{"id":"https://openalex.org/W7164523898","doi":"https://doi.org/10.48550/arxiv.2606.12978","title":"Trajectory-Level Redirection Attacks on Vision-Language-Action Models","display_name":"Trajectory-Level Redirection Attacks on Vision-Language-Action Models","publication_year":2026,"publication_date":"2026-06-11","ids":{"openalex":"https://openalex.org/W7164523898","doi":"https://doi.org/10.48550/arxiv.2606.12978"},"language":null,"primary_location":{"id":"doi:10.48550/arxiv.2606.12978","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12978","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"type":"preprint","indexed_in":["datacite"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://doi.org/10.48550/arxiv.2606.12978","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5093097256","display_name":"Gokul Puthumanaillam","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Puthumanaillam, Gokul","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5084253781","display_name":"Vardhan Dongre","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Dongre, Vardhan","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5023184269","display_name":"Pranay Thangeda","orcid":"https://orcid.org/0000-0002-0680-6334"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Thangeda, Pranay","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5050088104","display_name":"Hooshang Nayyeri","orcid":"https://orcid.org/0000-0001-8242-9983"},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Nayyeri, Hooshang","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"middle","author":{"id":"https://openalex.org/A5138552456","display_name":"Dilek Hakkani-T\u00fcr","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Hakkani-T\u00fcr, Dilek","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]},{"author_position":"last","author":{"id":"https://openalex.org/A5138492051","display_name":"Melkior Ornik","orcid":null},"institutions":[],"countries":[],"is_corresponding":false,"raw_author_name":"Ornik, Melkior","raw_affiliation_strings":[],"raw_orcid":null,"affiliations":[]}],"institutions":[],"countries_distinct_count":0,"institutions_distinct_count":0,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":null,"last_page":null},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8705000281333923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.8705000281333923,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11714","display_name":"Multimodal Machine Learning Applications","score":0.04390000179409981,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T11424","display_name":"Security and Verification in Computing","score":0.009999999776482582,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/adversarial-system","display_name":"Adversarial system","score":0.779699981212616},{"id":"https://openalex.org/keywords/adversary","display_name":"Adversary","score":0.7601000070571899},{"id":"https://openalex.org/keywords/task","display_name":"Task (project management)","score":0.7250000238418579},{"id":"https://openalex.org/keywords/action","display_name":"Action (physics)","score":0.6639000177383423},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.6229000091552734},{"id":"https://openalex.org/keywords/robot","display_name":"Robot","score":0.597000002861023},{"id":"https://openalex.org/keywords/control","display_name":"Control (management)","score":0.5428000092506409}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7896000146865845},{"id":"https://openalex.org/C37736160","wikidata":"https://www.wikidata.org/wiki/Q1801315","display_name":"Adversarial system","level":2,"score":0.779699981212616},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.7601000070571899},{"id":"https://openalex.org/C2780451532","wikidata":"https://www.wikidata.org/wiki/Q759676","display_name":"Task (project management)","level":2,"score":0.7250000238418579},{"id":"https://openalex.org/C2780791683","wikidata":"https://www.wikidata.org/wiki/Q846785","display_name":"Action (physics)","level":2,"score":0.6639000177383423},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.6229000091552734},{"id":"https://openalex.org/C90509273","wikidata":"https://www.wikidata.org/wiki/Q11012","display_name":"Robot","level":2,"score":0.597000002861023},{"id":"https://openalex.org/C2775924081","wikidata":"https://www.wikidata.org/wiki/Q55608371","display_name":"Control (management)","level":2,"score":0.5428000092506409},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.453000009059906},{"id":"https://openalex.org/C195324797","wikidata":"https://www.wikidata.org/wiki/Q33742","display_name":"Natural language","level":2,"score":0.43799999356269836},{"id":"https://openalex.org/C113843644","wikidata":"https://www.wikidata.org/wiki/Q901882","display_name":"Interface (matter)","level":4,"score":0.4357999861240387},{"id":"https://openalex.org/C107457646","wikidata":"https://www.wikidata.org/wiki/Q207434","display_name":"Human\u2013computer interaction","level":1,"score":0.4300000071525574},{"id":"https://openalex.org/C13662910","wikidata":"https://www.wikidata.org/wiki/Q193139","display_name":"Trajectory","level":2,"score":0.39070001244544983},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.33629998564720154},{"id":"https://openalex.org/C2776608160","wikidata":"https://www.wikidata.org/wiki/Q4785462","display_name":"Natural (archaeology)","level":2,"score":0.33239999413490295},{"id":"https://openalex.org/C140547941","wikidata":"https://www.wikidata.org/wiki/Q7797194","display_name":"Threat model","level":2,"score":0.32839998602867126},{"id":"https://openalex.org/C175154964","wikidata":"https://www.wikidata.org/wiki/Q380077","display_name":"Task analysis","level":3,"score":0.29510000348091125},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2745000123977661}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.48550/arxiv.2606.12978","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12978","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":null,"raw_source_name":null,"raw_type":"Preprint"}],"best_oa_location":{"id":"doi:10.48550/arxiv.2606.12978","is_oa":true,"landing_page_url":"https://doi.org/10.48550/arxiv.2606.12978","pdf_url":null,"source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":null,"issn":null,"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":null,"is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Preprint"},"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","display_name":"Peace, Justice and strong institutions","score":0.6563422679901123}],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"Vision-language-action":[0],"(VLA)":[1],"policies":[2],"bring":[3],"natural":[4],"language":[5],"into":[6],"closed-loop":[7,159],"robot":[8],"control,":[9],"enabling":[10],"robots":[11],"to":[12,83,130,155,185,201],"execute":[13],"manipulation":[14],"tasks":[15],"directly":[16],"from":[17],"text":[18,24,198],"instructions.":[19],"The":[20],"same":[21],"interface":[22],"gives":[23],"a":[25,73,78,103,162,191],"recurring":[26],"role":[27],"in":[28,107,171,194],"control":[29,211],"because":[30],"the":[31,44,49,85,90,109,115,125,131,167,203,213],"prompt":[32,79,113,126,149,179],"is":[33],"reused":[34],"at":[35],"every":[36],"replanning":[37],"step,":[38],"and":[39,119,124,138,173],"each":[40],"prompt-conditioned":[41],"action":[42],"changes":[43],"future":[45],"observations":[46],"on":[47,174],"which":[48,108],"policy":[50,118],"acts.":[51],"Existing":[52],"VLA":[53,183,195],"attacks":[54],"study":[55],"adversarial":[56],"prompts":[57],"that":[58,80,152,177,199],"elicit":[59],"targeted":[60],"low-level":[61],"actions":[62,66],"or":[63],"make":[64],"such":[65,143],"persist":[67],"across":[68],"changing":[69],"images.":[70],"We":[71,94],"identify":[72],"stronger":[74],"trajectory-level":[75,192],"failure":[76],"mode:":[77],"still":[81,207],"$\\textit{appears}$":[82],"specify":[84],"intended":[86,204],"task":[87,164],"but":[88],"redirects":[89],"final":[91,215],"physical":[92,216],"outcome.":[93,217],"mathematically":[95],"formalize":[96],"this":[97],"setting":[98],"as":[99],"$\\textit{command-preserving":[100],"trajectory":[101],"redirection}$,":[102],"prompt-only":[104],"threat":[105],"model":[106],"attacker":[110],"chooses":[111],"one":[112],"before":[114],"episode,":[116],"all":[117],"environment":[120],"components":[121],"remain":[122],"fixed,":[123],"must":[127],"stay":[128],"close":[129],"benign":[132],"instruction":[133,196],"while":[134,165],"omitting":[135],"target":[136,163],"words":[137],"correction":[139],"language.":[140],"To":[141],"find":[142],"prompts,":[144],"we":[145],"introduce":[146],"an":[147,209],"on-policy":[148],"search":[150],"method":[151],"uses":[153],"rollouts":[154,184],"discover":[156],"perturbations":[157,180],"whose":[158],"behavior":[160],"tracks":[161],"satisfying":[166],"command-preserving":[168],"constraints.":[169],"Experiments":[170],"simulation":[172],"hardware":[175],"show":[176],"near-benign":[178],"can":[181,206],"redirect":[182],"attacker-specified":[186],"targets.":[187],"These":[188],"results":[189],"expose":[190],"vulnerability":[193],"grounding:":[197],"appears":[200],"preserve":[202],"command":[205],"give":[208],"adversary":[210],"over":[212],"robot's":[214],"Project":[218],"website:":[219],"https://vla-redirection-attack.github.io/":[220]},"counts_by_year":[],"updated_date":"2026-07-01T06:00:48.157686","created_date":"2026-06-13T00:00:00"}