发表机构
UNSW Sydney; UNSW Canberra; National University of Singapore; Southern Cross University; Griffith University（新南威尔士大学悉尼分校; 新南威尔士大学堪培拉分校; 新加坡国立大学; 南十字星大学; 格里菲斯大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本研究揭示VLA策略中对抗补丁移除后仍存在持续性效应，提出状态恢复协议并验证恢复适配器在及时干预下可显著提升可恢复性。
AI 中文摘要
针对视觉-语言-动作（VLA）策略的对抗性补丁既能导致即时动作损坏，也能在补丁被移除后产生持续的状态效应。现有评估主要关注连续攻击，并未区分这两种效应。我们引入了一种状态恢复协议，该协议在匹配的动作块边界处移除补丁，并在相同的剩余步数预算下测量后续的可恢复性。干净、随机补丁、偏差匹配和固定方向对照组将对抗效应与遮挡、动作误差幅度和方向持续性区分开来。我们还评估了一个在受控干预延迟下、基于攻击诱导状态训练的恢复适配器。在OpenVLA-OFT上使用EDPA攻击时，经过五个块后，LIBERO-Long情节中仅有36.2%保持可恢复，而偏差匹配和固定方向对照组的比例分别为89.9%和87.0%。在自回归OpenVLA上也观察到类似的持续效应。恢复适配器在单块延迟下将恢复率从7.7%提升至47.4%，但其效益在延迟干预下大幅降低。这些结果表明，对抗效应在补丁移除后仍可持续，且及时干预对恢复至关重要。
英文摘要
Adversarial patches to Vision-Language-Action (VLA) policies can cause both immediate action corruption and persistent state effects that remain after the patch is removed. Existing evaluations largely focus on continuous attacks and do not separate these two effects. We introduce a state-restoration protocol that removes the patch at matched action-chunk boundaries and measures subsequent recoverability under the same remaining step budget. Clean, random-patch, deviation-matched, and fixed-direction controls distinguish adversarial effects from occlusion, action-error magnitude, and directional persistence. We also evaluate a recovery adapter trained on attack-induced states under controlled intervention latency. On OpenVLA-OFT with EDPA attacks, only 36.2% of LIBERO-Long episodes remain recoverable after five chunks, compared with 89.9% and 87.0% for the deviation-matched and fixed-direction controls. Similar persistent effects are observed on autoregressive OpenVLA. The recovery adapter improves recovery from 7.7% to 47.4% at one-chunk latency, but its benefit decreases substantially with delayed intervention. These results show that adversarial effects can persist after patch removal and that timely intervention is critical for recovery.
Comments8 pages, 2 figures
