool-Using LLMs [0.0]
  Openweight Large Language Models (LLMs) have democratized agentic AI, yet finetuned weights are frequently shared and adopted with limited scrutiny beyond leaderboard performance.<n>This creates a risk where third-party models are incorporated without strong behavioral guarantees.<n>We show that poisoned models maintain state-of-the-art performance on benign tasks, incentivizing their adoption.
  arXiv  Detail & Related papers  (2026-03-02T22:01:08Z)
• Gaming the Judge: Unfaithful Chain-of-Thought Can Undermine Agent Evaluation [76.5533899503582]
  Large language models (LLMs) are increasingly used as judges to evaluate agent performance.<n>We show this paradigm implicitly assumes that the agent's chain-of-thought (CoT) reasoning faithfully reflects both its internal reasoning and the underlying environment state.<n>We demonstrate that manipulated reasoning alone can inflate false positive rates of state-of-the-art VLM judges by up to 90% across 800 trajectories spanning diverse web tasks.
  arXiv  Detail & Related papers  (2026-01-21T06:07:43Z)
• When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models [81.7618160628979]
  Vision-Language-Action (VLA) models are vulnerable to adversarial attacks, yet universal and transferable attacks remain underexplored.<n>We introduce UPA-RFAS (Universal Patch Attack via Robust Feature, Attention, and Semantics), a unified framework that learns a single physical patch in a shared feature space.<n> Experiments across diverse VLA models, manipulation suites, and physical executions show that UPA-RFAS consistently transfers across models, tasks, and viewpoints.
  arXiv  Detail & Related papers  (2025-11-26T09:16:32Z)
• DeepThinkVLA: Enhancing Reasoning Capability of Vision-Language-Action Models [51.76664843721462]
  DeepThinkVLA is a new architecture for Vision-Language-Action models.<n>It generates sequential CoT with causal attention and switches to bidirectional attention for fast decoding of action vectors.<n>It achieves a 97.0% success rate on the LIBERO benchmark.
  arXiv  Detail & Related papers  (2025-10-31T05:26:16Z)
• TabVLA: Targeted Backdoor Attacks on Vision-Language-Action Models [63.51290426425441]
  A backdoored VLA agent can be covertly triggered by a pre-injected backdoor to execute adversarial actions.<n>We study targeted backdoor attacks on VLA models and introduce TabVLA, a novel framework that enables such attacks via black-box fine-tuning.<n>Our work highlights the vulnerability of VLA models to targeted backdoor manipulation and underscores the need for more advanced defenses.
  arXiv  Detail & Related papers  (2025-10-13T02:45:48Z)
• Adversarial Manipulation of Reasoning Models using Internal Representations [1.308812559547533]
  Reasoning models generate chain-of-thought (CoT) tokens before their final output.<n>We identify a linear direction in activation space during CoT token generation that predicts whether the model will refuse or comply.<n>We show that intervening only on CoT token activations suffices to control final outputs, and that incorporating this direction into prompt-based attacks improves success rates.
  arXiv  Detail & Related papers  (2025-07-03T20:51:32Z)
• Enhancing Adversarial Attacks through Chain of Thought [0.0]
  gradient-based adversarial attacks are particularly effective against aligned large language models (LLMs) This paper proposes enhancing the universality of adversarial attacks by integrating CoT prompts with the greedy coordinate gradient (GCG) technique.
  arXiv  Detail & Related papers  (2024-10-29T06:54:00Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.