DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack

• URL: http://arxiv.org/abs/2608.03207v1
• Date: Tue, 04 Aug 2026 06:47:26 GMT
• Title: DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
• Abstract summary: Flow-matching vision-language-action (VLA) models such as pi0 generate robot actions by integrating a learned denoising velocity field.<n>We show that this robustness is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE.<n>We introduce DRIFT, a test-time universal adversarial patch placed on the robot's gripper that attacks the denoising velocity field of an off-the-shelf policy.
• Score: 23.73320512301939
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Flow-matching vision-language-action (VLA) models such as pi0 generate robot actions by integrating a learned denoising velocity field, and have been reported to resist adversarial perturbations that readily fool autoregressive VLAs. We show that this robustness is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE. We introduce DRIFT (Denoising Redirection via Input perturbation of the Flow-matching Trajectory), a test-time universal adversarial patch placed on the robot's gripper that attacks the denoising velocity field of an off-the-shelf policy. Our central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps, which we explain through a gradient conflict unique to input-space optimization and which is exactly opposite to the training-time backdoor regime. On pi0 and pi0.5 across four LIBERO suites, DRIFT breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embedding-space attack baselines.

Related papers

• StructRL: Structured Action-Space Exploration for Flow-Based VLAs [81.43458629514139]
  Flow-based Vision-Language-Action models are now widely used for continuous robotic manipulation.<n>Online reinforcement learning is emerging as a key technique for adapting them to new tasks.<n>We show that effective robot exploration calls for structured noise: temporally smooth and scaled differently across action groups.
  arXiv  Detail & Related papers  (2026-08-15T09:31:29Z)
• High-Fidelity One-Step Generative Visuomotor Policy via Recursive Correction, Frequency Consistency, and Contrastive Flow Matching [3.5570904967011505]
  Generative models such as diffusion and flow matching have advanced robotic visuomotor policies by modeling multimodal action distributions.<n>Existing one-step acceleration methods compress the whole generation process into a single large update, leading to spatial deviation, frequency distortion, and mode averaging.<n>This paper proposes a high-fidelity one-step generative visuomotor policy framework that addresses these issues with three complementary mechanisms.
  arXiv  Detail & Related papers  (2026-07-04T13:12:38Z)
• SATB-VR: Training Few-Step Video Restoration Diffusion Model using SNR-Aware Trajectory Blending [55.764018145256216]
  We present SATB-VR, a few-step paradigm that jump-starts the denoising process via an auxiliary predictor.<n>We show that SATB-VR performs favorably against existing approaches on synthetic, real-world, and AIGC benchmarks.
  arXiv  Detail & Related papers  (2026-06-27T01:32:16Z)
• Exploiting Neural Audio Codec Latents for Adversarial Audio Attacks [2.3067587087700767]
  We propose a generative attack framework operating in the latent space of a neural audio.<n>A conditional generator synthesizes class-specific perturbations in a single forward pass and decodes them into adversarial waveforms.<n>Our method targeted attack success rates up to 99% with sub-7 ms inference, outperforming generative baselines while reducing latency by 24x.
  arXiv  Detail & Related papers  (2026-06-18T19:40:46Z)
• TempoVLA: Learning Speed-Controllable Vision-Language-Action Policies [58.40033352838586]
  Existing Vision-Language-Action models (VLAs) only inherit a single fixed speed from training demonstrations.<n>We observe that the magnitude of each predicted action already governs how fast the robot moves.<n>We turn this observation into TempoVLA, a single VLA whose execution speed is controlled by an explicit condition.
  arXiv  Detail & Related papers  (2026-06-04T17:59:40Z)
• Beyond Waveform Robustness: Robust Feature-Vocoder Adversarial Attacks on Automatic Speech Recognition [9.839293944956006]
  Existing adversarial attacks directly add adversarial noise to the speech audio.<n>Clean-Referenced Feature-Vocoder Attack moves the adversarial search space from raw waveforms to self-supervised learning representations.<n>Experiments show that, when optimized only on raw Whisper-small as a public surrogate model, our attack transfers effectively to black-box ASR models.
  arXiv  Detail & Related papers  (2026-06-04T04:00:48Z)
• BlockVLA: Accelerating Autoregressive VLA via Block Diffusion Finetuning [41.5997751218601]
  BlockVLA is a framework that adapts pretrained AR backbones into an efficient discrete diffusion policy.<n>We conduct extensive evaluations on the LIBERO and SimplerEnv benchmarks.<n>Our model exhibits superior training efficiency, with success rates converging substantially faster than baselines.
  arXiv  Detail & Related papers  (2026-05-13T11:37:51Z)
• OmniForcing: Unleashing Real-time Joint Audio-Visual Generation [51.031726911410594]
  Recent joint audio-visual diffusion models achieve remarkable generation quality but suffer from high latency.<n>We propose OmniForcing, the first framework to distill an offline, dual-stream bidirectional diffusion model into a high-fidelity streaming autore generator.
  arXiv  Detail & Related papers  (2026-03-12T08:17:36Z)
• HiAR: Efficient Autoregressive Long Video Generation via Hierarchical Denoising [52.237486207964245]
  HiAR is a hierarchical denoising framework that reverses the conventional generation order.<n>It performs causal generation across all blocks at every denoising step, so that each block is always conditioned on context at the same noise level.<n>On VBench (20s generation), HiAR achieves the best overall score and the lowest temporal drift among all compared methods.
  arXiv  Detail & Related papers  (2026-03-09T17:58:16Z)
• Action-to-Action Flow Matching [25.301629044539325]
  Diffusion-based policies have recently achieved remarkable success in robotics by formulating action prediction as a conditional denoising process.<n>We propose Action-to-Action flow matching (A2A), a novel policy paradigm that shifts from random sampling to initialization informed by the previous action.<n>A2A enables high-quality action generation in as few as a single inference step (0.56 ms latency), and exhibits superior robustness to visual perturbations and enhanced generalization to unseen configurations.
  arXiv  Detail & Related papers  (2026-02-07T02:39:49Z)
• Ada3Diff: Defending against 3D Adversarial Point Clouds via Adaptive Diffusion [70.60038549155485]
  Deep 3D point cloud models are sensitive to adversarial attacks, which poses threats to safety-critical applications such as autonomous driving. This paper introduces a novel distortion-aware defense framework that can rebuild the pristine data distribution with a tailored intensity estimator and a diffusion model.
  arXiv  Detail & Related papers  (2022-11-29T14:32:43Z)
• Sparse and Imperceptible Adversarial Attack via a Homotopy Algorithm [93.80082636284922]
  Sparse adversarial attacks can fool deep networks (DNNs) by only perturbing a few pixels. Recent efforts combine it with another l_infty perturbation on magnitudes. We propose a homotopy algorithm to tackle the sparsity and neural perturbation framework.
  arXiv  Detail & Related papers  (2021-06-10T20:11:36Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.