arXiv:2505.03500cs.RO2025-05被引 9

通过操控文本隐状态,让视觉语言动作模型学会组合新指令。

VLAs are Confined yet Capable of Generalizing to Novel Instructions

  • 用任务间文本隐状态插值,实现跨任务行为重组。
  • 在libero-ood上将成功率从<15%提升至83%。
  • 揭示模型存在空间过拟合,且可被隐蔽指令操控。

视觉语言动作模型(VLAs)在已演示任务上表现良好,但在需要组合不同任务技能的泛化任务上表现不佳。例如,模型能分别完成将奶油奶酪放入碗中、将碗放在橱柜上,却无法将奶油奶酪直接放到橱柜上。本文提出在推理时操纵模型内部表示,通过平均特定基础任务所有演示轨迹的文本标记隐藏状态,获得该任务的文本隐状态。执行泛化任务时,对两个基础任务的文本隐状态进行时间插值并重新注入,使子行为按序激活。我们在新构建的libero-ood基准上评估,该方法在20个泛化任务上使所有SOTA VLAs的失败率降至<15%,而π0模型达到83%成功率。定性分析发现,模型存在空间过拟合,将物体名称与演示位置绑定而非真正理解目标。此外,解码出的文本隐状态生成人类不可读的提示,仍能使模型在标准LIBERO套件上达到70%成功率,暗示存在私有指令或后门攻击风险。

原文摘要 · Abstract (English)

Vision-language-action models (VLAs) often achieve high performance on demonstrated tasks but struggle significantly when required to extrapolate, combining skills learned from different tasks in novel ways. For instance, VLAs might successfully put the cream cheese in the bowl and put the bowl on top of the cabinet, yet still fail to put the cream cheese on top of the cabinet. In this work, we demonstrate that behaviors from distinct tasks can be effectively recombined by manipulating the VLA's internal representations at inference time. Concretely, we identify the text latent by averaging the text tokens' hidden states across all demonstrated trajectories for a specific base task. For executing an extrapolated task, we can temporally interpolate the text latent of the two base tasks and add it back to the text hidden states, so sub-behaviors from the two tasks will be activated sequentially. We evaluate this approach using the newly created libero-ood benchmark, featuring 20 tasks extrapolated from standard LIBERO suites. The results on libero-ood show that all SOTA VLAs achieve < 15% success rate, while $\pi0$ with text latent interpolation reaches an 83% success rate. Further qualitative analysis reveals a tendency for VLAs to exhibit spatial overfitting, mapping object names to demonstrated locations rather than achieving genuine object and goal understanding. Additionally, we find that decoding the text latent yields human-unreadable prompts that can nevertheless instruct the VLA to achieve a 70% success rate on standard LIBERO suites, enabling private instruction or backdoor attacks.

视觉语言动作泛化能力隐状态操控安全风险

Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。