Robot Manipulation on LIBERO Spatial
2Failure Rate (FR)pi_0.5
Evaluation results
| Method | Links | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 2 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 3.8 | — | — | — | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 4 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 5 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 11 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 11 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 12 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 12 | — | — | — | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 12 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Clean2025.09 | 15.3 | — | — | — | — | — | — | — | — | |
| No AttackTarget Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 15.6 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 17 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 17 | — | — | — | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 17 | — | — | — | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 18 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Rand.2025.09 | 23 | — | — | — | — | — | — | — | — | |
| GaussianTarget Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 24.6 | — | — | — | — | 9 | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Rand.2025.09 | 28 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 36 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 40 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 45 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Rand.2025.09 | 48 | — | — | — | — | — | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 50 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Illum., Search Strategy=Best2025.09 | 55 | — | — | — | — | — | — | — | — | |
| OpenVLA-OFTEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 56 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 60 | — | — | — | — | — | — | — | — | |
| OpenVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 71 | — | — | — | — | — | — | — | — | |
| Tex3DTarget Model=$π_{0.5}$, Attack Setting=Untargeted Attack2026.04 | 71.8 | — | — | — | — | 70.6 | — | — | — | |
| Tex3DTarget Model=$π_{0.5}$, Attack Setting=Targeted Attack2026.04 | 72.9 | — | — | — | — | 71.7 | — | — | — | |
| Tex3DTarget Model=$π_0$, Attack Setting=Untargeted Attack2026.04 | 74.9 | — | — | — | — | 71.4 | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=Adv. Patch, Search Strategy=Best2025.09 | 75 | — | — | — | — | — | — | — | — | |
| Single-frameTarget Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 75.1 | — | — | — | — | 59.5 | — | — | — | |
| Tex3DTarget Model=$π_0$, Attack Setting=Targeted Attack2026.04 | 75.9 | — | — | — | — | 72.4 | — | — | — | |
| Tex3DTarget Model=OpenVLA-OFT, Attack Setting=Untargeted Attack2026.04 | 78.6 | — | — | — | — | 74.8 | — | — | — | |
| Vertex Param.Target Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 80.5 | — | — | — | — | 64.9 | — | — | — | |
| Tex3DTarget Model=OpenVLA-OFT, Attack Setting=Targeted Attack2026.04 | 80.9 | — | — | — | — | 77.1 | — | — | — | |
| Tex+Temp.Target Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 90.3 | — | — | — | — | 74.7 | — | — | — | |
| Tex3DTarget Model=OpenVLA, Attack Setting=Untargeted Attack2026.04 | 95.8 | — | — | — | — | 80.2 | — | — | — | |
| Tex3DTarget Model=OpenVLA, Attack Setting=Targeted Attack2026.04 | 96.7 | — | — | — | — | 81.1 | — | — | — | |
| UniVLAEvaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 98 | — | — | — | — | — | — | — | — | |
| pi_0.5Evaluation Protocol=fine-tuned, Perturbation Type=3D Trans., Search Strategy=Best2025.09 | 98 | — | — | — | — | — | — | — | — | |
| Adversarial-VLAModel Architecture=OpenVLA-7B2026.01 | — | 94.7 | 70.5 | 26.1 | — | — | — | — | — | |
| ATAATScenario=Data Poisoning (Implicit De-confliction)2026.05 | — | — | — | — | 88.8 | — | — | 83.5 | — | |
| ATAATScenario=Fine-tuning Poisoning (Explicit De-confliction)2026.05 | — | — | — | — | 78.1 | — | — | 72.5 | — | |
| BadNetModel Architecture=OpenVLA-7B2026.01 | — | 92.5 | 91 | 5.2 | — | — | — | — | — | |
| BadNetScenario=Data Poisoning (Implicit De-confliction)2026.05 | — | — | — | — | 4.5 | — | — | 0.8 | — | |
| BadNet (Fine-tune)Scenario=Fine-tuning Poisoning (Explicit De-confliction)2026.05 | — | — | — | — | 9.1 | — | — | 6.4 | — | |
| BadVLAModel Architecture=OpenVLA-7B2026.01 | — | 92.4 | 54 | 41.8 | — | — | — | — | — | |
| BadVLAModel Architecture=pi0.52026.01 | — | 91.6 | 56.2 | 39.5 | — | — | — | — | — | |
| BadVLATrigger Type=White Pixel2026.03 | — | 96.1 | — | 100 | — | — | — | — | — | |
| BadVLATrigger Type=Object State2026.03 | — | 95.1 | — | 13.4 | — | — | — | — | — | |
| BadVLATrigger Type=Scene Semantic2026.03 | — | 95.3 | — | 15.3 | — | — | — | — | — | |
| BadVLA (Adapted)Scenario=Data Poisoning (Implicit De-confliction)2026.05 | — | — | — | — | 17.5 | — | — | 13.1 | — | |
| BadVLA (Adapted)Scenario=Fine-tuning Poisoning (Explicit De-confliction)2026.05 | — | — | — | — | 52.1 | — | — | 39.2 | — | |
| BASEChunk Size=82026.04 | — | — | — | — | 93 | — | 1 | — | — | |
| BASEChunk Size=642026.04 | — | — | — | — | 68 | — | 3.22 | — | — | |
| Baseline (π0 libero)2026.03 | — | 96.8 | — | — | — | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=5k2026.05 | — | — | — | — | 53.8 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=10k2026.05 | — | — | — | — | 79.2 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=15k2026.05 | — | — | — | — | 81.6 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=20k2026.05 | — | — | — | — | 83 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=30k2026.05 | — | — | — | — | 88.4 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=40k2026.05 | — | — | — | — | 89 | — | — | — | — | |
| BlockVLAType=Block Diffusion, Training Steps=50k2026.05 | — | — | — | — | 90.6 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=5k2026.05 | — | — | — | — | 48 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=10k2026.05 | — | — | — | — | 56.8 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=15k2026.05 | — | — | — | — | 68.4 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=20k2026.05 | — | — | — | — | 81 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=30k2026.05 | — | — | — | — | 88.2 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=40k2026.05 | — | — | — | — | 87.2 | — | — | — | — | |
| DDVLAType=Discrete Diffusion, Training Steps=50k2026.05 | — | — | — | — | 89.8 | — | — | — | — | |
| DEFLECTdelay (d)=12026.05 | — | — | — | — | — | — | — | — | 96.8 | |
| DEFLECTdelay (d)=22026.05 | — | — | — | — | — | — | — | — | 98.2 | |
| DEFLECTdelay (d)=32026.05 | — | — | — | — | — | — | — | — | 97.4 | |
| DEFLECTdelay (d)=42026.05 | — | — | — | — | — | — | — | — | 95 | |
| DEFLECTdelay (d)=52026.05 | — | — | — | — | — | — | — | — | 90 | |
| DEFLECTdelay (d)=62026.05 | — | — | — | — | — | — | — | — | 82 | |
| DEFLECTdelay (d)=72026.05 | — | — | — | — | — | — | — | — | 74.2 | |
| DyQ-VLAType=Dyn., Prec.=W4AX, Spd.=1.51×, Mem. (GB)=4.72026.03 | — | — | — | — | 84.7 | — | — | — | — | |
| FlowHijack (IP)Trigger Type=White Pixel2026.03 | — | 96.3 | — | 91.1 | — | — | — | — | — | |
| FlowHijack (IP)Trigger Type=Object State2026.03 | — | 96 | — | 91.1 | — | — | — | — | — | |
| FlowHijack (IP)Trigger Type=Scene Semantic2026.03 | — | 96.7 | — | 100 | — | — | — | — | — | |
| FlowHijack (PL)Trigger Type=White Pixel2026.03 | — | 95.6 | — | 88.9 | — | — | — | — | — | |
| FlowHijack (PL)Trigger Type=Object State2026.03 | — | 95.8 | — | 73.3 | — | — | — | — | — | |
| FlowHijack (PL)Trigger Type=Scene Semantic2026.03 | — | 96 | — | 100 | — | — | — | — | — | |
| FP ModelType=Stat., Prec.=BF16, Spd.=1.00×, Mem. (GB)=15.22026.03 | — | — | — | — | 84.7 | — | — | — | — | |
| INFUSEModel Architecture=OpenVLA-7B2026.01 | — | 95.6 | 2 | 96.6 | — | — | — | — | — | |
| INFUSEModel Architecture=pi0.52026.01 | — | 92 | 20.6 | 73.5 | — | — | — | — | — | |
| Latent-PoisoningScenario=Data Poisoning (Implicit De-confliction)2026.05 | — | — | — | — | 13.6 | — | — | 10.1 | — | |
| Normal ModelModel Architecture=OpenVLA-7B2026.01 | — | 96.9 | 96.2 | — | — | — | — | — | — | |
| Normal ModelModel Architecture=pi0.52026.01 | — | 98.8 | 98 | — | — | — | — | — | — | |
| OpenVLAType=Autoregressive2026.05 | — | — | — | — | 84.7 | — | — | — | — | |
| QVLAType=Stat., Prec.=W4A4, Spd.=1.53×, Mem. (GB)=4.32026.03 | — | — | — | — | 84.4 | — | — | — | — | |
| SmoothQuantType=Stat., Prec.=W4A4, Spd.=1.59×, Mem. (GB)=4.72026.03 | — | — | — | — | 69.2 | — | — | — | — | |
| Speculative DecodingChunk Size=42026.04 | — | — | — | — | 85.8 | — | 1.28 | — | — | |
| SV-VLAChunk Size=642026.04 | — | — | — | — | 83 | — | 2.49 | — | — | |
| VLASHdelay (d)=12026.05 | — | — | — | — | — | — | — | — | 97 | |
| VLASHdelay (d)=22026.05 | — | — | — | — | — | — | — | — | 96 | |
| VLASHdelay (d)=32026.05 | — | — | — | — | — | — | — | — | 95.4 | |
| VLASHdelay (d)=42026.05 | — | — | — | — | — | — | — | — | 91.8 |