Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability

TL;DR - This paper presents the first bit-flip attack on quantized vision-language-action models, showing that a few targeted INT8 weight faults can reduce robotic task success to 0%. Vulnerability varies substantially with action-decoding architecture, making weight integrity critical for embodied AI security.

• Gradient-selected flips are highly effective, while hundreds of random flips are harmless.
• Direct-regression and token-policy heads fail after 1–5 flips; evaluated flow-matching policies require roughly 100–300.
• Damaging bits cluster in a small number of action-generating layers, enabling targeted protection of only 3.1–5.3% of weights.
• On a real robot, 100 targeted flips produced 0/20 successes, compared with 14/20 clean and 16/20 under global-random flips.