UPA-RFAS

Official code repository for our CVPR 2026 accepted paper "When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models".

---

UPA-RFAS is a research code release for patch-based adversarial attacks against vision-language-action policies, with an OpenVLA / OpenVLA-OFT evaluation pipeline on LIBERO.

This repository contains:

• adversarial patch optimization code
• OpenVLA-OFT evaluation scripts for LIBERO
• released adversarial patches
• demo videos for simulated and physical settings

Demo Videos

GitHub renders GIF previews directly in the repository homepage. Click any preview below to open the corresponding MP4 file.

Benign

Real-world Attacks

Baseline

Attacks in Simulated setting

Attacks in physical setting

Project Structure

.
├── adversarial_patches/      # released patch checkpoints used for evaluation
├── figs/                     # figures for the project page / README
├── openvla-oft/              # OpenVLA-OFT-based evaluation code
├── videos/                   # demo videos shown in the README
├── white_patch/              # attack and patch optimization modules
├── trans.py                  # training entry for adversarial patch optimization
└── sbatch_train.sh           # example training script

Requirements

This codebase is built on top of roboticAttack and openvla-oft.

Please prepare the environment by following those upstream repositories first, especially:

• Python / PyTorch / CUDA setup from openvla-oft
• LIBERO installation
• OpenVLA or OpenVLA-OFT checkpoint access
• optional dlimp dependency if your local setup requires it

Released Patches

The following patch checkpoints are included in this repository:

• adversarial_patches/patch_sim_v1.pt
• adversarial_patches/patch_sim_v2.pt
• adversarial_patches/patch_phy.pt

They can be passed directly to --patch_path during evaluation.

Training

trans.py is the main entry for adversarial patch optimization.

Example:

bash sbatch_train.sh

The provided script is a cleaned slurm-based public template. Adjust the dataset path, environment name, and cluster options to match your machine.

Training data is resolved from either:

• --server /path/to/project_root and then ${server}/openvla-main/dataset
• or the environment variable OPENVLA_DATA_ROOT

Evaluation on LIBERO

We provide a concise OpenVLA-OFT evaluation script in openvla-oft/sbatch_test.sh.

Example:

cd openvla-oft
bash sbatch_test.sh

The script evaluates released adversarial patches on multiple LIBERO task suites with OpenVLA-OFT checkpoints from Hugging Face, and the default patch_path now points to files under adversarial_patches/.

For a single run, you can also call the evaluator directly:

cd openvla-oft
python experiments/robot/libero/run_libero_eval.py \
  --pretrained_checkpoint moojink/openvla-7b-oft-finetuned-libero-spatial \
  --task_suite_name libero_spatial \
  --patch_path ../adversarial_patches/patch_sim_v1.pt

Acknowledgment

This repository builds upon:

• roboticAttack
• openvla-oft
• OpenVLA
• LIBERO

We thank the original authors for open-sourcing their code and models.

Citation

If you find our work helpful, please consider citing:

@article{lu2025when,
  title={When Robots Obey the Patch: Universal Transferable Patch Attacks on Vision-Language-Action Models},
  author={Lu, Hui and Yu, Yi and Yang, Yiming and Yi, Chenyu and Zhang, Qixin and Shen, Bingquan and Kot, Alex C. and Jiang, Xudong},
  journal={arXiv preprint arXiv:2511.21192},
  year={2025}
}