DRIFT: Derailing Denoising Trajectories of Flow-Matching VLAs with Adversarial Patch Attack
A small gripper-mounted patch can derail flow-matching robot policies by targeting the first denoising step.
The paper argues that reported robustness in flow-matching VLAs such as pi0 comes from attacks missing the models’ multi-step denoising ODE. DRIFT is a universal test-time adversarial patch applied to the robot gripper, aimed at the denoising velocity field of an off-the-shelf policy. The authors report that attacking only the first denoising step is stronger and cheaper than attacking more steps, due to gradient conflict in input-space optimization. On pi0 and pi0.5 across four LIBERO suites, they say DRIFT breaks essentially all tasks the models could originally solve. HF Daily Papers' note
The paper argues that reported robustness in flow-matching VLAs such as pi0 comes from attacks missing the models’ multi-step denoising ODE. DRIFT is a universal test-time adversarial patch applied to the robot gripper, aimed at the denoising velocity field of an off-the-shelf policy. The authors report that attacking only the first denoising step is stronger and cheaper than attacking more steps, due to gradient conflict in input-space optimization. On pi0 and pi0.5 across four LIBERO suites, they say DRIFT breaks essentially all tasks the models could originally solve. HF Daily Papers' note
score 6