arXiv：cs.LG· Hoseong Tae, Jong-Seok Lee·· 13 小时前
DRIFT：用对抗补丁攻击 Flow-Matching VLA 的去噪轨迹
DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
AI 导读
DRIFT 是一种贴在机器人夹爪上的测试时通用对抗补丁，通过扰动去噪速度场攻击 pi0、pi0.5 等 Flow-Matching VLA 模型。其核心发现是仅攻击第一步去噪比攻击更宽的步骤窗口更强也更省算力。在四个 LIBERO 套件上，DRIFT 用单个小补丁基本破坏了所有原本可解的任务，远超动作空间和嵌入向量空间的攻击基线。
正文
Abstract:Flow-matching vision-language-action (VLA) models such as pi0 generate robot actions by integrating a learned denoising velocity field, and have been reported to resist adversarial perturbations that readily fool autoregressive VLAs. We show that this robustness is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE. We introduce DRIFT (Denoising Redirection via Input perturbation of the Flow-matching Trajectory), a test-time universal adversarial patch placed on the robot's gripper that attacks the denoising velocity field of an off-the-shelf policy. Our central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps, which we explain through a gradient conflict unique to input-space optimization and which is exactly opposite to the training-time backdoor regime. On pi0 and pi0.5 across four LIBERO suites, DRIFT breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embedding-space attack baselines.
| Subjects: | Computer Vision and Pattern Recognition (cs.CV); Machine Learning (cs.LG) |
| Cite as: | arXiv:2608.03207 [cs.CV] |
| (or arXiv:2608.03207v2 [cs.CV] for this version) | |
| https://doi.org/10.48550/arXiv.2608.03207 arXiv-issued DOI via DataCite |
Submission history
From: Hoseong Tae [view email]
[v1]
Tue, 4 Aug 2026 06:47:26 UTC (2,360 KB)
[v2]
Fri, 9 Oct 2026 02:52:57 UTC (2,424 KB)
来源：arXiv：cs.LG · arxiv.org