News

• 🎉 2025/11/30: AttackVLA, a unified framework for studying adversarial and backdoor attacks on Visual-Language-Action model (VLA), has been released.

AttackVLA

Table of Contents

• AttackVLA
  • OpenVLA
    • Backdoor Attacks
    • UADA,UPA,TMA
    • RoboGCG
    • FreezeVLA,PGD
  • SpatialVLA
    • Backdoor Attacks and UADA,UPA,TMA
    • RoboGCG
    • FreezeVLA,PGD
  • $\pi_0$-fast
    • Backdoor Attacks and TMA
    • RoboGCG
    • FreezeVLA,PGD

OpenVLA

Backdoor Attacks

Before running backdoor attacks on openvla, please make sure the required environments are properly set up:

• 🧠 Please follow OpenVLA installation instructions to configure the base environment first.

• 🧪 Experiments are conducted in the LIBERO simulation environment. Make sure to install LIBERO and its dependencies as described in their official documentation.

Navigate to the backdoor attack directory:

cd OpenVLA/BackdoorAttack

Training:

bash vla-scripts/run_TAB.sh  #(TabVLA)
bash vla-scripts/run_BadVLA.sh  #(BadVLA)
bash vla-scripts/run_BackdoorVLA.sh #(BackdoorVLA)

Evaluate:

cd experiments/robot/libero
bash run_evaluate_TAB.sh    # Evaluate TabVLA
bash run_evaluate_BadVLA.sh # Evaluate BadVLA
bash run_evaluate.sh    # Evaluate BackdoorVLA on LIBERO-Goal, LIBERO-Object, LIBERO-Spatial
bash run_evaluate_10.sh # Evaluate BackdoorVLA on LIBERO-10

UADA,UPA,TMA

Please follow RoboticAttack installation instructions to configure the base environment first.

Navigate to the UADA,UPA,TMA attack directory:

cd OpenVLA/UADA_UPA_TMA

Adversarial Patch Generation:

bash scripts/run_UADA.sh
bash scripts/run_UPA.sh
bash scripts/run_TMA.sh

Evaluate:

bash scripts/run_simulation.sh

RoboGCG

Please follow RoboGCG installation instructions to configure the base environment first.

Navigate to the RoboGCG attack directory:

cd OpenVLA/robogcg

Running RoboGCG by:

bash run_robogcg.sh

FreezeVLA,PGD

Navigate to the corresponding directory:

cd OpenVLA/FreezeVLA

• create environment by

conda env create -f environment.yml

• You can obtain raw_dataset (for the format of raw_dataset, please refer to PackedDataset) by extracting certain frames from a trajectory replay, and then generate reference prompt from gpt by:

 python generate_ref_prompt.py --save_dir /Your/save_dir --dataset_path /Your/raw_dataset_path

• evaluate PGD or FreezeVLA+GPT by

torchrun --nproc_per_node=1 run_spatialvla_gpt_ddp.py --max_samples 256 --attack pgd
torchrun --nproc_per_node=1 run_spatialvla_gpt_ddp.py --max_samples 256 --attack ours_gpt

SpatialVLA

Backdoor Attacks and UADA,UPA,TMA

Before running backdoor attacks on SpatialVLA, please make sure the required environments are properly set up:

• 🧠 Please follow SpatialVLA installation instructions to configure the base environment first.

• 🧪 Experiments are conducted in the LIBERO simulation environment. Make sure to install LIBERO and its dependencies as described in their official documentation.

Navigate to the SpatialVLA directory:

cd SpatialVLA

Training:

bash finetune_TAB.sh # TabVLA
bash finetune_Badvla_fir.sh #  Trigger Injection Stage of BadVLA
bash finetune_Badvla_sec.sh # Clean Performance Enhancement of BadVLA
bash finetune.sh # BackdoorVLA
bash reproduce_TMA.sh # TMA
bash reproduce_UADA.sh  # UADA
bash reproduce_UPA.sh   # UPA

Evaluate:

cd LIBERO
run_evaluate_TAB.sh     # TabVLA
run_evaluate_Badvla.sh      # BadVLA
run_evaluate.sh     # BackdoorVLA on LIBERO-Goal LIBERO-Object LIBERO-Spatial
run_evaluate_10.sh  # BackdoorVLA on LIBERO-10
run_TMA.sh  # TMA
run_UADA.sh # UADA
run_UPA.sh  # UPA

RoboGCG

Please follow RoboGCG installation instructions to configure the base environment first, and install transformers==4.47.1

Navigate to the corresponding directory:

cd robogcg_spatialvla

Running RoboGCG by:

bash run_robogcg.sh

FreezeVLA,PGD

Navigate to the corresponding directory:

cd FreezeVLA

• create environment by

conda env create -f environment.yml

• You can obtain raw_dataset (for the format of raw_dataset, please refer to PackedDataset) by extracting certain frames from a trajectory replay, and then generate reference prompt from gpt by:

 python generate_ref_prompt.py --save_dir /Your/save_dir --dataset_path /Your/raw_dataset_path

• evaluate PGD or FreezeVLA+GPT by

torchrun --nproc_per_node=1 run_spatialvla_gpt_ddp.py --max_samples 256 --attack pgd
torchrun --nproc_per_node=1 run_spatialvla_gpt_ddp.py --max_samples 256 --attack ours_gpt

$\pi_0$-fast

Backdoor Attacks and TMA

Before running backdoor attacks on $\pi_0$-fast, please make sure the required environments are properly set up:

• 🧠 Please follow Openpi installation instructions to configure the base environment first.

• 🧪 Experiments are conducted in the LIBERO simulation environment. Please follow install instructions in Openpi to configure the simulation environment.

Setup

Navigate to the Pi0-Fast directory:

cd Pi0-Fast

Converting Your dataset (You can define your dataset in the src/openpi/training/config.py) to lerobot format and Computing the normalization statistics of it by:

bash convert_data.sh
bash compute_norm.sh

Training:

bash train_Tab.sh # TabVLA
bash train_BadVLA.sh # BadVLA
bash train.sh # BackdoorVLA
bash train_TMA.sh # TMA

Evaluate(Please run the server in one terminal and conduct evaluation in another terminal):

# TabVLA
bash serve_TabVLA.sh 
bash run_eval_Tab.sh 
# BadVLA
bash serve_BadVLA.sh 
bash run_eval_BadVLA.sh 
# BackdoorVLA
bash serve_BackdoorVLA.sh 
# BackdoorVLA on LIBERO-Goal,LIBERO-Object,LIBERO-Spatial
bash run_eval.sh 
# BackdoorVLA on LIBERO-10 
bash run_eval_10.sh 
# TMA 
python scripts/serve_policy.py --env LIBERO
bash run_eval_TMA.sh  

RoboGCG

Please follow RoboGCG installation instructions to configure the base environment first.

Navigate to the corresponding directory:

cd robogcg_pi0_fast

Running RoboGCG by:

bash run_robogcg.sh

FreezeVLA,PGD

Navigate to the corresponding directory:

cd FreezeVLA

• create environment by

conda env create -f environment.yml

• You can obtain raw_dataset (for the format of raw_dataset, please refer to PackedDataset) by extracting certain frames from a trajectory replay, and then generate reference prompt from gpt by:

 python generate_ref_prompt.py --save_dir /Your/save_dir --dataset_path /Your/raw_dataset_path

• evaluate PGD or FreezeVLA+GPT by

torchrun --nproc_per_node=1 run_pi_gpt_ddp.py --max_samples 256 --attack pgd
torchrun --nproc_per_node=1 run_pi_gpt_ddp.py --max_samples 256 --attack ours_gpt