Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models

# Hidden in Plain Sight: Diffusion-Based Unrestricted Robotic Attacks on Vision-Language-Action Models
Source: [https://arxiv.org/html/2608.10393](https://arxiv.org/html/2608.10393)
Jiahui Han1,2,\*, Yuhui Yao2,3,\*, Xin Wang2,\*,†, Jiafei Cao2, Mingxuan Zhang2, Danfeng Shan1, Huiqi Deng1,2,†, Guanchu Wang2,†, Xia Hu2,†

###### Abstract

Vision\-Language\-Action \(VLA\) models have shown strong capabilities in controlling robots across diverse manipulation tasks\. However, their adversarial robustness remains largely underexplored, and exploiting this weakness can lead to physical\-world harm\. Existing attacks on VLA models often rely on pixel\-space perturbations or white\-box access, resulting in noticeable artifacts and limited deployability in real\-world robotic systems\. In this work, we propose DURA, a diffusion\-based unrestricted robotic attack that generates visually natural adversarial patches for VLA models\. DURA supports both white\-box and black\-box attack settings, where the black\-box setting requires only the predicted actions of the victim model\. By optimizing along the latent trajectory of a pretrained diffusion model, DURA generates visually natural patches while steering the robot toward attacker\-specified target actions\. Extensive experiments in both simulation and the real physical world show that DURA consistently outperforms existing methods\. Our findings expose a safety risk for physically deployed VLA models and call for stronger defenses\.

††footnotetext:\*Equal contribution\.
†Corresponding authors: Huiqi Deng, Guanchu Wang, Xin Wang, and Xia Hu\.## Introduction

Vision\-Language\-Action \(VLA\) models have become a powerful paradigm for general\-purpose robotic control\(Kimet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib8)\), unifying visual perception, language understanding, and action prediction within a single policy\. Given an image observation, robot state, and language instruction, a VLA model can directly generate actions for open vocabulary manipulation tasks\. Representative systems, from RT\-1\(Brohanet al\.[2022](https://arxiv.org/html/2608.10393#bib.bib9)\)and RT\-2\(Zitkovichet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib10)\)to recent OpenVLA\(Kimet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib8)\), Octo\(Teamet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib11)\),π0\\pi\_\{0\}\(Blacket al\.[2024](https://arxiv.org/html/2608.10393#bib.bib12)\), and SpatialVLA\(Quet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib13)\)have demonstrated increasing generalization across tasks, embodiments, and action representations\. These advances point toward generalist robotic agents that can follow diverse instructions across complex environments, bringing VLA models increasingly closer to deployment in open\-world robotic systems\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/x1.png)

Figure 1:An illustration of unrestricted patch attacks on a VLA robot \(“pick up the cup”\)\.Top:a traditional noised patch stalls the arm but is conspicuous and white\-box only\.Bottom:our DURA patch stalls the arm while being*visually natural*,*black\-box deployable*, and*semantically consistent*\.However, the growing autonomy of VLA models also introduces substantial safety risks\(Wanget al\.[2024](https://arxiv.org/html/2608.10393#bib.bib26),[2025b](https://arxiv.org/html/2608.10393#bib.bib24),[2026](https://arxiv.org/html/2608.10393#bib.bib30); Maet al\.[2026](https://arxiv.org/html/2608.10393#bib.bib25)\)\. Recent studies show that carefully crafted visual patches or malicious language instructions can disrupt robot execution, causing the policy to freeze, deviate from the intended task, or follow target behaviors\(Zhanget al\.[2026](https://arxiv.org/html/2608.10393#bib.bib27); Wanget al\.[2025a](https://arxiv.org/html/2608.10393#bib.bib14); Joneset al\.[2025](https://arxiv.org/html/2608.10393#bib.bib15); Wanget al\.[2025c](https://arxiv.org/html/2608.10393#bib.bib16)\)\. While these attacks provide valuable evidence of VLA safety risks, they still fall short of realistic deployment conditions\. Specifically, \(1\)Visual naturalness:existing visual patches often appear as meaningless or conspicuous artifacts rather than natural scene content, making them easy to detect in real workspaces; \(2\)Black\-box deployability:existing VLA attacks commonly rely on privileged internal access, such as model parameters, gradients, or logits, which is rarely available for closed\-source robotic systems; \(3\)Time efficiency:they often require lengthy per\-instance optimization to craft a single patch, which incurs a high query or compute cost and limits their use in practice\. These limitations shift the central question from demonstrating white\-box vulnerabilities to constructing visually natural, black\-box adversarial perturbations with real\-world effectiveness\.

In this work, we proposeDURA, a diffusion\-based unrestricted robotic attack for VLA models, as illustrated in Figure[1](https://arxiv.org/html/2608.10393#Sx1.F1)\. Rather than crafting small norm\-bounded perturbations or high\-frequency additive noise on a fixed patch, DURA treats the localized patch content as unrestricted and searches along the latent trajectory of a pretrained diffusion model, using the diffusion prior to preserve visual naturalness while the VLA attack objective steers the robot toward an attacker\-specified target action\.

The resulting latent\-trajectory framework naturally accommodates both white\-box and black\-box threat models, differing only in how the per\-step attack direction is estimated\. Under white\-box access, DURA computes the latent update by backpropagating the target\-action loss through the VLA policy and the VAE decoder\(Kingma and Welling[2013](https://arxiv.org/html/2608.10393#bib.bib56)\)\. Under black\-box access, it estimates the update from action\-output queries alone, requiring no access to model parameters or gradients\. By optimizing a single patch over diverse frames and instructions, DURA further improves transferability across robotic tasks and deployment conditions\.

We evaluate DURA on two SOTA open\-source VLA models, OpenVLA\(Kimet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib8)\)andπ0\\pi\_\{0\}\-FAST\(Pertschet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib60)\), across both the LIBERO simulation benchmark\(Liuet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib17)\)and a real Franka robot arm\. Our results show that DURA achieves substantially higher attack success rates \(ASR\) than existing baselines under black\-box access, while remaining effective under common input\-transformation defenses and transferring to the real Franka arm as a controllable, on\-demand switch over robot behavior\. These results highlight the urgent need to assess and mitigate deployability\-level vulnerabilities of current VLA models\.

In summary, our main contributions are:

- •We proposeDURA, a diffusion\-based unrestricted robotic attack for Vision\-Language\-Action models\. DURA generates localized, visually natural, and semantically plausible patches that steer robot policies toward attacker\-specified actions\.
- •We establish DURA as a practical attack framework for both white\-box and action\-output black\-box settings\. By searching in a diffusion\-guided patch space, DURA achieves a favorable trade\-off among attack effectiveness, visual naturalness, and optimization efficiency\.
- •We conduct comprehensive evaluations on OpenVLA andπ0\\pi\_\{0\}\-FAST across LIBERO and a real\-world Franka robot\. DURA achieves79\.3–100%ASR across the evaluated white\-box and black\-box settings, outperforming the strongest target\-only baselines\. Real\-robot experiments further demonstrate controllable and repeatable targeted behaviors on physical hardware\.

## Related Work

Adversarial Attacks on Vision\-Language\-Action Models\.Existing attacks on VLA models target both visual and language inputs\. On the visual channel, Wang et al\.\(Wanget al\.[2025a](https://arxiv.org/html/2608.10393#bib.bib14)\)study patch\-based objectives for disrupting or steering robot actions, while FreezeVLA\(Wanget al\.[2025c](https://arxiv.org/html/2608.10393#bib.bib16)\)uses bi\-level optimization to induce action freezing\. These methods achieve strong attack performance but require white\-box access to the victim model\.

Transferable attacks reduce this requirement by optimizing patches on accessible models or shared representations\. Representative methods include UPA\-RFAS\(Luet al\.[2026](https://arxiv.org/html/2608.10393#bib.bib33)\), EDPA\(Xuet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib37)\), VLA\-Hijack\(Fuet al\.[2026](https://arxiv.org/html/2608.10393#bib.bib39)\), and TRAP\(Huanget al\.[2026](https://arxiv.org/html/2608.10393#bib.bib36)\)\. Although they avoid victim\-model gradients at deployment, their effectiveness relies on surrogate\-to\-victim transfer and may degrade across different architectures and action representations\. Across these visual attack paradigms, patch naturalness has received limited attention compared with attack success and transferability\.

On the language channel, adversarial instructions can derail robot execution\(Joneset al\.[2025](https://arxiv.org/html/2608.10393#bib.bib15)\), while SABER\(Wuet al\.[2026](https://arxiv.org/html/2608.10393#bib.bib35)\)performs agentic black\-box attacks through bounded instruction edits\.

DURA provides a unified framework for both white\-box and black\-box visual attacks\. DURA uses gradients when available, while estimating the attack direction directly from predicted actions in the black\-box setting\. In both settings, a diffusion prior guides the optimization toward natural\-looking patches while inducing attacker\-specified actions\.

Diffusion Priors for Natural Adversarial Examples\.Diffusion models provide strong image priors for generating natural adversarial examples beyond norm\-bounded perturbations\(Songet al\.[2021](https://arxiv.org/html/2608.10393#bib.bib3); Rombachet al\.[2022](https://arxiv.org/html/2608.10393#bib.bib4); Songet al\.[2020](https://arxiv.org/html/2608.10393#bib.bib7)\)\. Prior work incorporates adversarial guidance into reverse diffusion\(Chenet al\.[2023b](https://arxiv.org/html/2608.10393#bib.bib31); Gaoet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib38); Linet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib40); Chenet al\.[2023a](https://arxiv.org/html/2608.10393#bib.bib41),[c](https://arxiv.org/html/2608.10393#bib.bib44); Daiet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib45); Xueet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib46)\)\. AdvDiffVLM\(Guoet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib23)\), for example, embeds target semantics into generated images to attack vision\-language models\.

Such targets can be expressed directly through image content: a class or textual concept has a corresponding visual semantics\. A target robot action has no analogous visual form, as its relation to the image depends on the instruction, scene, and robot state\. Success on a single frame is also insufficient because these factors evolve throughout execution\. DURA therefore optimizes one diffusion\-constrained patch jointly over diverse frames, coupling it to a common action objective to induce consistent target behavior while retaining a natural appearance\.

## Method

![Refer to caption](https://arxiv.org/html/2608.10393v1/x2.png)Figure 2:The overall framework of DURA, which consists of \(a\) constructing diverse task scenarios with normal\-looking clean patches, \(b\) generating natural\-looking adversarial patches through diffusion\-mixed trajectories, \(c\) optimizing the patches in either white\-box or black\-box settings, and \(d\) using the resulting adversarial patches to steer the robot toward attacker\-specified target actions\.### Threat Model

We study targeted physical adversarial patch attacks against vision\-language\-action \(VLA\) models\. The attacker can place a single localized patch in the robot’s field of view, but cannot modify the model parameters, training data, robot state, or language instruction at test time\. The patch is physically realizable and restricted to a limited image region, while its content is otherwise unrestricted\. The attack goal is to drive the victim policy toward an attacker\-specified target action whenever the patch is visible\. We consider both white\-box access, where gradients of the victim policy are available, and black\-box action\-output access, where the attacker can submit observations and language instructions to the victim policy and observe only the predicted action sequence\. In both cases, we optimize a single patch over diverse observations to improve transfer across scenes and tasks\.

### Problem Formulation

Letπθ\\pi\_\{\\theta\}denote the victim VLA policy\. Given a visual observationxxand a language instructionℓ\\ell, the policy predicts an action sequencea=\(a1,…,aM\)a=\(a\_\{1\},\\ldots,a\_\{M\}\)\. Leta⋆=\(a1⋆,…,aM⋆\)a^\{\\star\}=\(a\_\{1\}^\{\\star\},\\ldots,a\_\{M\}^\{\\star\}\)denote the attacker\-specified target action sequence, and letp∈\[0,1\]h×w×3p\\in\[0,1\]^\{h\\times w\\times 3\}denote the adversarial patch\. Given a batch of clean scene frames\{ob\}b=1B\\\{o\_\{b\}\\\}\_\{b=1\}^\{B\}, we render the same patch into each frame through a compositing operator

x~b​\(p\)=𝒞​\(ob,p;m,Tb\),\\tilde\{x\}\_\{b\}\(p\)=\\mathcal\{C\}\(o\_\{b\},p;m,T\_\{b\}\),\(1\)wheremmis the patch mask andTbT\_\{b\}is the geometric transform for thebb\-th frame\. This captures the fact that the same physical patch may appear with different poses and placements across observations\. We optimize the patch with the following targeted batch objective

ℒattack​\(p\)=1B​∑b=1B∑i∈ℐwi​ℒi​\(yb,i​\(p\),ai⋆\),\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\(p\)=\\frac\{1\}\{B\}\\sum\_\{b=1\}^\{B\}\\sum\_\{i\\in\\mathcal\{I\}\}w\_\{i\}\\,\\mathcal\{L\}\_\{i\}\\left\(y\_\{b,i\}\(p\),a\_\{i\}^\{\\star\}\\right\),\(2\)whereℐ\\mathcal\{I\}indexes the attacked action dimensions or tokens,wiw\_\{i\}are weighting coefficients, andyb​\(p\)y\_\{b\}\(p\)denotes the attack\-visible output of the victim policy on the patched input\(x~b​\(p\),ℓb\)\(\\tilde\{x\}\_\{b\}\(p\),\\ell\_\{b\}\)\. The form ofyb​\(p\)y\_\{b\}\(p\)depends on the setting:

yb​\(p\)=\{πθ\(⋅∣x~b\(p\),ℓb\),white\-box,𝒬θ​\(x~b​\(p\),ℓb\),black\-box,y\_\{b\}\(p\)=\\begin\{cases\}\\pi\_\{\\theta\}\(\\cdot\\mid\\tilde\{x\}\_\{b\}\(p\),\\ell\_\{b\}\),&\\text\{white\-box\},\\\\ \\mathcal\{Q\}\_\{\\theta\}\(\\tilde\{x\}\_\{b\}\(p\),\\ell\_\{b\}\),&\\text\{black\-box\},\\end\{cases\}\(3\)where the white\-box output denotes differentiable action\-token outputs such as logits, and𝒬θ\\mathcal\{Q\}\_\{\\theta\}denotes the black\-box action\-output interface that returns the predicted executable action sequence\. Accordingly, we instantiate the per\-dimension loss as

ℒi​\(yb,i​\(p\),ai⋆\)=\{CE​\(yb,i​\(p\),ai⋆\),white\-box,‖y¯b,i​\(p\)−a¯i⋆‖22,black\-box,\\mathcal\{L\}\_\{i\}\\left\(y\_\{b,i\}\(p\),a\_\{i\}^\{\\star\}\\right\)=\\begin\{cases\}\\mathrm\{CE\}\\left\(y\_\{b,i\}\(p\),a\_\{i\}^\{\\star\}\\right\),&\\text\{white\-box\},\\\\ \\left\\\|\\bar\{y\}\_\{b,i\}\(p\)\-\\bar\{a\}\_\{i\}^\{\\star\}\\right\\\|\_\{2\}^\{2\},&\\text\{black\-box\},\\end\{cases\}\(4\)whereCE​\(⋅,⋅\)\\mathrm\{CE\}\(\\cdot,\\cdot\)is the targeted cross\-entropy loss, andy¯b,i​\(p\)\\bar\{y\}\_\{b,i\}\(p\)anda¯i⋆\\bar\{a\}\_\{i\}^\{\\star\}denote predicted and target actions\. For token\-based policies under black\-box access,𝒬θ\\mathcal\{Q\}\_\{\\theta\}returns the decoded continuous robot action before the MSE loss is evaluated\.

### Diffusion\-based Unrestricted Robotic Attacks

As illustrated in Figure[2](https://arxiv.org/html/2608.10393#Sx3.F2), DURA formulates unrestricted patch generation as an attack\-guided denoising problem\. Instead of directly optimizing patch pixels, DURA starts from a benign seed patch and searches along the latent trajectory of a frozen pretrained diffusion model\. This trajectory provides a natural generative space for patch content, while the targeted VLA loss steers the decoded patch toward the attacker\-specified robot action\. The same denoising trajectory is used in both white\-box and black\-box settings; only the way of estimating the per\-step attack direction differs\.

Diffusion\-guided Patch Optimization\.We use a latent diffusion model\(Rombachet al\.[2022](https://arxiv.org/html/2608.10393#bib.bib4)\)with VAE encoderℰ\\mathcal\{E\}, VAE decoder𝒟\\mathcal\{D\}, and frozen denoiserϵ^ϕ\\hat\{\\epsilon\}\_\{\\phi\}\. Here,ϵ^ϕ​\(zt,t\)\\hat\{\\epsilon\}\_\{\\phi\}\(z\_\{t\},t\)predicts the noise component of latentztz\_\{t\}at diffusion timesteptt\. Given a benign seed patch croppcleanp\_\{\\mathrm\{clean\}\}, DURA first encodes it into the latent space:

z0clean=ℰ​\(pclean\)\.z\_\{0\}^\{\\mathrm\{clean\}\}=\\mathcal\{E\}\(p\_\{\\mathrm\{clean\}\}\)\.\(5\)Rather than starting from pure Gaussian noise, we partially noise this seed latent to an intermediate timesteptstartt\_\{\\mathrm\{start\}\}, obtainingztstarta​d​vz^\{adv\}\_\{t\_\{\\mathrm\{start\}\}\}as the starting point of the adversarial denoising trajectory\. This initialization preserves the natural structure of the seed patch while leaving sufficient latent\-space freedom for the attack objective to reshape its content\.

Starting fromztstarta​d​vz^\{adv\}\_\{t\_\{\\mathrm\{start\}\}\}, DURA alternates between denoising and adversarial steering\. To keep the optimization close to a natural denoising path, we precompute a clean anchor trajectory\{ztanc\}\\\{z\_\{t\}^\{\\mathrm\{anc\}\}\\\}by running an unperturbed DDIM pass\(Songet al\.[2021](https://arxiv.org/html/2608.10393#bib.bib3)\)from the same seed patch\. At timesteptt, the current adversarial latent is softly tied to the corresponding clean anchor:

ztm​i​x=\(1−αw\)​zta​d​v\+αw​ztanc,z^\{mix\}\_\{t\}=\(1\-\\alpha\_\{w\}\)z^\{adv\}\_\{t\}\+\\alpha\_\{w\}z\_\{t\}^\{\\mathrm\{anc\}\},\(6\)whereαw∈\[0,1\]\\alpha\_\{w\}\\in\[0,1\]controls the anchor strength\.

DURA performs one DDIM denoising step and injects the attack update:

ut−1=DDIM​\(ztm​i​x,t;ϵ^ϕ\),zt−1a​d​v=ut−1−s⋅gt,u\_\{t\-1\}=\\mathrm\{DDIM\}\(z^\{mix\}\_\{t\},t;\\hat\{\\epsilon\}\_\{\\phi\}\),\\qquad z^\{adv\}\_\{t\-1\}=u\_\{t\-1\}\-s\\cdot g\_\{t\},\(7\)wheressis the attack step size andgtg\_\{t\}is the latent attack direction\. The DDIM step follows the pretrained diffusion prior, whereas the adversarial update moves the decoded patch toward the target robot action\. The clean anchor regularizes this process by preventing the attack trajectory from drifting too far from the original denoising path\.

Attack Direction Estimation\.The update rule in Eq\.[7](https://arxiv.org/html/2608.10393#Sx3.E7)reduces DURA to one central question: how to obtain the latent attack directiongtg\_\{t\}at each timestep\. In the white\-box setting, DURA decodes the current denoised latent, renders the candidate patch into the observation batch, and backpropagates the targeted VLA loss:

gtWB=∇ut−1ℒattack​\(𝒟​\(ut−1\)\)\.g\_\{t\}^\{\\mathrm\{WB\}\}=\\nabla\_\{u\_\{t\-1\}\}\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\mathcal\{D\}\(u\_\{t\-1\}\)\\right\)\.\(8\)Here,ℒattack​\(𝒟​\(ut−1\)\)\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\(\\mathcal\{D\}\(u\_\{t\-1\}\)\)explicitly includes decoding, patch rendering, victim\-policy evaluation, and the corresponding target\-action loss computation\. This estimates a local attack direction at the current denoising step, without backpropagating through the full DDIM trajectory\.

In the black\-box setting, gradients are unavailable and the attacker observes only action outputs\. DURA therefore estimatesgtg\_\{t\}from query losses around the current denoised latentu=ut−1u=u\_\{t\-1\}\. To keep the search aligned with the diffusion prior, we sample candidates with the one\-step forward noising distributionqt​\(zt∣u\)=𝒩​\(αt​u,\(1−αt\)​I\)q\_\{t\}\(z\_\{t\}\\mid u\)=\\mathcal\{N\}\(\\sqrt\{\\alpha\_\{t\}\}u,\(1\-\\alpha\_\{t\}\)I\), whereαt\\alpha\_\{t\}is the DDIM noise coefficient at timesteptt\. Specifically, we sampleKKperturbations aszt,k=αt​u\+1−αt​ϵkz\_\{t,k\}=\\sqrt\{\\alpha\_\{t\}\}u\+\\sqrt\{1\-\\alpha\_\{t\}\}\\epsilon\_\{k\}withϵk∼𝒩​\(0,I\)\\epsilon\_\{k\}\\sim\\mathcal\{N\}\(0,I\), decode the candidates into patches, render them into the same observation batch, and query the victim policy to obtain lossesℒattack\(k\)\\mathcal\{L\}\_\{\\mathrm\{attack\}\}^\{\(k\)\}\. We employ a score\-function estimator\(Williams[1992](https://arxiv.org/html/2608.10393#bib.bib5)\), the attack direction under black\-box access is estimated as follows:

gtBB=1K​∑k=1K\(ℒattack\(k\)−b\)​αt1−αt​ϵk,g\_\{t\}^\{\\mathrm\{BB\}\}=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\left\(\\mathcal\{L\}^\{\(k\)\}\_\{\\mathrm\{attack\}\}\-b\\right\)\\frac\{\\sqrt\{\\alpha\_\{t\}\}\}\{\\sqrt\{1\-\\alpha\_\{t\}\}\}\\,\\epsilon\_\{k\},\(9\)wherebbis an optional variance\-reduction baseline\. The full derivation of Eq\.[9](https://arxiv.org/html/2608.10393#Sx3.E9)is provided in Appendix A\.

Algorithm 1DURA Patch Optimization0:Clean patch

pcleanp\_\{\\mathrm\{clean\}\}, observation batch

ℬ\\mathcal\{B\}, target action

a⋆a^\{\\star\}, diffusion model

\(ℰ,𝒟,ϵ^ϕ\)\(\\mathcal\{E\},\\mathcal\{D\},\\hat\{\\epsilon\}\_\{\\phi\}\), access mode

mode∈\{WB,BB\}\\mathrm\{mode\}\\in\\\{\\mathrm\{WB\},\\mathrm\{BB\}\\\}
0:Adversarial patch

padvp\_\{\\mathrm\{adv\}\}
1:

z0clean←ℰ​\(pclean\)z^\{\\mathrm\{clean\}\}\_\{0\}\\leftarrow\\mathcal\{E\}\(p\_\{\\mathrm\{clean\}\}\)
2:Obtain

ztstartadvz^\{\\mathrm\{adv\}\}\_\{t\_\{\\mathrm\{start\}\}\}by partially noising

z0cleanz^\{\\mathrm\{clean\}\}\_\{0\}
3:Precompute clean anchor trajectory

\{ztanc\}t=tstart0\\\{z^\{\\mathrm\{anc\}\}\_\{t\}\\\}\_\{t=t\_\{\\mathrm\{start\}\}\}^\{0\}
4:for

t=tstart,…,1t=t\_\{\\mathrm\{start\}\},\\ldots,1do

5:

ztm​i​x←\(1−αw\)​ztadv\+αw​ztanc\{z\}^\{mix\}\_\{t\}\\leftarrow\(1\-\\alpha\_\{w\}\)z^\{\\mathrm\{adv\}\}\_\{t\}\+\\alpha\_\{w\}z^\{\\mathrm\{anc\}\}\_\{t\}
6:

ut−1←DDIM​\(ztm​i​x,t;ϵ^ϕ\)u\_\{t\-1\}\\leftarrow\\mathrm\{DDIM\}\(\{z\}^\{mix\}\_\{t\},t;\\hat\{\\epsilon\}\_\{\\phi\}\)
7:

gt←EstimateDirection​\(ut−1,ℬ,a⋆,mode\)g\_\{t\}\\leftarrow\\textsc\{EstimateDirection\}\(u\_\{t\-1\},\\mathcal\{B\},a^\{\\star\},\\mathrm\{mode\}\)
8:

zt−1adv←ut−1−s⋅gtz^\{\\mathrm\{adv\}\}\_\{t\-1\}\\leftarrow u\_\{t\-1\}\-s\\cdot g\_\{t\}
9:endfor

10:

padv←𝒟​\(z0adv\)p\_\{\\mathrm\{adv\}\}\\leftarrow\\mathcal\{D\}\(z^\{\\mathrm\{adv\}\}\_\{0\}\)
11:return

padvp\_\{\\mathrm\{adv\}\}

## Experiments

SimulatedPhysicalMethodSpatialObjectGoalLongAvgSpatialObjectGoalLongAvgBenign\(no patch\)15\.311\.620\.846\.323\.515\.311\.620\.846\.323\.5Clean patch27\.038\.026\.067\.039\.527\.038\.026\.067\.039\.5White\-box attacks: label\-supervised \(requires action\-token GT\)UMA100\.098\.899\.0100\.099\.596\.656\.480\.082\.078\.8UPA96\.277\.888\.096\.889\.795\.657\.057\.272\.870\.7UADA100\.0100\.0100\.0100\.0100\.0100\.0100\.0100\.0100\.0100\.0White\-box attacks: target\-only \(no action\-token GT\)TMA100\.0100\.0100\.099\.099\.896\.483\.674\.491\.886\.6FreezeVLA95\.398\.495\.792\.295\.4−\-−\-−\-−\-−\-Ours100\.0↑\\uparrow4\.7100\.0↑\\uparrow1\.6100\.0↑\\uparrow4\.3100\.0↑\\uparrow1\.0100\.0↑\\uparrow0\.2100\.0↑\\uparrow3\.6100\.0↑\\uparrow16\.4100\.0↑\\uparrow25\.6100\.0↑\\uparrow8\.2100\.0↑\\uparrow13\.4Black\-box attacks: target\-onlyTMA\-NES43\.036\.030\.060\.042\.341\.035\.028\.053\.039\.3Ours100\.0↑\\uparrow57\.096\.0↑\\uparrow60\.068\.0↑\\uparrow38\.080\.0↑\\uparrow20\.086\.0↑\\uparrow43\.797\.0↑\\uparrow56\.070\.0↑\\uparrow35\.076\.0↑\\uparrow48\.074\.0↑\\uparrow21\.079\.3↑\\uparrow40\.0

Table 1:Attack Success Rate \(ASR, %,↑\\uparrow\) on LIBEROfor OpenVLA\-7B across four task suites\. Methods are grouped by supervision:*label\-supervised*attacks use ground\-truth action tokens, while*target\-only*attacks need only a fixed target\.Boldandunderlinemark the best and second\-best within each group;↑\\uparrowis the gain ofOursover the next\-best distinct score\.### Experimental Setup

![Refer to caption](https://arxiv.org/html/2608.10393v1/x3.png)Figure 3:Real\-robot targeted attack on a Franka arm\(task: place the bread slice into the basket\)\. \(a\) Without the patch, the arm completes the task\. \(b\) Inserting the printed patch into the camera view drives the arm to the target action and it stays still; removing it lets the arm resume; inserting it again drives the arm to the target action once more\. Here,△\\triangledenotes the position in the previous frame, while∘\\circdenotes the position in the current frame\. The behavior tracks the presence of the patch, which shows the attack is controllable and repeatable on real hardware\.Datasets and Models\.We evaluate our method on two widely used robotic manipulation benchmarks, LIBERO\(Liuet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib17)\)and BridgeData V2\(Walkeet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib32)\)\. To cover different VLA action representations, we consider two representative models, OpenVLA\(Kimet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib8)\)andπ0\\pi\_\{0\}\-FAST\(Pertschet al\.[2025](https://arxiv.org/html/2608.10393#bib.bib60)\)\. For OpenVLA, we use checkpoints fine\-tuned on the four LIBERO suites\. Forπ0\\pi\_\{0\}\-FAST, we use its LIBERO fine\-tuned checkpoint\.

Attack Configuration\.We study targeted attacks in both white\-box and black\-box settings\. The patch is optimized over batches of frames sampled from multiple rollouts, so that it generalizes across scenes, robot states, and instructions rather than overfitting to a single observation\. We compare against strong white\-box baselines, including UMA, UPA, UADA, TMA, and FreezeVLA, and against query\-based black\-box baselines\. Since there is no directly comparable query\-only baseline for OpenVLA, we adapt TMA into a black\-box NES variant, denoted TMA\-NES\(Ilyaset al\.[2018](https://arxiv.org/html/2608.10393#bib.bib42); Chenet al\.[2017](https://arxiv.org/html/2608.10393#bib.bib43)\)\. Forπ0\\pi\_\{0\}\-FAST, we additionally report UPA\-RFAS\.

Patch Generation and Evaluation Setup\.We craft adversarial patches under three generating settings\. The*simulation setting*uses the Openvla\-7B model trained in simulation on the LIBERO\(Kimet al\.[2024](https://arxiv.org/html/2608.10393#bib.bib8)\), while the*physical setting*uses a model trained on real\-world data from BridgeData V2 with the openvla\-7B model\(Walkeet al\.[2023](https://arxiv.org/html/2608.10393#bib.bib32)\)\. We then evaluate the generated patches on victim models trained on different task suites, which differ in both data source and task objective, to rigorously verify the robustness and effectiveness of our method\. For the*real\-world evaluation*, we deploy the attack on a Franka robot arm, a 7\-DoF manipulator equipped with a parallel\-jaw gripper and observed by a single fixed RGB camera\. We print the optimized adversarial patch and place it in the robot workspace within the camera view, while keeping the task instruction and policy weights unchanged so that the only intervention is the presence of the printed patch\. This setup tests whether the optimized patch can induce the intended target action under real imaging conditions, including printing artifacts, lighting variations, camera perspective, and placement noise\.

Table 2:Attack Success Rate \(ASR, %,↑\\uparrow\) on LIBERO for𝝅𝟎\\boldsymbol\{\\pi\_\{0\}\}\-FAST across four task suites\.*Target\-only*attacks require only a fixed target action\. Bold and underlined values denote the best and second\-best results within each group, respectively\.Implementation Details\.Our attack optimizes the patch in the VAE latent space of a frozen diffusion model\(Rombachet al\.[2022](https://arxiv.org/html/2608.10393#bib.bib4)\)\. A clean seed patch is noised totstart=0\.5t\_\{\\mathrm\{start\}\}=0\.5and optimized for 200 DDIM steps\(Songet al\.[2021](https://arxiv.org/html/2608.10393#bib.bib3)\), with anchor weightαw=0\.2\\alpha\_\{w\}=0\.2\. The target\-action loss uses weights1\.01\.0,0\.50\.5, and0\.20\.2for translation, rotation, and gripper dimensions, respectively\. In the black\-box setting,K=2048K=2048denotes the number of queries per optimization update\. For fair comparison, both DURA and TMA\-NES use 100 optimization updates, leading to a default budget of100×K100\\times Kqueries per patch\.

Evaluation Metrics\.Attack Success Rate \(ASR\) is computed at the rollout level and reports the fraction of rollouts in which the attacked policy fails to complete the task:

ASR=NfailN,\\mathrm\{ASR\}=\\frac\{N\_\{\\text\{fail\}\}\}\{N\},\(10\)whereNNdenotes the total number of evaluation rollouts andNfailN\_\{\\text\{fail\}\}the number of failed rollouts\. A higher ASR indicates a stronger disruption of task execution\.

Attack Precision \(AP\) is computed at the action\-step level and quantifies the consistency between the executed behavior and the attacker\-specified target action\. For theii\-th trajectory, letT\(i\)T^\{\(i\)\}denote its total number of action steps andTtarget\(i\)T^\{\(i\)\}\_\{\\text\{target\}\}the number of steps matching the target action \(e\.g\.,*no\-action*or*move\-forward*\)\. AP is defined as the per\-trajectory ratio averaged over allNNtrajectories:

AP=1N​∑i=1NTtarget\(i\)T\(i\)\.\\mathrm\{AP\}=\\frac\{1\}\{N\}\\sum\_\{i=1\}^\{N\}\\frac\{T^\{\(i\)\}\_\{\\text\{target\}\}\}\{T^\{\(i\)\}\}\.\(11\)A higher AP indicates that the policy is steered more consistently toward the target action, which separates targeted control from incidental performance degradation\.

### Main Results

Quantitative Results\.Table[1](https://arxiv.org/html/2608.10393#Sx4.T1)summarizes the OpenVLA results on LIBERO\. Under white\-box access, DURA achieves 100% ASR on all suites in both simulated and physical patch settings\. Although DURA is target\-only and does not use ground\-truth action tokens, it matches the strongest label\-supervised baseline UADA and outperforms prior target\-only attacks\. Under black\-box access, DURA achieves 86\.0% ASR with simulated patches and 79\.3% with physical patches, improving over TMA\-NES by 43\.7 and 40\.0 points, respectively\. In contrast, the benign policy and clean patch obtain only 23\.5% and 39\.5% ASR, confirming that the failures are caused by the optimized adversarial patch rather than patch insertion alone\. Beyond task failure, DURA also attains a high attack precision \(AP\), showing that the failures stem from the intended target action rather than incidental out\-of\-distribution degradation\. Because AP is only well\-defined for target\-only attacks, we report applicable AP results separately in Appendix C\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/x4.png)
Figure 4:Qualitative comparison of adversarial patch naturalness\.From left to right, we show patches generated by UADA, UPA, TMA, and DURA under the main experimental configuration\. Compared with the noise\-like or visually irregular patterns produced by the baselines, the DURA patch exhibits a more coherent appearance and recognizable semantic content\.![Refer to caption](https://arxiv.org/html/2608.10393v1/x5.png)
Figure 5:Visual naturalness comparison\.The figure reports six visual\-quality metrics for DURA\(⋆\\star\),TMA,UPA, andUADA, together with the no\-patch clean reference baseline\. DURA stays closest to the no\-patch baseline among attack methods, indicating better local naturalness and fewer visible artifacts\.
### Additional Analyses

Real\-Robot Results\.We evaluate DURA on a physical Franka arm in a bread\-in\-basket task\. As shown in Figure[3](https://arxiv.org/html/2608.10393#Sx4.F3), the clean rollout follows the intended pick\-and\-place trajectory and completes the task\. In contrast, when the printed adversarial patch appears in the camera view, the robot deviates from normal execution and enters attacker\-specified behaviors, including freezing action\(Wanget al\.[2025c](https://arxiv.org/html/2608.10393#bib.bib16)\)and moving forward erroneously\(Wanget al\.[2025a](https://arxiv.org/html/2608.10393#bib.bib14)\)\. With the policy, instruction, and robot setup unchanged, DURA transfers to real hardware and induces diverse physical failure modes beyond generic task failure\.

Visual Naturalness\.Figure[5](https://arxiv.org/html/2608.10393#Sx4.F5)evaluates the visual quality of the optimized patches using six metrics: NIQE\(Mittalet al\.[2012](https://arxiv.org/html/2608.10393#bib.bib51)\), CLIP\-Natural\(Radfordet al\.[2021](https://arxiv.org/html/2608.10393#bib.bib53); Wanget al\.[2023](https://arxiv.org/html/2608.10393#bib.bib57)\), DISTS\(Dinget al\.[2020](https://arxiv.org/html/2608.10393#bib.bib52)\), SSIM\(Wanget al\.[2004](https://arxiv.org/html/2608.10393#bib.bib50)\), Boundary Seam Energy \(BSE\)\(Choet al\.[2010](https://arxiv.org/html/2608.10393#bib.bib61)\), and Patch Total Variation \(Patch TV\)\(Rudinet al\.[1992](https://arxiv.org/html/2608.10393#bib.bib59)\), with the evaluation protocol deferred to Appendix D\. Overall, DURA is visually closer to the no\-patch scene than the pixel\-space baselines\. This trend appears not only in perceptual similarity metrics, but also in local artifact measurements around the patch region\. In particular, the pixel\-space attacks tend to introduce high\-frequency textures and visible boundary seams, whereas the diffusion\-guided patch remains smoother and more consistent with the surrounding scene\. A qualitative comparison under the main experimental configuration is shown in Figure[4](https://arxiv.org/html/2608.10393#Sx4.F4)\. These results support that DURA improves the stealthiness of the patch through the diffusion prior, instead of relying on conspicuous adversarial patterns\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/x6.png)
Figure 6:Query budget K\.Black\-box ASR versus query budgetKKon LIBERO\. DURA already achieves a high ASR atK=512K\{=\}512and improves further as the budget increases, whereasTMA\-NESremains at a consistently low ASR\.Query Budget\.Figure[6](https://arxiv.org/html/2608.10393#Sx4.F6)studies the effect of the black\-box query budget\. DURA and TMA\-NES use the same batch of frames and the same number of optimization iterations\. For each update, both methods useKKblack\-box action\-output queries, and we sweep the per\-update budget from 128 to 2048 while matching the total queries between methods\. DURA improves steadily asKKincreases, with ASR rising from 49% atK=128K\{=\}128to 100% atK=2048K\{=\}2048\. Notably, DURA already achieves a relatively high ASR atK=512K\{=\}512, demonstrating effective attacks with a moderate query budget\. In contrast, TMA\-NES remains around 40%–48% under the same budgets\. This gap indicates that DURA uses the same query budget more effectively by performing black\-box search in a diffusion\-guided latent space\. Importantly, practical attacks need not use the query budget required for 100% ASR, since DURA already achieves a high ASR with substantially fewer queries, enabling a flexible trade\-off between attack effectiveness and query cost\.

Impact of the Victim Model\.We further evaluate DURA onπ0\\pi\_\{0\}\-FAST model to examine whether the attack transfers across VLA models and action architectures\. Unlike OpenVLA, which predicts discrete action tokens,π0\\pi\_\{0\}\-FAST leverages action chunks\. As shown in Table[2](https://arxiv.org/html/2608.10393#Sx4.T2), DURA achieves 100% ASR on all four LIBERO task suites in both white\-box and black\-box settings\. In comparison, the strongest baselines reach only 58\.0% ASR in the white\-box setting and 31\.3% in the black\-box setting\. These results indicate that DURA can reliably induce target behaviors and achieve successful attacks across different VLA action formulations\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/x7.png)
Figure 7:Time efficiency\.Time–ASR trade\-off on OpenVLA under \(a\) white\-box and \(b\) black\-box access\. The x\-axis reports single\-GPU wall\-clock time in hours\. DURA reaches high attack success substantially earlier than direct pixel\-space optimization baselines in both settings\.Time Efficiency\.Figure[7](https://arxiv.org/html/2608.10393#Sx4.F7)compares the time–ASR trade\-off on OpenVLA\. All runtimes are measured as single\-GPU wall\-clock time on an H200 with batch size 16, while the victim model, evaluation suite, and patch setting are kept fixed\. For the direct pixel\-space baselines, we trace the curves by varying the number of optimization steps; for DURA, we vary the number of DDIM steps\. In the white\-box setting, DURA reaches high ASR within minutes, whereas TMA, UPA, and UADA require hours to approach comparable success rates\. In the black\-box setting, DURA achieves higher ASR with longer optimization time, whereas TMA\-NES remains less effective even with extended runtimes\. Overall, DURA provides a more favorable trade\-off between runtime and ASR under both access settings\.

## Conclusion

We presented DURA, a diffusion\-guided unrestricted adversarial patch attack for VLA models\. By optimizing along the latent trajectory of a pretrained diffusion model, DURA generates localized, natural\-looking patches that steer robot policies toward attacker\-specified actions under both white\-box and action\-output black\-box access\. Experiments on OpenVLA andπ0\\pi\_\{0\}\-FAST across LIBERO show that DURA improves attack success, target\-action control, visual naturalness, and efficiency over pixel\-space and query\-based baselines\. Printed\-patch Franka experiments further suggest that the attack can persist under physical execution conditions\.

These findings expose a risk for embodied AI: adversarial control can be embedded in visually ordinary workspace content, not only in synthetic or noise\-like perturbations\. Once placed in the robot’s camera view, such content may turn the physical workspace itself into an attack surface\. This calls for VLA defenses that evaluate natural\-looking, physically placeable adversarial content, rather than assuming attacks will appear as conspicuous artifacts\.

## References

- K\. Black, N\. Brown, D\. Driess, A\. Esmail, M\. Equi, C\. Finn, N\. Fusai, L\. Groom, K\. Hausman, B\. Ichter,et al\.\(2024\)π0\\pi\_\{0\}: a vision\-language\-action flow model for general robot control\.arXiv preprint arXiv:2410\.24164\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1)\.
- A\. Brohan, N\. Brown, J\. Carbajal, Y\. Chebotar, J\. Dabis, C\. Finn, K\. Gopalakrishnan, K\. Hausman, A\. Herzog, J\. Hsu,et al\.\(2022\)Rt\-1: robotics transformer for real\-world control at scale\.arXiv preprint arXiv:2212\.06817\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1)\.
- Zoo: zeroth order optimization based black\-box attacks to deep neural networks without training substitute models\.InProceedings of the 10th ACM workshop on artificial intelligence and security,pp\. 15–26\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p2.1)\.
- X\. Chen, F\. Liu, D\. Jiang, and K\. Yan \(2023a\)Natural adversarial patch generation method based on latent diffusion model\.arXiv preprint arXiv:2312\.16401\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- X\. Chen, X\. Gao, J\. Zhao, K\. Ye, and C\. Xu \(2023b\)Advdiffuser: natural adversarial example synthesis with diffusion models\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 4562–4572\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- Z\. Chen, B\. Li, S\. Wu, K\. Jiang, S\. Ding, and W\. Zhang \(2023c\)Content\-based unrestricted adversarial attack\.Advances in Neural Information Processing Systems36,pp\. 51719–51733\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- T\. S\. Cho, S\. Avidan, and W\. T\. Freeman \(2010\)The patch transform\.IEEE Trans\. Pattern Anal\. Mach\. Intell\.32\(8\),pp\. 1489–1501\.Cited by:[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- Z\. Dai, S\. Liu, R\. He, J\. Wu, N\. Lu, W\. Fan, Q\. Li, and K\. Tang \(2025\)SemDiff: generating natural unrestricted adversarial examples via semantic attributes optimization in diffusion models\.arXiv preprint arXiv:2504\.11923\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- K\. Ding, K\. Ma, S\. Wang, and E\. P\. Simoncelli \(2020\)Image quality assessment: unifying structure and texture similarity\.IEEE transactions on pattern analysis and machine intelligence44\(5\),pp\. 2567–2581\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p4.1),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- J\. Fu, K\. Jiang, J\. Jia, Z\. Chen, X\. Chen, L\. Hong, S\. Gao, C\. Tan, D\. Yang, and W\. Zhang \(2026\)VLA\-hijack: a transferable patch attack against vision\-language\-action models via visual proprioception hijacking\.arXiv preprint arXiv:2605\.28083\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p2.1)\.
- Z\. Gao, K\. Chen, Z\. Wei, T\. Mou, J\. Chen, Z\. Tan, H\. Li, and Y\. Jiang \(2024\)ReToMe\-va: recursive token merging for video diffusion\-based unrestricted adversarial attack\.InACM MM,Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- Q\. Guo, S\. Pang, X\. Jia, Y\. Liu, and Q\. Guo \(2024\)Efficient generation of targeted and transferable adversarial examples for vision\-language models via diffusion models\.IEEE Transactions on Information Forensics and Security20,pp\. 1333–1348\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- Z\. Huang, W\. Zhu, H\. Qiu, X\. Ji, and W\. Xu \(2026\)TRAP: hijacking vla cot\-reasoning via adversarial patches\.arXiv preprint arXiv:2603\.23117\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p2.1)\.
- A\. Ilyas, L\. Engstrom, A\. Athalye, and J\. Lin \(2018\)Black\-box adversarial attacks with limited queries and information\.InInternational conference on machine learning,pp\. 2137–2146\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p2.1)\.
- International Commission on Illumination \(2019\)Colorimetry — part 4: cie 1976 lab\* colour space\.Note:ISO/CIE 11664\-4:2019Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p5.1)\.
- E\. K\. Jones, A\. Robey, A\. Zou, Z\. Ravichandran, G\. J\. Pappas, H\. Hassani, M\. Fredrikson, and J\. Z\. Kolter \(2025\)Adversarial attacks on robotic vision language action models\.arXiv preprint arXiv:2506\.03350\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1),[Related Work](https://arxiv.org/html/2608.10393#Sx2.p3.1)\.
- M\. J\. Kim, K\. Pertsch, S\. Karamcheti, T\. Xiao, A\. Balakrishna, S\. Nair, R\. Rafailov, E\. Foster, G\. Lam, P\. Sanketi,et al\.\(2024\)Openvla: an open\-source vision\-language\-action model\.arXiv preprint arXiv:2406\.09246\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1),[Introduction](https://arxiv.org/html/2608.10393#Sx1.p5.1),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p1.2),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p3.1)\.
- D\. P\. Kingma and M\. Welling \(2013\)Auto\-encoding variational bayes\.arXiv preprint arXiv:1312\.6114\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p4.1)\.
- S\. Lin, E\. Chu, P\. Yeh, J\. Chen, and J\. Wang \(2025\)Diffusion to confusion: naturalistic adversarial patch generation based on diffusion model for object detector\.In2025 IEEE International Conference on Image Processing \(ICIP\),pp\. 2378–2383\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- B\. Liu, Y\. Zhu, C\. Gao, Y\. Feng, Q\. Liu, Y\. Zhu, and P\. Stone \(2023\)Libero: benchmarking knowledge transfer for lifelong robot learning\.Advances in Neural Information Processing Systems36,pp\. 44776–44791\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p5.1),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p1.2)\.
- H\. Lu, Y\. Yu, Y\. Yang, C\. Yi, Q\. Zhang, B\. Shen, A\. C\. Kot, and X\. Jiang \(2026\)When robots obey the patch: universal transferable patch attacks on vision\-language\-action models\.InProceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition,pp\. 22867–22878\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p2.1)\.
- X\. Ma, Y\. Gao, Y\. Wang, R\. Wang, X\. Wang, Y\. Sun, Y\. Ding, H\. Xu, Y\. Chen, Y\. Zhao,et al\.\(2026\)Safety at scale: a comprehensive survey of large model and agent safety\.Foundations and Trends in Privacy and Security\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1)\.
- A\. Mittal, R\. Soundararajan, and A\. C\. Bovik \(2012\)Making a “completely blind” image quality analyzer\.IEEE Signal processing letters20\(3\),pp\. 209–212\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p3.2),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- K\. Pertsch, K\. Stachowicz, B\. Ichter, D\. Driess, S\. Nair, Q\. Vuong, O\. Mees, C\. Finn, and S\. Levine \(2025\)FAST: efficient action tokenization for vision\-language\-action models\.CoRRabs/2501\.09747\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p5.1),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p1.2)\.
- D\. Qu, H\. Song, Q\. Chen, Y\. Yao, X\. Ye, Y\. Ding, Z\. Wang, J\. Gu, B\. Zhao, D\. Wang,et al\.\(2025\)Spatialvla: exploring spatial representations for visual\-language\-action model\.arXiv preprint arXiv:2501\.15830\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1)\.
- A\. Radford, J\. W\. Kim, C\. Hallacy, A\. Ramesh, G\. Goh, S\. Agarwal, G\. Sastry, A\. Askell, P\. Mishkin, J\. Clark,et al\.\(2021\)Learning transferable visual models from natural language supervision\.InInternational conference on machine learning,pp\. 8748–8763\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p3.2),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- R\. Rombach, A\. Blattmann, D\. Lorenz, P\. Esser, and B\. Ommer \(2022\)High\-resolution image synthesis with latent diffusion models\.InProceedings of the IEEE/CVF conference on computer vision and pattern recognition,pp\. 10684–10695\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1),[Diffusion\-based Unrestricted Robotic Attacks](https://arxiv.org/html/2608.10393#Sx3.SSx3.p2.7),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p4.7)\.
- L\. I\. Rudin, S\. Osher, and E\. Fatemi \(1992\)Nonlinear total variation based noise removal algorithms\.Physica D: Nonlinear Phenomena60\(1–4\),pp\. 259–268\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p5.1),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- J\. Song, C\. Meng, and S\. Ermon \(2021\)Denoising diffusion implicit models\.InInternational Conference on Learning Representations,Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1),[Diffusion\-based Unrestricted Robotic Attacks](https://arxiv.org/html/2608.10393#Sx3.SSx3.p3.3),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p4.7)\.
- Y\. Song, J\. Sohl\-Dickstein, D\. P\. Kingma, A\. Kumar, S\. Ermon, and B\. Poole \(2020\)Score\-based generative modeling through stochastic differential equations\.arXiv preprint arXiv:2011\.13456\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- O\. M\. Team, D\. Ghosh, H\. Walke, K\. Pertsch, K\. Black, O\. Mees, S\. Dasari, J\. Hejna, T\. Kreiman, C\. Xu,et al\.\(2024\)Octo: an open\-source generalist robot policy\.arXiv preprint arXiv:2405\.12213\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1)\.
- H\. R\. Walke, K\. Black, T\. Z\. Zhao, Q\. Vuong, C\. Zheng, P\. Hansen\-Estruch, A\. W\. He, V\. Myers, M\. J\. Kim, M\. Du,et al\.\(2023\)Bridgedata v2: a dataset for robot learning at scale\.InConference on Robot Learning,pp\. 1723–1736\.Cited by:[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p1.2),[Experimental Setup](https://arxiv.org/html/2608.10393#Sx4.SSx1.p3.1)\.
- J\. Wang, K\. C\. K\. Chan, and C\. C\. Loy \(2023\)Exploring CLIP for assessing the look and feel of images\.InThirty\-Seventh AAAI Conference on Artificial Intelligence, AAAI 2023, Thirty\-Fifth Conference on Innovative Applications of Artificial Intelligence, IAAI 2023, Thirteenth Symposium on Educational Advances in Artificial Intelligence, EAAI 2023, Washington, DC, USA, February 7\-14, 2023,B\. Williams, Y\. Chen, and J\. Neville \(Eds\.\),pp\. 2555–2563\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p3.2),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- T\. Wang, C\. Han, J\. Liang, W\. Yang, D\. Liu, L\. X\. Zhang, Q\. Wang, J\. Luo, and R\. Tang \(2025a\)Exploring the adversarial vulnerabilities of vision\-language\-action models in robotics\.InProceedings of the IEEE/CVF International Conference on Computer Vision,pp\. 6948–6958\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1),[Related Work](https://arxiv.org/html/2608.10393#Sx2.p1.1),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p1.1)\.
- X\. Wang, K\. Chen, X\. Ma, Z\. Chen, J\. Chen, and Y\. Jiang \(2024\)Advqdet: detecting query\-based adversarial attacks with adversarial contrastive prompt tuning\.InACM MM,Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1)\.
- X\. Wang, K\. Chen, J\. Zhang, J\. Chen, and X\. Ma \(2025b\)Tapt: test\-time adversarial prompt tuning for robust inference in vision\-language models\.InCVPR,Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1)\.
- X\. Wang, Y\. Chen, J\. Li, Y\. Wang, Y\. Yao, T\. Gu, J\. Li, Y\. Teng, Y\. Wang, and X\. Hu \(2026\)Openrt: an open\-source red teaming framework for multimodal llms\.arXiv preprint arXiv:2601\.01592\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1)\.
- X\. Wang, J\. Li, Z\. Weng, Y\. Wang, Y\. Gao, T\. Pang, C\. Du, Y\. Teng, Y\. Wang, Z\. Wu,et al\.\(2025c\)Freezevla: action\-freezing attacks against vision\-language\-action models\.arXiv preprint arXiv:2509\.19870\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1),[Related Work](https://arxiv.org/html/2608.10393#Sx2.p1.1),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p1.1)\.
- Z\. Wang, A\. C\. Bovik, H\. R\. Sheikh, and E\. P\. Simoncelli \(2004\)Image quality assessment: from error visibility to structural similarity\.IEEE transactions on image processing13\(4\),pp\. 600–612\.Cited by:[Appendix D](https://arxiv.org/html/2608.10393#A4.p4.1),[Additional Analyses](https://arxiv.org/html/2608.10393#Sx4.SSx3.p2.1)\.
- R\. J\. Williams \(1992\)Simple statistical gradient\-following algorithms for connectionist reinforcement learning\.Machine learning8\(3\),pp\. 229–256\.Cited by:[Diffusion\-based Unrestricted Robotic Attacks](https://arxiv.org/html/2608.10393#Sx3.SSx3.p6.9)\.
- X\. Wu, G\. Shi, Q\. Wang, Z\. Li, A\. S\. Bedi, and D\. Manocha \(2026\)SABER: a stealthy agentic black\-box attack framework for vision\-language\-action models\.arXiv preprint arXiv:2603\.24935\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p3.1)\.
- H\. Xu, Y\. S\. Koh, S\. Huang, Z\. Zhou, D\. Wang, J\. Sakuma, and J\. Zhang \(2025\)Model\-agnostic adversarial attack and defense for vision\-language\-action models\.arXiv preprint arXiv:2510\.13237\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p2.1)\.
- H\. Xue, A\. Araujo, B\. Hu, and Y\. Chen \(2023\)Diffusion\-based adversarial sample generation for improved stealthiness and controllability\.Advances in Neural Information Processing Systems36,pp\. 2894–2921\.Cited by:[Related Work](https://arxiv.org/html/2608.10393#Sx2.p5.1)\.
- B\. Zhang, Y\. Zhang, J\. Ji, Y\. Lei, J\. Dai, Y\. Chen, and Y\. Yang \(2026\)Safevla: towards safety alignment of vision\-language\-action model via constrained learning\.Advances in Neural Information Processing Systems38,pp\. 153335–153373\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p2.1)\.
- B\. Zitkovich, T\. Yu, S\. Xu, P\. Xu, T\. Xiao, F\. Xia, J\. Wu, P\. Wohlhart, S\. Welker, A\. Wahid,et al\.\(2023\)Rt\-2: vision\-language\-action models transfer web knowledge to robotic control\.InConference on Robot Learning,pp\. 2165–2183\.Cited by:[Introduction](https://arxiv.org/html/2608.10393#Sx1.p1.1)\.

## Appendix ADerivation of the Black\-box Attack Direction

At DDIM timesteptt, letu=ut−1u=u\_\{t\-1\}denote the latent after one DDIM denoising step and before the adversarial update\. To estimate the attack direction under black\-box access, DURA samples one\-step noised query latents arounduu:

qt​\(zt∣u\)=𝒩​\(αt​u,\(1−αt\)​I\),q\_\{t\}\(z\_\{t\}\\mid u\)=\\mathcal\{N\}\\left\(\\sqrt\{\\alpha\_\{t\}\}u,\(1\-\\alpha\_\{t\}\)I\\right\),\(12\)or equivalently,

zt=αt​u\+1−αt​ϵ,ϵ∼𝒩​\(0,I\)\.z\_\{t\}=\\sqrt\{\\alpha\_\{t\}\}u\+\\sqrt\{1\-\\alpha\_\{t\}\}\\epsilon,\\qquad\\epsilon\\sim\\mathcal\{N\}\(0,I\)\.\(13\)For each sampledztz\_\{t\}, the frozen diffusion and decoding pipeline constructs a candidate patch, which is rendered into the observation batch and evaluated through the victim policy\. We denote this black\-box query pipeline byΦt​\(zt\)\\Phi\_\{t\}\(z\_\{t\}\)\.

We define the smoothed attack objective as

Jt​\(u\)=𝔼zt∼qt\(⋅∣u\)​\[ℒattack​\(Φt​\(zt\)\)\]\.J\_\{t\}\(u\)=\\mathbb\{E\}\_\{z\_\{t\}\\sim q\_\{t\}\(\\cdot\\mid u\)\}\\left\[\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t\}\)\\right\)\\right\]\.\(14\)Using the score\-function identity, its gradient with respect touuis

∇uJt​\(u\)\\displaystyle\\nabla\_\{u\}J\_\{t\}\(u\)=∇u​∫ℒattack​\(Φt​\(zt\)\)​qt​\(zt∣u\)​𝑑zt\\displaystyle=\\nabla\_\{u\}\\int\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t\}\)\\right\)q\_\{t\}\(z\_\{t\}\\mid u\)\\,dz\_\{t\}\(15\)=∫ℒattack​\(Φt​\(zt\)\)​∇uqt​\(zt∣u\)​𝑑zt\\displaystyle=\\int\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t\}\)\\right\)\\nabla\_\{u\}q\_\{t\}\(z\_\{t\}\\mid u\)\\,dz\_\{t\}\(16\)=𝔼zt∼qt\(⋅∣u\)​\[ℒattack​\(Φt​\(zt\)\)​∇ulog⁡qt​\(zt∣u\)\]\.\\displaystyle=\\mathbb\{E\}\_\{z\_\{t\}\\sim q\_\{t\}\(\\cdot\\mid u\)\}\\left\[\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t\}\)\\right\)\\nabla\_\{u\}\\log q\_\{t\}\(z\_\{t\}\\mid u\)\\right\]\.\(17\)
It remains to compute the score term\. From Eq\.[12](https://arxiv.org/html/2608.10393#A1.E12),

log⁡qt​\(zt∣u\)=C−12​\(1−αt\)​‖zt−αt​u‖22,\\log q\_\{t\}\(z\_\{t\}\\mid u\)=C\-\\frac\{1\}\{2\(1\-\\alpha\_\{t\}\)\}\\left\\\|z\_\{t\}\-\\sqrt\{\\alpha\_\{t\}\}u\\right\\\|\_\{2\}^\{2\},\(18\)whereCCis independent ofuu\. Thus,

∇ulog⁡qt​\(zt∣u\)\\displaystyle\\nabla\_\{u\}\\log q\_\{t\}\(z\_\{t\}\\mid u\)=αt1−αt​\(zt−αt​u\)\.\\displaystyle=\\frac\{\\sqrt\{\\alpha\_\{t\}\}\}\{1\-\\alpha\_\{t\}\}\\left\(z\_\{t\}\-\\sqrt\{\\alpha\_\{t\}\}u\\right\)\.\(19\)Substituting Eq\.[13](https://arxiv.org/html/2608.10393#A1.E13)into Eq\.[19](https://arxiv.org/html/2608.10393#A1.E19)gives

∇ulog⁡qt​\(zt∣u\)=αt1−αt​ϵ\.\\nabla\_\{u\}\\log q\_\{t\}\(z\_\{t\}\\mid u\)=\\frac\{\\sqrt\{\\alpha\_\{t\}\}\}\{\\sqrt\{1\-\\alpha\_\{t\}\}\}\\epsilon\.\(20\)
Combining Eq\.[17](https://arxiv.org/html/2608.10393#A1.E17)and Eq\.[20](https://arxiv.org/html/2608.10393#A1.E20), we obtain

∇uJt​\(u\)=𝔼ϵ∼𝒩​\(0,I\)​\[ℒattack​\(Φt​\(zt\)\)​αt1−αt​ϵ\]\.\\nabla\_\{u\}J\_\{t\}\(u\)=\\mathbb\{E\}\_\{\\epsilon\\sim\\mathcal\{N\}\(0,I\)\}\\left\[\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t\}\)\\right\)\\frac\{\\sqrt\{\\alpha\_\{t\}\}\}\{\\sqrt\{1\-\\alpha\_\{t\}\}\}\\epsilon\\right\]\.\(21\)
WithKKMonte Carlo samples, DURA draws

zt,k=αt​u\+1−αt​ϵk,ϵk∼𝒩​\(0,I\),z\_\{t,k\}=\\sqrt\{\\alpha\_\{t\}\}u\+\\sqrt\{1\-\\alpha\_\{t\}\}\\epsilon\_\{k\},\\qquad\\epsilon\_\{k\}\\sim\\mathcal\{N\}\(0,I\),\(22\)and queries the corresponding losses

ℒattack\(k\)=ℒattack​\(Φt​\(zt,k\)\)\.\\mathcal\{L\}\_\{\\mathrm\{attack\}\}^\{\(k\)\}=\\mathcal\{L\}\_\{\\mathrm\{attack\}\}\\left\(\\Phi\_\{t\}\(z\_\{t,k\}\)\\right\)\.\(23\)The resulting estimator is

gtBB=1K​∑k=1K\(ℒattack\(k\)−b\)​αt1−αt​ϵk,g\_\{t\}^\{\\mathrm\{BB\}\}=\\frac\{1\}\{K\}\\sum\_\{k=1\}^\{K\}\\left\(\\mathcal\{L\}\_\{\\mathrm\{attack\}\}^\{\(k\)\}\-b\\right\)\\frac\{\\sqrt\{\\alpha\_\{t\}\}\}\{\\sqrt\{1\-\\alpha\_\{t\}\}\}\\epsilon\_\{k\},\(24\)wherebbis a variance\-reduction baseline\. This baseline does not change the expectation, since

𝔼zt∼qt\(⋅∣u\)​\[∇ulog⁡qt​\(zt∣u\)\]\\displaystyle\\mathbb\{E\}\_\{z\_\{t\}\\sim q\_\{t\}\(\\cdot\\mid u\)\}\\left\[\\nabla\_\{u\}\\log q\_\{t\}\(z\_\{t\}\\mid u\)\\right\]=∫∇uqt​\(zt∣u\)​𝑑zt\\displaystyle=\\int\\nabla\_\{u\}q\_\{t\}\(z\_\{t\}\\mid u\)\\,dz\_\{t\}\(25\)=∇u​∫qt​\(zt∣u\)​𝑑zt=0\.\\displaystyle=\\nabla\_\{u\}\\int q\_\{t\}\(z\_\{t\}\\mid u\)\\,dz\_\{t\}=0\.\(26\)Therefore,

𝔼​\[gtBB\]=∇uJt​\(u\)\.\\mathbb\{E\}\\left\[g\_\{t\}^\{\\mathrm\{BB\}\}\\right\]=\\nabla\_\{u\}J\_\{t\}\(u\)\.\(27\)
DURA then applies this estimate in the shared update rule:

zt−1a​d​v=ut−1−s⋅gtBB\.z^\{adv\}\_\{t\-1\}=u\_\{t\-1\}\-s\\cdot g\_\{t\}^\{\\mathrm\{BB\}\}\.\(28\)

## Appendix BImpact of Patch Size

Figure[8](https://arxiv.org/html/2608.10393#A2.F8)studies the effect of patch size, measured by the fraction of image area occupied by the patch\. We conduct this study on OpenVLA with the LIBERO under white\-box access, and report the mean ASR over three random seeds with the other settings fixed as in Section:Experiments\. Even with a small visual footprint, DURA already induces effective attacks\. The ASR stays modest when the patch occupies at most1%1\\%of the image, but rises sharply to77%77\\%at only2%2\\%area\. As the patch grows to5%5\\%, the ASR reaches99%99\\%and then saturates at100%100\\%for larger ratios\. We also observe that the variance across seeds is largest in the transition region \(around2%2\\%–3%3\\%area\) and vanishes once the patch saturates, where all three seeds reach100%100\\%\. These results show that DURA is effective with a low\-area patch, while larger patches further improve attack stability\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/Figures/openvla_spatial_patch_size_asr.png)
Figure 8:Patch size\.White\-box ASR versus patch size on LIBERO\-Spatial; ASR rises past a size threshold and saturates\.
## Appendix CQuantitative Results AP

A higher AP indicates stronger steering toward the target action\. For each suite we compare the no\-patch*Clean*baseline against our diffusion\-guided patch under the*white\-box*\(gradient access\) and*black\-box*threat models\. Under white\-box access our patch raises AP to82\.0%82\.0\\%on average \(6161–99%99\\%across suites\), and under black\-box access to67\.3%67\.3\\%\(4848\-84%84\\%\), peaking on Object and Spatial\. In contrast, the clean policy AP only25\.0%25\.0\\%of the time \(1919–32%32\\%\),confirming that the freezing is caused by the optimized adversarial patch rather than by patch insertion alone\. Each bar is a single run over100100trials per suite \(1010tasks×\\times1010rollouts\)\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/Figures/ap.png)Figure 9:AP on OpenVLA across four LIBERO suites\. Compared to the no\-patch Clean baseline, our diffusion\-guided patch sharply raises AP in both the white\-box and black\-box settings\.
## Appendix DVisual Naturalness Evaluation Details

We provide the evaluation details for the visual\-quality analysis in Figure[5](https://arxiv.org/html/2608.10393#Sx4.F5)\. For each attack method, we generate 8 patches and composite each patch into the same 10 LIBERO\-Goal scenes, resulting in 80 patched crops per method\. The no\-patch reference uses the corresponding clean scene crops\. All methods follow the same patch insertion location and image\-compositing rule as in the main experiments\.

To focus the evaluation on the patch and its nearby context, we crop a192×192192\\times 192local region from each scene \(x∈\[0,192\),y∈\[32,224\)x\\in\[0,192\),y\\in\[32,224\)\)\. This crop contains the complete patch and the surrounding background\. All metrics are computed on these local crops, and we report the mean and standard deviation over the evaluated crops\.

We use both no\-reference and reference\-based metrics\. Natural Image Quality Evaluator \(NIQE\)\(Mittalet al\.[2012](https://arxiv.org/html/2608.10393#bib.bib51)\)measures the deviation from natural image statistics without requiring a clean reference; lower values indicate more natural images\. CLIP\-Natural is computed using the CLIP\-based image\-quality assessment protocol\(Radfordet al\.[2021](https://arxiv.org/html/2608.10393#bib.bib53); Wanget al\.[2023](https://arxiv.org/html/2608.10393#bib.bib57)\), with the prompt pair "*natural photo and synthetic photo*"\. Higher values indicate that the crop is more strongly aligned with natural photographic content\. Before CLIP evaluation, each crop is resized to224×224224\\times 224and normalized to\[0,1\]\[0,1\]\.

For reference\-based evaluation, each patched crop is paired with its corresponding no\-patch crop\. Deep Image Structure and Texture Similarity \(DISTS\)\(Dinget al\.[2020](https://arxiv.org/html/2608.10393#bib.bib52)\)measures perceptual structure and texture distortion, where lower values indicate smaller perceptual changes\. Structural Similarity Index Measure \(SSIM\)\(Wanget al\.[2004](https://arxiv.org/html/2608.10393#bib.bib50)\)measures luminance, contrast, and structural consistency, where higher values indicate better preservation of the original scene\.

We further include two local artifact measures\. Boundary Seam Energy \(BSE\) measures the average CIE76 color difference\(International Commission on Illumination[2019](https://arxiv.org/html/2608.10393#bib.bib58)\)between adjacent pixels across the patch boundary; lower values indicate a smoother transition between the patch and the surrounding scene\. Since the patch touches the left and bottom image borders, only the valid top and right boundaries are used\. Patch Total Variation \(Patch TV\) measures the anisotropic total variation inside the patch region\(Rudinet al\.[1992](https://arxiv.org/html/2608.10393#bib.bib59)\):

TV​\(P\)=𝔼​\|Pi\+1,j−Pi,j\|\+𝔼​\|Pi,j\+1−Pi,j\|\.\\mathrm\{TV\}\(P\)=\\mathbb\{E\}\|P\_\{i\+1,j\}\-P\_\{i,j\}\|\+\\mathbb\{E\}\|P\_\{i,j\+1\}\-P\_\{i,j\}\|\.\(29\)
Lower Patch TV indicates smoother patch texture and fewer high\-frequency artifacts\.

## Appendix ERobustness to Input Transformations

![Refer to caption](https://arxiv.org/html/2608.10393v1/x8.png)Figure 10:Robustness to input\-transformation defenses \(ASR\)\.ASR \(%,↑\\uparrow\) averaged over the four LIBERO suites on OpenVLA andπ0\\pi\_\{0\}\-FAST under JPEG compression, bit\-depth reduction, and Gaussian noise at several strengths\.We evaluate common input\-transformation defenses, including JPEG compression, bit\-depth reduction, and Gaussian noise, on both OpenVLA andπ0\\pi\_\{0\}\-FAST, and measure their effect with ASR \(Figure[10](https://arxiv.org/html/2608.10393#A5.F10)\) and per\-suite AP \(Figure[11](https://arxiv.org/html/2608.10393#A5.F11)\)\. In terms of ASR, DURA stays effective under every defense and strength\. Even under the strongest JPEG compression \(Q=10Q\{=\}10\), its ASR remains90%90\\%on OpenVLA and100%100\\%onπ0\\pi\_\{0\}\-FAST, and it stays at9898–100%100\\%under bit\-depth reduction and Gaussian noise, far above the clean baselines of23%23\\%and14%14\\%\.

For AP, each radar axis in Figure[11](https://arxiv.org/html/2608.10393#A5.F11)is one LIBERO suite for OpenVLA \(OV\) andπ0\\pi\_\{0\}\-FAST \(Pi0\), and the dashed contour marks the no\-defense attack\. Across all three defenses, the AP contours stay close to this no\-defense level, so the defenses rarely turn a targeted failure back into correct execution\. The drop is largest under the strongest JPEG setting \(Q=10Q\{=\}10\) and bit\-depthk=3k\{=\}3, mostly on the OpenVLA suites, while Gaussian noise barely changes AP at any strength, and theπ0\\pi\_\{0\}\-FAST results stay close to no\-defense throughout\.

![Refer to caption](https://arxiv.org/html/2608.10393v1/x9.png)Figure 11:Robustness to input\-transformation defenses \(AP\)\.AP per suite on OpenVLA\(OV\) andπ0\\pi\_\{0\}\-FAST under JPEG compression, bit\-depth reduction, and Gaussian noise at several strengths\. The dashed line is the no\-defense attack, and each defense stays close to it\.