Are Vision-Language-Action Models Robust to One-Step Observation Perturbations?

Shojiro Yamabe; Jun Sakuma

cs.AISep 26, 2026

Are Vision-Language-Action Models Robust to One-Step Observation Perturbations?

Authors: Shojiro Yamabe, Jun Sakuma

Organizations: Science Tokyo · Science Tokyo, RIKEN

Abstract

Understanding the safety risks of vision-language-action (VLA) models is essential for their deployment in the physical world. Existing safety research has mainly considered persistent perturbations that are applied continuously to observations throughout an episode. However, momentary observation corruption, in which observations are severely perturbed only briefly within an episode, remains an underexplored safety threat. To address this gap, this work investigates robustness to one-step perturbations applied at a single time step per episode. Our experiments reveal that these perturbations substantially degrade VLA performance and that their impact depends on the action chunk execution length. Based on them, we propose CARE, which dynamically selects the execution length based on consistency with the previously predicted action chunk. CARE improves robustness with low computational overhead while preserving clean performance by selecting shorter execution lengths only under perturbations.

Figures & tables

Figure 1: Overview. (a) We evaluate VLA robustness to one-step perturbations and observe substantial success rate drops across 40 LIBERO tasks. Corrupted scores average the lowest 10% of success rates across evaluated intervention steps. (b) Adaptive execution length selection based on prediction consistency shortens execution under perturbations to improve robustness.

Figure 2: Eight types of one-step perturbations. Each perturbation corrupts the image input, the state input, or both at a single inference step.

Figure 3: Perturbation timing strongly affects task success. Heatmaps show success rates under data loss on LIBERO-Goal, with black boxes marking task-wise minima.

Model	Clean	Image input				State input			Image + state
Model	Clean	Overexp.	Blackout	Blur	Packet loss	Zero fill	Spike	Random	Data loss
$\pi_{0}$	70.9	53.9 ( $\downarrow 17.0$ )	48.1 ( $\downarrow 22.8$ )	51.4 ( $\downarrow 19.5$ )	50.2 ( $\downarrow 20.7$ )	5.9 ( $\downarrow 65.0$ )	13.8 ( $\downarrow 57.1$ )	19.6 ( $\downarrow 51.3$ )	7.4 ( $\downarrow 63.5$ )
$\pi_{0}$ -FAST	89.8	44.4 ( $\downarrow 45.4$ )	45.0 ( $\downarrow 44.8$ )	36.7 ( $\downarrow 53.1$ )	75.6 ( $\downarrow 14.2$ )	79.7 ( $\downarrow 10.1$ )	72.9 ( $\downarrow 16.9$ )	76.1 ( $\downarrow 13.7$ )	49.5 ( $\downarrow 40.3$ )
$\pi_{0.5}$	97.4	88.0 ( $\downarrow 9.4$ )	45.9 ( $\downarrow 51.5$ )	64.9 ( $\downarrow 32.5$ )	91.1 ( $\downarrow 6.3$ )	90.1 ( $\downarrow 7.3$ )	91.6 ( $\downarrow 5.8$ )	91.0 ( $\downarrow 6.4$ )	47.2 ( $\downarrow 50.2$ )
SmolVLA	82.6	33.3 ( $\downarrow 49.3$ )	34.8 ( $\downarrow 47.8$ )	44.1 ( $\downarrow 38.5$ )	69.5 ( $\downarrow 13.1$ )	53.3 ( $\downarrow 29.3$ )	52.3 ( $\downarrow 30.3$ )	58.5 ( $\downarrow 24.1$ )	15.4 ( $\downarrow 67.2$ )
X-VLA	96.4	90.5 ( $\downarrow 5.9$ )	28.6 ( $\downarrow 67.8$ )	38.5 ( $\downarrow 57.9$ )	41.5 ( $\downarrow 54.9$ )	15.0 ( $\downarrow 81.4$ )	2.8 ( $\downarrow 93.6$ )	10.4 ( $\downarrow 86.0$ )	5.0 ( $\downarrow 91.4$ )

Table 1: Existing VLAs are vulnerable to one-step perturbations. Clean success rate and Bottom10%-SR under each perturbation (%), averaged over 40 tasks on LIBERO.

Figure 4: Execution Length Amplifies Perturbation Effects . Clean success rate and Bottom10%-SR under Data-loss perturbation across execution lengths

H

Model	Method	Clean	Image input				State input			Image + state
Model	Method	Clean	Overexp.	Blackout	Blur	Packet loss	Zero fill	Spike	Random	Data loss
$\pi_{0}$	Vanilla	70.9	53.9	48.1	51.4	50.2	5.9	13.8	19.6	7.4
	RobustVLA	72.2	53.4	52.1	52.8	54.1	10.1	17.2	21.9	6.9
	VLA-Corrector	69.8	54.2	53.0	53.6	54.1	9.8	21.5	24.2	11.5
	AAC	70.1	50.6	49.4	51.1	52.0	10.2	10.6	21.0	9.6
	CARE (ours)	72.5	54.8	52.9	54.0	56.2	51.2	47.4	50.5	53.5

Table 2: CARE improves robustness to one-step observation perturbations across diverse VLA models. Clean success rate and Bottom10%-SR (%,

\uparrow

) across 40 tasks on LIBERO.

	$\pi_{0}$		$\pi_{0}$ -FAST		$\pi_{0.5}$		SmolVLA		X-VLA
Method	Clean	Perturbed	Clean	Perturbed	Clean	Perturbed	Clean	Perturbed	Clean	Perturbed
VLA-Corrector	9.20	9.16	–	–	9.51	9.71	8.60	8.12	8.41	8.29
AAC	18.97	14.81	8.92	9.28	15.51	26.05	19.81	13.52	10.78	9.11
CARE (ours)	8.98	2.22	6.56	1.29	10.53	1.39	10.65	2.45	11.45	1.04

Table 3: CARE selects shorter execution lengths for perturbed observations. Mean selected execution lengths for clean and perturbed observations in data-loss.

Figure 7: Real-world evaluation results. Success rates are averaged over 25 for clean conditions and 15 episodes for perturbed conditions.

Figure 8: Typical failure examples in real-world robot experiments. The top row shows the four task phases before perturbation, and the bottom row shows typical failures following a one-step perturbation in each phase.

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 9: Real-world experimental setup. (a) Workspace overview showing the two follower arms and the leader arms used for teleoperated demonstration collection. The blue dashed boxes mark the block’s start and goal locations and are annotations added to the image. (b) Follower arm with a wrist-mounted Intel RealSense D405 camera.

Figure 10: Perturbation timing analysis by model and suite. Rows show $\pi_{0}$ , $\pi_{0}$ -FAST, $\pi_{0.5}$ , SmolVLA, X-VLA, and their equal-weight average. Columns show LIBERO-Spatial, LIBERO-Object, LIBERO-Goal, and LIBERO-10.

Figure 11: Perturbation timing analysis on Meta-World MT50. Values show success rates under data loss relative to clean performance. Hatching indicates tasks with zero clean success rate. Black boxes mark the timing bins with the lowest relative success rate for each task.

Model	Method	Clean	Bottom10%-SR
Model	Method	Clean	Blur	Random state	Data loss
$\pi_{0}$	Vanilla	71.6	56.9	29.4	23.5
	RobustVLA	47.2	41.0	22.6	21.6
	VLA-Corrector	74.2	59.4	32.6	28.4
	AAC	74.0	62.7	45.5	42.4
	CARE (ours)	76.4	63.0	59.6	58.2

Appendix

Table 4: Clean success rate and Bottom10%-SR (%,

\uparrow

) under one-step observation perturbations on Meta-World MT50. Each task receives 10 episodes per condition. Bold and underlining indicate the highest and second-highest scores within each model, respectively.

Figure 12: Sensitivity to the discrepancy threshold

\tau

. Each panel shows clean success rate and Bottom10%-SR under data loss, averaged over 40 tasks across the four LIBERO suites.

Figure 13: Robustness to multi-step motion blur. Red curves show Bottom10%-SR under Blur at durations of 1, 5, and 10 steps. Success rate is averaged over 40 tasks across the four LIBERO suites, with 10 trials.

Figure 14: Effect of cold start in CARE. Comparison of Vanilla (fixed execution length), an initial-

H=1

variant with

H=15

thereafter, and CARE under data loss. The cold-start-only evaluation covers 40 tasks across four LIBERO suites, with 10 episodes per setting.

Explore similar work

Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models
Jul 20, 2026Tuan Duong Trinh, Naveed Akhtar, Basim AzamNeural Network Robustness Adversarial Attacks on VLA Models
University of Melbourne Parkville, VIC, Australia
Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms
Apr 26, 2026Qi Li, Bo Yin, Weiqi Huang +6AI Agent Safety Adversarial Attacks on VLA Models
National University of Singapore · Peking University · Monash University
Learning What to Say to Your VLA: Mostly Harmless Vision Language Action Model Steering
Jun 10, 2026Hyun Joe Jeong, Gokul Swamy, Andrea BajcsyLanguage Model-Based Control Vision-Language-Action Models
Robotics Institute Carnegie Mellon University

Jul 20, 2026J/K move · Enter open · S save

Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

Tuan Duong Trinh, Naveed Akhtar, Basim Azam

University of Melbourne Parkville, VIC, Australia

Neural Network Robustness Adversarial Attacks on VLA Models Vision-Language-Action Models VLMs for Robotics Robustness of VLA Models Reasoning for VLA Models+1

Open paper AskPDF arXiv

Does adding a reasoning step make a Vision-Language-Action (VLA) model more robust to perturbation? Intuitively, a policy that reasons before acting should absorb a perturbed input better than one that maps observations directly to actions. We test this premise head-on across three models that span the reasoning spectrum (no reasoning, a text chain-of-thought, and a latent iterative loop), perturbing each at the vision, reasoning, and action stages on LIBERO and SimplerEnv. Two questions organize the study: does the reasoning design shift robustness, and can the reasoning be read back at runtime as a safety signal? We find that the latent-iterative model is by far the least robust: under both stochastic noise and white-box perturbation its task success collapses, while the other two hold. This fragility is structural rather than cumulative: varying the reasoning depth at inference barely moves it. Reasoning outputs can in principle be monitored, but the monitors fail under fair tests. A plan--action consistency probe that looks near-perfect under naive evaluation falls to chance under adaptive attack. Under matched-FPR calibration, fusing it with an action-anomaly probe never lifts defended success above undefended. Scoped to these output-level behavioral probes under white-box vision-stage attack, this ceiling is a precondition that any viable defense must first satisfy.

Abstract

Explore similar work

Reasoning as a Double-Edged Sword: Architecture and Cross-Stage Robustness in Vision-Language-Action Models

Vision-Language-Action Safety: Threats, Challenges, Evaluations, and Mechanisms

Learning What to Say to Your VLA: Mostly Harmless Vision Language Action Model Steering