Hiding in plain sight: diffusion-based unrestricted robotic attacks against VLA models

In their paper, Han et al. propose DURA, a diffusion-based unrestricted attack framework against vision-language-action (VLA) models, which optimizes on the latent-space trajectory of a pretrained diffusion model to generate visually natural, physically printable local adversarial patches that hijack robotic arm actions. On the LIBERO benchmark, DURA achieves a 100.0% white-box attack success rate against OpenVLA-7B, and under a black-box setting relying only on action outputs, the simulated patch achieves an average success rate of 86.0% and the physical patch 79.3%; against the continuous action chunking architecture π0-FAST it reaches 100.0% under both white-box and black-box settings. The authors placed the printed patch into the workspace of a 7-DoF Franka robotic arm and induced target behaviors such as action freezing and uncommanded forward movement without modifying the language instruction, policy weights or hardware. The paper states that the success rate saturates to 100% when the patch occupies more than 5% of the image area, and that the white-box setting converges within minutes on a single NVIDIA H200, whereas pixel-space baselines require hours. The authors recommend incorporating natural-scene perturbations into automated red-teaming pipelines for VLA.