Robotic Manipulation Attack on LIBERO Real-to-Sim BridgeData V2 (test)
100OpenVLA Spatial Success RateVLA-Hijack
Evaluation results
| Method | Links | |||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| VLA-HijackSurrogate Model=OpenVLA-7B2026.05 | 100 | 99.8 | 99.8 | 99.4 | 93.4 | 100 | 17.8 | 82.8 | 26.2 | 13.8 | 11.4 | 19.8 | 63.68 | |
| Arm imageSurrogate Model=OpenVLA-7B2026.05 | 66.2 | 44.4 | 28.8 | 60.8 | 4.8 | 11.2 | 9.4 | 15.8 | 8.2 | 11.4 | 5.2 | 15.2 | 23.45 | |
| TMA7Surrogate Model=OpenVLA-7B2026.05 | 37.8 | 36.8 | 27.8 | 52 | 5.2 | 6 | 8.2 | 8.2 | 15.2 | 10.6 | 5.4 | 15.2 | 19.03 | |
| TMA1−7Surrogate Model=OpenVLA-7B2026.05 | 36.4 | 41.8 | 31.8 | 51.8 | 8 | 9.6 | 9.4 | 14.6 | 16 | 11 | 5.8 | 16 | 21.02 | |
| UADA1Surrogate Model=OpenVLA-7B2026.05 | 32 | 32.4 | 26.8 | 50.8 | 5.2 | 10.4 | 7.8 | 9.6 | 14 | 9.2 | 5.6 | 15.4 | 18.27 | |
| UPA1−3Surrogate Model=OpenVLA-7B2026.05 | 31.2 | 32.4 | 28 | 50.6 | 5.4 | 12.6 | 8.6 | 9 | 15 | 10 | 6 | 15.4 | 18.68 | |
| TMA1−3Surrogate Model=OpenVLA-7B2026.05 | 30.8 | 39 | 30 | 54 | 6.6 | 8.6 | 9.8 | 10.4 | 14 | 9.8 | 4.8 | 14.6 | 19.37 | |
| TMA1Surrogate Model=OpenVLA-7B2026.05 | 30.4 | 38.4 | 31.4 | 51.2 | 4.6 | 10.4 | 8.8 | 13.4 | 13.8 | 8.6 | 5 | 14.2 | 19.18 | |
| UADA1−3Surrogate Model=OpenVLA-7B2026.05 | 29.4 | 36.2 | 28.4 | 49.4 | 4.6 | 11 | 10.4 | 11.4 | 15 | 8.4 | 6.2 | 13.8 | 18.68 | |
| UPA1Surrogate Model=OpenVLA-7B2026.05 | 29 | 34.6 | 25.8 | 48.6 | 5.4 | 11.8 | 9.8 | 9.2 | 14.2 | 10.2 | 6.4 | 15.4 | 18.37 | |
| random NoiseSurrogate Model=OpenVLA-7B2026.05 | 26.8 | 27.4 | 24.6 | 48.6 | 3.8 | 9.6 | 6.6 | 7.4 | 11.8 | 7.6 | 4.6 | 14.2 | 16.08 | |
| BenignSurrogate Model=OpenVLA-7B2026.05 | 16 | 16.8 | 24.2 | 45.2 | 2.4 | 5.6 | 5.2 | 7 | 7.4 | 7.6 | 4.2 | 13.8 | — |