Robot Manipulation on LIBERO Goal
3Failure Rate (FR)pi_0.5
Evaluation results
| Method | Links | ||||||
|---|---|---|---|---|---|---|---|
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 3 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 3 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 3.8 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 5 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 5 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 9 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 14 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 15 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 18 | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 20.8 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 22 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 22 | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 30 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 30 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 31 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 32 | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 34 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 40 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 44 | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 45 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 58 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 58 | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 59 | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 60 | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 67 | — | — | — | — | — | |
| Tex3DTarget Model=$π_{0.5}$, Attack Setting=Untargeted Attack2026.04 | 69.7 | — | — | — | 67.7 | — | |
| Tex3DTarget Model=$π_0$, Attack Setting=Untargeted Attack2026.04 | 70.3 | — | — | — | 65.1 | — | |
| Tex3DTarget Model=$π_{0.5}$, Attack Setting=Targeted Attack2026.04 | 71.3 | — | — | — | 69.3 | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 72 | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 73 | — | — | — | — | — | |
| Tex3DTarget Model=$π_0$, Attack Setting=Targeted Attack2026.04 | 73.4 | — | — | — | 68.2 | — | |
| Tex3DTarget Model=OpenVLA-OFT, Attack Setting=Untargeted Attack2026.04 | 76.8 | — | — | — | 73 | — | |
| Tex3DTarget Model=OpenVLA-OFT, Attack Setting=Targeted Attack2026.04 | 79.8 | — | — | — | 76 | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 83 | — | — | — | — | — | |
| Tex3DTarget Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 84.8 | — | — | — | 61.2 | — | |
| Tex3DTarget Model=OpenVLA, Attack Setting=Targeted Attack2026.04 | 86.9 | — | — | — | 63.3 | — | |
| Adversarial-VLAModel Architecture=OpenVLA-7B2026.01 | — | 90.6 | 76.4 | 19 | — | — | |
| BadNetModel Architecture=OpenVLA-7B2026.01 | — | 91.5 | 78.5 | 17.1 | — | — | |
| BadVLAModel Architecture=OpenVLA-7B2026.01 | — | 75.5 | 67.8 | 22.9 | — | — | |
| BadVLAModel Architecture=pi0.52026.01 | — | 89.8 | 20.4 | 72.5 | — | — | |
| BadVLATrigger Type=White Pixel2026.03 | — | 95.3 | — | 100 | — | — | |
| BadVLATrigger Type=Object State2026.03 | — | 94.4 | — | 11.2 | — | — | |
| BadVLATrigger Type=Scene Semantic2026.03 | — | 94.5 | — | 11.7 | — | — | |
| Baseline (π0 libero)2026.03 | — | 95.8 | — | — | — | — | |
| FlowHijack (IP)Trigger Type=White Pixel2026.03 | — | 95.6 | — | 93.1 | — | — | |
| FlowHijack (IP)Trigger Type=Object State2026.03 | — | 97.8 | — | 100 | — | — | |
| FlowHijack (IP)Trigger Type=Scene Semantic2026.03 | — | 94.9 | — | 100 | — | — | |
| FlowHijack (PL)Trigger Type=White Pixel2026.03 | — | 92.4 | — | 96.7 | — | — | |
| FlowHijack (PL)Trigger Type=Object State2026.03 | — | 94 | — | 100 | — | — | |
| FlowHijack (PL)Trigger Type=Scene Semantic2026.03 | — | 94.4 | — | 97.8 | — | — | |
| INFUSEModel Architecture=OpenVLA-7B2026.01 | — | 94 | 5 | 93.3 | — | — | |
| INFUSEModel Architecture=pi0.52026.01 | — | 89.4 | 9 | 82.8 | — | — | |
| Normal ModelModel Architecture=OpenVLA-7B2026.01 | — | 95.5 | 95.5 | — | — | — | |
| Normal ModelModel Architecture=pi0.52026.01 | — | 98 | 97.8 | — | — | — | |
| TMAPrefix Length (K)=102026.06 | — | — | — | — | — | 59.1 | |
| TMAPrefix Length (K)=202026.06 | — | — | — | — | — | 59 | |
| TMAPrefix Length (K)=302026.06 | — | — | — | — | — | 69.3 | |
| TMAPrefix Length (K)=402026.06 | — | — | — | — | — | 73.7 | |
| Two-Phase FrameworkPrefix Length (K)=102026.06 | — | — | — | — | — | 67.2 | |
| Two-Phase FrameworkPrefix Length (K)=202026.06 | — | — | — | — | — | 75.7 | |
| Two-Phase FrameworkPrefix Length (K)=302026.06 | — | — | — | — | — | 79.6 | |
| Two-Phase FrameworkPrefix Length (K)=402026.06 | — | — | — | — | — | 83.9 | |
| UADAPrefix Length (K)=102026.06 | — | — | — | — | — | 56 | |
| UADAPrefix Length (K)=202026.06 | — | — | — | — | — | 57.1 | |
| UADAPrefix Length (K)=302026.06 | — | — | — | — | — | 74.4 | |
| UADAPrefix Length (K)=402026.06 | — | — | — | — | — | 75.8 | |
| UPAPrefix Length (K)=102026.06 | — | — | — | — | — | 55 | |
| UPAPrefix Length (K)=202026.06 | — | — | — | — | — | 60.4 | |
| UPAPrefix Length (K)=302026.06 | — | — | — | — | — | 71 | |
| UPAPrefix Length (K)=402026.06 | — | — | — | — | — | 69.4 |