首次发现视觉语言动作模型的比特翻转攻击，仅需数次精准翻转即导致任务失败。
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
- 通过梯度选择比特翻转，精准打击动作生成层
- 少数翻转（1-5次）使直接回归与令牌策略失效
- 攻击效果依赖架构，对流匹配策略需百次以上
量化视觉语言动作（VLA）模型存在权重故障面：类似Rowhammer的故障可篡改已部署的INT8比特。本文提出首个针对VLA的比特翻转攻击：少数梯度选择的翻转即可将闭环成功率降至0%，而数百次随机翻转则无效。在四种模型变体、三类动作头中，受损比特集中于少数动作生成层，但实际攻击预算随头部类型显著变化——直接回归和令牌策略仅需1至5次翻转，而流匹配策略需约100至300次。固定方向的流逃逸损失将 extit{pizero}的攻击预算从约1000次降至约100次；五方向扫描证实攻击不依赖单一方向。在直接头模型中，保护3.1%权重可使K=100时保持60%成功率，保护5.3%则使开环崩溃阈值从3次提升至100次。任务校准的模拟K=100次翻转在真实机器人上实现0/20成功，而干净样本为14/20，全局随机翻转为16/20。因此，权重完整性是具身基础模型的安全边界。代码作为附录提供。
原文摘要 · Abstract (English)
Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to $0\%$, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in $1$--$5$ flips, whereas the evaluated flow-matching policies require ${\sim}100$--$300$. Our fixed-direction manifold-escape loss cuts \pizero{}'s budget from ${\sim}1000$ to ${\sim}100$ flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting $3.1\%$ of weights preserves $60\%$ success at $K{=}100$, and protecting $5.3\%$ moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated $K{=}100$ flips yield $0/20$ real-robot successes, versus $14/20$ clean and $16/20$ global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。