Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability

Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability Yudong Gao1∗ , Linghan Chen2∗ , Wenhan Wu3 , Mia Zhou4 , Jiyao Wang2 , Kaiyan Ji2 , Mingyu Guo2 , Honglong Chen5† 1

The Hong Kong University of Science and Technology 2 Adelaide University 3 Georgia Institute of Technology 4 University of North Carolina at Chapel Hill 5 China University of Petroleum (East China) yudonggao0504@163.com

arXiv:2608.15475v1 [cs.CR] 16 Aug 2026

Abstract Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to 0%, while hundreds of random flips are harmless. Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in 1–5 flips, whereas the evaluated flow-matching policies require ∼100–300. Our fixeddirection manifold-escape loss cuts π0 ’s budget from ∼1000 to ∼100 flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction. On a direct head, protecting 3.1% of weights preserves 60% success at K=100, and protecting 5.3% moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated K=100 flips yield 0/20 real-robot successes, versus 14/20 clean and 16/20 global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.

1

Introduction

Vision-Language-Action (VLA) models such as OpenVLA (Kim et al. 2024), π0 (Black et al. 2024), and RT-2 (Zitkovich et al. 2023) map images and instructions directly to robot actions. Existing attacks target inputs or training-time backdoors (Gao et al. 2024a), leaving deployed weights intact. Yet low-precision edge deployment (Kim et al. 2024) makes integer weights a target for Rowhammer-style faults. A few flips have crushed quantized classifiers (Rakin et al. 2019; Yao et al. 2020) and, more recently, LLMs (Khalil and Hoque 2025; Galil et al. 2026), but only at categorical outputs. A classifier fault is read out once; a VLA fault passes through an action decoder and then repeatedly interacts with a changing environment. Decoder dynamics may attenuate the immediate perturbation, while modest residual errors can compound through feedback. Classifier BFA budgets and open-loop deviations therefore do not predict closed-loop robot failure. ∗ †

These authors contributed equally. Corresponding author.

Figure 1: Fixed-direction insight. Across ten rerankings it is never less coherent than energy (7 higher, 3 ties) and lowers π0 ’s empirical collapse budget 10×.

We ask: how few weight flips cause such failure, and how can they be contained? On LIBERO-Spatial, 3 selected flips collapse simulated closed-loop success from 88% to 0% (n=50); 1–5 flips suffice across four suites, while 300 random flips are harmless (Table 1). The evaluated flow heads instead require ∼100– 300 flips. On a real 6-DoF arm, task-calibrated emulated K=100 perturbations yield 0/20 successes, versus 14/20 clean and 16/20 global-random (§6.2). Figure 1 motivates our flow-head objective: across ten independent K=100 rerankings, fixed direction is never less coherent than energy (seven higher, three ties; onesided Wilcoxon p=.0078) and its same-policy empirical collapse budget is 10× lower. We therefore optimize the same nonzero, one-sided executed-action projection on every calibration trace, seeking perturbations with a common actionspace orientation. Backpropagating this objective through the complete decoder scores each INT8 bit by its quantizationaware directional gain. The complementary where insight is spatial: damaging bits concentrate in a few action-generating layers (Fig. 5). Together, these observations guide both attack and defense. Gradient ranking discovers high-leverage layers, and a matched sweep confirms that fixed-direction manifold escape is not peculiar to the all-positive default (§6.5). Conversely, protecting L1 (3.1%) preserves closed-loop success through

K=100; adding the action head (5.3% total) moves the openloop threshold from 3 to 100. Contributions. (1) The first weight-fault attack on a VLA. To our knowledge, this is the first bit-flip attack on a VLA and a continuous, closed-loop action policy. Just 1–5 selected INT8 flips collapse simulated task success to 0%, revealing closed-loop consequences absent from prior attacks on categorical outputs. (2) An empirical vulnerability spectrum and an architecture-aware attack. Across directregression, discrete-token, and flow-matching decoders, we localize damaging bits to high-leverage action layers. Fixeddirection manifold escape breaks the evaluated flow heads with ∼10× fewer flips than isotropic energy, and a matched five-direction sweep rejects an all-positive-direction artifact. (3) Broad evaluation and localized protection. Across five simulation checkpoints, four LIBERO suites, and SimplerEnv, attack budgets range from 1–5 flips for direct heads to ∼100–300 for flow heads. A separate real-trained π0.5 with task-calibrated emulated K=100 perturbations yields 0/20 real-robot successes. On a direct head, 3.1% protection preserves 60% success at K=100, and 5.3% protection raises the open-loop threshold 33×.

2

Related Work

Security of VLAs and generative robot policies. AttackVLA and ANNIE study input-side VLA attacks (Li et al. 2025; Huang et al. 2025); BadVLA, TrojanRobot, and DropVLA study training- or supply-chain backdoors, including action-level backdoors (Zhou et al. 2025; Wang et al. 2024; Xu et al. 2025). For diffusion and flow policies (Chi et al. 2025; Lipman et al. 2023), DP-Attacker perturbs inputs and identifies the visual encoder as vulnerable (Chen et al. 2024), while TrojFlow implants triggers (Qi and Xu 2024). Broader image-security work studies stealthy backdoors, retraining-free backdoor removal, and black-box reconstruction defenses (Gao et al. 2024a,b; Yu et al. 2025). We instead corrupt served weights: damage concentrates in the action expert, and the evaluated flow heads require larger directed budgets (§6.4–6.5). Bit flips and quantized deployment. BFA/PBS gradientranks INT8 bits, collapsing classifiers with ∼11–17 flips while hundreds of random flips do little (Rakin et al. 2019); targeted variants install chosen behavior (Rakin et al. 2022). Recent work scales search to LLMs (Khalil and Hoque 2025), finds sparse sign-bit lesions that motivate selective protection (Galil et al. 2026), and reports block-localized BFA sensitivity in vision transformers (Zhou et al. 2024). DeepHammer realizes DDR3/4 faults (Yao et al. 2020), while GPUHammer and GDDRHammer extend Rowhammer to GPU memory (Lin et al. 2025; Hu et al. 2026). Defenses include binarization, clipping, and selective checksums/ECC (Rakin et al. 2021; He et al. 2020; Li et al. 2021; Chen et al. 2025). VLA quantization studies efficiency (Wang et al. 2025; Zhang et al. 2026; Akbari et al. 2026), while quantization-conditioned backdoors poison weights before release (Hong et al. 2021); neither addresses served-weight faults in continuous closedloop action.

3

Preliminaries

Quantized VLA policies. A VLA policy πθ : O → A maps o = (image, instruction) to an H-step, d-dimensional action chunk aθ (o). Its action-generating transformer has weights θ = {W (ℓ) }ℓ . We evaluate three decoders: a directregression head, aθ = Wo hθ (o) + bo ; a discrete-token head with C = 256 bins, ah,r = decode(arg maxc zh,r,c (o)); and a flow-matching head that transforms x1 ∼ N (0, I) into a = x0 : Z 0 aθ (o, x1 ) = x1 + vθ (xt , t, co ) dt 1

≈ x1 +

N X

∆t vθ (xtk , tk , co ),

∆t = −1/N.

k=1

(1) The final flow action therefore depends on a sequence of solver updates rather than a single readout. INT8 logical faults. Every eligible linear weight is quantized per output channel; stored integers are faultable, while scales and activations remain intact. Definition 1 (Per-channel symmetric INT8 quantization). For W ∈ Rm×n , let si = max{maxj |Wij |/127, 10−8 } and qij = clip[−128,127] (round(Wij /si )). The stored qij uses 8-bit two’s-complement representation, and inference cij = qij si . An all-zero row maps to qij = 0. dequantizes W For the OFT policy, clean quantization changes the action by only ∥aθb(o)−aθ (o)∥ = 0.003, well below its action scale. Definition 2 (Bit flip and induced weight perturbation). Toggling b ∈ {0, . . . , 7} maps qij 7→ flipb (qij ) and changes the dequantized weight by ∆ijb = (flipb (qij ) − qij )si . Non-sign and sign flips change the integer by at most 64 and 128, respectively, so |∆ijb | ≤ 128si and no INT8 flip directly produces ∞/NaN. Decoder-dependent propagation is therefore meaningful for these bounded faults.

4

Threat Model

Deployment and attacker. We consider an edge-served INT8 VLA whose model memory may be shared with an untrusted process. Following BFA (Rakin et al. 2019), the attacker knows the architecture, stored weights, scales, and decoder, and has a small calibration set Dcal disjoint from evaluation. It induces at most K persistent linear-weight flips, one per selected scalar, but controls neither training, inputs, activations, scales, nor the environment. The baseline deployment lacks effective end-to-end memory integrity or ECC. Goal and defender. The primary goal is to collapse closedloop success with few flips; targeted diagnostics instead drive a chosen action. Selective protection removes defended weights from the candidate set and rebuilds the attack over the remainder, making defense evaluation adaptive rather than a replay. Physical-delivery boundary. DeepHammer maps profiled cells and induces targeted chains (Yao et al. 2020); GPUHammer reports 8 flips across four GDDR6 banks, while

Figure 2: Fixed-direction manifold-escape attack. The displayed L = −a · u is gradient-equivalent to the centered loss in Eq. (3). A bit score s = g∆ predicts its first-order loss change; ranking uses the corresponding gain G = −s and discovers high-leverage layers without an architectural prior. GDDRHammer demonstrates cross-component attacks (Lin et al. 2025; Hu et al. 2026). Prior demonstrations reach fault counts comparable to our 1–5 direct-head regime, but coordinate reachability remains device-, placement-, and faultprofile-dependent. We therefore evaluate logical INT8 corruption rather than end-to-end physical delivery; the ∼100– 300 flow-head regime is not a deliverability claim.

5

Method

Our evidence points to two factors—how faults propagate through the decoder and where high-leverage weights lie— which become two design choices: an executed-action objective that remains effective through iterative decoding, and an unrestricted quantization-aware ranking that reveals sensitive locations. Step 1 specifies how the executed action should move, while Step 2 determines where that displacement can be induced most efficiently. The objective is decoderaware; the location search remains architecture-agnostic. For (weight, bit) pairs F, define X (ℓ) (ℓ) δθ(F) = ∆ijb eij , ((ℓ,i,j),b)∈F

(2)

⋆

F ∈ arg min L θb + δθ(F); θb , |F |≤K

(ℓ)

where eij is the unit weight-coordinate and the cleanreference argument is omitted when unnecessary. For Nw eligible scalar weights, exact optimization over ∼8Nw bit candidates is intractable, so we use two steps (Fig. 2). Step 1: design the loss (§5.1). We differentiate the final executed action for every decoder and construct a fixed-direction manifold-escape loss that remains effective through flow sampling. Step 2: rank and flip (§5.2). Following gradient-ranked bit search (Rakin et al. 2019), we combine the action gradient with each exact dequantized bit change. All action-generating

linears remain eligible, so localization is an outcome rather than a prior. Algorithm 1 gives the procedure.

5.1

Step 1: a fixed-direction manifold-escape loss

Differentiable executed actions. We construct an attacktime differentiable action e aθ for each decoder. Direct regression uses e aθ = aθ . For discrete tokens, only the ranking gradient replaces arg max with the expected decoded P value e ah,r = c softmax(zh,r )c νc , where νc denotes bin c; evaluation retains the hard decoder. A flow policy uses e aθ = aθ = x0 , backpropagated through all solver steps in Eq. (1). Because the attack targets executed action rather than field fit, we use this sampling gradient and average over M = 2–3 fixed noise draws; deterministic heads use M = 1. Centered directional objective. Several natural ports fail on the evaluated flow head. Direct squared deviation, −∥e aθ − e aθb∥22 , has zero gradient at θ = θb and cannot initialize firstorder search. Driving a fixed valid action saturates empirically, while isotropic energy requires ∼10× more flips (§6.5). We instead detach the clean action and optimize a one-sided displacement: Definition 3 (Fixed-direction manifold-escape objective). For a nonzero direction u ∈ RH×d , define h i (m) (m) (m) dθ (o) = e aθ (o, x1 ) − sg e aθb(o, x1 ) , b =− Ldir (θ; θ)

1 |Dcal |M

M X X

(m)

⟨dθ

(3) (o), u⟩,

o∈Dcal m=1

where sg denotes stop-gradient and the noise input is omitted for deterministic heads. b θ) b = 0, detaching the reference gives Although Ldir (θ; the same nonzero gradient as −⟨e aθ , u⟩ while making cleanaction displacement explicit. We use u = 1 and test −1 plus three Gaussian directions in §6.5; positive rescaling does not

Algorithm 1 Quantization-aware fixed-direction bit search Require: quantized weights {q (ℓ) , s(ℓ) }, candidates C, calibration set Dcal , direction u, noise draws M , budget K b 1: g ← ∇W Ldir (θ; θ) θ=θb

6.1

2: for each weight (ℓ, i, j) ∈ C do (ℓ) ∆ijb

(ℓ) Gijb

compute and 0, . . . , 7 ⋆(ℓ) (ℓ) 4: bij ← arg maxb Gijb , 3:

(ℓ) (ℓ) −gij ∆ijb

= (ℓ)

for b =

(ℓ)

Gij ← G

⋆(ℓ)

ijbij

5: F ← top-K positive-gain weights paired with b⋆ 6: return F and θb + δθ(F)

change ranking. Sharing u gives traces a common actionspace orientation without fitting a geometric manifold or forcing per-step gradient signs. Targeted diagnostics instead use Ltgt = Eo ∥e aθ (o) − a⋆ ∥22 .

5.2

Step 2: quantization-aware bit ranking

Given Ldir , which bits best solve Eq. (2)? Let (ℓ)

gij =

∂Ldir

,

(ℓ)

∂Wij

(4)

θ=θb

(ℓ) (ℓ) (ℓ) (ℓ) sijb = gij ∆ijb ≈ ∆Lijb ,

(ℓ) (ℓ) Gijb = −sijb .

The score s predicts the loss change; G is positive when a flip improves the minimizing attack. Since Ldir is a fixed action projection, +# "* de aθ (ℓ) (ℓ) Gijb = ∆ijb Eo,m ,u . (5) (ℓ) dWij θ=θb Thus G combines directional action sensitivity with the quantization-dependent flip magnitude; it is a projection, not the full sensitivity norm. For each scalar weight we keep b⋆ij = arg maxb Gijb , then select the K largest positive per-weight gains. Directional leverage is highly nonuniform, so this unrestricted ranking concentrates in a few actiongenerating layers without being told where to search (§6.4). The search requires one backward pass and scores eight bits per eligible weight, giving O(8Nw ) = O(Nw ) scoring cost. Its one-shot gradient ignores interactions among selected flips; progressive re-ranking can capture some interactions at higher cost, and §6.2 verifies that the low-budget discrete result survives canonical PBS. The same algorithm collapses the discrete policy at K=3, drives OFT’s action a full scale off, and, with the primary u = 1, collapses π0 at K≈100: one recipe whose empirical budget varies sharply with the action decoder.

6

and the required budget spans two orders of magnitude across architectures. We establish the attack across this spectrum (§6.2), show that protecting ∼3–5% of weights substantially raises the tested budget of a direct head (§6.3), and analyze localization and flow-head objectives (§6.4–6.5).

Experiments

Overview. Quantization makes the policy look safe: naive bit-flips leave the action essentially unchanged. Yet a gradient-ranked search that maximizes a fixed executedaction projection collapses closed-loop task success to zero,

Experimental setup

Models. We study three action-head families across four simulation model variants and five simulation checkpoints (3–7B, the 7B OpenVLA family and the ∼3.3B π0 /π0.5 ): (i) OpenVLA-OFT (Kim et al. 2025) (continuous L1 -regression head, 8-step chunks), (ii) discrete OpenVLA (256-bin action tokens emitted by the LLM head), (iii) π0 (flow-matching with a separate action expert, N =10 denoising steps), and (iv) π0.5 (Physical Intelligence et al. 2025) (a newer flowmatching VLA with a distinct architecture and weights, used to test whether the flow-matching findings generalize beyond a single model). (i)–(iv) are LIBERO-finetuned. For the cross-benchmark transfer we additionally use (v) the OXEpretrained openvla-7b base policy (discrete token head, Google-Robot/Bridge embodiment). The real-robot study separately uses a real-trained π0.5 checkpoint. Benchmarks. Closed-loop evaluation uses LIBERO (Liu et al. 2023) (four suites: Spatial, Object, Goal, Long) and SimplerEnv (Li et al. 2024) (ManiSkill2/SAPIEN, GoogleRobot pick-coke-can and move-near). Quantization and attack surface. Weights are quantized per Def. 1. The attacker’s candidate set is every linear layer of the action-generating transformer (all decoder layers plus the action head/expert, 228–437 matrices), a realistic Rowhammer surface rather than the small head alone. The ranking gradient is accumulated over ≤6 calibration frames, disjoint from evaluation. The attack is robust to both knobs: a single calibration frame already collapses the discrete policy at K=3 (identical to 6 or 20 frames), and either extreme direction works (push-high 0%, push-low 5% at K=3, n=20), so the attack does not depend on tuned hyperparameters. Metrics. (a) Open-loop action deviation: mean per-step L2 between corrupted and clean executed actions on heldout frames (baseline action scale 0.804 OFT / 0.169 discrete / 0.638 π0 ). (b) Closed-loop success rate (SR): the fraction of successful rollouts. Headline endpoints use n=30– 50 with Clopper-Pearson (exact binomial) 95% intervals on 0/n collapses, and the random-flip control reports a 5-seed mean±std. (c) Safety predicates: per-step gripper inversion, out-of-envelope motion, and direction reversal for targeted diagnostics. Each closed-loop cell aggregates NT tasks × EP episodes. All simulated experiments use one NVIDIA A800; the physical-robot runtime is described separately in §6.2. Clean SR varies across experiments (discrete 88–90%, π0 57–70%) because attacks use different small task–episode subsets; every attack is compared with the matched clean baseline from the same subset. Reproducibility. The appendices document the statistical protocol and additional diagnostics; ancillary code provides the attack, evaluation, analysis, and real-robot patching implementations. The π0 direction sweep fixes seed 20260722, three calibration frames, two ranking-noise draws, and identical 30 rollout slots across directions. The fixed-path study in-

policy

stored-weight quantizer

clean SR

break K

discrete π0 discrete π0 π0

INT8, all 437 linears INT8, all 422 linears INT4, per-channel INT4, group-wise INT4, per-channel

88.9% 56.7% 76.7% preserved 10.0%

3 ∼100 2 ∼100 n/a

Table 2: Attack budgets under INT8 and INT4 quantization.

Figure 3: Three gradient-ranked INT8 flips move OpenVLAOFT a full action scale; 300 naïve flips barely move it. suite

clean min K 95% upper rand.-300

Spatial (n=50) 88.0% Object (n=30) 80.0% Goal (n=30) 83.3% Long (n=30) 50.0%

3 5 2 1

≤7.1% ≤11.6% ≤11.6% ≤11.6%

80.0% n/a n/a n/a

Table 1: Closed-loop attack results on four LIBERO suites.

dependently reranks ten seeds (20260730–39), each with 17 held-out frames and three shared sampler-noise draws. These jobs use Ubuntu 22.04, Python 3.12, PyTorch 2.5, Transformers 4.53, LeRobot 0.4.4, and LIBERO 0.1.0; checkpoints, benchmark assets, calibration observations, robot videos, and experiment outputs are not redistributed.

6.2

The attack

Naïve flips (premise). In bf16 a single magnitude-targeted exponent-MSB flip already moves the OFT action by 0.306 (38% of scale) and ≥10 random flips produce NaNs (a denialof-service), but this is a floating-point artifact. In the realistic INT8 regime, bounded values eliminate NaNs and naïve attacks fail: 300 random and 100 magnitude-targeted flips both leave the action within ∼0.004 of clean (Fig. 3), mirroring the BFA literature. Does INT8 also resist a gradient-ranked search? Gradient-ranked bit search. Full-model gradient-PBS on OFT, over all 228 LLM-decoder + action-head linears: K=3 → deviation 0.828 (≈full scale), K=10 → 1.00, K=100 → 1.13, three orders of magnitude above naïve at matched budgets. The selected flips are dominated by LLM Layer 1 (earliest decoder layer) and the action head, the highest-leverage points on this direct head’s action pathway. Closed-loop task failure. Closed-loop LIBERO rollouts of discrete OpenVLA yield the suite-level results below: The discrete robot fails every task after 3 gradient-selected flips on LIBERO-Spatial (0/50 successes). The random-flip con-

trol is decisive: 300 random flips leave success near clean (80% vs. 88%, over 5 seeds 90.0% ± 5.4%, never collapsing), confirming the loss-aligned search, not the flip count, is the cause. Three flips induce only a modest per-step deviation (0.105) yet drive closed-loop success to zero: errors compound over the ∼200-step horizon. Consistent with horizon compounding, the longest-horizon suite (LIBEROLong) collapses at a single flip (Table 1). The continuousregression OFT head is even more fragile: a single gradient flip in its small, high-leverage action head collapses closedloop success. Not all architectures are equally fragile, though: the flow-matching π0 requires a different objective and a larger budget (§6.5). Progressive-ranking check. Although the main attack ranks once, we also run canonical PBS with a fresh gradient and ranking after every discrete-policy flip. Open-loop deviation is 0.017, 0.090, and 0.153 at K=1, 2, 3, respectively, and every selected bit remains in LLM L1. Thus the rapid low-budget damage and early-layer localization are not artifacts of a frozen ranking. All-linear weight quantization and lower precision. Table 2 summarizes the deployment-quantization checks. Quantizing every linear weight to INT8 preserves clean behavior and the direct-versus-flow budget gap. Lower precision does not remove the threat: per-channel INT4 reduces the discrete collapse budget to two flips, while usable group-wise INT4 preserves π0 ’s ∼100-flip regime. For π0 , per-channel INT4 reduces clean SR to 10.0% as denoising accumulates quantization error, so we exclude it from attack-budget comparisons. For discrete INT4, SR drops from 76.7% clean to 46.7% at K=1 and 0% at K=2. These comparisons isolate stored-weight precision while ranking and arithmetic remain floating point. Cross-benchmark transfer. We also attack a different benchmark, embodiment, and checkpoint: the OXEpretrained openvla-7b base policy on SimplerEnv (ManiSkill2/SAPIEN, Google Robot). On pick-coke-can, SR is 20.8% → 0% at K=3 (random-300: 29.2%). On the stronger move-near task it is 58.3% → 12.5% at K=3, 4.2% at K=5, and 0% at K=10 (random-300: 41.7%), all at n=24 (Table 3). The higher-clean move-near task provides the stronger evidence; together, the results demonstrate transfer across benchmark, embodiment, and OXE- versus LIBEROfinetuned checkpoints. Targeted action diagnostics. On held-out traces of the discrete policy, a target-action variant concentrates at low K on the most-sensitive gripper coordinate: K=3 inverts the

SimplerEnv task

clean

flips → 0%

random

protection

weights

break K

dev.@K=3

pick-coke-can move-near

20.8% 58.3%

3 10

29.2% 41.7%

none action head head + L1 L0–5

0.0% 2.3% 5.3% 20.6%

3 3 100 100

0.83 0.75 0.14 0.12

Table 3: SimplerEnv attack results (n=24 per task).

Table 4: Adaptive open-loop defense (break: dev. >0.5). protection

weights SR@3 SR@10 SR@100

none early layer (L1) random slice

0.0% 3.1% 3.0%

0% 80% 10%

0% 83% n/a

– 60% –

Table 5: Adaptive closed-loop defense (clean 90%, n=30).

6.3 Figure 4: Physical-robot rollouts on the calibrated blue-bowl task. Headers report 20-trial success; rows show stages under emulated INT8-equivalent patches.

gripper command on 99% of steps while leaving arm-motion deviation at ∼0.003. At K=30, 60% of commands leave the clean envelope and 41% reverse direction. We report these outcomes as per-step open-loop safety diagnostics; closedloop targeted behavior is outside this evaluation. Trigger-conditioned stealthiness (negative result). We additionally test a T-BFA-style goal: preserve clean behavior but alter it under a checkerboard trigger. The trigger separates clean and triggered attack gradients (cosine ≈0.24) while leaving patch-only success near clean. An iterative search with a clean-preservation penalty keeps the clean actiontoken proxy within ±3 bins and drives the triggered proxy away over 30 flips, yet clean closed-loop SR still falls to 0% at K=10–30. Thus we do not obtain a stealthy triggered backdoor. Real-robot study. On a 6-DoF place-block-in-bowl task, a collaborator patched a real-trained π0.5 with task-calibrated dequantized values equivalent to K=100 INT8 flips (99 readout coordinates, one expert). The patch yields 0/20 successes versus 14/20 clean and 16/20 equal-count globalrandom (Fig. 4; exact 95% CIs: [0, 16.8]%, [45.7, 88.1]%, and [56.3, 94.3]%). Two-sided Fisher tests give p < 10−5 against either control; clean and random do not differ (p = .716). The directed list contains 100 distinct weight coordinates: 99 in action_out_proj and one in expert-L17, with 96 sign-bit and four bit-6 flips. The global-random list also uses 100 distinct coordinates but spans all eight bit positions. This study validates task-calibrated logical weight corruption on a real robot using an equal-count global-random control; end-to-end fault delivery and cross-task transfer remain open.

Defense: Localized Integrity Protection

We protect weights by removing them from the candidate set and rebuilding the attack, so every result is adaptive rather than a replay of fixed flips. Open loop, protecting the intuitive action head alone is useless: the attack pivots to L1 and still breaks at K=3 (Table 4). Adding L1 raises the threshold to K=100 (33×), while expanding coverage to L0–5 provides no further gain. Closed loop requires only L1 (3.1%): success remains 80%, 83%, and 60% at K=3, 10, 100 (Table 5). At matched K=3, specific protection yields 24/30 successes versus 0/30 unprotected and 3/30 for an equal-size random slice (twosided Fisher p = 3.3×10−11 and 5.6×10−8 , respectively). After L1 is excluded, the rebuilt ranking redistributes to later layers (L9, L19, and L23), yet 18/30 trials still succeed at K=100 (exact 95% CI: [40.6, 77.3]%). Survival through K=100 therefore establishes an at-least 33× increase in the tested attack budget. Scope and full-cost alternatives. Localized protection does not transfer to π0 : protecting 14% of its expert fails as the attack redistributes, so flow heads need broader coverage but already require ∼30× more flips. Full checksums or ECC are the 100%-coverage endpoint of our defense. For a 7B-parameter INT8 model, one parity byte per eight data bytes alone adds roughly 0.9 GB, before verification cost; protecting the identified 3.1–5.3% instead raises the tested direct-head budget while touching far less state. Weight shuffling provides no integrity by itself: a static layout may be recovered during memory templating, whereas repeatedly moving gigabytes of weights is bandwidth-heavy. It is therefore complementary to selective protection rather than an equal-cost substitute.

6.4

Where Damaging Bits Concentrate

The highest-gain bits occupy small action-generating subsets, but their exact layer depends on the architecture. Localization across architectures. On discrete OpenVLA, K=3 gives deviation 0.105 and 0% closed-loop SR, with top flips in LLM L1. On π0 , K=3 gives 0.363 deviation, with flips in the action expert; the primary objective

fixed direction

successes

SR ↓

95% CI

clean (no flips) +1 −1 random u0 random u1 random u2

18/30 2/30 8/30 2/30 2/30 4/30

60.0% 6.7% 26.7% 6.7% 6.7% 13.3%

[40.6, 77.3] [0.8, 22.1] [12.3, 45.9] [0.8, 22.1] [0.8, 22.1] [3.8, 30.7]

Table 7: Matched fixed-direction π0 trials at K=100 (n=30). attack

Figure 5: Layer localization among the top-100 flips (blank cells are zero). Direct heads concentrate in LLM L1, whereas π0 concentrates in its final expert layer (5-seed mean).

policy/suite clean

directed SR@K

random SR@K

∼ 12 clean@30; 0.0%@∼100 ∼clean@300 π0 /Spatial 70.0% π0 /Object 86.7% 3.3%@100 70.0%@100 66.7%@30; 30.0%@100; π0.5 /Spatial 93.3% 0.0%@300 96.7%@300

Table 6: Closed-loop flow-head budgets (n=30). favors expert-L17 across 5 noise seeds rather than the visionlanguage backbone (Fig. 5). Thus high-leverage layers are sparse but architecture dependent. This localization result is distinct from the budget spectrum: it identifies where an attack enters each model, not why one decoder needs more flips than another.

6.5

Flow-Head Objective Analysis

We next isolate the role of the executed-action objective on the evaluated flow heads. Complete flow-head budget curves. Table 6 makes the primary fixed-direction endpoints explicit. On π0 /Spatial, the attack removes roughly half the clean successes by K=30 and reaches 0% at ∼100; on Object it leaves only 3.3% at K=100. The distinct π0.5 reaches 0% at K=300, supporting the empirical ∼100–300 flow-head regime. Exact n=30 counts for the latter two rows are π0 /Object 26/1/21 clean/directed/random at K=100, and π0.5 /Spatial 28/30 clean, 20/9/0 directed at K=30/100/300, and 29/30 random-300. For the controlled objective comparison on π0 /Spatial, isotropic energy instead requires ∼1000 flips to reach 0% (n=50; random 76.0%), ten times the fixeddirection budget. Objective-direction robustness. We repeat the K=100 π0 /LIBERO-Spatial attack with +1, −1, and three independent Gaussian unit directions. Each receives a fresh oneshot ranking; 414 candidate linears, three calibration frames, two noise draws, quantization, and the same 30 task–episode seeds are fixed. From the matched 18/30 clean rate, the random directions

clean random-300 magnitude-3 token-CE self-deviation isotropic max ∥a∥2 manifold escape

direct, K=3

π0 flow

90% 90% 90% 0% n/a 0% 0%

70% ∼clean ∼clean n/a 76.7% at K=1000 0% at ∼1000 0% at ∼100

Table 8: Head-specific empirical collapse budgets. yield 2/30, 2/30, and 4/30 successes; −1 is weaker (8/30; Table 7). After Bonferroni correction across the five directions, +1 and all random directions remain significant (adjusted p ≤ 2.6×10−3 ), whereas −1 does not (raw p = .031, adjusted p = .154). Thus direction affects strength, but the result is not all-positive-specific. Every ranking stays in the action expert, usually with 81–92 flips in L17; one random direction splits between L0 (44) and L17 (43). Attack comparison. Table 8 separates head-specific ports. On the direct head, any gradient-aligned objective collapses at K=3, whereas random and magnitude baselines remain at clean SR; without iterative decoding, objective design matters little. On π0 , the direct self-deviation port remains at 76.7% SR at K=1000 because its clean-initialization gradient is zero. The meaningful nonzero-gradient comparison is therefore isotropic energy versus manifold escape, which require ∼1000 and ∼100 flips, respectively. Step-effect consistency across rerankings. Across ten K=100 rerankings (51 shared traces each), fixed-direction coherence is 1.000 versus 0.969 for energy. Differences are positive/tied in 7/3 cases (one-sided Wilcoxon p=.0078), with mean 0.031 (95% CI [−0.019, 0.081]). Architecture-level synthesis. Together, the results separate where faults enter from how they propagate: localization guides protection, while decoder architecture and directional consistency shape the empirical closed-loop budget. Limitations and ethics. Reported K budgets measure logical INT8 susceptibility, not hardware-independent margins; physical fault delivery and ECC remain outside scope. This dual-use study is intended to motivate integrity protection.

7

Conclusion

Selected INT8 flips collapse random-fault-tolerant VLAs: 1–5 for direct heads versus ∼100–300 for the evaluated

flow heads. Fixed-direction manifold escape cuts π0 ’s budget tenfold, works across five directions, and guides protection through K=100. Physical-robot trials validate taskcalibrated failure. This architecture-aware view links attack construction to selective protection. It also motivates decoder-aware fault evaluation before deployment. For direct heads, localized integrity checks offer a practical starting point. Weight integrity is therefore a VLA security boundary.

References A. S. Rakin et al. Bit-Flip Attack: Crushing Neural Network with Progressive Bit Search. ICCV 2019. F. Yao et al. DeepHammer: Depleting the Intelligence of Deep Neural Networks through Targeted Chain of Bit Flips. USENIX Security 2020. C. S. Lin, J. Qu, and G. Saileshwar. GPUHammer: Rowhammer Attacks on GPU Memories are Practical. USENIX Security 2025. Y. Hu, N. Brown, Y. Chen, J. Bakita, T. Chen, D. Genkin, and A. Kwong. GDDRHammer: Greatly Disturbing DRAM Rows—Cross-Component Rowhammer Attacks from Modern GPUs. IEEE S&P 2026. A. S. Rakin et al. T-BFA: Targeted Bit-Flip Adversarial Weight Attack. IEEE TPAMI 2022. A. S. Rakin et al. RA-BNN: Constructing Robust & Accurate Binary Neural Network to Simultaneously Defend Adversarial Bit-Flip Attack and Improve Accuracy. arXiv:2103.13813. M. J. Kim et al. OpenVLA: An Open-Source VisionLanguage-Action Model. CoRL 2024 (arXiv:2406.09246). K. Black et al. π0 : A Vision-Language-Action Flow Model for General Robot Control. arXiv:2410.24164. B. Zitkovich et al. RT-2: Vision-Language-Action Models Transfer Web Knowledge to Robotic Control. CoRL 2023. X. Zhou, G. Tie, G. Zhang, H. Wang, P. Zhou, and L. Sun. BadVLA: Towards Backdoor Attacks on VisionLanguage-Action Models via Objective-Decoupled Optimization. arXiv:2505.16640. H. Wang, C. Xiong, R. Wang, and X. Chen. BitVLA: 1-bit Vision-Language-Action Models for Robotics Manipulation. arXiv:2506.07530. K. Khalil and K. A. Hoque. FlipLLM: Efficient Bit-Flip Attacks on Multimodal LLMs using Reinforcement Learning. arXiv:2512.09872. I. Galil, M. Kimhi, and R. El-Yaniv. Maximal Brain Damage Without Data or Optimization: Disrupting Neural Networks via Sign-Bit Flips. TMLR 2026 (arXiv:2502.07408). X. Zhou, S. Kundu, D. Chen, J. Huang, and P. A. Beerel. What Makes Vision Transformers Robust Towards Bit-Flip Attack? ICPR 2024. Y. Chen et al. Diffusion Policy Attacker: Crafting Adversarial Attacks for Diffusion-based Policies. NeurIPS 2024 (arXiv:2405.19424). Z. Qi and X. Xu. TrojFlow: Flow Models are Natural Targets for Trojan Attacks. arXiv:2412.16512.

X. Wang et al. TrojanRobot: Physical-World Backdoor Attacks Against VLM-Based Robotic Manipulation. arXiv:2411.11683. Y. Huang et al. ANNIE: Be Careful of Your Robots. arXiv:2509.03383. J. Li, Y. Zhao, X. Zheng, Z. Xu, Y. Li, X. Ma, and Y.-G. Jiang. AttackVLA: Benchmarking Adversarial and Backdoor Attacks on Vision-Language-Action Models. arXiv:2511.12149. Z. Xu, J. Li, Y. Zhao, X. Zheng, X. Ma, and Y.-G. Jiang. DropVLA: An Action-Level Backdoor Attack on VisionLanguage-Action Models. arXiv:2510.10932. J. Zhang, Y. Hsieh, Z. Wan, H. Lin, X. Wang, Z. Wang, Y. Lei, and M. Zhang. QuantVLA: Scale-Calibrated PostTraining Quantization for Vision-Language-Action Models. arXiv:2602.20309. A. Akbari et al. ActQuant: Sub-4-bit Action-Guided Quantization for Vision-Language-Action Models. arXiv:2605.24011. S. Hong et al. Qu-ANTI-zation: Exploiting Quantization Artifacts for Achieving Adversarial Outcomes. NeurIPS 2021. Y. Gao, H. Chen, P. Sun, J. Li, A. Zhang, Z. Wang, and W. Liu. A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives. AAAI 2024, pp. 1851–1859. Y. Gao, H. Chen, P. Sun, Z. Li, J. Li, and H. Shao. EnergyBased Backdoor Defense without Task-Specific Samples and Model Retraining. ICML 2024, pp. 14611–14637. C. Chi et al. Diffusion Policy: Visuomotor Policy Learning via Action Diffusion. IJRR 44(10–11):1684–1704, 2025. Y. Lipman et al. Flow Matching for Generative Modeling. ICLR 2023. Z. He et al. Defending and Harnessing the Bit-Flip Based Adversarial Weight Attack. CVPR 2020. J. Li et al. RADAR: Run-time Adversarial Weight Attack Detection and Accuracy Recovery. DATE 2021. Y. Chen et al. BitShield: Defending Against Bit-Flip Attacks on DNN Executables. NDSS 2025. M. J. Kim, C. Finn, and P. Liang. Fine-Tuning VisionLanguage-Action Models: Optimizing Speed and Success. arXiv:2502.19645. Physical Intelligence et al. π0.5 : A Vision-Language-Action Model with Open-World Generalization. arXiv:2504.16054. B. Liu, Y. Zhu, C. Gao, Y. Feng, Q. Liu, Y. Zhu, and P. Stone. LIBERO: Benchmarking Knowledge Transfer for Lifelong Robot Learning. NeurIPS Datasets and Benchmarks 2023. X. Li et al. Evaluating Real-World Robot Manipulation Policies in Simulation. CoRL 2024 (arXiv:2405.05941). J. Yu, H. Chen, J. Li, L. Chen, Y. Gao, W. Liu, and L. Zhang. Black-Box Adversarial Defense Based on Image Decomposition and Reconstruction. IEEE Transactions on Multimedia, 27:5909–5921, 2025.

A

Additional Statistical and Reproducibility Details

A.1

Code and environment

The ancillary code contains reusable INT8 quantization and bit-ranking utilities; implementations for the direct, discretetoken, π0 , and π0.5 experiments; analysis code for the fixeddirection study; and the real-robot patch-and-restore utility. It intentionally excludes checkpoints, benchmark assets, calibration observations, selected patch lists, robot videos, and experiment outputs. The π0 jobs used one NVIDIA A800 under Ubuntu 22.04.3, Python 3.12.12, PyTorch 2.5.0, Transformers 4.53.3, LeRobot 0.4.4, and LIBERO 0.1.0. The direction sweep fixes seed 20260722, three calibration frames, two ranking-noise draws, and 30 rollout slots per condition. The multi-seed fixed-path study independently reranks seeds 20260730–39, using three calibration frames, two ranking-noise draws, and 17 held-out frames with three shared evaluation-noise draws per seed.

A.2

A.4

Attack-port comparison

The direct-head result reduces to gradient-ranked bit search, while the relevant flow-head comparison separates zerogradient and nonzero-gradient objectives: attack clean random-300 magnitude-3 token-CE self-deviation isotropic max ∥a∥2 manifold escape

direct, K=3

π0 flow

90% 90% 90% 0% n/a 0% 0%

70% ∼clean ∼clean n/a 76.7% at K=1000 0% at ∼1000 0% at ∼100

Table 10: Head-specific empirical collapse budgets.

Real-robot aggregate results

Table 9 aggregates the blue-bowl trials used in the main paper. Confidence intervals are two-sided Clopper–Pearson intervals. condition

success

SR

exact 95% CI

clean directed K=100 global-random K=100

14/20 0/20 16/20

70.0% 0.0% 80.0%

[45.7, 88.1]% [0.0, 16.8]% [56.3, 94.3]%

Table 9: Physical-robot success on the blue-bowl task. Two-sided Fisher exact tests give p = 3.34 × 10−6 for directed versus clean and p = 1.54×10−7 for directed versus global-random; clean versus global-random is not distinguishable (p = 0.716). These comparisons do not establish task transfer, and the random control is not layer/bit matched.

A.3

with the 5-seed localization study, whereas energy often favors Expert-L12 and sometimes Expert-L0. The supported claim is concentration in a small action-expert subset, not invariance of one exact layer.

Fixed-path consistency diagnostic

At K=100, corrupted velocities are re-evaluated P Pat every clean denoising state, and coherence is | k ck |/ k |ck |. A single expanded ranking paired on 17 held-out frames and three shared noise draws (n=51 traces) gave coherence 1.000 versus 0.998 and did not resolve a difference (p = .159). Because the independently rebuilt ranking is the relevant experimental unit, we then fixed a ten-seed protocol before inspecting its results. Each seed reranks both objectives and averages the same 51 within-seed traces. Fixed direction has coherence 1.000 for all ten seeds, whereas energy averages 0.969: seven paired differences are positive, three are ties, and none is negative (one-sided Wilcoxon p = .0078). The mean difference is 0.031, but its 95% CI is wide ([−0.019, 0.081]). Thus the experiment supports a tendency toward more consistent step effects, while the tenfold closed-loop budget gap remains an empirical objective comparison rather than an identified causal mechanism. Layer identity varies across ranking seeds. Manifoldescape flips usually concentrate in Expert-L17, consistent

B

Exploratory Flow-Attenuation Analysis

These exploratory diagnostics probe why the two evaluated flow-matching policies have high attack budgets. They neither isolate decoder dynamics causally nor predict closedloop bit budgets.

B.1

Endpoint sensitivity to initial-noise perturbations

We perturb initial noise by ϵd for random unit d and measure ρend = ∥∆a∥/∥∆ noise∥ (n=24 per ϵ). It is 0.16–0.38 for π0 and 0.04–0.22 for π0.5 over ϵ ∈ {0.1, 0.3, 1.0}. These finite endpoint ratios show shrinkage but neither identify the symmetric part of Jx nor verify Jx + Jx⊤ ⪯ −2µI; κend = − ln ρend is descriptive only. They also do not predict budget ordering: π0.5 has larger first-order per-flip open-loop damage despite its higher closed-loop budget.

B.2

Solver-depth diagnostic

We rebuild each attack for N ∈ {2, 5, 10, 20} denoising steps. Increasing N changes discretization, not the learned vector field, so it is not a controlled intervention on contraction. At fixed budget, isotropic open-loop deviation falls roughly 2× (0.057 at N ≤ 5 to 0.025 at N =20), while manifold escape collapses success at every N . This establishes objective efficacy across solver depths but does not identify cancellation or contractivity; moreover, the deviation result is open-loop and the closed-loop sample (n=12) is too noisy for a stronger claim.

C

Conditional First-Order Contraction Bound

This section records a sufficient-condition analysis that helps organize intuition. The condition is not verified by the endpoint diagnostic above, and the bound is not used to estimate any experimental budget.

Proposition 1 (Budget lower bound from contraction). Write denoising in forward time s ∈ [0, 1], with ẋs = vθ (xs , s, c) and executed action a = x1 . Partition weights into blocks θ = {θℓ } and let Lℓ := sups ∥∂θℓ vθ ∥. Suppose Jx = ∂vθ /∂x satisfies Jx + Jx⊤ ⪯ −2µI along the sampling trajectory for µ > 0. Then the first-order action variation satisfies ∥δa∥ ≤ C(µ)

X ℓ

Lℓ ∥δθℓ ∥,

C(µ) =

1 − e−µ . µ

If each of K INT8 flips changes one weight by at most b and Lmax = maxℓ Lℓ , reaching first-order open-loop deviation D requires K ≥ D/[Lmax bC(µ)]. Here Lℓ describes where a perturbation enters the vector field and C(µ) how a contractive trajectory would attenuate it. Since C(µ) → 1 as µ → 0, the unattenuated first-order case is recovered. This is an open-loop upper bound, not an equality or closed-loop certificate; direct heads lie outside its premise. Task tolerance, bit values, nonlinear interactions, and feedback can dominate, so budgets are measured rather than inferred. Proof. For each block, Sℓ = ∂xs /∂θℓ obeys Ṡℓ = Jx Sℓ + ∂θℓ v, Sℓ (0) = 0. The hypothesis gives ∥Φ(1, s)∥ ≤ e−µ(1−s) and thus P ∥Sℓ (1)δθℓ ∥ ≤ Lℓ C(µ)∥δθℓ ∥. Sum over blocks and use ℓ ∥δθℓ ∥ ≤ Kb.

Related documents

• Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability#616638
• Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability#616138
• Robustness of Vision Language Models Against Split-Image Harmful Input Attacks#798765
• Robustness of Vision Language Models Against Split-Image Harmful Input Attacks#797351
• DropVLA: An Action-Level Backdoor Attack on Vision-Language-Action Models#999678