AdvNav is proposed, a behavior-guided black-box adversarial attack framework that disturbs an agent's first-person views during navigation, which demonstrates the effectiveness and generality of AdvNav, reveals critical perception vulnerabilities and offers insights for the design of future resilient VLN models.
Abstract
Despite progress in Embodied AI, Vision-and-Language Navigation systems remain vulnerable to adversarial visual disturbances. Most existing methods rely on white-box access to target model gradients, which is often unrealistic for real-world deployed systems and computationally exhaustive due to recursive backpropagation for optimization, limiting their applicability. While previous black-box methods predominantly target single-step, instantaneous decision tasks, they struggle to handle the task complexities and temporal dependencies. This highlights the need for a gradient-free attack method that can effectively disrupt the multistep sequential perception-action loop using only observable inputs and outputs. Therefore, we propose AdvNav, a behavior-guided black-box adversarial attack framework that disturbs an agent's first-person views during navigation. To construct an informative surrogate objective for effective optimization guidance in gradient-free search under the black-box setting, we design a dual-granularity behavior-based feedback, aggregating a trajectory-level performance score representing overall navigation degradation, an action-level reward score considering the potential decision risk, and a deviation indicator, all of which are extracted from the agent's self-output behaviors. This feedback guides a hybrid optimization strategy that heuristically tunes perturbation strength via adaptive updates and evolves noise spatial structure genetically, to iteratively discover the most disruptive noise configuration. Evaluated against Transformer-based HAMT and LLM-based MapGPT with two types of backbones on R2R dataset, AdvNav achieves 49.70/65.96/87.30% Attack Success Rate. The result demonstrates the effectiveness and generality of AdvNav, reveals critical perception vulnerabilities and offers insights for the design of future resilient VLN models.
Flow-matching Vision-Language-Action (VLA) policies generate actions through $\tau$-indexed ordinary differential equation (ODE) rollouts, exposing intermediate velocity-field structure that endpoint-only adversarial objectives do not directly target. We study this mechanism on the evaluated $\pi_{0.5}$ policy in LIBERO and propose the Tau-Path Coupled Attack (TPCA), a white-box visual attack that couples executed-window endpoint displacement with velocity-field divergence along the flow rollout. The study is deliberately scoped as a single-architecture mechanism analysis rather than a general claim about all flow-matching policies. Under matched compute against Visual-PGD, TPCA and endpoint-only optimization both produce near-saturated task failure at $3/255$, while TPCA yields larger action-space endpoint displacement. As the perturbation budget tightens, the task-level gap becomes visible: at $1/255$, TPCA induces a Drop of $0.38$ whereas endpoint-only optimization induces $0.17$, with over $+129\%$ larger action-space endpoint displacement. Cross-task checks on two additional LIBERO spatial tasks show consistent action-space endpoint-displacement advantages for the evaluated setting, while task-failure advantages are budget- and task-dependent. These results support a bounded conclusion: flow-rollout coupling provides additional optimization signal for the evaluated $\pi_{0.5}$ policy, but broader architectural generalization and defense effectiveness require future extensive studies.
Mengxiang Liu, Ruilong Deng, Rong Guo et al.· Security and Safety· 0 citations
Safe quadrotor navigation in cluttered and dynamic environments depends not only on instantaneous geometric perception, but more critically on anticipating collision risks induced by relative motion. Conventional modular pipelines frequently suffer from perception latency, while end-to-end learning methods relying on implicit scalar rewards often struggle to extract reliable spatio-temporal features without physics-grounded supervision. To address this, we propose an anticipatory risk-guided reinforcement learning framework. Leveraging privileged simulator states, we construct a directionally aligned future collision risk map based on the Closest Point of Approach (CPA). Through an asymmetric actor-critic architecture, the network is trained to self-predict this structured risk, which explicitly guides the visual policy during deployment. A lightweight spatio-temporal encoder extracts motion cues directly from onboard depth sequences, bypassing explicit object tracking or optical flow estimation. Extensive simulated and real-world experiments demonstrate that our method effectively improves safety margins and flight efficiency in dense dynamic clutters compared to existing baselines. Furthermore, the learned policy achieves robust zero-shot Sim-to-Real transfer on a physical quadrotor, relying purely on abstracted spatio-temporal depth sequences and its self-predicted risk priors, validating the effectiveness of our approach and its robust generalization from simulation to reality.
Yuchao Mei, Guohao Zhang, Luxia Ai et al.· 0 citations
Vision-Language-Action (VLA) models have emerged as generalist robotic policies capable of following diverse language instructions and performing a wide range of manipulation tasks. However, their direct control over embodied agents also exposes them to adversarial interference that may cause unsafe physical behaviors. Existing attacks on robotic policies are typically optimized for a single task or instruction, leaving the cross-task vulnerabilities of multitask VLAs largely unexplored. We introduce UniTexture, a cross-task universal adversarial texture attack that uses a single textured 3D object to induce targeted deviations in VLA action predictions across multiple tasks. UniTexture backpropagates gradients from the policy's action outputs to surface texture parameters through a differentiable renderer. It jointly optimizes the shared texture over a distribution of tasks, instructions, states, and viewpoints using a targeted action-space objective, steering predicted actions toward attacker-defined targets without optimizing a separate texture for each task. We evaluate UniTexture on OpenVLA and $\pi_{0.5}$ across diverse manipulation tasks and multiple evaluation settings. UniTexture reduces the mean task success rate from 90.0% under benign conditions to 48.4% under attack, induces target-aligned action shifts, and further exhibits cross-suite and cross-model transfer without re-optimization. Together, these findings reveal shared cross-task vulnerabilities in multitask VLAs that can be systematically exploited through a single adversarial surface texture.
Yu Dai, Mingzhe Dai, Tianshi Wang et al.· 0 citations
Reactive local planners such as the Dynamic Window Approach (DWA) often fail in non-convex dead-end structures because their greedy objective drives the robot into local minima. This paper presents a ROS 2-native mapless navigation framework that trains a Proximal Policy Optimization (PPO) agent using a Procedural Adversarial Trap Generator (ATG) in Gazebo. The generator systematically produces U-shaped traps, corners, and narrow passages so that the agent learns proactive avoidance and recovery behavior rather than merely reacting to nearby obstacles. In simulation, the proposed DRL policy achieves an 88% success rate in complex maze scenarios, while the DWA baseline drops to 8%. A zero-shot deployment on a physical Unitree Go2 further confirms that the learned behavior transfers to real hardware despite LiDAR noise and odometry uncertainty.
Ardiansyah Al Farouq, Yuya Hosoda, Jooho Lee· 2026 23rd International Conf...· 0 citations
Vision-Language-Action (VLA) models have emerged as a powerful paradigm for general-purpose robot manipulation; however, their transition to real-world environments reveals vulnerabilities to minor environmental perturbations. We propose FLARE, an optimized physical spotlight attack framework that exploits these vulnerabilities via targeted illuminations, dropping baseline task success rates to zero without any access to model internals. While adversarial training is the standard countermeasure, we identify a critical and previously underestimated defensive pitfall: naive data augmentations incorrectly condition VLA models to discard color as noise, collapsing their visual perception into a purely shape-biased processor. We expose this degradation through a diagnostic grayscale evaluation, in which the defended model maintains high success rates on grayscale inputs, while its success rate on benign, color-dependent real-world tasks drops to at most 47.5%, well below the undefended baseline. To address this, we propose ChromaGuard, a chroma-preserving adversarial training method. On a physical 6-DoF robotic platform, we demonstrate that ChromaGuard achieves 97.5% and 92.5% success rates in benign and attacked color-dependent tasks, respectively.
Reachability analysis for visuomotor policies is difficult because large visual encoders make end-to-end set propagation computationally expensive and excessively conservative. We therefore freeze the visual encoder and confine set propagation to a low-dimensional interface between it and the downstream policy, with the interface set calibrated from held-out camera-pose perturbations. Propagating this set through the policy with zonotopes yields a terminal output-enclosure width that set-based training optimizes directly. During evaluation, camera-pose perturbations are sampled from the prescribed distribution, and rollout-level split conformal calibration converts the resulting action-deviation scores into a probabilistic reachable-action radius with finite-sample coverage. In controlled manipulation experiments, set-based training reduces this radius while preserving closed-loop task capability, and matched behavior-only, observational-consistency, and pointwise-adversarial controls all leave a larger radius.
Yanliang Huang, Zhuocheng Zhang, Peng Xie et al.· 0 citations