跳转至

视觉-语言-动作模型的比特翻转攻击：动作解码架构决定漏洞脆弱性

文章背景与核心概要

随着具身智能系统的快速发展，量化后的视觉-语言-动作（VLA）模型在真实世界中得到了广泛部署。然而，这也暴露出了一个关键的安全隐患：Rowhammer式的硬件故障可能会破坏INT8权重。本文展示了针对VLA模型的首个成功比特翻转攻击（BFA），证明了只需通过梯度选择少量比特翻转，就能将闭环成功率降至0%，而数百个随机翻转则完全无害。

研究揭示，模型的脆弱性在很大程度上取决于底层的动作解码架构。直接回归和标记（token）策略极其脆弱，仅需1到5次定向翻转就会崩溃；而流匹配（flow-matching）策略则需要更大的攻击预算（约100到300次翻转），这可以通过固定方向的流形逃逸损失（manifold-escape loss）进一步优化。在真实机器人上进行的任务校准仿真攻击证实，权重完整性构成了具身基础模型至关重要的安全边界，与干净的基线运行相比，攻击会导致完全的任务失败（0/20成功率）。

核心摘要 (Executive Summary)

Quantized Vision-Language-Action (VLA) models deployed in real-world embodied AI systems expose a critical security vulnerability: Rowhammer-style hardware faults can corrupt INT8 weights. This research presents the first successful bit-flip attack (BFA) on a VLA model, demonstrating that just a few gradient-selected bit flips can reduce closed-loop success rates to \(0\%\), while hundreds of random flips remain entirely harmless.

量化后的视觉-语言-动作（VLA）模型在真实世界的具身AI系统中部署时，暴露出了一个关键的安全漏洞：Rowhammer式的硬件故障可能会损坏INT8权重。这项研究展示了针对VLA模型的首个成功比特翻转攻击（BFA），证明了只需进行几次梯度选择的比特翻转，就能将闭环成功率降至\(0\%\)，而数百次随机翻转则完全无害。

The study reveals that vulnerability is heavily shaped by the underlying action-decoding architecture: * Direct regression and token policies are extremely fragile, collapsing with only \(1\text{--}5\) targeted flips. * Flow-matching policies require a larger budget (\(\sim\!\!100\text{--}300\) flips), which can be further optimized via a fixed-direction manifold-escape loss. * Task-calibrated emulated attacks on real robots confirm that weight integrity forms a vital security boundary for embodied foundation models, resulting in complete task failure (\(0/20\) successes) compared to clean baseline runs.

该研究表明，漏洞的脆弱性很大程度上由底层的动作解码架构所决定： * 直接回归与标记（token）策略极为脆弱，仅需\(1\text{--}5\)次定向翻转就会崩溃。 * 流匹配（flow-matching）策略需要更大的预算（\(\sim\!\!100\text{--}300\)次翻转），这可以通过固定的方向流形逃逸损失进一步优化。 * 在真实机器人上进行的任务校准仿真攻击证实，权重完整性构成了具身基础模型至关重要的安全边界，与干净的基线运行相比，攻击会导致彻底的任务失败（成功率为\(0/20\)）。

论文元数据 (Paper Metadata)

  • arXiv ID: arXiv:2608.15475 [cs.CR]
  • Primary Subjects: Cryptography and Security (cs.CR), Artificial Intelligence (cs.AI)
  • Submission Date: August 16, 2026
  • Authors: Yudong Gao, Linghan Chen, Wenhan Wu, Mia Zhou, Jiyao Wang, Kaiyan Ji, Mingyu Guo, Honglong Chen
  • Resources: View PDF | HTML Version | Ancillary Code Repository
  • arXiv ID: arXiv:2608.15475 [cs.CR]
  • 主要学科: 密码学与安全 (cs.CR)、人工智能 (cs.AI)
  • 提交日期: 2026年8月16日
  • 作者: Yudong Gao, Linghan Chen, Wenhan Wu, Mia Zhou, Jiyao Wang, Kaiyan Ji, Mingyu Guo, Honglong Chen
  • 相关资源: 查看 PDF | HTML 版本 | 辅助代码仓库

摘要 (Abstract)

Quantized Vision-Language-Action (VLA) models expose a weight-fault surface: Rowhammer-style faults can corrupt deployed INT8 bits. We present the first bit-flip attack on a VLA: a few gradient-selected flips reduce closed-loop success to \(0\%\), while hundreds of random flips are harmless.

量化后的视觉-语言-动作（VLA）模型暴露出了权重故障面：Rowhammer式的故障会损坏部署的INT8比特。我们提出了针对VLA的首个比特翻转攻击：几次梯度选择的翻转就能将闭环成功率降至\(0\%\)，而数百次随机翻转则毫无影响。

Across four model variants spanning three action-head families, damaging bits concentrate in a few action-generating layers, but the empirical budget depends sharply on the head: direct regression and token policies fall in \(1\text{--}5\) flips, whereas the evaluated flow-matching policies require \(\sim\!\!100\text{--}300\). Our fixed-direction manifold-escape loss cuts \(\pi_0\)'s budget from \(\sim\!\!1000\) to \(\sim\!\!100\) flips, and a matched five-direction sweep shows that the attack is not specific to an all-positive direction.

在跨越三个动作头（action-head）系列的四种模型变体中，破坏性比特集中在少数几个生成动作的层中，但经验预算高度取决于动作头：直接回归和标记策略只需\(1\text{--}5\)次翻转，而被评估的流匹配策略则需要\(\sim\!\!100\text{--}300\)次。我们的固定方向流形逃逸损失将 \(\pi_0\) 的预算从 \(\sim\!\!1000\) 次减少到 \(\sim\!\!100\) 次翻转，并且匹配的五个方向扫描表明该攻击并不局限于全正方向。

On a direct head, protecting \(3.1\%\) of weights preserves \(60\%\) success at \(K=100\), and protecting \(5.3\%\) moves the open-loop break threshold from 3 to 100 flips. Finally, task-calibrated emulated \(K=100\) flips yield \(0/20\) real-robot successes, versus \(14/20\) clean and \(16/20\) global-random. Weight integrity is therefore a security boundary for embodied foundation models. Code is included as ancillary material.

在直接回归头上，保护 \(3.1\%\) 的权重可在 \(K=100\) 时保持 \(60\%\) 的成功率，而保护 \(5.3\%\) 的权重则将开环破坏阈值从 3 次翻转提升至 100 次。最后，经过任务校准的 \(K=100\) 仿真翻转在真实机器人上取得了 \(0/20\) 的成功率，而干净基线为 \(14/20\)，全局随机翻转为 \(16/20\). 因此，权重完整性是具身基础模型的一道安全边界。代码作为辅助材料一并提供。

核心发现与架构洞察 (Key Findings & Architecture Insights)

  1. Architecture-Dependent Vulnerability: Different action-decoding heads exhibit drastically different failure thresholds under targeted weight perturbation. Direct regression and token-based policies break almost instantly (\(1\text{--}5\) flips), whereas flow-matching policies demand higher resource budgets (\(\sim\!\!100\text{--}300\) flips).

    1. 架构决定的脆弱性： 在目标权重扰动下，不同的动作解码头表现出截然不同的失效阈值。直接回归和基于标记的策略几乎瞬间崩溃（\(1\text{--}5\)次翻转），而流匹配策略则需要更高的资源预算（\(\sim\!\!100\text{--}300\)次翻转）。

  2. Localization of Faults: Damaging bit-flips are not uniformly distributed across the network; instead, they heavily concentrate within specific action-generating layers.

    1. 故障的局部化： 具有破坏性的比特翻转在网络中并非均匀分布；相反，它们高度集中在特定的动作生成层中。

  3. Defense & Mitigation: Strategic protection of a small fraction of model weights (e.g., safeguarding \(3.1\%\text{--}5.3\%\) of critical weights) drastically increases the resilience of the open-loop break threshold.

    1. 防御与缓解： 对一小部分模型权重进行战略性保护（例如，保护 \(3.1\%\text{--}5.3\%\) 的关键权重）可以极大地增强开环破坏阈值的韧性。

  4. Real-World Impact: Physical experiments on robotic hardware demonstrate that memory corruption via targeted bit-flips completely disables successful task execution, validating that hardware-level weight integrity is an urgent security concern for robotics.

    1. 现实世界的影响： 在机器人硬件上的物理实验表明，通过定向比特翻转造成的内存损坏会完全瘫痪成功的任务执行，这验证了硬件级别的权重完整性是机器人技术中一个迫切的安全问题。