UIUC Discovers Trajectory-Level Redirection Attacks on VLA Robot Models — 7 out of 9 Models Vulnerable

UIUC Researchers Expose Trajectory-Level Redirection Attacks on VLA Robot Models

A research team from UIUC has identified a critical security vulnerability in vision-language-action (VLA) models. Their study (arXiv:2606.12978) shows that seemingly benign prompt modifications can redirect a robot's entire physical trajectory.

The attack, termed 'command-preserving trajectory redirection,' exploits VLA closed-loop control. Changing just one character — e.g., 'put the bowl on the stove' to 'put the bowl on the staove' — redirects the frozen policy to place the bowl on a plate instead.

Key Findings

• Tested across 9 VLA model families: OpenVLA, MolmoAct, π0.5, SmolVLA, GR00T-N1 — 7 achieved >90% attack success
• Real SO-100 robot arm hardware validation
• On-policy prompt search discovers perturbations tracking attacker-specified targets

Best defense: user instruction normalization to a trusted task set. Paper accepted at CoRL 2026.

Source: arXiv:2606.12978