DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack

arXiv:2608.03207 · cs.CV, cs.LG · Submitted 2026-08-04 · Read on arXiv

Listen

Transcript

Introduction to the show: ident: AI Radio. Generated commentary on the latest Artificial Intelligence papers.

Tom: Today's paper: "DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack".

Jane: The gist: DRIFT introduces Denoising Redirection via Input perturbation of the Flow-matching Trajectory,

Tom: First, who's behind it and why it matters.

Title and authors: Tom: So we're diving into this paper now called "DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack." It sounds pretty technical, but basically, they’re showing how to mess with the robot models used in these vision language action systems.

Jane: Right. So we have these models like pi zero that figure out what action to take by following a path through a denoising velocity field. The authors are saying this path is actually more vulnerable than people thought, and they’ve created something called DRIFT to exploit that weakness.

Lu: What's interesting is that they show how this attack works by placing a small adversarial patch on the robot's gripper and perturbing the very first step of that denoising trajectory. They are calling it Denoising Redirection via Input perturbation of the Flow-matching Trajectory >

Meng: So, if I understand correctly, instead of trying to mess up every single step along that whole path, they found that only attacking the first one is actually better and cheaper for the attacker >

Tom: Exactly. They discovered this counterintuitive thing where attacking only the first step is both stronger and cheaper than attacking a wider window of steps. They explain this by pointing out a gradient conflict specific to how input space optimization works, which is different from what happens during training time >

Jane: That gradient conflict means that the early and late steps of the attack actually cancel each other out when they add up, but the first step's gradient stays aligned with its neighbors, making it much more effective >

Lalam: From an AI perspective, this suggests that for models running at test time on a frozen policy, we should focus on keeping the integrity of those initial steps intact because that’s where the vulnerability is most pronounced >

Tom: It's not just a small trick; they show this attack breaks essentially all originally solvable tasks across four different suites like LIBERO, and it does this with just one small patch >

Lu: And the numbers are pretty telling. On pi zero and pi zero point five, DRIFT breaks basically everything that was previously solvable in those tests >

Meng: It’s not just breaking tasks; they also found that the attack causes a "phantom grasp," meaning the robot closes its gripper almost immediately, even when it shouldn't be grasping anything >

Jane: That phantom grasp is a cool way to visualize what happens when you mess with the trajectory, because it shows the policy doing something totally unintended >

Tom: And they also looked at how much attention these models pay to the object they're supposed to be reaching for, and they found that under the patch, attention concentrates twenty-eight to thirty-three percent more than usual on that bowl token across the first three steps of a failed rollout >

Lu: That’s a significant increase in attention, and it shows precisely where the model is getting confused when it's being steered by this adversarial input >

Meng: From an engineering standpoint, they also showed how you can defend against this kind of manipulation using JPEG compression as a baseline defense, which works reasonably well for spatial and goal tasks when the quality drops below fifty to sixty >

Jane: So it’s not all bad news; there is a practical mitigation strategy for simpler tasks, which suggests that applying some compression might be a cheap way to keep things running smoothly >

Tom: But they also pointed out a limitation. They noted that while JPEG compression helps on simpler tasks, it doesn't work as well for the long-horizon tasks in the Long suite when you push the quality down >

Lu: That’s an important caveat. It confirms that this early-step vulnerability is a shared property of flow matching models, but the specific way to exploit it depends on which model you are using >

Meng: So for practical deployment, this means we need to think about how we secure those initial trajectory steps, because attacking them is easier and requires less effort from an adversary >

Jane: Exactly. We might be able to harden the system by focusing our defensive efforts on preserving the integrity of those first few actions before the policy even gets deep into the task >

Tom: So, to wrap up on this paper called "DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack," they’ve shown that test-time attacks can be very effective when they exploit a specific gradient conflict in input space optimization >

Lu: It really shows how we can understand the dynamics of these models better by looking at how the trajectory actually evolves step by step >

Meng: We need to keep an eye on this because if adversaries can reliably target just the first step, then securing those initial inputs becomes a priority for building safer AI systems >

Lalam: And from a cultural view, understanding these vulnerabilities helps us build trust in these complex vision language action systems because we see exactly where the failure mode is happening >

The paper's summary: Tom: So we're talking about DRIFT now, which is this test-time universal adversarial patch that messes with how these flow matching vision language action models work >

Jane: Yeah, essentially they’ve figured out a way to derail the denoising velocity field of an off-the-shelf policy just by putting a small sticker on the robot's gripper >

Tom: The core idea is that you don't need to attack every single step along the trajectory to make it fail; you only have to mess with the very first step >

Jane: That’s actually counterintuitive because attacking just that one initial step is both stronger and cheaper for the attacker than trying to attack a whole window of steps >

Tom: The reason they found this is due to some specific gradient conflict that happens in input-space optimization, where the early and late steps actually cancel each other out when you add them up >

Jane: So, it's like if you try to push the trajectory in one direction but then immediately push it back in the opposite direction later on, only messing with the start is more effective >

Tom: Exactly. The first step’s gradient stays aligned with its immediate neighbors, but it turns completely anti-aligned with the latest steps, and that misalignment gets worse as you move further down the path >

Jane: And this single-step attack requires only one forward and backward pass through the velocity field per iteration, which makes it much faster to run than a full trajectory attack >

Tom: The results are pretty wild. DRIFT breaks essentially all originally solvable tasks on models like pi zero across four different test suites, far outperforming other action and embedding space attacks with the same amount of patch size used >

Jane: It even hits the highest measure of task failure, which shows that it’s not just about getting a wrong answer; it’s about derailing the entire intended behavior >

Tom: They found a specific failure mode called a "phantom grasp," where under the patch, the policy commands the gripper to close almost immediately, way before it even gets near an object >

Jane: And that phantom grasp is interesting because they showed that under this attack, attention on the object token actually increases eight or nine times over chance across those first three steps >

Tom: That means you can actually probe these models internally by seeing where their attention goes when they're being pushed off course, and it’s not always to the right place >

Jane: It also gives us some practical defense ideas; they showed that applying a certain level of JPEG compression can block this attack for simpler tasks like spatial or goal-based ones >

Tom: But there’s a catch there too; that JPEG defense doesn't work as well on the longer horizon tasks, which is something engineers need to watch out for >

Jane: So what does this mean for us who just listen? It means that when we build these vision language action systems, we have to think about how we secure those very first inputs because they’re the weakest link >

Tom: Right. If adversaries can reliably target just the start of the trajectory, then making those initial steps more robust is a huge priority for building safer AI systems across the board >

The paper's improvements: Tom: So we're moving on to how they suggest improving this DRIFT attack, which is about making these test-time disruptions more effective >

Jane: Right, so they’re looking at ways to make those early steps even more vulnerable and easier for an attacker to exploit >

Tom: They’re suggesting a focus on protecting the earliest steps because that's where the vulnerability is most pronounced, which is exactly what we talked about before >

Jane: So instead of trying to mess up the whole path, you concentrate your effort on just keeping those initial actions clean and accurate >

Tom: That’s smart engineering. It means defenses should be built around preserving the integrity of those first few trajectory points, since that's where the attack is strongest >

Jane: And they also showed that using JPEG compression can serve as a simple defense baseline, which works for simpler tasks if you bring the quality down below fifty or sixty >

Tom: That’s a practical thing we can use right away. It means for basic vision tasks, applying some compression is a cheap way to mitigate this input manipulation >

Jane: But they also pointed out that this JPEG defense isn't reliable on longer tasks, like those requiring many steps >

Tom: True. So the implication is that defenses need to be tailored based on how long the task is expected to take, not just a one-size-fits-all approach >

Jane: And they also pointed out that cross-model tests showed that some models are more robust than others, requiring a bigger patch to break them >

Tom: So we can’t assume every AI model is equally vulnerable when it comes to these input perturbations, which is a big deal for security >

Jane: It also confirmed the early-step vulnerability is something shared across different flow matching models, but the specific way you exploit it depends on which model you are using >

Tom: And Lalam here sees how this helps us understand culture, because if we can reliably figure out where these models fail under attack, we can build systems that are more predictable and trustworthy >

Jane: It’s about understanding the mechanics of the failure so we can design better safety constraints for those complex systems >

Tom: So the main thing here is that they give us a blueprint: focus your defense on protecting the beginning of the action sequence, because that’s where all this attack power comes from >

Conclusion: Tom: So we're wrapping up on DRIFT, which is this paper about Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack >

Jane: Basically, they showed how a tiny sticker on a robot's gripper can mess up the entire action plan of an AI model running at test time >

Tom: The main thing is that this attack only needs to target the first step, and it’s actually stronger than attacking the whole sequence because of how gradients behave >

Jane: So for anyone listening who just wants to know what this means, it's that we need to think about securing those initial inputs in these vision language action systems >

Tom: It changes how we think about safety. If an adversary can reliably target just the start of the trajectory, then securing those initial inputs becomes a huge priority for building safer AI systems >

Jane: I agree. And they also gave us some practical ways to defend against this, like using JPEG compression for simpler tasks when you’re driving or walking >

Tom: Right. So we have the attack mechanism, the results showing it breaks almost everything, and now some ideas on how to defend against it >

Jane: Lu here sees that this whole concept opens up possibilities for how we can interpret these models by seeing exactly where their attention gets redirected when they're being pushed off course >

Lu: Yeah, I think the real potential is in using this kind of localized perturbation to study the internal dynamics of these generative models without needing full training data >

Tom: Meng, what about you on the engineering side? How do we actually implement something like this? Can we put a sticker on a physical robot and test this out quickly? >

Meng: Well, from an engineering view, it’s feasible because the optimization only requires a single forward and backward pass per step, which keeps the computational cost low compared to attacking every single action in the plan >

Jane: And we have to remember that for long-horizon tasks, like complex navigation over a whole scene, those simple JPEG defenses just don't work as well >

Tom: Exactly. So the lesson is that there’s no single fix; you need a layered approach for different types of AI tasks >

Jane: Lalam sees how this helps us improve culture because if we can reliably figure out where these models fail under attack, we can build systems that are more predictable and trustworthy for everyone >

Lalam: Yeah, knowing the failure modes lets us design better guardrails so the AI behaves consistently and safely in real-world situations >

Tom: So to summarize, this paper on DRIFT shows that test-time attacks can be very effective when they exploit a specific gradient conflict in input space optimization >

Jane: It really shows how we can understand the dynamics of these models better by looking at how the trajectory actually evolves step by step >

Tom: We'll keep an eye on this because if adversaries can reliably target just the first step, then securing those initial inputs becomes a priority for building safer AI systems >

Yonsei University

cs.CV, cs.LG

Submitted: 2026-08-04

Updated: 2026-10-09

License: http://creativecommons.org/licenses/by/4.0/

Importance score: 82/100

The gist: The gist: DRIFT introduces Denoising Redirection via Input perturbation of the Flow-matching Trajectory, a test-time universal adversarial patch that attacks the denoising velocity field of an

Key concepts

Flow-matching VLA Models: These are vision-language models used for robotics that generate robot actions by integrating a learned denoising velocity field. They resist common adversarial attacks but are vulnerable to specific methods like DRIFT because of how they integrate information across multiple denoising steps.
Denoising Velocity Field: This is the core mechanism in flow-matching models where the policy uses a learned field to guide the transformation from noise to a coherent action sequence. The attack targets this field by perturbing it, causing the model to generate incorrect actions.
Gradient Conflict in Input-Space Optimization: This is a specific mathematical phenomenon unique to input-space optimization where gradients from early and late denoising steps regarding the adversarial patch are misaligned. This misalignment causes gradients to cancel out when accumulated across many steps, making a single-step attack more effective than a multi-step one.

Terminology

Robustness — 1× in this paper · explained in 5 episodes
Vision-Language-Action (VLA) Models — 1× in this paper · explained in 4 episodes

Summary

The gist: DRIFT introduces Denoising Redirection via Input perturbation of the Flow-matching Trajectory, a test-time universal adversarial patch that attacks the denoising velocity field of an off-the-shelf policy by exploiting a gradient conflict unique to input-space optimization, demonstrating that attacking only the first denoising step is both stronger and cheaper than attacking a wider window

How it works

The paper introduces DRIFT, which is a test-time universal adversarial patch placed on the robot’s gripper that attacks the denoising velocity field of an off-the-shelf policy. This attack is designed to maximize task failure by driving the generated action chunk away from the behavior the policy would have produced on a perturbed observation. The adversary has white-box access to the frozen policy for offline patch optimization but cannot modify model weights.

The attack targets the denoising velocity field, which is the quantity that the policy integrates to generate every action. The attack is implemented by perturbing the conditioning observation from ot to o+t = A(ot, δ), where A replaces pixels in R with δ and leaves the remaining observation untouched. The objective for the single-step attack is LDRIFT(δ) = L0(δ)—Eq. equation 6 evaluated at k=0. This approach avoids the gradient conflict incurred by attacking additional steps and requires only a single forward and backward pass through the velocity field per iteration, reducing the optimization cost by a factor of K relative to a full-trajectory attack.

Key Findings on Attack Strategy

The central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps. This less-is-more effect is attributed to a gradient conflict specific to input-space optimization, where early- and late-step gradients with respect to the patch are misaligned, leading to cancellation when accumulated. The first-step gradient g0 stays well aligned with its immediate neighbors but turns anti-aligned with the latest steps (i.e., cos(g0, g9)≈−0.35), and this misalignment grows with the distance between steps.

This contrasts sharply with the training-time backdoor regime, where FlowHijack An et al. (2026) must inject its malicious dynamics over a wide early window because too narrow a window provides insufficient gradient to learn a consistent malicious vector field in weight space. For a test-time patch on a frozen model, the optimization instead seeks a single input perturbation, for which concentrating the entire attack on the first step is both necessary (to avoid cancellation) and sufficient.

Experimental Validation and Performance

DRIFT was validated on π0 and π0.5 across four LIBERO suites Liu et al. (2023), where DRIFT—our single-step wrist-camera patch—breaks essentially all originally-solvable tasks, far exceeding action-space (UADA Wang et al. (2025)) and embedding-space (EDPA Xu et al. (2025a)) baselines under the same patch-size budget. Table 1 reports that attacking only the first step (M=1, i.e., DRIFT) is strongest on average, with an ASR of 100.0 ± 0.0 across Spatial, Goal, Object, and Long suites.

The attack breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embeddingspace attack baselines under the same patch-size budget. DRIFT also attains the highest NAD, confirming that it perturbs the action most strongly at the action level, not only in task outcome.

Failure Mode Analysis

The failure mode is characterized as a phantom grasp, where under the patch, the policy commands the gripper to close almost immediately, within the first 7 control steps in all five episodes (mean 3.8), long before the arm has approached any object. The clean policy keeps the gripper open until it reaches the bowl, closing only around step 46 on average. The failure is spatial as well, as the attacked arm advances through the scene already clenched on nothing—a phantom grasp—and never executes the reach-then-grasp sequence the task demands.

Furthermore, analysis of internal mechanisms shows that under the patch, 28–33% of the attention concentrates there for the “bowl” token’s attention across the first three steps of a failed rollout, an 8–9× increase over chance.

Defense Probes

A simple defense baseline test involving JPEG compression showed that ASR falls off progressively as the JPEG quality Q decreases, and once compression is strong enough—roughly Q ≲ 50–60—it is largely blocked on Spatial, Goal, and Object. However, the Long suite is an exception, plateauing at a markedly higher ASR (16–21%) even under the strongest compression tested. This suggests that JPEG compression is a promising, cheap first mitigation on simpler tasks once a sufficient compression level is applied, but it is less reliable on long-horizon tasks.

Finally, cross-model transfer tests indicated that π0.5 appears more robust, requiring a larger 64 px patch to be broken than π0. This reinforces the conclusion that the early-step vulnerability is a shared property of flow-matching VLAs—both are breakable—but the specific perturbation exploiting it is model-specific.

The paper introduces DRIFT, a test-time universal adversarial patch that corrupts the denoising velocity field of a frozen flow-matching VLA through a single sticker on the robot’s gripper. This attack is designed to maximize task failure by driving the generated action chunk away from the behavior the policy would have produced on a perturbed observation. The adversary has white-box access to the frozen policy for offline patch optimization but cannot modify model weights. The attack targets the denoising velocity field, which is the quantity that the policy integrates to generate every action. The attack is implemented by perturbing the conditioning observation from ot to o+t = A(ot, δ), where A replaces pixels in R with δ and leaves the remaining observation untouched. The objective for the single-step attack is LDRIFT(δ) = L0(δ)—Eq. equation 6 evaluated at k=0. This approach avoids the gradient conflict incurred by attacking additional steps and requires only a single forward and backward pass through the velocity field per iteration, reducing the optimization cost by a factor of K relative to a full-trajectory attack. The central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps. This less-is-more effect is attributed to a gradient conflict specific to input-space optimization, where early- and late-step gradients with respect to the patch are misaligned, leading to cancellation when accumulated. The first-step gradient g0 stays well aligned with its immediate neighbors but turns anti-aligned with the latest steps (i.e., cos(g0, g9)≈−0.35), and this misalignment grows with the distance between steps. The attack breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embedding-space attack baselines under the same patch-size budget. DRIFT also attains the highest NAD, confirming that it perturbs the action most strongly at the action level, not only in task outcome. The attack also generalizes to π0.

Improvements for AI systems

A new test-time universal adversarial patch called DRIFT can be used to break essentially all originally-solvable tasks on flow-matching VLAs like π0, far exceeding existing action- and embeddingspace attack baselines under the same patch-size budget. This allows for a practical threat model where an adversary places a single small adversarial patch that derails the denoising trajectory of an unmodified, deployed policy.
The system can be hardened against input-space manipulation by focusing on protecting the earliest steps, as attacking only the first step is both stronger and cheaper than attacking a wider window. This exploits a specific gradient conflict, which is exactly opposite to the training-time regime, suggesting defenses should focus on preserving early trajectory integrity.
The system can be defended against attacks by using JPEG compression as a simple defense baseline, as ASR drops are mitigated when JPEG quality Q is reduced below roughly 50–60 for Spatial, Goal, and Object suites. This suggests that applying sufficient compression acts as a cheap first mitigation on simpler tasks.
The system can be analyzed for internal mechanism vulnerabilities by extracting the policy’s actual softmax selfattention weights to see if the patch redirects attention; analysis shows the patch can cause an 8–9× increase over chance, concentrated precisely on a region that is otherwise task-irrelevant, leading to a phantom grasp failure mode.

Abstract

Flow-matching vision-language-action (VLA) models such as pi0 generate robot actions by integrating a learned denoising velocity field, and have been reported to resist adversarial perturbations that readily fool autoregressive VLAs. We show that this robustness is largely illusory: it stems from prior attacks ignoring the multi-step denoising ODE. We introduce DRIFT (Denoising Redirection via Input perturbation of the Flow-matching Trajectory), a test-time universal adversarial patch placed on the robot's gripper that attacks the denoising velocity field of an off-the-shelf policy. Our central finding is counterintuitive: attacking only the first denoising step is both stronger and cheaper than attacking a wider window of steps, which we explain through a gradient conflict unique to input-space optimization and which is exactly opposite to the training-time backdoor regime. On pi0 and pi0.5 across four LIBERO suites, DRIFT breaks essentially all originally-solvable tasks with a small single patch, far exceeding action- and embedding-space attack baselines.