Capability and Robustness Cannot Both Be Free: An Information-Theoretic Bound for Vision-Language-Action Models Jianwei Tai
arXiv:2605.25889v1 [cs.CR] 25 May 2026
School of Internet, Anhui University [email protected]
Abstract Vision-Language-Action (VLA) models are increasingly deployed on real robots, where each predicted action is executed and each failure carries a safety cost. They reach high success rates on clean inputs but collapse under small adversarial perturbations. A 16/255 PGD attack on OpenVLA-7B drops LIBERO success from above 95% to under 5%. Empirical defenses recover some robustness at a cost in clean accuracy, but the literature does not say whether the trade-off has a theoretical floor. We prove that it does. For any VLA policy with discrete actions, the sum of capability (mutual information between policy action and oracle action) and robustness (mutual information preserved under adversarial perturbation, net of trivial channel leakage) is upper-bounded by a policyindependent budget: task entropy plus adversarial channel capacity. The proof is two applications of the Data Processing Inequality plus MI non-negativity. The pixel-level bound is loose on current models (∼ 103 nats), but an encoderspecific corollary restricts the channel to the policy-relevant subspace, reducing the budget from ∼ 5,000 to ∼ 31 nats on OpenVLA; the policy already consumes ∼ 24% of this tighter budget, leaving limited room for simultaneous robustness improvement. We validate the bound across 252 closedform Gaussian-VLA cells and 48 OpenVLA-7B × LIBERO × PGD cells (zero violations). We propose encoder-specific slack as a normalized comparison axis for defense papers, and release all code, manifests, and results.
1
Introduction
Vision-Language-Action (VLA) models, large multimodal policies that map an image and a natural-language instruction directly to a robot action, account for much of the past two years’ progress in generalist manipulation, and are starting to show up alongside humans on real hardware. OpenVLA-7B (Kim et al. 2024) reaches 95.4% success on LIBERO-Spatial. RT-2 (Brohan et al. 2023) generalizes to unseen object-verb compositions. π0 (Black et al. 2024) scales to dexterous bimanual tasks. Clean-input success rates keep climbing year over year. But each prediction is a physical action, and that turns visual fragility into a safety problem rather than an accuracy one. Under attack the picture shifts. A series of recent empirical studies (Wang et al. 2024; Yan et al. 2025; Kim et al. Copyright © 2026, Association for the Advancement of Artificial Intelligence (www.aaai.org). All rights reserved.
2025) reports the same pattern. A 16/255 PGD perturbation that a human cannot see drops OpenVLA’s task success on LIBERO from 95% to under 5%. Defenses help only part way. Adversarial fine-tuning typically buys back 10–50% of the lost robustness while costing 5–15% on clean tasks, and the resulting Pareto frontier is uneven across datasets and architectures. For safety-critical deployment, the question that should come first remains open. We do not yet know whether the trade-off has a theoretical floor or whether a smarter training procedure could deliver clean accuracy and adversarial invariance together without limit. Tsipras et al. (2019) settled the analogous question for binary classifiers under specific data distributions, but the corresponding statement for action-generating policies has not, to our knowledge, been written down. We write it down. For any VLA policy π producing action Aπ from observation X, with oracle action A⋆ and adversarial perturbation δ such that X̃ = X + δ and Ãπ = π(X̃): I(A⋆ ; Aπ ) + I(Aπ ; Ãπ ) − I(Aπ ; δ) ≤ H(A⋆ ) + I(X; X̃) . | {z } | {z } | {z } Capability
Robustness
Budget
(1) The proof reduces to two applications of the Data Processing Inequality plus standard non-negativity facts (Theorem 1). It is a short proof; the work is in the framing. Capability and robustness trade against a single policy-independent budget that depends only on the task entropy and the attack channel capacity. On current models the bound is loose (slack ∼ 103 nats, dominated by the gap between imagedimensional channel capacity and 7-D action geometry), so it serves as a ceiling guarantee rather than a tight predictor of achievable performance. The bound is non-constructive. It asserts Cap + Rob ≤ Budget without telling us how to construct a π that saturates it. We propose the slack S(π, ε) = H(A⋆ ) + I(X; X̃) − Cap(π) − Rob(π) ≥ 0 as a comparable cross-paper metric, so a defense paper can report “we closed 60% of the slack at ε = 4/255” instead of absolute robustness numbers that do not transfer across settings. Our MI estimators are biased, and Sec. 4 catalogs the bias direction. The bias does not threaten the inequality, since estimator error shrinks the LHS faster than the RHS in the regime we operate in, so it widens slack rather than manufacturing violations. Contributions.
1. An information-theoretic ceiling (Sec. 3). Theorem 1 bounds Cap + Rob by H(A⋆ ) + I(X; X̃) for any VLA policy. Corollaries show that discretization tightens the bound (Cor. 2), adaptive attackers leave residual slack (Cor. 1), and restricting the channel to the encoder subspace reduces the budget from ∼ 5,000 to ∼ 31 nats (Cor. 4). 2. Validation (Secs. 4, 5). The bound holds in 252/252 closed-form Gaussian-VLA cells (analytic and MINE) and 48/48 OpenVLA-7B × LIBERO × PGD cells. Under the encoder-specific bound, the measured Capdisc ≈ 7.5 nats consumes 24% of the 31-nat budget, showing the constraint is non-vacuous at the policy-relevant scale. 3. Slack as a metric. We propose encoder-specific slack Senc (π, ε) ≥ 0 as a comparable figure of merit within an encoder family, so defense papers can report the fraction of the encoder budget consumed at a given ε. Code, manifests, and the 252-cell toy grid are released.
2 2.1
Related Work
Information-Theoretic Bounds in Deep Learning
The mutual-information lens on neural networks goes back to Tishby and Zaslavsky (2015)’s Information Bottleneck framework, later sharpened into generalization bounds by Xu and Raginsky (2017) via algorithmic stability of inputoutput MI. The closest antecedent of our bound is Tsipras et al. (2019), who proved that robustness and accuracy are fundamentally at odds for specific data distributions under ℓ∞ attack. We push the framework in three directions. First, the output is an action distribution rather than a class probability. Second, the trade-off variables are mutual informations I(A⋆ ; Aπ ) and I(Aπ ; Ãπ ), not accuracies. Third, the leakage debit −I(Aπ ; δ), absent from any classifier formulation we know of, turns out to matter for action-generating policies, where the action space can passively transmit attack information. The proof of Corollary 1 relies on Polyanskiy and Wu (2017)’s strong-DPI tools. Beyond classification, Zhang et al. (2019) decomposed robust error into natural and boundary components. Ross and Doshi-Velez (2018) earlier proposed input-gradient regularization as a way to get robustness and interpretability at the same time, and Fan and Li (2021) formalized the empirical-vs.-provable robustness trade as a joint optimization. All of these target classification loss, while we target MI between continuous (or discrete-tokenized) actions.
2.2
VLA Models and Adversarial Robustness
Kim et al. (2024) set the open-weights baseline with OpenVLA-7B (LIBERO 95% clean), and a string of empirical attack/defense studies has piled on since. Wang et al. (2024) report the now-standard 95% → <5% collapse under 16/255 PGD. Yan et al. (2025) probe joint vision + language perturbations, Kim et al. (2025) build attributionguided defenses, Fei et al. (2025) catalog physical perturbations, and Liu et al. (2025) measure real-world domain shift.
Table 1: Differentiation matrix. The cell that was empty before this paper is the bottom-right. Work
Output
Bound on
Tsipras et al. (2019) Wang et al. (2024) This work
class label 7-D pose action
accuracy — (empirical) action-MI
The same vulnerability shows up in the broader VLM literature. Qi et al. (2024) demonstrate that a single visual adversarial example can universally jailbreak aligned LLMs, and Fang, Fang, and Wang (2026) expose multi-modal fragility through texture-constrained perturbations. All of these are empirical and stop at measuring how robust a VLA or VLM can be made. None states an upper bound on what is possible. Their measurements anchor our H(A⋆ ) and I(X; X̃) estimates, and our bound supplies the comparison axis their papers lack.
2.3
Our position
Existing impossibility results bound classifier accuracy under attack (Tsipras et al. 2019), while existing VLA work measures empirical fragility (Wang et al. 2024). We sit between, with an information-theoretic bound for VLA-class policies and both closed-form and real-model validation. Table 1 places the bound in the prior literature.
3
The Capability–Robustness Bound
All MI and entropy quantities are in nats. Random variables are capitalized, and realizations lowercase.
3.1
Notation and setup
A Vision-Language-Action (VLA) policy π maps an observation X (a jointly-encoded image + language instruction) to a distribution over actions Aπ = π(X) ∈ A. For LIBERO and OpenVLA, A ⊆ R7 (6-DoF end-effector pose plus a 1bit gripper). Let A⋆ denote the oracle action from an expert demonstration on the same observation. Take p(X, A⋆ ) to be fixed by the task and demonstrator, with π defining p(Aπ | X). When π is stochastic the conditional comes from its sampling distribution; when deterministic, Aπ is a function of X. The attacker observes X and produces X̃ = X + δ with ∥δ∥∞ ≤ ε. We allow δ to depend on X (white-box) and on π. The attacked action is Ãπ = π(X̃), the same policy applied to the perturbed input. The only Markov assumption we need is Aπ = π(X),
Ãπ = π(X̃),
X̃ = X + δ.
(M)
For stochastic π, we additionally assume that any internal randomness used to compute Ãπ is independent of (X, Aπ , δ), so the Markov chain Aπ − X̃ − Ãπ holds. Both this and the deterministic case (OpenVLA’s argmax decoding, used in Sec. 5) preserve the proof’s two DPI applications.
slack S 0
(iii) Leakage debit. Since mutual information is nonnegative,
LHS Cap Rob
−I(Aπ ; δ) ≤ 0.
(iii)
Adding (i), (ii), and (iii) yields (2).
RHS
H(A )
The leakage debit. Step (iii) drops a non-negative term, so removing it would only loosen the bound. We keep it because it is what makes Rob a meaningful metric. A policy that simply embeds δ into its action achieves high I(Aπ ; Ãπ ) without any genuine invariance, and the −I(Aπ ; δ) debit cancels exactly that pathology.
I(X; X)
Figure 1: Theorem 1 schematic. The LHS (capability + robustness any policy can claim) is bounded by the RHS (task entropy + attack channel capacity); the gap is slack S ≥ 0. Capability and Robustness. Cap(π) ≜ I(A⋆ ; Aπ ) is how informative Aπ is about the oracle action. Rob(π) ≜ I(Aπ ; Ãπ ) − I(Aπ ; δ) is invariance under attack, debited by the part of Ãπ that is just δ leaking into the action. The subtraction is operationally important. It discounts the degenerate policy that copies δ into its output, but does not affect the upper bound itself, only its tightness.
Magnitude of the budget. The RHS depends only on the task (H(A⋆ )) and the attacker (I(X; X̃)), not on π. No architectural change to the policy can move the budget. For OpenVLA on LIBERO, H(A⋆ ) ≈ 26 nats (token-level) and I(X; X̃) ≈ 5,000 nats at ε = 4/255 (PCA-tightened upper bound; Sec. 5). The pixel-level budget is loose because the image-dimensional channel capacity far exceeds what the 7D action space can exploit. However, the encoder-specific bound (Cor. 4) reduces the budget to ≈ 31 nats, and the discretized Cap ≈ 7.5 nats already consumes 24% of this tighter budget. Sec. 5 measures all terms directly.
3.2
3.3
Statement and Proof
Theorem 1 (Capability–Robustness Bound). For any VLA policy π satisfying (M) with discrete (or discretized) action space A, any joint distribution p(X, A⋆ ), and any (possibly adaptive) attacker producing X̃ = X + δ, Cap(π) + Rob(π) ≤ H(A⋆ ) + I(X; X̃).
(2)
⋆
Scope. The bound requires H(A ) to be a well-defined (finite, non-negative) Shannon entropy, which holds whenever A⋆ takes values in a finite set. OpenVLA, RT-2, and other tokenized VLAs discretize each action dimension into 256 bins, so the theorem applies directly. For continuousaction policies (π0 , diffusion policies), the bound holds with H(A⋆ ) replaced by log |Aq | after any deterministic quantizer q (Cor. 2), since MI is invariant to invertible transforms and quantization can only reduce it. Proof. We decompose the LHS into three terms and bound each. (i) Capability. By definition of mutual information, ⋆
⋆
⋆
⋆
I(A ; Aπ ) = H(A ) − H(A | Aπ ) ≤ H(A ).
(i)
Equality iff H(A⋆ | Aπ ) = 0, i.e. Aπ is a sufficient statistic for A⋆ . (ii) Coupling under attack. We claim I(Aπ ; Ãπ ) ≤ I(X; X̃).
(ii)
Two applications of the Data Processing Inequality (DPI). First, Aπ is a deterministic function of X, so Aπ − X − X̃ is Markov, giving I(Aπ ; X̃) ≤ I(X; X̃). Second, Ãπ is a deterministic function of X̃, so Aπ − X̃ − Ãπ is Markov, giving I(Aπ ; Ãπ ) ≤ I(Aπ ; X̃). Chaining gives I(Aπ ; Ãπ ) ≤ I(Aπ ; X̃) ≤ I(X; X̃).
Tightness
Corollary 1 (Tightness of Theorem 1). Equality in (2) holds iff (i) Aπ is a sufficient statistic for A⋆ given X; (ii) π retains all X-information relevant to Ãπ , i.e. π has no information bottleneck on the support of X̃; and (iii) δ ⊥ Aπ . A sufficient condition is δ ⊥ X (which implies δ ⊥ Aπ since Aπ is Xmeasurable); the converse holds when π is injective. Adaptive PGD attackers craft δ as a function of X, so (iii) fails by construction. This is why empirical Pareto frontiers sit strictly inside the bound, since the bound is tight only for oblivious noise. Sec. 5 confirms it. On OpenVLA, slack remains ∼ 103 nats even with PCA-tightened RHS, dominated by the dimensional gap between image channel capacity and 7-D action geometry.
3.4
Action Discretization
OpenVLA discretizes each of 7 action dimensions into 256 bins (8 bits per dim, about 38.8 nats total). Let A⋆q = q(A⋆ ) be the quantized oracle. Corollary 2 (Discretization tightens the bound). For any deterministic quantizer q : A → Aq , Cap(q ◦ π) + Rob(q ◦ π) ≤ H(A⋆q ) + I(X; X̃) ≤ log |Aq | + I(X; X̃).
(3)
Discrete-token VLAs (RT-2, OpenVLA) have a strictly tighter capability ceiling than continuous-action policies on the same task. We therefore expect the trade-off cliff to appear earlier for tokenized architectures.
3.5
Multi-step Policies
Deployed VLAs roll out for T steps, with action Aπ,t = π(Xt , Ht−1 ) conditioned on history Ht−1 = (X1:t−1 , Aπ,1:t−1 ). The attacker may perturb every frame, with X̃t = Xt + δt and ∥δt ∥∞ ≤ ε. Define the episode-level P ⋆ quantities CapT ≜ t I(At ; Aπ,t | Ht−1 ) and RobT ≜ P t [I(Aπ,t ; Ãπ,t | Ht−1 ) − I(Aπ,t ; δt | Ht−1 )]. Corollary 3 (Multi-step extension). Under (M) applied per step, CapT + RobT
T X ≤ H(A⋆t | Ht−1 )
(4)
The proof is just term-by-term application of Theorem 1 to the conditional distribution at each step. The RHS is the rollout-summed task entropy and per-step channel capacity, still policy-independent.
3.6
Encoder-Specific Tightening
The pixel-level I(X; X̃) is loose because most image dimensions are irrelevant to the policy. For any VLA of the form π = f ◦ ϕ where ϕ is a frozen encoder (e.g. DINOv2+SigLIP in OpenVLA), DPI gives a tighter familyspecific bound. Corollary 4 (Encoder-specific bound). Let ϕ : X → Rd be a deterministic encoder and π = f ◦ ϕ. Then Cap(π) + Rob(π) ≤ H(A⋆ ) + I(ϕ(X); ϕ(X̃)).
(5)
Proof. Since Aπ = f (ϕ(X)) and Ãπ = f (ϕ(X̃)), step (ii) of Theorem 1 becomes I(Aπ ; Ãπ ) ≤ I(ϕ(X); ϕ(X̃)) by two applications of DPI through f and ϕ. The rest is unchanged. On OpenVLA, I(ϕ(X); ϕ(X̃)) measured via InfoNCE is ≈ 4.6 nats at ε = 8/255 (Sec. 5), versus the pixel-level PCA bound of ≈ 4,000 nats. The encoder-specific budget is therefore H(A⋆ ) + Ienc ≈ 26 + 4.6 ≈ 31 nats, reducing the slack from ∼ 103 to ∼ 101 nats. This bound is no longer policy-independent (it depends on ϕ), but it applies to any downstream head f sharing the same encoder.
3.7
4 4.1
t=1
+ I(Xt ; X̃t | Ht−1 ) .
as the figure of merit. S → 0 identifies Pareto-optimal policies, and large persistent S marks unrealized capacity that the architecture has not yet captured. (c) Larger attack budgets tighten the bound. As ε grows, I(X; X̃) shrinks (the perturbed observation retains less information about X) and the RHS contracts. The budget available to Cap + Rob decreases, so the constraint becomes more binding at larger ε. Slack should therefore be reported at the deployment ε, not at a benign one.
Implications
Theorem 1 bounds existence, not algorithms. Three consequences follow. (a) Robustness gains have a price. Any technique that increases Rob without also adding A⋆ -information has to trade against Cap. Adversarial fine-tuning increases I(Aπ ; Ãπ ) − I(Aπ ; δ) but pushes Aπ off the sufficientstatistic manifold for A⋆ , lowering Cap. Inside the budget, robustness is never free. (b) Slack is the metric to report. Two policies with Rob = 2.0 nats are not equivalent if one sits 0.1 nats below the budget and the other 3.0 below. We propose S(π, ε) ≜ H(A⋆ )+I(X; X̃)−Cap(π)−Rob(π) ≥ 0 (6)
Synthetic Validation
Estimator selection
We validate Theorem 1 in a closed-form Gaussian-VLA proxy where every quantity in the bound, namely H(A⋆ ), I(A⋆ ; Aπ ), I(Aπ ; Ãπ ), I(Aπ ; δ), and I(X; X̃), has a closed-form expression. Estimator error therefore separates from theorem violation, and any deviation from the analytical truth is the estimator’s fault, not the bound’s. We use three MI estimators with complementary biases. MINE (Belghazi et al. 2018) is variational, with a neural critic and EMA bias-correction, and does well on Gaussians but degrades when n < Θ(exp(d)). InfoNCE (van den Oord, Li, and Vinyals 2018) is contrastive and saturates at log K. KSG (Kraskov, Stögbauer, and Grassberger 2004) is k-NN, bias-free in low d but hits the curse of dimensionality at d ≳ 20. A 540-cell hyperparameter sweep (P3) over hidden width, depth, EMA decay, and learning rate for MINE on a d=7 Gaussian identifies a stable region. The best mean rel-err is 6.9% (±0.9% over 5 seeds) at hidden = 512, depth = 2, EMA = 0.999, lr = 10−4 . The next four configurations sit within 1% of this minimum, so the optimum is broad. All subsequent MINE results in the paper use these settings. A 360-cell sample-complexity sweep (P4 with d ∈ {2, 7, 32, 128}, n ∈ {500, . . . , 20000}, and 15 seeds) shows median MINE rel-err at d=7 falling from 0.49 (n=500) to 0.16 (n=20000). The means stay higher (0.60 → 0.57) because of a heavy right tail of failed seeds, so we report medians as the headline number. Below n = 2000 the estimator is unreliable, so we use n ≥ 5000 throughout. A 135-cell non-Gaussian sweep (P5 over Laplace, uniform, and GMM) gives MINE rel-err median 21% (Laplace), 32% (uniform), 52% (GMM). The bound is distribution-free, but the estimator is not.
4.2
DPI sanity check
A theorem-of-theorems prerequisite is that our MI estimators have to respect the Data Processing Inequality. P6 estimates I(X; Y ) and I(X; Z) separately on X → Y → Z across 27 grid cells ×5 seeds (270 measurements). When grouped by cell and averaged across seeds, 0/27 violate I(X; Z) ≤ I(X; Y ) + 0.05 nats, with a max group-mean diff of +0.031 nats. Per-seed, 9/135 pairs exceed the 0.05nat tolerance, but they sit at d=32 where the critic is samplestarved, attributable to MINE seed-level variance rather than systematic DPI failure. At our P7 grid resolution (3 seeds aggregated), DPI holds tightly enough that any Theorem-1 violations cannot be blamed on estimator-level DPI failure.
ε
0.05
0.1
0.2
0.5
1.0
2.0
Sa (nats) Sm (nats)
23.1 12.7
18.3 11.6
13.7 10.4
8.3 7.4
6.2 4.9
5.0 3.9
Table 2: Slack monotonically decreases as ε grows, matching Corollary 1.
Synthetic Gaussian-VLA: slack vs (252 cells) 50
Sa (analytic) Sm (MINE)
slack S (nats)
40 30 20 10 0 10 1
attack budget
100
Figure 2: P7 Gaussian-VLA: median slack vs. ε across 252 cells; bands show IQR. Both analytical Sa and MINEestimated Sm stay non-negative and decrease monotonically as predicted by Cor. 1.
4.3
Theorem 1 verification
P7 is our primary validation, a closed-form Gaussian-VLA proxy with A⋆ = W ⋆ X + ξ ⋆ , Aπ = Wπ X + ξπ , and additive Gaussian δ of variance ε2 I. We sweep dx ∈ {4, 7, 16}, da ∈ {3, 7}, σπ ∈ {0.3, 1.0}, σ⋆ = 0.3, ε ∈ {0, 0.05, 0.1, 0.2, 0.5, 1.0, 2.0}, and 3 seeds, for 252 cells (84 distinct grouped configs after seed-averaging). For each cell we estimate Cap, Rob, H(A⋆ ), I(X; X̃) using MINE (P3-stable hyperparams) and also compute their analytical values in closed form. We report both the analytical slack Sa and the MINE-estimated slack Sm . Result. Sa ≥ 0 in 252/252 cells and Sm ≥ 0 in 252/252 cells. After seed-averaging the 84 grouped configs, all have Sa ≥ 0. After Holm–Bonferroni correction across 84 groups, 52/84 (62%) reach significance at α = 0.05 for the alternative S > 0 (one-sided t-test on per-seed slacks), and the remaining 32 are non-significant due to small effect size relative to MINE per-seed variance, not violations. Slack scales as predicted by Theorem 1. Median slack across all 36 configs at each ε: The ε = 0 baseline anchors at Sa ≈ 352 nats (vacuous, since with no attack channel the RHS is dominated by the prior H(A⋆ ) alone). We omit ε = 0 from headline figures. The monotone decrease matches Corollary 1, since as the attack channel widens, I(X; X̃) shrinks and the RHS budget tightens. In a representative subgroup (dx =7, da =7, σπ =1.0), MINE Cap stays put at 0.82 nats
independent of ε while Rob rises from 0.53 (ε=0.05), peaks at 1.12 (ε=0.5), and falls back to 0.57 (ε=2.0) as highamplitude noise drowns the action signal. The bound stays satisfied because the RHS shrinks faster than Rob grows.
4.4
Estimator-agnostic verification
The 0/252 result is not an artifact of MINE’s bias profile. We re-run validation with three estimators of complementary failure modes. P8 covers 174 high-d cells, d ∈ {1, . . . , 256}, in two regimes. Regime A fixes σ = 1 so true MI grows with d, while regime B chooses σ so analytical MI sits at ≈ 5 nats. At d = 256 in regime A, MINE rel-err is 93%, InfoNCE 92%, and KSG is undefined for d > 64. Even with these collapsed estimators, the Theorem 1 bound still holds in 100% of cells. The bound is on the signed quantity Cap + Rob −RHS. MINE’s dominant failure mode at high d is to underestimate Cap and Rob, which underestimates the LHS proportionally. The RHS is computed analytically in the proxy, so estimator error pushes the measured slack up, not down. Lowbiased estimators make the inequality easier to satisfy, not harder. The dual concern, estimators biased high, is theoretically possible but rarely observed. MINE’s variational lower bound on MI gives a one-sided guarantee against high bias under regularity. InfoNCE’s log K ceiling explicitly upperbounds the estimate. KSG has either sign of bias but is bounded in absolute terms by its k-NN scale. Summary. The Gaussian-VLA proxy verifies Theorem 1 in 252/252 closed-form cells across all reasonable estimator and dimensionality settings. Slack scales monotonically with ε as predicted, and the bound survives estimator-level error.
4.5
Achievability
Theorem 1 bounds existence, not construction. We exhibit an explicit policy in the Gaussian-VLA proxy that attains S = 0 in the oblivious-noise limit, demonstrating the bound is not vacuously loose. Proposition 1 (Achievability under oblivious noise). Let X be supported on a finite set with H(X) < ∞, A⋆ = X, and δ independent of X producing X̃. Take π the identity. Then Aπ = X = A⋆ , Ãπ = X̃, and Cap(π) + Rob(π) = H(A⋆ ) + I(X; X̃), saturating Theorem 1. Proof sketch. With identity π, Aπ = X is a sufficient statistic for A⋆ = X, so Cap = H(A⋆ ). There is no bottleneck, so I(Aπ ; Ãπ ) = I(X; X̃). And δ ⊥ X with Aπ = X gives I(Aπ ; δ) = I(X; δ) = 0. The three Cor. 1 conditions hold. The construction is degenerate but shows the bound is tight under oblivious noise. The Gaussian-VLA proxy (Fig. 2) extends this informally to continuous X: any uniform quantizer applied to both A⋆ and Aπ drives the discrete-bound equality to the differential-entropy values as
the bin width shrinks (Cor. 2). Failure of S → 0 on real VLAs is therefore traceable to (a) the A⋆ ̸= X misalignment between observation and oracle action and (b) adaptive PGD breaking Cor. 1 (iii).
5
Real-Model Validation: OpenVLA on LIBERO
Sec. 4 verifies Theorem 1 in a setting where every quantity is either analytic or estimated against ground truth. That is necessary but not sufficient: a tight inequality that only holds for Gaussian actions and linear policies is not a useful theorem about deployed VLAs. This section closes the gap by instantiating the bound on OpenVLA-7B (Kim et al. 2024), evaluated on the four LIBERO suites (Spatial, Object, Goal, LIBERO-10) using the suite-specific finetuned checkpoints released by the OpenVLA team.
5.1
Experimental setup
Model. OpenVLA-7B base + four LIBERO-finetuned variants, loaded in bf16 on a single RTX 4090. Clean inference uses the published predict action interface (autoregressive 7-token decode followed by the official bridge orig unnormalization). For PGD we replicate the forward manually, exposing pixel values as a differentiable bf16 tensor (the OpenVLA processor’s PIL round-trip otherwise breaks the gradient chain). Data. LIBERO HDF5 demonstrations, ten files per suite. Each timestep provides RGB (128 × 128 × 3), expert action (7-D continuous), and language instruction. We sample at 1in-5 stride within episodes with a per-file balanced budget, N = 5,000 for capability MI and N = 200 per cell for PGD. Variables. A⋆ is the expert action, X the clean RGB observation, Aπ = π(X) the OpenVLA prediction (continuous 7-D after unnormalization), δ the adversarial perturbation with ∥δ∥∞ ≤ ε in [0, 1] image-space units and ε ∈ {2, 4, 8, 16}/255, X̃ = clamp(X + δ, 0, 1), and Ãπ = π(X̃).
yields Capdisc ∈ {2.68, 6.85, 7.54, 9.04} nats for LIBERO10, Object, Spatial, and Goal respectively, with H(A⋆ ) ∈ [24.71, 27.35] nats. The discretized Cap is 20–100× larger than MINE, giving Capdisc /H(A⋆ ) ∈ [10%, 33%]. The ordering (LIBERO-10 ≪ Goal) matches the known difficulty heterogeneity of LIBERO suites and is consistent with the MINE ordering. The gap between MINE and discretized estimates reflects the well-known difficulty of continuous MI estimation in moderate dimensions at finite N , not a deficiency of the bound itself.
5.3
Robustness
PGD. Projected gradient descent on δ in DINOv2 + SigLIP post-normalization space, with per-channel ε rescaling so the effective ∥δ∥∞ in raw-pixel units is exactly εpx /255. The loss is the negated decode-time CE against P7 the clean argmax tokens, L(δ) = − t=1 CE(logitst (X + δ), arg maxt logitst (X)), with sign-step α = ε/4 for 10 iterations, projecting back into the per-channel ε-ball each step. Ãπ is decoded via OpenVLA’s official bin centers + bridge orig unnormalization, so Ãπ lives in the same 7-D continuous space as Aπ . PGD is non-trivial in every cell. The mean ℓ2 gap ∥Ãπ −Aπ ∥2 ranges from 0.72 at ε = 2 to 0.92 at ε = 16, well above the per-cell Aπ RMS standard deviation (≈ 0.18–0.24). For context, Wang et al. (2024) report that the same ε = 16/255 PGD budget drops OpenVLA rollout success on LIBERO from > 95% to < 5%, confirming that our perturbation magnitudes are operationally destructive. I(Aπ ; δ). Estimated using the deterministic 1-D summary δ 7→ ∥δ∥∞ . By DPI, I(Aπ ; ∥δ∥∞ ) ≤ I(Aπ ; δ). Using this smaller subtractive term inflates Rob and therefore the LHS, the stricter direction for testing S = RHS − LHS ≥ 0. Across all 48 cells, I(Aπ ; ∥δ∥∞ ) ∈ [−3 · 10−5 , 0], indistinguishable from zero.
MINE estimates. The four suites give CapMINE ∈ {0.02, 0.13, 0.25, 0.38} nats. KSG (k = 5–20) returns negative values on all four suites, confirming that continuous MI estimation in 7-D with N = 5,000 is at the noise floor for both estimators.
Sign artifact. MINE’s variational lower bound can dip below the (non-negative) true MI in low-MI, small-N regimes. We see I(Aπ ; Ãπ ) ∈ [−1.19, −0.14] across cells with no monotone ε-trend, a known small-N bias (Belghazi et al. 2018) rather than an MI violation. To check that this is variance and not structure, we re-run the spatial ε = 8 cell at N ∈ {200, 500, 1000, 2000}. I(Aπ ; Ãπ ) moves from −0.34 at √ N = 200 toward −0.08 at N = 1000, consistent with N variance shrinkage. At N = 2000, both MINE (−0.13) and KSG (k=5, −0.87; k=10, −0.82) remain negative, indicating the true I(Aπ ; Ãπ ) is near zero rather than substantially positive. This is consistent with OpenVLA’s discrete tokenization: at moderate ε, PGD either fails to flip the argmax token (zero action change, zero MI contribution) or flips it to a near-random bin (low pairwise dependence). Clamping Rob to max(Rob, 0) is the conservative correction, but the bound holds either way.
Discretized estimates. To obtain a more reliable Cap, we quantize both A⋆ and Aπ into 256 uniform bins per dimension (matching OpenVLA’s tokenization granularity) and compute MI via the plug-in histogram estimator. This
Black-box sanity check. To rule out a PGD-specific artifact, we re-run the spatial ε = 8 cell with the score-based, gradient-free Square Attack (Andriushchenko et al. 2020) (200 queries, N = 200). The realized RobSquare = −0.17
Estimators. All MI quantities use the P3-stable MINE configuration (hidden = 512, depth = 2, EMA = 0.999, lr = 10−4 , 2,000 epochs).
5.2
Capability
For each suite we estimate Cap on N = 5,000 samples, with H(A⋆ ) reported as a 256-bin per-dim plug-in estimate on the same sample.
Table 3: PCA-tightened RHS vs. isotropic surrogate. The PCA bound exploits the heavy-tailed natural-image spectrum (top-1 eigvalue ≈ 5–10% of tr(Cov)); the isotropic bound counts every pixel-mode at full rate. ε (px/255)
I(X; X̃)iso
I(X; X̃)PCA
ratio
SPCA
2 4 8 16
186.5 k 152.5 k 118.6 k 85.1 k
5970 4932 3900 2888
31× 31× 30× 29×
5996 4959 3927 2914
stays inside the same MINE small-N band as PGD, and the slack SSquare = H(A⋆ ) + I(X; X̃)PCA − Cap − RobSquare ≈ 3.98 · 103 nats remains ≫ 0. The bound holds under a nongradient adaptive attack at the same ε budget.
5.4
Channel capacity
Estimating I(X; X̃) directly is intractable (D = 49,152). Theorem 1 requires only an upper bound on I(X; X̃), and any valid upper bound suffices regardless of whether the attacker is adaptive or oblivious, because the PCA surrogate bounds the channel capacity of the ℓ∞ -ball constraint set, not the MI of a specific attack strategy. The isotropic Gaussian-channel surrogate gives ∼ 105 nats. Natural images are not isotropic, so the parallel-Gaussian-channel inequality (Cover and Thomas 2006) replaces it with a pereigenmode sum, I(X; X̃) ≤
D X
2 1 2 log 1 + λi /σδ
,
(7)
i=1
where {λi } are the eigenvalues of Cov(X). We estimate the spectrum from 1,500 LIBERO frames per suite (rank ≤ 1499). Empirically the top-1 eigenvalue carries 5–10% of tr(Cov) on Spatial / Object / Goal and 55% on LIBERO-10. The PCA bound tightens the RHS by a near-uniform 30× across all four suites. The remaining looseness (SPCA ≈ 3–6 × 103 nats) is dominated by the spectrum’s tail, since eigenmodes with λi ≫ σδ2 count at full rate even though the policy responds to far less of the channel. To quantify this, we estimate I(ϕ(X); ϕ(X̃)) where ϕ is OpenVLA’s frozen DINOv2+SigLIP encoder (d = 2176 pooled features), using InfoNCE (Poole et al. 2019) after PGD on spatial ε = 8. By DPI, I(ϕ(X); ϕ(X̃)) ≤ I(X; X̃), so this is a lower bound on the true channel MI but a useful diagnostic of policy-relevant information. We measure INCE ≈ 4.6 nats (against the log(Nbatch ) = 4.85 ceiling at Nbatch = 128). Less than 0.2% of the 3.95 · 103 -nat PCA budget reaches the encoder representation, so almost all of the analytical RHS is channel capacity that the downstream policy never converts. We use the PCA-tightened RHS for all subsequent S values. Cap is suite-specific, not estimator noise. As a sanity check, we evaluate the Spatial-finetuned policy on the other three suites’ data at ε = 8/255. Cross-suite
Table 4: Slack S vs. attack budget ε (mean ± std across 4 suites × 3 seeds, 12 cells per row); RHS uses the PCAtightened I(X; X̃) from Table 3. Slack stays bounded away from zero, confirming Cor. 1 (iii) fails for adaptive PGD — the bound is loose for OpenVLA on LIBERO. ε (px/255)
Cap
Rob
RHS
S
2 4 8 16
0.19 0.19 0.19 0.19
−0.75 −0.53 −0.48 −0.54
5996 4959 3927 2914
5996.6 ± 0.6 4959.3 ± 0.5 3927.3 ± 0.4 2914.4 ± 0.6
Cap collapses where matched Cap was non-trivial, with Capspatial→goal = −0.05 vs. matched Goal 0.38 nats, and Capspatial→LIBERO-10 = −0.13 vs. matched 0.13 nats. (Object’s matched Cap is already at the MINE noise floor.) Cap therefore tracks task-conditional capability rather than the marginal entropy of the action space.
5.5
Bound verification and tightness
Each (suite, ε, seed) cell yields S = H(A⋆ ) + I(X; X̃) − Cap − Rob .
(8)
Across the full 4 × 4 × 3 = 48-cell grid, S ≥ 0 in every cell, zero violations. Theorem 1 holds for OpenVLA-7B + LIBERO + adaptive PGD. PT Multi-step. Cor. 3 predicts ST = t=1 [H(A⋆t | Ht−1 ) + PT I(Xt ; X̃t | Ht−1 )] − t=1 [Capt + Robt ] accumulates linearly in horizon T . Empirically on T = 10, ntraj = 30 demo trajectories from spatial ε = 8 (using ground-truth observation sequences in lieu of a sim env), we measure P t (Capt + Robt ) = −15.8 nats (per-step values inside the MINE small-N band) and the unconditional upper bound P ⋆ 4 [H(A t ) + I(Xt ; X̃t )] = 3.93 · 10 nats, giving ST =10 = t 4 3.93 · 10 ≈ T · S1 as predicted (Fig. 4). The cumulative bound holds and remains an order of magnitude loose at every horizon, the same structural slack as the single-step case. Tightness. Even with the PCA-tightened RHS, the bound is loose by about three orders of magnitude. We measure S ≈ I(X; X̃) ∈ [3 · 103 , 6 · 103 ] nats while CapMINE + Rob+ < 1 nat. The dominance is structural, since I(X; X̃) scales with the active-eigenmode count, while H(A⋆ ) ≤ 7 log 256 ≈ 38.8 nats is bounded by actionspace cardinality. Encoder-specific slack (Cor. 4). Replacing the pixel-level RHS with the encoder-space bound I(ϕ(X); ϕ(X̃)) ≈ 4.6 nats (InfoNCE, spatial ε = 8) gives an encoder-specific budget of H(A⋆ ) + Ienc ≈ 26 + 4.6 ≈ 31 nats. With the discretized Capdisc ≈ 7.5 nats and Rob+ ≈ 0, the encoderspecific slack is Senc ≈ 31 − 7.5 = 23 nats, a reduction from ∼ 103 to ∼ 101 . The bound is still not tight (the remaining 23 nats reflect channel capacity that the 7-token decoder does not fully exploit), but it is now within one order
0.2 0.4 0.6 0.8 1.0 1.2
105
0.0
0.1
0.2
Spatial Object
Goal LIBERO-10
0.3
0.4
Cap = I(A ; A ) (nats)
= 2/255 = 4/255
RHS vs LHS per suite
107 nats (log scale)
Rob (nats)
OpenVLA-7B Cap--Rob Pareto (48 cells)
RHS
RHS
RHS
RHS
103 101 LHS
10 1 10 3
Spatial
= 8/255 = 16/255
I(X; X)
LHS
LHS
LHS
Object H(A )
Goal
LIB-10
Cap
Rob+
LHS (nats)cumulative (nats, ×103)
Figure 3: OpenVLA-7B on LIBERO. Left: Cap–Rob Pareto across 48 cells (4 suites × 4 budgets × 3 seeds), where color encodes suite and marker shape encodes ε. The frontier sits well inside the analytical RHS (∼ 105 nats), and the visible Rob ∈ [−1.2, −0.1] band is the MINE small-N sign artifact. Right: per-suite mean of the four bound terms (log-y). The RHS pair (H(A⋆ ) + I(X; X̃)) exceeds the LHS pair (Cap + Rob+ ) by ∼ 5 orders of magnitude. The bound holds but is loose, since I(X; X̃) scales with image dimension while Rob is constrained by the 7-D action space.
T S1 (Cor.~3) RHST = ST
40 30 20 10
max | |/(T S1) = 0.03%
0 10 0 10
capacity term, and Cor. 1 (iii) fails, so the realized Rob does not track I(X; X̃). The gap is budget the attacker cannot convert into action-space deviation. PGD perturbs the image at the analytical rate, but the policy’s action response is constrained by 7-D action geometry rather than D-D pixel geometry. The encoder-specific bound (Cor. 4) closes most of this gap by restricting the channel to the policy-relevant subspace.
6 6.1
1
2
3
4
5
6
horizon T
MINE small-N band
7
8
9 10
LHST
Figure 4: Cumulative bound vs. horizon T on spatial ε = 8, ntraj = 30. Top: RHST = ST (markers) lands on the T · S1 reference (gray dotted) within 0.03% at every T , confirming the linear scaling predicted by Cor. 3. Bottom: LHST stays inside the MINE small-N band (shaded), four orders of magnitude below the RHS.
of magnitude of the LHS and begins to constrain the achievable Cap + Rob. Structural slack. For any VLA with D ≫ action-tokens · log(vocab), the analytical RHS reduces to the channel-
Discussion and Limitations
Scope of the theorem
Theorem 1 gives a policy-independent upper bound on joint capability + robustness. It does not give a recipe for designing π that achieves the budget, nor does it say whether the slack-zero policy is computable or finite-parameter. On OpenVLA, the pixel-level bound is loose by ∼ 103 nats (Sec. 5), because the image-dimensional channel capacity far exceeds what the 7-D action space can exploit. However, the encoder-specific bound (Cor. 4) reduces the slack to ∼ 23 nats by restricting the channel to the policy-relevant subspace. At this tighter level, the bound begins to constrain: the measured Capdisc ≈ 7.5 nats already consumes ∼ 24% of the encoder-specific budget (≈ 31 nats), leaving limited room for simultaneous Rob improvement without trading Cap. The practical value of the bound depends on which version is applied. The pixel-level bound (Theorem 1) functions as a universal ceiling guarantee. The encoder-specific bound (Cor. 4) is diagnostic: it shows that for OpenVLA’s architecture, the achievable Cap + Rob is bounded by ∼ 31 nats rather than ∼ 5,000 nats, and the policy already uses a
substantial fraction of this budget. We propose the encoderspecific slack Senc (π, ε) = H(A⋆ ) + I(ϕ(X); ϕ(X̃)) − Cap(π)−Rob(π) as the figure of merit for cross-paper comparison within an encoder family.
6.2
Estimator caveats
All real-model numbers (Sec. 5) rely on MI estimators with known failure modes. We mitigate this in four ways. First, MINE, InfoNCE, and KSG report concordant directional signals (P2, P8) even when absolute estimates diverge by 30–50%. Second, the 252-cell Gaussian proxy of Sec. 4 gives ground truth, validating the bound where estimators can be checked against analytical MI. Third, Theorem 1 is one-sided, and MINE’s known low bias under high d pessimizes the LHS more than the RHS, which loosens our verification rather than tightening it falsely. Fourth, the discretized histogram estimator (Capdisc ) provides an independent cross-check: it gives 20–100× higher Cap than MINE while remaining well below the RHS, confirming that the bound holds under a bias-free estimator and that the MINEbased slack was inflated by LHS underestimation rather than RHS overestimation. The slack measurements are biased, while the bound itself holds regardless, and the slack distribution under any reasonable estimator is consistent with the theorem. For safety reporting, the bias direction is favorable, since estimator error inflates measured S, so a small observed slack is a real signal rather than noise.
6.3
Attack model assumptions
We use ℓ∞ -bounded additive PGD, the field-standard threat model and a conservative safety baseline. Theorem 1 extends without modification to several other settings. For ℓ2 attacks, replace the ∥δ∥∞ ≤ ε constraint, and I(X; X̃) acquires the standard Gaussian-channel bound d2 log(1 + 2 ). For semantic attacks, replace X̃ = X + δ with ε2 /σX X̃ = g(X, δ) for any deterministic generator g, and the DPI proof carries through provided Ãπ depends on (X, δ) only through X̃. For black-box attacks, δ depends on X only via its distribution, not its realization, so the bound is unchanged and only Cor. 1’s tightness conditions become easier to satisfy. We do not cover poisoning attacks (where the attacker contaminates training data), backdoor triggers, or distribution-shift “attacks” that change p(X) rather than perturbing X. These break the assumption that A⋆ is fixed and require a separate safety analysis.
6.4
Action-space caveats
OpenVLA discretizes actions into 256 bins per dimension, while π0 (Black et al. 2024) uses continuous output heads. Cor. 2 predicts tighter bounds for tokenized policies because H(A⋆q ) < H(A⋆ ). Sec. 5 measures H(A⋆q ) ≈ 26 nats on LIBERO training data, well below the worst-case 7 log 256 ≈ 38.8 nats. The bound is therefore most informative, and the slack measurement most diagnostic, on OpenVLA-class architectures driving the current generation
of VLA work, which happens to be the same architecture most empirical robustness papers study.
7
Conclusion
VLA models are crossing into deployments where their failures have physical consequences, so adversarial fragility is a safety problem rather than a leaderboard one. We proved an information-theoretic upper bound on the joint capability and robustness any VLA policy with discrete actions can claim, and validated it across 252 closed-form GaussianVLA cells and 48 OpenVLA-7B + LIBERO + PGD cells without a single violation. The right-hand side depends only on task entropy and attack channel capacity, neither of which moves with the policy, so any architectural change must trade capability against robustness within a fixed budget. The pixel-level bound is loose by ∼ 103 nats on current models, dominated by the gap between image-dimensional channel capacity and 7-D action geometry. The encoderspecific bound (Cor. 4) closes most of this gap: restricting the channel to OpenVLA’s DINOv2+SigLIP representation reduces the budget from ∼ 5,000 to ∼ 31 nats, and the discretized Cap ≈ 7.5 nats already consumes ∼ 24% of this tighter budget. At this level, the bound is within one order of magnitude of the measured LHS and begins to constrain achievable performance. For the theory side, the contribution is the first impossibility result we know of for action-generating policies, where prior bounds target classifiers. For empirical robustness work, the encoder-specific slack provides a normalized comparison axis: a defense paper can report the fraction of the ∼ 31-nat encoder budget consumed by Cap + Rob at a given ε. The bound is non-constructive, and finding a policy that closes the slack remains open. Tightness for adaptive attackers requires fundamentally different tools. We release code, the Gaussian-VLA validation grid, the OpenVLA evaluation pipeline, and the slack-measurement scripts.
References Andriushchenko, M.; Croce, F.; Flammarion, N.; and Hein, M. 2020. Square Attack: A Query-Efficient Black-Box Adversarial Attack via Random Search. In European Conference on Computer Vision (ECCV). Belghazi, M. I.; Baratin, A.; Rajeswar, S.; Ozair, S.; Bengio, Y.; Courville, A.; and Hjelm, R. D. 2018. Mutual Information Neural Estimation. In Proceedings of the 35th International Conference on Machine Learning (ICML), volume 80 of Proceedings of Machine Learning Research, 531–540. Black, K.; Brown, N.; Driess, D.; Esmail, A.; Equi, M.; Finn, C.; Fusai, N.; Groom, L.; Hausman, K.; Ichter, B.; Jakubczak, S.; Jones, T.; Ke, L.; Levine, S.; Li-Bell, A.; Mothukuri, M.; Nair, S.; Pertsch, K.; Shi, L. X.; Tanner, J.; Vuong, Q.; Walling, A.; Wang, H.; and Zhilinsky, U. 2024. π0 : A Vision-Language-Action Flow Model for General Robot Control. arXiv preprint arXiv:2410.24164. Brohan, A.; Brown, N.; Carbajal, J.; Chebotar, Y.; Chen, X.; Choromanski, K.; Ding, T.; Driess, D.; Dubey, A.; Finn, C.; Florence, P.; Fu, C.; Arenas, M. G.; Gopalakrishnan, K.;
Han, K.; Hausman, K.; Herzog, A.; Hsu, J.; Ichter, B.; Irpan, A.; Joshi, N.; Julian, R.; Kalashnikov, D.; Kuang, Y.; Leal, I.; Lee, L.; Lee, T.-W. E.; Levine, S.; Lu, Y.; Michalewski, H.; Mordatch, I.; Pertsch, K.; Rao, K.; Reymann, K.; Ryoo, M.; Salazar, G.; Sanketi, P.; Sermanet, P.; Singh, J.; Singh, A.; Soricut, R.; Tran, H.; Vanhoucke, V.; Vuong, Q.; Wahid, A.; Welker, S.; Wohlhart, P.; Wu, J.; Xia, F.; Xiao, T.; Xu, P.; Xu, S.; Yu, T.; and Zitkovich, B. 2023. RT-2: Vision-LanguageAction Models Transfer Web Knowledge to Robotic Control. In Conference on Robot Learning (CoRL). Cover, T. M.; and Thomas, J. A. 2006. Elements of Information Theory. Hoboken, NJ: Wiley-Interscience, 2 edition. Fan, J.; and Li, W. 2021. Adversarial Training and Provable Robustness: A Tale of Two Objectives. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 35, 7367–7376. Fang, X.; Fang, W.; and Wang, C. 2026. Unveiling the Fragility of Vision-Language Models: Multi-Modal Adversarial Synergy via Texture-Constrained Perturbations and Cross-Modal Optimization. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI). Fei, S.; Wang, S.; Shi, J.; Dai, Z.; Cai, J.; Qian, P.; Ji, L.; He, X.; Zhang, S.; Fei, Z.; Fu, J.; Gong, J.; and Qiu, X. 2025. LIBERO-Plus: In-depth Robustness Analysis of Vision-Language-Action Models. arXiv preprint arXiv:2510.13626. Kim, J.-Y.; Park, J.-H.; Kim, M.; and Kim, G.-W. 2025. Explainable Adversarial-Robust Vision-LanguageAction Model for Robotic Manipulation. arXiv preprint arXiv:2512.11865. Kim, M. J.; Pertsch, K.; Karamcheti, S.; Xiao, T.; Balakrishna, A.; Nair, S.; Rafailov, R.; Foster, E.; Lam, G.; Sanketi, P.; Vuong, Q.; Kollar, T.; Burchfiel, B.; Tedrake, R.; Sadigh, D.; Levine, S.; Liang, P.; and Finn, C. 2024. OpenVLA: An Open-Source Vision-Language-Action Model. arXiv preprint arXiv:2406.09246. Kraskov, A.; Stögbauer, H.; and Grassberger, P. 2004. Estimating Mutual Information. Physical Review E, 69(6): 066138. Liu, H.; Ruan, S.; Long, J.; Wu, J.; Hou, J.; Tang, H.; Jiang, T.; Zhou, W.; and Yao, W. 2025. Eva-VLA: Evaluating Vision-Language-Action Models’ Robustness Under Real-World Physical Variations. arXiv preprint arXiv:2509.18953. Polyanskiy, Y.; and Wu, Y. 2017. Strong Data-Processing Inequalities for Channels and Bayesian Networks. In Convexity and Concentration, volume 161 of The IMA Volumes in Mathematics and its Applications, 211–249. Springer. Poole, B.; Ozair, S.; van den Oord, A.; Alemi, A. A.; and Tucker, G. 2019. On Variational Bounds of Mutual Information. In International Conference on Machine Learning (ICML). Qi, X.; Huang, K.; Panda, A.; Henderson, P.; Wang, M.; and Mittal, P. 2024. Visual Adversarial Examples Jailbreak Aligned Large Language Models. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 38.
Ross, A. S.; and Doshi-Velez, F. 2018. Improving the Adversarial Robustness and Interpretability of Deep Neural Networks by Regularizing Their Input Gradients. In Proceedings of the AAAI Conference on Artificial Intelligence (AAAI), volume 32. Tishby, N.; and Zaslavsky, N. 2015. Deep Learning and the Information Bottleneck Principle. In Proceedings of the IEEE Information Theory Workshop (ITW), 1–5. IEEE. Tsipras, D.; Santurkar, S.; Engstrom, L.; Turner, A.; and Madry, A. 2019. Robustness May Be at Odds with Accuracy. In International Conference on Learning Representations (ICLR). van den Oord, A.; Li, Y.; and Vinyals, O. 2018. Representation Learning with Contrastive Predictive Coding. arXiv preprint arXiv:1807.03748. Wang, T.; Han, C.; Liang, J. C.; Yang, W.; Liu, D.; Zhang, L. X.; Wang, Q.; Luo, J.; and Tang, R. 2024. Exploring the Adversarial Vulnerabilities of Vision-Language-Action Models in Robotics. arXiv preprint arXiv:2411.13587. Xu, A.; and Raginsky, M. 2017. Information-Theoretic Analysis of Generalization Capability of Learning Algorithms. In Advances in Neural Information Processing Systems (NeurIPS), 2524–2533. Yan, Y.; Xie, Y.; Zhang, Y.; Lyu, L.; Wang, H.; and Jin, Y. 2025. Multimodal Adversarial Attacks on Vision-LanguageAction Models. arXiv preprint arXiv:2511.16203. Zhang, H.; Yu, Y.; Jiao, J.; Xing, E. P.; El Ghaoui, L.; and Jordan, M. I. 2019. Theoretically Principled Tradeoff between Robustness and Accuracy. In Proceedings of the 36th International Conference on Machine Learning (ICML), volume 97 of Proceedings of Machine Learning Research, 7472–7482.