# RedVLA: Physical Red Teaming for Vision-Language-Action Models Source: [RedVLA: Physical Red Teaming for Vision-Language-Action Models]() Collection index: [llms.txt]() Data updated: 2026-04-28T05:00:04.744Z Authors: Yuhao Zhang, Borong Zhang, Jiaming Fan, Jiachen Shen, Yishuai Cai, Yaodong Yang, Jiaming Ji Published: 2026-04-24T14:18:23.000Z ## Abstract The real-world deployment of Vision-Language-Action (VLA) models remains limited by the risk of unpredictable and irreversible physical harm. However, we currently lack effective mechanisms to proactively detect these physical safety risks before deployment. To address this gap, we propose \\textbf{RedVLA}, the first red teaming framework for physical safety in VLA models. We systematically uncover unsafe behaviors through a two-stage process: (I) \\textbf{Risk Scenario Synthesis} constructs a valid and task-feasible initial risk scene. Specifically, it identifies critical interaction regions from benign trajectories and positions the risk factor within these regions, aiming to entangle it with the VLA's execution flow and elicit a target unsafe behavior. (II) \\textbf{Risk Amplification} ensures stable elicitation across heterogeneous models. It iteratively refines the risk factor state through gradient-free optimization guided by trajectory features. Experiments on six representative VLA models show that RedVLA uncovers diverse unsafe behaviors and achieves the ASR up to 95.5\\% within 10 optimization iterations. To mitigate these risks, we further propose SimpleVLA-Guard, a lightweight safety guard built from RedVLA-generated data. Our data, assets, and code are available \\href{https://redvla.github.io}{here}. ## Recorded benchmark results A research result applies to its stated dataset, split, metric and evaluation configuration. Compare like-for-like settings, preserve the metric's unit and direction, and distinguish paper-reported results from independent reproduction. The best result recorded here is not a claim of exhaustive, current global coverage. - [Offline Physical Risk Detection on LIBERO-Long (Seen Tasks)](): Offline Physical Risk Detection; LIBERO-Long (Seen Tasks); PRC-AUC: 94. - [Offline Physical Risk Detection on LIBERO Long (Unseen Tasks)](): Offline Physical Risk Detection; LIBERO Long (Unseen Tasks); PRC-AUC: 0.89. - [Online Physical Risk Defense on LIBERO Long (Seen Tasks)](): Online Physical Risk Defense; LIBERO-Long (Seen Tasks); ASR without Guard: 90.9. - [Online Physical Risk Defense on LIBERO Long (Unseen Tasks)](): Online Physical Risk Defense; LIBERO Long (Unseen Tasks); ASR w/o Guard: 98.3. - [Physical Red Teaming on RedVLA Conditional-Level Scenarios](): Physical Red Teaming; RedVLA Conditional-Level Scenarios; ASR: not recorded. - [Physical Red Teaming on RedVLA State-Level Scenarios](): Physical Red Teaming; RedVLA State-Level Scenarios; Attack Success Rate (ASR): not recorded. - [Physical Red Teaming on RedVLA Cumulative-Level Scenarios](): Physical Red Teaming; RedVLA Cumulative-Level Scenarios; Attack Success Rate (ASR): not recorded. ## Original sources and implementation [Original paper]() [PDF]()