New Attack Method Threatens Robotic Vision-Language Models

A new adversarial attack method, named DURA (Diffusion-based Unrestricted Robotic Attack), has been developed to exploit vulnerabilities in Vision-Language-Action (VLA) models that control robots. Unlike previous attacks that often produce noticeable visual artifacts or require full system access, DURA generates visually natural adversarial patches. These patches can subtly steer a robot towards attacker-specified actions, even in real-world physical environments. DURA operates by optimizing along the latent trajectory of a pre-trained diffusion model, allowing it to create imperceptible perturbations. The attack is effective in both white-box scenarios (where the attacker has full knowledge of the model) and black-box settings (requiring only the robot's predicted actions). Extensive experiments confirm DURA's superior performance over existing methods, highlighting a critical safety concern for robots deployed in physical spaces and underscoring the need for stronger defensive measures.