Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Ranking
Overall
91
Content
100
Popularity
69
Observed public metrics from 1 member.
Merged summary
TL;DR - This paper presents the first bit-flip attack on quantized vision-language-action models, showing that a few targeted INT8 weight faults can reduce robotic task success to 0%. Vulnerability varies substantially with action-decoding architecture, making weight integrity critical for embodied AI security.
- Gradient-selected flips are highly effective, while hundreds of random flips are harmless.
- Direct-regression and token-policy heads fail after 1–5 flips; evaluated flow-matching policies require roughly 100–300.
- Damaging bits cluster in a small number of action-generating layers, enabling targeted protection of only 3.1–5.3% of weights.
- On a real robot, 100 targeted flips produced 0/20 successes, compared with 14/20 clean and 16/20 under global-random flips.
Sources (1)
Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability
Public signals
Semantic Scholar citations 2 · Semantic Scholar influential citations 0
TL;DR - This paper presents the first bit-flip attack on quantized vision-language-action models, showing that a few targeted INT8 weight faults can reduce robotic task success to 0%. Vulnerability varies substantially with action-decoding architecture, making weight integrity critical for embodied AI security.
- Gradient-selected flips are highly effective, while hundreds of random flips are harmless.
- Direct-regression and token-policy heads fail after 1–5 flips; evaluated flow-matching policies require roughly 100–300.
- Damaging bits cluster in a small number of action-generating layers, enabling targeted protection of only 3.1–5.3% of weights.
- On a real robot, 100 targeted flips produced 0/20 successes, compared with 14/20 clean and 16/20 under global-random flips.