Bit-flip attacks VLA models: 5 flips crash robot success to 0%

Robots that rely on vision-language-action models to see, reason, and act in the physical world might have a hidden weak spot: their own memory chips. New research shows that bit-flip attacks VLA models can face are not just a theoretical curiosity — a handful of precisely chosen bit corruptions in a quantized model’s weights can push a robot’s task success rate straight down to zero, even though the model looked perfectly fine moments before.

The findings come from a study titled “Bit-Flip Attacks on Vision-Language-Action Models: Action-Decoding Architecture Shapes the Vulnerability,” authored by Yudong Gao, Linghan Chen, Wenhan Wu, Mia Zhou, Jiyao Wang, Kaiyan Ji, Mingyu Guo, and Honglong Chen. It is the first documented bit-flip attack aimed specifically at a VLA system, and it lands at a moment when embodied AI — models that combine language understanding with physical action — is moving quickly from research labs toward real robotic deployment.

Critical Vulnerability of Quantized VLA Models to Rowhammer Bit-Flip Attacks

Quantized VLA models are exposed to a specific kind of hardware-level threat: Rowhammer-style faults that corrupt the INT8 weights a model relies on once it’s compressed for deployment. Quantization is common practice for running large AI models efficiently on robotic hardware, but the researchers found that this same compression step opens a narrow but dangerous fault surface.

… Continue reading the full article at the original source below.